Don't forget to capture the tacit knowledge!
Looking back at my many years in system integration it stikes me that when things didn't go to plan and unexpected risks presented themselves, there would almost always be someone on or associated with the project team who would utter "yeh - seen that before on the ... project" or "that only happens when ..." or something similar. The point being that someone KNEW it was a potential risk, but it was neither captured as such nor risk-managed subsequently, until it had actually become a major issue.
More recently we've extended the front-end risk capture stage by introducing a tacit knowledge capture step. This uses a structured process to interview experts from different functional disciplines to capture their significant tacit knowledge - in other words expertise they have that they can apply without conscious thought. The knowledge is held in a software model that emulates the way the expert sees things (so non-experts gain the same understanding of the issue and its relationships to other important factors) and feeds into the risk management issue register.
Worth thinking about if, like us, you still get surprised by unidentified risks that someone on the team already knows about.
