It seems people just want to start doing things to "Get things done" instead of first taking the time to 'Think things through"; they favor 'issues' because they can immediately jump at them to resolve them, instead of doing things to prevent something that might or might not happen in the future. I am often amazed at the short planning horizon some people seem to have.
Furthermore, I think people are already overwhelmed with the first part of a journey (or a challenging project), that they don't whish to think much of the second part that is still so far away, is still much of a black box and so it seems to frighten us even more. If there are any problems we will get to them then; right now I already have enough things to think of thank you very much.
So it is always like "we'll see how we get across the river when we get there", instead of "we'll cross the bridge when we get there" :-).
So it is a cultural thing: point 2) of MathAttacks answer was spot on. I also think it is inherent to some people's personality type; maybe MBTI or some other personality indicator can give some answers there.
As it is, to apply risk management well, it needs constant education of your stakeholders.
Here are some actions I apply:
- Once more, the WBS is my closest friend here. The visual aspect of the WBS helps eliciting and assigning potential risks more easily. People are much more likely to react wen they see individual elements that they are more familiar with. When they see some risks defined on other elements, they'll think about their own subjects more closely. Color-coding WBS elements in terms of risk-status is a positive trigger as well, and will often result in replies like: "why is there nothing on this thingy here, didn't you know that ..."
- Giving lots of examples and the way they were handled (or not) in the past.
- Explaining the consequences in a measure your target audience can understand . The answer of Iain9688 is key here. So for instance discuss the risk of incomplete data-conversion with your customer in terms of overall project delay and additional cost, and with your team in terms of the extra hours (possibly overtime) of manually correcting the data in the database ...
- Treat risk-review as a fixed topic on the agenda of your status/progress/steerco meetings the same way as you would manage your issue list. The point is to keep the risk-owners aware of their responsibility.
- Discuss risks during individual talks or one-on-ones with your team and stakeholders; not everybody wants to share possibly bad things in public.
I have a mantra I repeat sometimes when I feel people are reluctant to discuss possible risks and progress (it is not mine, but I don't know its origins):
> No news = bad news
> Bad news = good news
> Good news = excellent news
The sooner a risk, lack of progress, possible roadblock is communicated, the sooner something can be done about it ...