Your biggest program risk might not even be in your risk log

A project manager naturally focuses on the progress and risks of their own project. That makes sense. But in a complex program, decisions and dependencies across different projects can combine to create a risk that no single project team sees.

Let me give you an example:

In one program, subsidies were essential to securing the overall program budget. To meet a specific funding condition, several projects each had to make their own contribution. Individually, the decisions made within those projects seemed to have limited impact.

It was only when the information was brought together at program level that it became clear just how narrow the margin was between meeting and failing to meet that condition.

The program manager therefore needs sufficient visibility into what’s happening across the projects to recognise these connections. Not by micromanaging project managers, but by asking the right questions, understanding dependencies and connecting signals from different projects.

This only works if project managers are also willing to share their doubts, obstacles and emerging risks, even when they don’t yet fully understand the potential impact.

In practice, that kind of openness doesn’t always come naturally. Project managers want to keep their projects moving forward and protect the progress they’ve made. Raising a problem can feel like admitting a loss of control, especially when meetings are mainly about defending a green status.

That’s precisely why governance matters so much.

Not as another layer of reporting, but as a safe, recurring space where teams at every level can discuss what’s uncertain, what might go wrong and where they need support or a decision.

A project manager should feel comfortable saying: “I don’t know exactly how significant this risk is yet, but I’m concerned about this dependency.”

The program manager should then be able to ask further questions without immediately taking over the operational details.

When these conversations become normal, warning signs surface while there’s still time to adjust course, rather than only when a risk has already materialised.

Not every risk belongs on the sponsor’s desk or the steering group’s agenda. If a project team can resolve an issue within its own mandate, it should be empowered to do so.

But as soon as a decision falls outside that mandate, affects multiple stakeholders or could have significant financial or strategic consequences, the program manager needs to escalate the risk to the appropriate level.

Simply reporting that there’s a problem isn’t enough. Decision-makers need context: What do we know? What remains uncertain? What options are available? What are the consequences? And what decision needs to be made?

The partnership between the program manager and the sponsor is crucial here. The program manager brings together different perspectives and makes the urgency clear. The sponsor must be willing to discuss difficult risks with the right stakeholders and initiate the necessary decision-making process.

Without that commitment, escalation remains a reporting exercise rather than a step towards a solution.

Here’s a concrete example:

In a construction project, approval of a request to deviate from specific legal requirements was still pending, while the installation of the infrastructure was approaching. Several scenarios were available, each with different costs and uncertainties.

The issue kept coming up in site meetings for months, even though the project manager had no authority to make the financial decision.

It was only when the timing became critical that the decision reached senior management. Earlier escalation would have provided more time to evaluate the different scenarios and limit the impact on the schedule.

Steering groups are sometimes seen as a waste of time: yet another meeting to explain the status to people who aren’t involved in the program’s day-to-day activities.

But for a game-changing program, that regular meeting is particularly valuable, provided it goes beyond reporting.

It brings the sponsor and other decision-makers together to discuss risks, trade-offs and dependencies that fall outside the program team’s authority. The groundwork can be done in an operational or tactical working group, but the steering group must be able to make decisions.

For example, a technically cheaper solution might carry greater risks for business continuity. In that case, you don’t just need someone responsible for the financial side. You also need the people who will be accountable for the operational consequences.

Good governance ensures that all these perspectives are heard before a decision is made.

A regular meeting rhythm creates space and builds trust, but it should never be an excuse to leave urgent risks unresolved until the next meeting. The escalation process must also work between meetings.

Senior management doesn’t need to know about every operational risk either. But leaders must be able to rely on a structure that brings risks to their attention in time when the consequences or required decisions fall within their responsibilities.

This might involve significant costs, reputational damage, legal obligations or strategic choices.

For a game-changing program, where existing routines are often insufficient, these arrangements need to be established deliberately.

Who monitors what? Who needs to be involved? When is simply informing someone enough, and when is a decision required?

The goal isn’t maximum visibility. It’s relevant visibility at a point when there’s still time to act.

In a game changer program, it’s impossible to identify everything that could go wrong in advance. A well-maintained risk log remains useful, but it will never tell the full story.

What you can put in place is an environment where project managers feel confident sharing early warning signs, program managers can recognise connections, sponsors don’t shy away from difficult conversations and steering groups make the right decisions at the right time.

For me, that’s the real value of governance and risk management in programs that are too important to fail: not the illusion that you can predict everything, but the confidence that your organisation can act when the unexpected happens.