We sometimes forget that project related activities are not as clear to business people as they are to us. In particular risk management can be seen as a low key part of the project by some business people. I remember trying to organise a risk workshop so that we could put together a risk management plan for a project. I was told by the Sponsor,
Risk management is about spending some time before you start a project to work out what might go wrong, and if you should/can do something about it. Not all risks are evident on day one so the exercise does need to be repeated. Don't just tell the people you are doing a risk assessment. Make sure they understand why, and the value to them of the exercise.
IRMC – International Risk Management Conference
In day to day business matters, risk management is embedded. It might not be called risk management or even seen as risk management, but it is there. This is particularly so where there are financial impacts - either direct or indirect. An indirect financial risk may be the damage that can be done to the business if a faulty product cannot be removed quickly from the market. Businesses have product withdrawal plans; they have business continuity plans to lessen the financial impact of a catastrophic event. They may or may not have evolved from a risk management workshop and if one were held today, usually other business risks would be identified.