What the road is telling you
If you have ever driven in an Indian city during rush hour, you already understand something important about risk management.
You may simply never have called it that.
There are lanes, but they are often treated as suggestions. A two-wheeler appears in a gap you were certain did not exist. An autorickshaw begins moving across the road before indicating any intention to do so. A pedestrian waits at the edge of the pavement, and something in their posture tells you they may step out. Occasionally, a cow occupies the road with far greater confidence than anyone driving on it.
Yet most people arrive safely.
They do not arrive because every risk was known in advance. They arrive because they are paying attention to what is forming around them. They watch further ahead than the vehicle immediately in front. They notice movement at the edge of their vision. They read speed, position and hesitation. They make small adjustments early, while there is still room to make them.
That is what proactive risk management looks like.
The register is useful, but it cannot watch the road
I have nothing against risk registers. They are useful and necessary. They help a team record known risks, assess likelihood and impact, assign ownership and agree mitigation.
The problem begins when completing the register creates the feeling that the risks have been managed.
A register can only contain what someone has already noticed and named. By the time a risk appears there, an important part of the work has already happened. Someone saw it coming.
The risks that cause the greatest disruption are often quieter. A vendor begins moving routine meetings. A capable team member becomes unusually guarded. A stakeholder continues to agree in meetings, but the promised actions begin arriving late. A few minor status deviations appear unrelated until someone notices that they form a pattern.
None of these signals may justify escalation on its own. Together, they may be telling you that the road ahead is changing.
The risk register records recognised hazards. Good risk management also searches for the risks that have not yet become clear enough to record.
Notice the movement before the manoeuvre
An experienced driver rarely waits for the autorickshaw to cross directly in front of the car before responding. A slight change in angle, an uneven speed or a small movement towards the next lane is often enough. The driver eases off the accelerator or creates a little more space.
The adjustment may be so small that nobody else notices it. That is precisely why it works.
In projects, we often wait for stronger evidence. We want the delay to appear in the schedule, the defect trend to become statistically convincing or the stakeholder to state openly that support is weakening. By then, the range of available responses has usually narrowed.
Proactive risk management begins earlier. It asks what a small signal might become if it continues.
This does not mean treating every hesitation as a crisis. Indian roads would be impossible if a driver stopped for every possible hazard. The skill lies in distinguishing noise from a developing pattern, then making a proportionate adjustment.
Sometimes that means asking one more question. Sometimes it means speaking privately with a team member, checking an assumption with a client or creating a contingency before announcing that one is needed. The action is often modest because the warning arrived early.
Read patterns, not isolated events
One missed commitment may be an exception. A missed commitment followed by a more defensive status report, slower responses and repeated requests to postpone a review may be something else.
Experienced leaders learn to connect signals that a dashboard presents separately.
This is pattern recognition, and it develops through attention. It requires knowing how a team normally behaves, how a stakeholder usually communicates and what a healthy programme feels like before it begins to drift.
That last part matters. We cannot recognise a change in behaviour if we have never taken the time to understand the people involved. Some of the earliest risk information comes through relationships, not reporting systems.
A team member who trusts you may mention that a colleague is struggling before the missed work becomes visible. A vendor may tell you about an internal reorganisation while there is still time to adjust. A client may quietly warn you about a changing political dynamic that no formal status report will capture.
Proactive risk management is therefore not a solitary technical exercise. It is strengthened by the relationships that allow weak signals to reach us in time.
Look beyond the question you were asked
In 2006, I was at a client location in the United States discussing a new software module. The requirements conversations had gone well. The module could be built, and the client was prepared to pay for it.
From a conventional delivery perspective, the opportunity looked healthy.
During a separate conversation with the divisional vice president, however, I became concerned about the business operation the module was intended to support. The technical solution was viable. The underlying economics were less certain. Some operational constraints had not yet been examined closely enough, and the cost of supporting the new business line could take far too long to recover.
The client had not asked me to assess its commercial viability. My organisation stood to earn revenue from building the module. The easiest course would have been to answer the question we had been asked and proceed.
I raised the concern.
The client revisited the business case and eventually decided not to proceed in its original form. We lost the immediate billable work.
But the conversation protected the client from a larger risk and built a deeper level of trust. The relationship led to future opportunities, and the concept was later redesigned as a flexible feature that could serve other clients.
That experience stayed with me because it showed that proactive risk management is not simply about identifying what might go wrong with the plan. It is also about looking beyond the plan and asking whether the value the plan is meant to create is itself at risk.
Sometimes the most responsible advice costs something in the short term. That does not make it poor commercial judgement. It may be the decision that protects the relationship and creates greater value later.
Preserve room to respond
A good driver does not merely predict hazards. They preserve options.
They leave enough space to brake. They avoid placing the vehicle where one unexpected movement would make a collision unavoidable. They adjust speed to the amount of uncertainty around them.
Projects need the same discipline.
A plan that succeeds only when every assumption remains true is not robust. If one delayed decision, unavailable specialist or failed dependency makes recovery impossible, the project has been travelling without enough space around it.
Contingency is not pessimism. It is room to respond.
This may mean protecting time around a critical dependency, retaining an alternative supplier, testing a difficult integration earlier or resisting the temptation to commit every available person at full capacity. These choices can look inefficient while everything is going well. Their value becomes visible when something changes.
Risk management is a posture
The deepest lesson from Indian traffic is not that disorder somehow works. Nor is it an argument against structure, standards or formal controls. Roads need rules, and projects need registers.
The lesson is that documentation cannot replace attention.
Good risk managers carry a particular posture into meetings, status updates and ordinary conversations. They keep asking what has changed, what they may be assuming without evidence and what small signals deserve a second look. They think a little further ahead than the immediate task. They preserve enough room to act when reality differs from the plan.
Over time, this way of noticing becomes instinctive. Like the experienced driver who sees the autorickshaw's movement before the manoeuvre begins, the experienced leader senses trouble while it is still only a possibility.
That is the moment when risk management has its greatest value.
Not after the problem has arrived and the register has been updated.
While there is still time to change direction.