Most project management approaches address risk in a fairly superficial way: risk mitigation is viewed as an important activity, but one that is largely a distraction from the main effort of the project. Risks are identified at the start of the project, they are usually assiged to someone to address the risks, but these risk-mitigation activities are largely viewed as things that take away from the project work. In practice the risks are only identified once and then they are largely forgotten in the large amount of work to be done.
On a traditional project, change is viewed as a bad thing, and great efforts are undertaken to prevent it. Change disrupts the original plan, and it is the plan (and not value delivery) that is sacrosanct on a Traditional project.
Similarly, change must be embraced. Change results from new information, from feedback that something in the original plan will not result in the desired end result. Change is something that will occur as people get new information, but change is a good thing: it means convergence on the right solution.
Change is not the same as churn - churn results from the business not being clear about what it needs to achieve, or from the lack of a suitable technical solution. Churn is a sign that some basic assumptions about the project have gone horribly wrong, and the project team needs to stop and step back to reassess where it is going.
Aggressively attacking the project’s risk requires the process to be agile, not prescriptive. The project must be able to do whatever is required to address its most important risks and must not be limited in the set of activities that it can apply. For example, if the most important risk facing a project is the integration of several commercial products, then writing the requirements for the integration does not significantly reduce the risk; only the creation of an executable prototype that demonstrates that the products can work together truly addresses risk.
The fundamental problem with conventional waterfall approaches is that they postpone risk mitigation to the point where it can become too costly to recover from the risks. The waterfall approach tends to mask the real risks to a project until it is too late to do anything meaningful about them.