M74: If your project doesn't have a formal Risk List, you are doing management wrong