This exercise should be done with a team that contains knowledge of both the business and the IT used to support the business. You don't need people who have a comprehensive knowledge of both. You do need people who have comprehensive knowledge in one area (e.g. costs) and some knowledge of how the other (e.g. IT) interacts with it

1. Use brainstorming or other creative methods to generate as many possible risks as you can. You should include anything that anyone wishes to raise. By involving the team you will start to develop an idea of where their concerns lie and what confidence they have in other team members or departments. In addition, group members will hear one another's' concerns and this also helps to form the team.
   Do not let anyone criticise or comment on any risk raised at this stage - just capture thoughts. Hint: look at any assumptions made and at any constraints (as listed in the project definition).
2. Write each risk on a Post-It Note as it is called out; ask for clarification if the risk is not understood but otherwise do not allow comments.
3. Put each Post-It Note on a board where all can see them. Carry on generating risks until the team have no more to offer.
4. By inspection, cluster the risks into similar groups. This may be around technologies, people, legal, employee relations, funding, etc. Choose any clusters that 'fit' the situation.
5. Rationalise the risks, combining some, clarifying others; number each risk sequentially.
6. Evaluate each risk using the risk log and plot all medium and high risks onto a flip chart.
7. Take time for the team to review the output so far. Are there any themes noticeable in the risks or in the way they are clustered?
8. Begin with the high risks: start generating possible ways of dealing with them. Allow all options to be raised. Do not evaluate, just capture the possible risk management actions for later evaluation.
9. Evaluate and agree which risk-management options should be followed and who is accountable for managing each particular risk.
   Capture your risks in a log (similar to below).