In any project prior to its development, during the initiation phase, risk assessment, analysis and mitigation planning is done. PM office, Project team, external stakeholders including the end customer management team members all become the part of this committee to work out and cover all possible areas from where any kind of risks can arise. Once all risks are listed down, their priority or severity is set based on their chances of occurance, gravity of impact on the project and time it would require for its mitigation.
Mitigation of each risk is a cost. Similarly each risk has an impact on project cost also. Hence there is a cost that is getting impacted by means of project delay etc. and there is a cost to overcome or mitigate this kind of delays. If cost of mitigation of a risk is higher than the cost of impact, nobody would like to invest in its mitigation. It is always true that higher is the impact cost, higher is the severity of the risk. And hence higher are the chances of its importance for mitigation.
After all kind of exercises of risk assessment, mitigation planning and management; there is always a hole from where unwanted rats always slide in, unstintingly. And you have no choice other than fighting against it, finding out quick ways to mitigate it and resolve it so that it has least impact on the progress of the running project.