Pay the Dealer - and Pay Attention
All of this business should be documented in a risk management plan. This plan defines the risk management approach, the qualitative/quantitative analysis, risk responses, the risk registry or database of risks, and scheduling for additional risk identification and planning.
As the project moves toward completion, the project manager and the project team must monitor and control the risks within the project. No one wants a project to fail because no one wanted to discuss a newly identified risk.
Sometimes a sense of dread arises within the project team because the project manager hasn't stressed the importance of iterative risk identification. The dread is that the person who speaks up about the risk may fear retribution for bringing bad news to the table. We need to know about risks in order to respond to them.