> That said, management needs to know there's pain and in a language it speaks - risk. Cost, legal, whatever.
In my own experience, people in management generally refuse to evaluate risks that are not immediate. Instead of looking at risks as something that could happen the general mode is looking at risks as something that may not necessarily happen and therefore does not need immediate attention.
Raising risks becomes a risky business (pun intended, hehe). If you raise, especially repeatedly, that in x weeks/month something will probably happen a manager will sweep that under a rug, ignore any warnings and will not give (even more so fight for) resources to proactively tackle the risk. Yet, if the risks manifests and hurts business metrics, then suddenly you are remembered and get all the blame. Yet, if you wait it out and clean up the mess caused by the risky event, you are a hero.
The higher up the management chain one is, the more prevalent this phenomenon is. I don't want to imply there's no planning or that management types are "dumb" or whatever. It's just that in my experience, the higher up one is, the more they are focused on the proverbial happy path. It's generally easier to get a goalpost moved instead of getting a blocker risk removed. All the projects that exceed budgets and underdeliver are, in part, a symptom of this: raising a simple "we don't have safeguards against a third party in a critical path delivering in time and under budget" project risk makes someone look bad and is generally unacceptable, yet once the deadline is up getting more budget assigned is one meeting away. I'm always surprised how strong a simple moat of simply already being in the market can be: businesses that continuously take all-or-nothing type of risks keep surviving against simple mathematical odds.