When Does an Assumption Become a Project Risk?

Every project starts with assumptions.

1. We assume resources will be available when needed.
2. We assume dependencies will be delivered on time.
3. We assume stakeholders will provide timely decisions.
4. We assume requirements will remain reasonably stable.
5. We assume a technology or solution will perform as expected.

We document many of these assumptions during planning, but I sometimes wonder whether we give them enough attention once execution begins.

Risks usually receive regular reviews, owners, mitigation plans, and escalation when necessary. Assumptions, on the other hand, can quietly remain in a document until one of them turns out to be wrong — at which point we may already have a problem.

This raises a few questions for me:

1. How often should critical assumptions be revisited during a project?
2. Should important assumptions have owners and validation dates, just like risks?
3. At what point should an unvalidated assumption be converted into a risk?
4. Have you experienced a project where an assumption that everyone took for granted eventually became a major issue?

Perhaps good risk management doesn't begin with identifying what might go wrong. It begins with continuously questioning what we believe will go right.

How do you manage assumptions throughout the project lifecycle?