The organization recognized the need to manage risk and has set up a corporate risk committee, but there seems to be areas the organization is willing to really delve into exploring some of the known

The generic definition of Risk management as "forecasting and evaluation of financial risks together with the identification of procedures to avoid or minimize their impact" vice PMI's definition ""an uncertain event or condition that, if it occurs, has a positive or negative effect on a project's objectives." has most of us confused about what it should be about.

Risk management like everything else is a framework and the organization's mitigation strategy can be to ACCEPT, TRANSFER, or AVOID risks. Without context, it is hard to see what they may be doing wrong.

It wouldn't be business-savvy to spend thousands of dollars to backup data that is irrelevant to an organization's day-to-day or bottomline if something goes wrong.

I would use a cyber security scenario, where most organizations are worried they might get hacked and ransomed. If they use current security recommendations of say, strong passwords, good patch management, not using default password of password, it reduces their risk of being easily hacked. It doesn't entirely remove the risk but they can choose to buy insurance to cover their loss in the event they get hacked. They can choose to accept the risk and go with whatever happens.

If they do this every year, do you have pertinent examples from previous years that you can use to illustrate your point?

Another consideration... Is their attitude toward this process simply an indicator that others have a higher risk tolerance? In other words, are they upset by the outcomes of their falling short?

I'm not saying that this isn't a great opportunity for improvement. It could be. But you have to be passionate AND informed. The benefit of taking more action needs to outweigh what they consider the costs to be. If you can't make it meaningful to them, they have no reason to support what you are recommending.

Anon:
It's a slippery slope; so do your best to focus on your role, document all known risks, assign owners and report your project performance. Sometimes you need to pick your battles; keep your team focused on the goal.

In the risk analysis you would evaluate the potential mitigation actions to see how far they can reduce the risk. So a certain "least effort" action might reduce the risk from 25 points to say 16 points. So as a PM in the next risk management meeting you can still notify all stakeholders that after that mitigation action the risk is still there. Well, I believe that would draw every stakeholder's attention to work together to reduce the risk further.