From personal experience, I know that the most difficulty in risk management is the need to state a reason for the result. Filling out the risk management assessment gives results. These results, however, need to be further analyzed.

After doing some perusing online, I found that another mistake in risk management is not creating an avoidance plan. Others include professionals attempting to reinvent the process of security risk management. There exists well-established methods for risk-analysis tasks already. CSO mentions that there is also the problem of focusing too heavily on listing and ranking all things that can go wrong. The article states that the problem with this approach is that companies may end up, “piling on risks, even the most obscure, from cyber attackers with every conceivable motivation to the possibility of a jet engine falling through the roof of the data center.”

http://www.csoonline.com/article/2132291/strategic-planning-erm/7-common-risk-management-mistakes.html