Few of the mistake that company make that I came across are

1. Not considering opportunities – just threats
2. Confusing risk causes, risk events & impacts
3. Using checklists and not ‘scanning the
horizon’ for other risks
4. Understating risk impacts, and not scaling the
impacts based on project drivers
5. Not using 100% probability during planning

7. Calling risk response planning ‘mitigation’
6. Not considering sensitivity with risk analysis
8. Not considering contingency plans when
doing risk response planning
9. Not making specific project team members
responsible for specific risk events
10. Not making managing risks an on-going process