You are in a project review. You have spotted something that could become a problem.
It is not a crisis yet. But if nothing changes, it could affect the timeline.
So you have a choice.
Say too little, and the risk may not receive enough attention.
Say too much, and you may make the situation sound worse than it is.
This is one of the harder communication skills to develop:
How do you raise a concern without creating unnecessary alarm?
Because good risk communication is not about making something sound serious.
It is about helping people understand how serious it actually is.
Raising a risk is an act of judgement
In the previous edition of The Leadership Signal, we explored the difference between knowledge and judgement.
One of the clearest places that judgement becomes visible is in how you communicate risk.
Anyone can say:
“There is a problem.”
Strong communicators help the room understand:
What has happened?
How significant is it?
What could happen next?
What are we doing about it?
That distinction matters. Because when a risk reaches a senior stakeholder, they are not only evaluating the risk.
They are also evaluating your assessment of it.
The two extremes
Risk communication often goes wrong in one of two directions.
Extreme 1: Underplaying the risk
You say:
“There is a small issue with the vendor, but we're working on it.”
It sounds reassuring.
But what does small mean?
What could happen?
When will you know more?
Does anyone need to act?
The language is calm, but the communication is incomplete.
Extreme 2: Amplifying the risk
You say:
“We have a serious vendor problem and the release is now in danger.”
Now everyone is paying attention.
But perhaps the release is not yet in danger. Perhaps one dependency is delayed and you still have two days of buffer.
The language creates urgency before the facts justify it. Neither approach helps the room make a good decision.
Calm does not mean vague
This is an important distinction.
Some professionals soften risk because they want to sound composed.
They use phrases like:
"There may be a slight concern."
"We are seeing a few challenges."
"There could potentially be some impact."
The intention is to avoid sounding dramatic. But excessive softening creates ambiguity.
Calm communication is not vague communication.
You can be direct without being alarming:
“The vendor is two days late. We still have one day of buffer, so the release date is not affected yet. If we do not receive the API by Wednesday, the release will move.”
That is calm. And it is precise.
Separate the fact from the possibility
One of the simplest ways to communicate risk well is to distinguish between:
What has happened
and
What could happen
For example:
Fact: “The client has delayed approval by three days.”
Potential impact: “If approval does not arrive by Thursday, testing will move into next week.”
Those are two different statements.
Keeping them separate prevents a possibility from being communicated as though it has already happened.
It also makes your assessment easier to trust.
Add a third layer: What are we doing about it?
Risk communication becomes much stronger when you move beyond identifying the problem.
Consider:
“The vendor is two days late.”
Useful information.
Add the impact:
“The vendor is two days late. If we do not receive the API tomorrow, testing will be affected.”
Better.
Now add action:
“The vendor is two days late. If we do not receive the API tomorrow, testing will be affected. We have escalated with the vendor and reserved an additional testing slot for Thursday.”
Now the listener knows:
what happened
what could happen
what is being done
The risk has context.
A simple structure for risk communication
When you need to raise a concern, use four elements:
Fact → Impact → Action → Trigger
Fact What do we know for certain?
Impact What could this affect?
Action What are we doing now?
Trigger At what point does this require another decision or escalation?
The fourth element is particularly important.
A trigger tells people when the situation changes from something being managed to something requiring intervention.
For example:
“The vendor is two days late. We still have one day of buffer. We have escalated and expect confirmation tomorrow morning. If the API is not received by noon, I recommend moving the release by one day.”
That is a much more useful risk update than:
“The release may be delayed.”
What this looks like in Finance
Imagine you notice an adverse cost trend.
You could say:
“Contractor costs are getting quite high and this could become a major budget issue.”
That communicates concern.
But it does not give the concern proportion.
A stronger version:
“Contractor spend is 8% above plan this month. It does not affect the quarterly forecast yet, but if the current run rate continues next month, we will exceed the full-quarter budget. I recommend reviewing the open contractor positions this week.”
Now the stakeholder can see:
the fact, the scale, the future risk, and the proposed action.
What this looks like in IT
Instead of:
“We have a critical issue with testing.”
Try:
“Two high-priority defects remain open. Neither affects core functionality, so today's testing can continue. If they are not resolved by Thursday, however, Friday's release will be at risk.”
You have not minimised the defects.
You have not exaggerated them either.
You have placed them in context.
Use proportion, not emotion
Words such as:
critical urgent serious major significant have a place.
But they should mean something.
If every issue is critical, people eventually stop responding to the word.
Where possible, replace emotional intensity with specifics.
Instead of:
“There is a major delay.”
Say:
“We are three days behind the agreed timeline.”
Instead of:
“Costs are becoming a serious concern.”
Say:
“Costs are currently 12% above plan.”
Instead of:
“The client is extremely unhappy.”
Say:
“The client has escalated twice this week and asked for a recovery plan by Friday.”
Specificity gives people something they can evaluate.
Knowing when to escalate is part of the skill
Not every risk needs senior attention immediately.
Sometimes the strongest update is:
“I want to make you aware of this, but I am not asking for intervention yet.”
Then explain why.
For example:
“The dependency is delayed, but we still have two days of contingency. The team is managing it. I will escalate if we lose that buffer.”
That sentence does two useful things. It creates visibility.
And it shows that you understand proportion. You are not hiding the risk. You are managing it.
A useful way to think about risk is not simply “problem or no problem,” but where it currently sits: Monitor, Manage, or Escalate.
The goal is not reassurance
When communicating risk, it can be tempting to reassure people.
"Don't worry, we're handling it."
Sometimes that is appropriate. But reassurance should not be the goal.
Clarity should be.
Your stakeholder should leave the conversation knowing:
what is true now
what could change
what you are doing
when they may need to get involved
That creates confidence far more effectively than simply saying everything is under control.
Actionable item for the next 7 days
The next time you need to raise a risk, avoid starting with:
“We have a problem.”
Instead, prepare four lines:
Fact: What do we know?
Impact: What could it affect?
Action: What are we doing?
Trigger: When will we need to escalate or decide?
Then communicate those four things in that order.
It will help you sound neither alarmist nor vague.
It will help you sound measured.
Strong risk communication is not about making a problem sound smaller.
And it is not about making sure everyone understands how serious you think it is.
It is about giving the problem the right weight.
Be clear about what has happened.
Be precise about what could happen.
Show what is already being done.
And make it clear when the situation will require a decision.
Because one of the strongest signals of leadership judgement is not simply spotting risk.
It is knowing how to communicate its significance.