On the face of it, the concept of project risk management is quite straightforward. Because projects by their nature involve new activities under new circumstances designed to achieve new objectives and benefits, they have not been done exactly like this before (although some projects may have been very similar, which is helpful). Consequently, the various activities involved in the project will not go exactly as planned. Some activities may go better and others, more often that not, will take longer, or cost more, or both.
Most project estimates are compiled on the bases of optimum conditions, in other words, hoping for the best. That condition rarely applies in real life things happen. So, as practicing project managers we like to set aside a certain reasonable amount of time and cost to cover such eventualities. This amount is usually arrived at by examining each activity, or at least homogeneous groups of activities, and then assigning some percentage margin based on experience or prior results. Having gone through this exercise, we may also gain a good insight into which activities may need more careful supervisory attention than others. This is all a proper part of a project estimate.
Since a majority of small to medium sized projects are typically "run of the mill", and where the outcome of the project is fairly well understood, the subject of project risk management may be given little attention, if any. This is especially true of projects where the work is mostly intellectual rather than craft, such as in administrative changes, or Information Technology. In such cases, it is relatively easy to back track and redirect current efforts if that makes sense, and the cost of discarded work is minimal.
This is not true in the case of projects where significant amounts of craftwork are involved such as in building, engineering and infrastructure works. This is because, depending on the stage of the project, especially in the execution phase of a so-called "construction" project, significant but unexpected amounts of physical "demolition" and "re-work" can often be involved if someone decides to change direction after part of the works has been built.
1. The whole process of conducting a project risk management component of a project's management is typically explained in some detail in any competent book on managing projects, e.g. A Guide to the Project Management Body of Knowledge published by the Project Management Institute, PA, USA