Risk management is getting to be too complex to use on anything less than a major, multimillion-dollar project. The use of risk management on IT programs is overly complicated. This Executive Update shows one way of cutting through the clutter of risk management tools, status reports, and metrics by adopting a simple, stratified approach.