The paper outlines the necessity for risk management in IT projects and describes a risk management process and methodology to identify the risks of an IT project in advance. The methodology has been developed 1999 within KPMG, and applied in many firms all over the world. In 2002 the risk management process and the methodology was revised and afterwards published by the author.