We aren't really bad at estimating. What we are really bad at is enumerating all the assumptions that lie behind our estimates.
― Paul Rook, from his keynote on risk management, European Conference on Software Methods, London, October 1994.
If we're going to do credible risk management, we're going to have to estimate the reducible and irreducible uncertainties that create risk, following the guidance of Tim Lister
Risk Management is Project Management for Adults