"We're not real risk-averse right now," Rogers notes. "If they're handled right, we're ready to take some risks."

On the other hand, Caddell's current crusade is to ensure timely delivery of projects, and she's not eager to take on anything that might compromise that mission. "Last year we were 96 percent on time with projects, and I attribute that to risk management," she says.

Ultimately, the CIO must understand his enterprise's culture and know which risks are worth taking. No amount of risk analysis will lift the decision-making burden from the CIO's shoulders or ensure the success of any project. Risk analysis is a tool, not a substitute for leadership. After all, it takes a leader to understand that although there's no such thing as a sure bet, decisions must be made.

"In these matters, the only certainty is that nothing is certain," famously noted Pliny the Elder, who, incidentally, died from ash inhalation in 79 A.D., when the volcano Mount Vesuvius erupted.