I totally agree with the 'Risk-first' approach. This idea fits in very nicely with risk driven technical assurance, where the goal of project reviews (even including those covering pre-project activities such as bidding) is to quantify and mitigate the risk to the business. Such assurance provides an outer shell for engineering activities such as software development.