i think there are definitely categories of risk, and knowing these categories is helpful. when can then analyse a software project in terms of which risks are relevant, which have a contingency and which can simply be ignored. then it's possible to focus on the risks that are actually serious and can be addressed.