This article, based on a keynote lecture given at the Finnish Rock Mechanics Day 2019, discusses how structured risk management can be implemented to rock engineering projects. The suggested procedure is based on ISO 31000 and a recently published methodology for practical implementation of the standard to geotechnical engineering projects. The main message is that structured risk management is a key tool to achieve high-quality rock engineering structures. A key component for many projects will be the use of the observational method to cost-effectively reduce the lack of knowledge of the ground conditions during construction of the facility.