If you take the risk memo approach and then present it to management or the stakeholder, beware of the "Shoot the Messenger" syndrome. In the project from which the above risk memo example comes, I was considered a messenger with bad news and it wasn't taken well. Rather than focusing on the risk at hand, management looked at me as the problem for highlighting the risk. In hindsight, I would have been much better off taking the short assessment approach because then I wouldn't have ended up at a meeting table with a barrage of angry faces and shouts of "why didn't you tell me this earlier!". Trust me, it's not much fun!
The reality is no-one likes bad news. Knowing this, I started the meeting with a quote from the most recent Standish Report on Project Success; it said that over 70% of software projects fail—not something management likes to hear. My rationale for saying this was to prepare the stakeholders for bad news, that chances were, their project would fail....