Abstract Risk management is essential to protect the quality of a large-scale engineering effort. It should be a well-defined process that builds on an encompassing and detailed understanding of the purpose, elements, and contexts of the system. It should accommodate qualitative and quantitative information in understanding sources of risk. In an application paper, we use hierarchical holographic modeling (HHM) to identify sources of risk in the acquisition of a large ($1 billion US) software and database system. HHM provides a framework to integrate the perceptions by managers and analysts of what could go wrong in the acquisition. In addition, we filter and prioritize the identified sources of risk based on their likelihoods and potential consequences. Finally, we generate and evaluate alternatives for risk management, focusing on potential impacts to the acquisition schedule.