Quality plans and risk management plans must result in project tasks to be actioned, tracked and managed to completion, otherwise the vendor's quality plans and risk management plans are simply shelfware. One of the biggest causes of troubled projects is vendor over-confidence in their abilities. A vital role of an independent QA organisation is to detect this problem and ensure that plans are realistic and achievable. Quality is delivered through: specifying quality requirements in tangible, real-world terms; defining and using appropriate software development processes; controlling quality through the use of appropriate VV independent QA reviews to ensure that quality attainment plans and quality control plans are being executed; defining and using appropriate processes to preserve quality throughout the life of the software. All of the above are defined in the quality plan, a crucial input to project estimation and planning. The goal of risk management is to reduce project overspend and slippage, and thereby to maximise quality. Risks must be identified and analysed to determine their probability and impact. Risk reduction actions can then be defined to re engineer the risk profile. What is left is the residual risk. Residual risk can be examined using best, likely and worst case scenarios, and appropriate contingency strategies and plans defined. Automated statistical tools can indicate the residual risk contingency which should be set aside to provide the desired confidence level that the contingency will not be exceeded.