In 1996, the University of Southern California (USC) switched its core two-semester software engineering course from a hypothetical-project, homework-and-exam course based on the Bloom taxonomy of educational objectives (knowledge, comprehension, application, analysis, synthesis and evaluation). The revised course is a real-client team-project course based on the CRESST (Center for Research on Evaluation, Standards and Student Testing) model of learning objectives (content understanding, problem solving, collaboration, communication and self-regulation). We used the CRESST cognitive demands analysis to determine the necessary student skills required for software risk management and the other major project activities, and have been refining the approach over the last four years of experience, including revised versions for one-semester undergraduate and graduate project courses at Columbia University. This paper summarizes our experiences in evolving the risk management aspects of the project courses. These have helped us mature more general techniques, such as risk-driven specifications, domain-specific simplifier and complicator lists, and the SAIV (schedule as an independent variable) process model. The largely positive results in terms of review pass/fail rates, client evaluations, product adoption rates and hiring manager feedback are summarized as well.