Good article. And good discussion. Your point “Don’t risk more than you can afford to lose” is so fundamental to the developer and DBA, but also the business. I would just add that it is important to communicate with the business managers when risk is identified. The DBA, developers, or IT staff, may not be able to properly assess exactly the risk or what a company can afford to lose for a particular company.