Critical success and failure factors of software projects were extensively studied. However, software project risk management has rarely researched organizational risks even though most problems occur when the social aspects are not addressed. By employing the resistance to change theory, our paper develops an organizational risk diagnosing (ORD) framework in order to show how can organizational risks be better understood and managed. Organizational risk factors may have non-trivial underlying root causes. A failure to diagnose them may result in ineffective risk responses that address the symptoms. A case study of a loan application software project has been conducted in one of the biggest banks in South-Eastern Europe. An analysis of the risk management process in the studied case allows a better understanding of organizational risk management. •Hardly detectable root causes may be underlying organizational risks in software projects.•Discussing various stakeholder views helps diagnosing organizational risks.•Checklists alone may not be effective for managing organizational risks.•Defined the difference between “user resistance” and “stakeholder resistance”.•A novel resistance checklist based on extant research.