Iron Monkey's Law of Project Risk

The amount of risk in projects tends to remain constant over time. Let R be the "customary" amount of risk. If a new methodology, technology, strategy, or resource could be used to reduce the risk of typical projects to below R, it will be used instead to do more ambitious projects with risk R.

Though the above wording is my own creation, the idea is nothing new. It is just a special case of the theory of risk homeostasis:

Risk Homeostasis Theory maintains that, in any activity, people accept a certain level of subjectively estimated risk to their health, safety, and other things they value, in exchange for the benefits they hope to receive from that activity (transportation, work, eating, drinking, drug use, recreation, romance, sports or whatever).[8]

In any ongoing activity, people continuously check the amount of risk they feel they are exposed to. They compare this with the amount of risk they are willing to accept, and try to reduce any difference between the two to zero. Thus, if the level of subjectively experienced risk is lower than is acceptable, people tend to engage in actions that increase their exposure to risk. If, however, the level of subjectively experienced risk is higher than is acceptable, they make an attempt to exercise greater caution.

So the amount of risk on projects will tend to stay the same over time. When people adopt methods that "reduce risk," the real effect will be to attempt to do more with less, in less time, with about the same risk. Just as with cars:

Adding anti-lock brakes to a car, for example doesn’t reduce accidents. Aware of their greater braking ability, drivers follow more closely and drive faster on slick streets.