Agile and Program Risk Management
Agile and Program Risk Management
By Melanie Carasso
You’re managing a program. You’ve got risks. How do you identify, plan for, and track those risks in an agile way?
A bit of inspiration from Agile development can help. Think of risk planning like product release planning. You have a high-level plan for the release, made up of a series of iterations. You know a lot more about the next few iterations than you do about the later stages of the release, so your next 1-2 iteration plans are more detailed and accurate than the overall release plan.
For your program, you can create a high-level risk register – complete with probability & impact scores and mitigation plans – at the start of the program. You can review and update this every month or so, similar to a release plan. It won’t be accurate all the time, but it’s a good source of ideas and a reassuringly scary reminder of what could still go wrong in the future. I like to use risk categories like Investment, Process, Schedule, Scope, Technology, Equipment, Customer or Sponsor, Staff, and Communications:
OK, so far this is not that agile. But for day-to-day risk management you can create a simple Top 10 risk list. You can use the Top 10 list like an iteration plan – it’s more current and less formal than the big risk register, it’s easy for everyone on the team to read and understand, and it drives your conversations and actions for the day or week:
You might decide you don’t need to create the high-level risk register at all, and just work off the Top 10 (or 5 or 20) Risks list that you check and update frequently. I’ve found the risk register comes in handy in two scenarios:
- You wake up at 3 am on four consecutive nights thinking “I know there are more risks out there. I feel like I’m missing something big”.
- That day the new executive asks “So where’s the risk assessment for this program? What do you mean, you just have a Top 10?”
In both of these situations, you’ll probably feel better if you’ve gone through the exercise of creating a more formal risk register – especially if you set aside a half or full day to really tap into your most creative worst-case-scenario mode. Get the program team to participate in a risk brainstorming session, or at least make sure they review and comment on it. This way the risk register can serve as a placeholder for way-down-the-track (and/or lunatic-fringe) risks, as well as a source of mitigation ideas for your constantly-changing Top 10.
Melanie Carasso is the program manager at Atlassian, an Australian software company that develops collaboration and development tools including JIRA and Confluence. Melanie has been managing software projects and programs for the past 8 years in various regions of the waterfall-agile spectrum, at telecommunications, medical management and industrial automation companies. Before diving into software project management, Melanie worked as a research scientist in microelectronics and fiber optics at Bell Labs and IBM in the US. She holds a PhD in chemistry from the University of Sydney and is PMP certified. In her blog, The Agile Program Manager, she shares her thoughts on managing programs in an agile way.
