Agile and Risk Management
When we speak with executives about their aspirations for Agile adoption, largely we hear about the desire to reduce lead times and make more effective use of resources. We don’t hear nearly so much about using Agile thinking as a risk management strategy.
This is a shame, given the origins of the Agile Manifesto as a way to reduce the frequency/risk of project failure.
But we should remember that the Agile Manifesto emerged from the pain of software project failure. Software projects were making all their key decisions at the time when they knew least about the problem to be solved. The problem was named ‘Big Design Up Front’ and it was the search for an alternative approach that led to Agile as we know it today.
In Agile, key risks are addressed not by theorising about solutions in early-stage design, but through a process of concurrent design and build activity, delivering incrementally through an iterative process. Incremental delivery to the customer is measured using ‘earned value’ rather than completion of tasks.
But incremental delivery of software also allows incremental reduction of risk. Teams can seek to increase value or reduce risk. They need to make choices about these options and those decisions need to be well informed.
Sometimes we hear objections to the assertion that there are choices, in the belief that the Agile Manifesto requires working software as the only true measure. This is an immature misreading of the manifesto, which guides us that the working software should be valuable and continuously delivered in a sustainable environment; attributes that require effective risk management. Lean thinking has something to contribute here by identifying flows of information, which includes intelligence about risk that should be deliberately identified, managed and acted upon.
Having identified risk, we can manage it – and Agile’s core practice of incremental delivery can be leveraged to transform risk management, by seeking fast feedback from stakeholders. Under previous delivery models, feedback was late and based on sight of the whole project or some substantial milestone. Now it is granular and frequent.
With each delivery, we can use feedback to assess key questions. We can predict future delivery rate based on our track record to understand the probability of delivering in any given time period. Scope expansion can be tracked. We can know whether the functions provided so far are satisfactory, both to customers for their purpose, and in respect of quality criteria such as privacy, security, cost of ownership and so on. All of this intelligence can be gathered for each small increment delivered.
And Agile teams have retained the ability to modify their work plan. Similarly to balancing risk reduction work against earned value work, there is a cost to them choosing to do so. However, the reward has been that Agile projects deliver increased customer satisfaction (measured by revenue), and are three times more likely to be regarded as successful by their stakeholders.
Of course, not all risks are amenable to being reduced through fast feedback. Some are sufficiently external that the organisation can take no specific action or there are perceived ‘uncertainties’. In these cases, the organisation must ‘assume a posture’ that minimises impact. This is a strategic activity comprising avoidance, impact reduction, acceptance and transference.
One piece of advice IndigoBlue can offer is that when adopting a ‘transference’ strategy, be sure that it is the impact of the risk that is transferred, and not just responsibility for the mitigating action. For example, one major retailer ‘transferred’ all its future network infrastructure risk to its provider, but when they failed to provide, it was still the retailer’s stores that went blind. The lesson is clear.
In conclusion then, the Agile Manifesto and movement was triggered by the search for a better way to overcome the risk of failure to deliver desired functionality to predicted timescales. Incremental delivery can be leveraged for fast feedback, to ensure scope satisfaction. Statistical techniques can be applied to the past delivery record to predict future delivery probability. And finally, the manifesto’s emphasis on value and collaboration provides guidance on the best human behaviour to most effectively realise this goal through incremental delivery.
This article was originally published here and was reposted with permission.
