Agile has become a prevalent process in the management of projects.  A process where we constantly roll out updated software (for this article’s purposes, can be used on any type of project).

How do we track risk in this type of environment where we are constantly doing builds, releasing them and then doing updates based on customer input?  Not only are we delivering software we have to roll the results of each step into the design, i.e.  adjust the requirements, and run verification. This means we also need to be assessing how the currently defined risks are being impacted by each iterative delivery.  Is the identified risk(s) still mitigated by the design?  Do we need to adjust the mitigation?  If a new risk is identified, then new mitigation(s) needs to be created to address risk and then incorporated into the design.

Agile will require us to consider how the following impacts risk work on the project:

• Build and deliver – new builds are done based on feedback incorporated into the design and then delivered.
• Continuous integration – there is no single integration cycle, as changes are made they are integrated

MAKE YOUR TEAM DO THE RISK ASSESSMENT
One key step is for the risk assessment/monitoring effort to be moved to the team members doing the work. In this fast an environment it will be impossible for the project management to keep track of all the risk work.  Rather it makes more sense to move the responsibility for assessing and identifying risk to the team members working each build.  Weekly team meetings can be held to review risk status and the project manager can follow and address serious issues, but the likelihood of success will increase if team members are managing risk.  This not only keeps the project on track, but also provides team members to opportunity to develop skills on the understanding and management of risk.

In an Agile environment risk management does not go away, it increases in importance as deliveries are at a higher frequency and needs to be addressed in each release.  This requires the team members to have greater visibility and responsibility for risk.

Bio:

Paul J. Kostek is a Principal of Air Direct Solutions, a systems engineering/project management consulting firm. He works with companies in defining system architecture, system requirements, interface definition, verification planning, risk management and software development standards. Paul received his BS from the University of Massachusetts, Dartmouth.   Paul works in a range of industries including: aerospace, defense, medical device and e-commerce.

Paul is a long-time volunteer with several professional engineering societies including IEEE, AIAA, SAE, INCOSE and PMI.  He also writes for the CERM Risk Insights emagazine.