Using Agile practices to manage project risk

All projects have risks. The success of a project can often be dictated by how well the project team manages that risk.

Last month Equinox IT training partner and Certified Scrum Trainer Rowan Bunning delivered a webinar with us entitled Using Agile techniques to manage risk more effectively. The webinar covered a lot of ground and was very well received. In this article I summarise some of Rowan’s key takeaway messages.

Project risk

At its most basic level risk can be defined as ‘uncertainty’ on a project. While most of us look upon risk in negative terms, Rowan pointed out that it can also play a positive role for projects. ‘Upside risk’ is something that can be exploited to a project’s benefit and should not be overlooked.

“If a project has no risks, don’t do it.” 

Timothy Lister, Waltzing with Bears (Dorset House, 2003).

Project risks can be categorised into the following groups:

• Business - Are we developing the right thing?
• Social - Can the people involved deliver it? What if a key person leaves the project?
• Technical - Is the solution technically possible?
• Cost and Schedule - Do we understand the cost and timing of the project?

A poll of those attending the webinar revealed that Cost and Schedule was the most prevalent risk in the represented New Zealand projects (43%), followed by Business (33%).

Waterfall is not well suited to managing project risk

The Waterfall approach has been around since the 1970s and is still commonly used today in many New Zealand projects. Rowan explained that the creator of Waterfall, Winston Royce, admitted at the time that Waterfall was a risky model and one that invited failure.

In essence, by gaining all the knowledge and information about a project at the outset and completing all the project parts sequentially and independently, you can’t easily review or change, and you reduce the ability to minimise risk at any stage.

Agile practices are better suited to managing project risk

An incremental and iterative approach, such as Agile, on the other hand is a much more adaptive model that builds on cumulative knowledge throughout the project’s phases, and minimises risk along the way across all the four risk groups. Using Agile practices also allows you to see return on your investment earlier and often.

Rowan referenced one of his clients, the Reserve Bank of Australia, which has adopted Agile practices to implement a major banking system change. This was a project with high stakes that could not fail. They intentionally took an iterative and incremental approach using Scrum, and in doing so were able to better manage the risks on their project.

In the image below Henrik Kniberg shows how incremental and iterative approaches reduce risk compared with Waterfall approaches. The slide comes from Henrik’s presentation slides What is Agile? and is used under Creative Commons CC BY 3.0.

Using Scrum and XP with built-in risk management

The Agile methods Scrum and eXtreme Programming (XP) have a lot of feedback loops built into them to deal with different types of risk across the four risk groups. Scrum for example, encourages constant customer involvement, developing in priority order, small estimates tracked daily, review and adjustment with every iteration, delivery of software every iteration, confronting issues early, and clear goals and scope each iteration.

Using Lean Startup to manage the risk of developing the wrong product

The Lean Startup, which has been adopted by entrepreneurs, uses rapid, low investment iterations of build-measure-learn cycles to validate that a product is what the customer or user wants, before significant investment is made. This allows business risk to be mitigated very early with little investment of cost or time.

Rowan gave the example of Dropbox where at startup they put together a video of what their product would do once complete and released this online to get early feedback before the product was developed.

Using impact mapping to focus on value not features

Rowan cited figures from the Standish Group CHAOS report, which showed that 64% of software features are seldom or never used and only 20% are always or often used. This is the biggest waste in software development.

Agile has a focus on keeping schedule and cost fixed and managing scope or features to only deliver what is of most value. This helps the project focus on outcomes and not simply outputs (that may or may not be of value to the customer).

Impact mapping is a useful tool for getting clarity around what outcomes need to be achieved and can be used to help focus project effort on delivering value.

Using story mapping to plan out minimum product features

Story mapping can be used to map out the minimum set of features that will be delivered in each iteration, building on the principles discussed from Lean Startup and impact mapping. The approach can be used to deliver the minimum features or stories that could be developed in the first iterations of a project to make a system that is barely useable.

Initially this may just be a ‘backbone’, then a ‘walking skeleton’, and then mapping out the stories for subsequent iterations that add more and more richness. In doing so the projct always has a working system that covers the end-to-end capabilities, and it is just a matter of how rich this is, and when to stop once there is reducing value in adding additional richness.

Using release planning to manage project risk

During release planning projects should explicitly write up their assumptions, risks and open questions. Risks can then be charted against the likelihood of occurring and the impact if they do occur to understand the risk exposure. Risks can then also be charted on a collaborative risk board showing how the project team plans to deal with each risk, by exploiting, reducing, accepting, transferring or avoiding the risk.

Other Agile practices

During the webinar Rowan also spoke about these are agile practices for managing project risk:

• The risk and reward game, taking an entrepreneurial approach to software development, where hypotheses are formed, experiments are conducted, and teams can focus on doing more of what works and less of what does not.
• Potentially shippable products, where software that can be potentially released and the end of any given sprint, limiting risk exposure only to those things that haven’t yet been developed.
• Making risk visible, where in good Agile fashion post-it notes and wall charts can be used so that risk information is radiated to the team and stakeholders and not buried in a project manager’s planning documents.
• Forecasting from real velocity, where actual team velocity from previous iterations is used to give better estimates and probabilities of developing the project within budget.
• Reducing your ‘bus factor’, by using approaches such a pair programming and collaborative modelling to minimise the social risk to your project if a key team member gets hit by a bus.

Next steps

We all want our projects to be more successful, and Rowan covered a number of valuable Agile approaches and practices that allow us to better manage the risks that may impact our projects. To learn more, watch the Using Agile techniques to manage risk more effectively webinar. The Agile approaches and practices that Rowan covered during the webinar are also covered in more detail in the courses that Rowan teaches with Equinox IT, including the Certified ScrumMaster course and the Certified Scrum Product Owner course.