Good design and process seeks to reduce or eliminate risks, but we all know that it is impossible to act completely risk-free. Because of this, we need a way to assess those risks we cannot prevent, in order to determine what, if anything, to do about them. This podcast will offer an effective way to do that, collaboratively
A Thought Framework for Risk Assessment
Agile and Lean processes promote, among other things, the concept of deferred commitment. Put simply, they say you should delay decisions until the last responsible moment because you'll have better information then. Also the factors that influence those decisions will often change over time unpredictably.
That said, putting off decisions can be problematic if the risks involved are too high. In Acceptance Test-Driven Development the stakeholders collaborate around the analysis of requirements. Many useful artifacts come out of this process. One of them is a list of risks that the team has identified. These risks must be assessed to determine what, if anything, to do about them.
So assessing risk effectively is an important skill. It's also a matter of judgement which no process, technique, or approach can replace. Decisions will always have to be made by intelligent, experienced, dedicated professionals doing their best.
Although I cannot tell you how to assess your specific risks I can offer a thought framework for that assessment. Having such a thing will empower you to organize your analysis about risk but also, if it is something the entire team shares, will serve to improve communication and collaboration. I encourage you to promote this technique with your colleagues.
Risk can be considered to have two dimensions that intersect, creating four quadrants. Examining each quadrant reveals a third dimension. What are the first two?
The first is likelihood. Is the risk something that happens routinely, or is it rare or even outlandish? Most risks are somewhere along that continuum.
The second is severity. Is the risk something that, were it to happen, would result in catastrophic damage, or is it something that would be trivial or even meaningless? Again, each risk can be placed along that range.
If you intersect these two dimensions you come up with 4 quadrants. The first task of the team is to place the risk somewhere on this plane. This discussion will bring out different points of view and will stimulate everyone's critical thinking. You can dot-vote if you find that effective.
Let's examine each quadrant, provide an analogous example, and discuss the third dimension in each case.
Highly Likely, Crucial:
A good analogy is a car accident. These happen all the time (most of you have likely been in at least one). They are also potentially lethal. So that's a risk we don't ignore or put off.
The third dimension in each case is what we can do to remediate the risk. Should we make all cars out of three-inch-thick steel? Nobody would ever die in an accident if we did. But no, we have judged that to be an overreaction. But we do install airbags and seat-belts, we have speed limits and stoplights and so forth. We take reasonable measures that reduce the likelihood and severity of the risk without incurring excessive cost or removing important functionality.
Highly Unlikely, Trivial:
An example: Your neighbor's mail delivered to your house accidentally. That has only happened once in my life and when it did the remediation was to drop the mail off on their porch. So I didn't complain to the letter carrier or lobby the city council for new regulations, and I won't go to any lengths to prevent this in the future. I feel I can safely ignore these kinds of things. If it starts happening all the time then perhaps I will take some kind of action, but nothing too severe because it really does not matter than much.
Highly Likely, Trivial:
Most of us will stub our toes several times in a given year. It hurts, it's annoying, but it is not life-threatening. We could wear steel-toed boots in our homes at all times but the discomfort and inconvenience is not worth it. Maybe I'll install some night lights to make sure I can see better when I get up in the middle of the night but that's about all.
Highly Unlikely, Crucial:
If you drive your car into a lake you are in a bad situation almost immediately. It is seriously dangerous. But has this ever happened to you or anyone you know? In my case, no. So I don't keep a scuba tank in my car. Since I don't live in Minnesota (the land of 10,000 lakes) I don't keep one of those window-breaking tools in my glove-box. My relatives who live there do, however.
But my state puts guardrails along the roads that run next to large bodies of water and I think that's prudent even though I'm sure it is fairly expensive.
Again, none of this serves as a replacement for your judgement; nothing I teach can ever do that, nor would you really want that, right? We all want to keep ownership of our decision-making processes, but we seek to be better at them. Organizing your thought process regarding risk assessment is meant to empower you and your team in this way.
(For information on dot-voting, see https://en.wikipedia.org/wiki/Dot-voting)