PMI-ACP Lesson 9 Agile Risk Management

Copyright 2014, Simplilearn, All rights reserved.1
PMI® & ACP are the registered marks of Project Management Institute, Inc. Copyright 2014, Simplilearn, All rights reserved.
Agile Risk Management
PMI®—Agile Certified Practitioner (PMI-ACP)®

● Explain risk adjusted product backlog in Agile
● Identify the steps involved in Agile risk management
● Describe various risk identification, assessment, response and review
strategies
● List the steps in progressive risk reduction
● Determine the use of Agile risk-based spike
After completing
this lesson, you will
be able to:
Objectives

Risks are managed in Agile projects by associating user stories to themes and ensuring that risks are
prioritized early in the project’s iterations. The goal of each iteration should be to progressively ‘de-
risk’ the project.
Risk Management in Agile

The risk management process is
repeated every iteration. As part of the
iteration retrospective, the remaining
risks can be reviewed and the
probabilities and impacts validated.
The team can be asked to identify new
risks. The remaining features that
continue to carry risk would be
identified for selection in the next
iteration.
Risk Management in Agile (contd.)
Image Courtesy : LeadingAnswers.com
Planning
User Eval
Learn
Req
Analysis
Design
Develop
Test
Planning
User Eval
Learn
Req
Analysis
Design
Develop
Test
Planning
User Eval
Learn
Req
Analysis
Design
Develop
Test
Iteration #1 Iteration #2 Iteration #3
Planning
User Eval
Learn
Req
Analysis
Design
Develop
Test
Iteration #4
Risk process every iteration

Risk involved with a feature is an important factor in the prioritization of the product backlog.
● The product backlog is continually reviewed and adjusted.
● The customer, along with an analyst and other team members, prunes the backlog.
● While pruning, impact (risk) analysis is the key: items are broken down, analyzed for their
interdependencies, shifted up or down in priority, re-estimated, removed, and reallocated to
iterations or releases. This happens weekly in most Agile teams.
● Analyzing the impact of changing requirements should be a routine among successful Agile teams.
Risk Adjusted Product Backlog

Risk Management Lifecycle
The four steps in risk management cycle
are:
● Risk Identification
● Risk Assessment
● Risk Response
● Risk Review
Identify
(@ Daily Scrum;
Retrospective: Requirement
workshop; Sprint planning;
Sprint review etc.)
Review
(@ Retrospective)
Agile Risk
Management
Process
Respond
(Avoid, Mitigate,
Transfer, or Accept )
Assess
(Likelihood/Impact/
Response)

The team identifies project risks and
records them in a risk register or
spreadsheet. Risk identification is done
using information gathering techniques
such as checklists, document reviews,
and assumption analysis.
Requirement Gathering
Risk Identification
Risk

Risk identification can happen at the following stages:
Risk Identification Opportunities
Team discusses risks handled successfully, the chances of reoccurrence of risk and what will be
done differently for risk mitigation in the subsequent iteration or sprint.
Retrospective Meeting
Team discusses risks. Successful mitigation or evasion activities are highlighted and shared
with the stakeholders too.
Iteration or Sprint
Review
Team identifies risks and issues. The risks are added to the risk board and the agreed response
plan is documented.
Scrum Meeting
Team identifies, assesses, and responds to risk. Team works with the product manager to
maximize output, thereby reducing the risk of failure.
Iteration or Sprint
Planning
Team estimates the relative size of each user story to reduce risk by rejecting user stories that
are over a certain size.
Planning Poker
Team and the product manager discuss new ideas to reconsider and adjust requirements in a
way that maximizes value and minimizes risk.
Requirement
Gathering

Classifying risks can serve as a checklist for
identifying risks.
A broad categorization could be:
● Business risk
● Technological risks
● Logistical risk
To ensure that a broad range of risks have been
identified, the acronym given can be used:
Risk Assessment—Categories
P
E
S
T
L
E
Societal
Technological
Legal
Economic
Environmental
Political

Risk Assessment—Risk Census
A risk census is a simple framework for analyzing
the risk exposure of a project.
● It describes each risk;
● It provides an estimate of how likely the risk is to
occur (risk probability);
● It indicates the impact to the schedule if the risk
did occur; and
● It identifies the expected exposure to the risk.
The total exposure can be used to determine how
much slack or buffer is required in the project.
Risk Probability Impact
(days of
delay)
Exposure
(Probability *
Impact)
Required test bed
server and software
licenses may not
arrive on time
30% 10 3
Complexity of the
API’s used may
increase the effort
required
50% 15 7.5
Platform team may
not deliver a stable
version in time
20% 25 12.5
Unexpected absence
of team members
during the flu season
40% 5 2
Total Exposure 25

Risk board is an information radiator that is used to
make the risks of a project transparent to the team and
the stakeholders. A risk board indicates the following:
● Identified risks
● Probability
● Impact
● Risk response (if applicable)
Risk board should be reviewed regularly as part of the
daily Scrum and/or as part of the end-of-sprint or
iteration retrospective.
Risk Assessment—Risk Board

Risk Burndown Chart
The risk burn down chart is a simple graphical
indicator of the risk trends in the project.
● The risk burndown chart is created by plotting the
sum of the risk exposure values from the risk
census against the remaining risks in each
iteration.
● In the chart, there should be linear drop in risk
over the course of the project.
● Each iteration should be de-risking the project by
delivering a user story that mitigates or eliminates
a risk on the risk board.

For every risk identified, it is important to have a strategy to respond to it:
Risk Response Strategies
Avoid
A project or a part
of a project is
cancelled in order
to remove the
threat of risk
realization.
Mitigate
Reduces the
impact of risk, if
the event occurs.
Transfer
Most of the risk is
transferred to a
third party. The
residual risk is
handled using
different
strategies.
Accept
The team agrees
to handle lower
impact risk, when
they arise.

Risk review is the phase where the team meets for reviewing the risks.
● The active risks are reviewed to ensure that responses are delivered in a timely and efficient
manner, generally done through the ‘daily scrum’. Actions and decision points are added to the
risk board and reviewed everyday.
● The team needs to provide feedback on the risk management process to ensure that it is
optimized as a part of the project retrospective.
● Review of the impact of risk and risk realizations on project and company objectives is conducted
as part of the sprint or iteration planning activities.
Risk Review

Risk Profile Graphs
A risk profile graph is a more elaborate instance
of the risk breakdown chart:
● Risk profile graphs are ‘stacked area graphs’
of risk severity. The risk severity scores for
each risk are plotted one on top of another to
give a cumulative severity profile of the
project.
● Risk profile graphs inform stakeholders if the
risks are moving in the right direction
(downwards) or if issues and concerns are
escalating (upwards).

Steps to reduce the risk levels of a project are as follows:
Progressive Risk Reduction
Perform
continuous risk
assessment
Collect early
and continuous
feedback from
the team
Introduce
features to deal
with risks
Identify risks as early as
possible

Spike is a time-boxed period designated to reduce
uncertainty by learning about a feature, technology, or
process to better estimate, develop, or fix an upcoming
feature or defect.
● A spike should require minimal time and effort; not
more than one or two days.
● A spike should be made visible by creating a story for
it in the product backlog.
● Spike should be used sparingly as they do not create
story points themselves.
Risk-Based Spike
Iteration backlog
Spike
Stories
Defects

Quiz

QUIZ
a.
b.
c.
d.
Which of the following are the steps involved in risk management cycle, in the correct
sequence?1
Identify, Assess, Respond, Review
Review, Identify, Assess, Respond
Identify, Review, Respond, Assess
Identify, Assess, Respond

QUIZ
a.
b.
c.
d.
Which of the following are the steps involved in risk management cycle, in the correct
sequence?1
Answer: b.
Explanation: Identify, Assess, Respond, Review are the steps involved in risk management.
Identify, Assess, Respond, Review
Review, Identify, Assess, Respond
Identify, Review, Respond, Assess
Identify, Assess, Respond

QUIZ
a.
b.
c.
d.
What is a graph that shows the risk severity scores for each risk plotted one on top of
the other to give a cumulative severity profile of the project?2
Risk board
Risk profile graphs
Risk issue boards
Risk graph

QUIZ
a.
b.
c.
d.
What is a graph that shows the risk severity scores for each risk plotted one on top of
the other to give a cumulative severity profile of the project?2
Answer: c.
Explanation: Risk profile graph shows the risk severity scores for each risk plotted one on
top of the other to give a cumulative severity profile of the project.
Risk board
Risk profile graphs
Risk issue boards
Risk graph

QUIZ
a.
b.
c.
d.
Which of the following strategies seeks to reduce the impact of risk event if it occurs?
3
Transfer
Mitigate
Accept
Avoid

QUIZ
a.
b.
c.
d.
Which of the following strategies seeks to reduce the impact of risk event if it occurs?
3
Answer: c.
Explanation: Mitigation seeks to reduce the impact of risk event if it occurs.
Transfer
Mitigate
Accept
Avoid

QUIZ
a.
b.
c.
d.
If the risk probability is 20% and size of loss is 5, what is the risk exposure?
4
5
20
1
100

QUIZ
a.
b.
c.
d.
If the risk probability is 20% and size of loss is 5, what is the risk exposure?
4
Answer: d.
Explanation: Risk exposure is the product of probability and size of loss. Therefore, the risk
exposure = 20% x 5 = 1.
5
20
1
100

QUIZ
a.
b.
c.
d.
What is the purpose of a spike?
5
A significant increase in velocity from one iteration to another.
Adding extra stories to an existing iteration.
A story that requires an increase in its story points due to uncertainty in its
underlying technology or process requirements.
An activity in an iteration intended to reduce uncertainty in a feature, technology, or
process.

QUIZ
a.
b.
c.
d.
What is the purpose of a spike?
5
Answer: a.
Explanation: A spike is time-boxed period intended to reduce uncertainty by learning about
a feature, technology, or process to better estimate, develop, or fix an upcoming feature or
defect.
A significant increase in velocity from one iteration to another.
Adding extra stories to an existing iteration.
A story that requires an increase in its story points due to uncertainty in its
underlying technology or process requirements.
An activity in an iteration intended to reduce uncertainty in a feature, technology, or
process.

QUIZ
a.
b.
c.
d.
How do Agile projects manage risk?
6
Agile approaches inherently manage risk through test driven development.
Risk stories are added to the backlog and completed during the last iteration.
Total Exposure points are added to every story based on the risk census.
Agile projects ensure that risks are associated to user stories and complete these
stories early in the iteration schedule to de-risk the project.

QUIZ
a.
b.
c.
d.
How do Agile projects manage risk?
6
Answer: a.
Explanation: By ensuring that risks are associated to user stories and completing these
stories early in the iteration schedule, Agile approach de-risk the projects.
Agile approaches inherently manage risk through test driven development.
Risk stories are added to the backlog and completed during the last iteration.
Total Exposure points are added to every story based on the risk census.
Agile projects ensure that risks are associated to user stories and complete these
stories early in the iteration schedule to de-risk the project.

● Risks in Agile projects are managed by associating user stories to themes
and ensuring that risks are prioritized early in the project’s iterations.
● A risk census is a simple framework for analyzing the risk exposure of a
project.
● Risk board is an information radiator that is used to make the risks of a
project transparent to the team and the stakeholders.
● The risk burn down chart is a simple graphical indicator of the risk trends in
the project.
● The four risk response strategies are avoid, mitigate, transfer, and accept.
● Risk profile graphs inform stakeholders if the project risks are increasing or
decreasing.
● Spike is a time-boxed period designated to reduce uncertainty by learning
about a feature, technology, or process to better estimate, develop, or fix an
upcoming feature or defect.
Summary
Here is a quick
recap of what was
covered in this
lesson:

PMI-ACP Lesson 9 Agile Risk Management

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to PMI-ACP Lesson 9 Agile Risk Management (20)

More from Thanh Nguyen (19)

Recently uploaded (20)

PMI-ACP Lesson 9 Agile Risk Management