3 Agile Risk Management Tips from Shamu

Experienced agilists make it sound so easy, don't they?  They tell you over beers about the big, honking project they did last time.  They showed up, did some "workshopping," set up a little CI environment, and then, two weeks later, they began churning out working software.  And not just any working software:  high quality, low complexity, and perfect fit to business needs.  And why not?  The Product Owner was in the room to design and approve it!  Agile is fun!  Woo hoo!

This may not sound like the projects you do at all, where you experience confusion, resistance, fear, sweat, and tears, and you teeter daily on the edge of failure, public humiliation, alcoholism, and unwilling participation in corporate "resource efficiency" efforts.   How can you be an agilist when you don't share this ability to triumph over the grim corporate realities and do the impossible every day (twice on Sunday?)

http://simple.wikipedia.org/wiki/File:Shamu_in_SeaWorld,_San_Diego.jpeg

Here's a quick answer from Shamu, the quirkily named Orca(s) at the Sea World amusement park(s world-wide):  if it looks like a killer whale, and it swims like a killer whale, and it has killer whale teeth, then it probably IS a killer whale, and you need to be careful.  Agilists cannot be any more cavalier about project risks than anyone else.  Ask yourself:  are you "making a hard job look easy," or are you thinking that you have "changed the world so that we don't have risk any more." If it's the latter, please think again.

If you as an agilist are not finding, mitigating, and escalating project blockers, issues, and risks faster and with more rigor than your waterfall counterparts, then you are going to"fail fast," but not in a good way.   This flop is going to be without proper messaging, and on a schedule that is quite a bit faster than the one for which you, yourself, had hoped.

Every software project is a corporate financial investment backed by an explicit or implicit risk strategy.  Executives put money on the table to finance team activities with the expectation that the business will benefit from the expenditure.  That is why they are financing the project rather than putting the money into CDs and living on the interest (or buying a patent to exclusive-or bit-map representation and living off of the lawsuit proceeds).

When you are working on a big project, where a lot of money has been paid up front, then you own a piece of a sizable executive gamble.  What you do matters not only to you, and to your team, but to your whole organization, to your board of directors, and, depending on your industry, potentially to the whole world.

Which brings us back to Shamu.  What does Shamu have to recommend to you as an agile team participant, leader, or funder? 

1.  Risk is real.  Even in agile, and especially in agile, "risk management" is not a CYA activity in which boxes are ticked off, although that may be all you are doing today.

• Effective project participants need to start with the expectation that the world tends towards entropy, and that if something can break, it will.  
• Entropy needs to be constantly evaluated and triaged.  Do we have a crisis today, you should ask yourself, not just at the retro, but every day.  
• If you do think you see something terrible about to happen, "pull the andon cord," as they used to say at Toyota.  Make a stink.  Get people's attention.  Make sure that the team acknowledges and fixes your perceived crisis-level problem or can explain to you why your perception is off, within a reasonable time frame.  And don't be too quick to think "it's just you." 

Problems come in many shapes and sizes but an actual crisis can come up on any day, and you want to be the one to point it out and prevent it, not the one crushed by it. 

2.  Put on a show, but be honest with yourself and your team, and fix your important issues.  As of 2010, Sea World has banned having trainers in the pools with the whales, after a whale trapped an experienced trainer at the bottom of a pool and killed her in front of a crowd.  For the 20 preceding years, the trainers had made it look easy, but it's not as though there hadn't been warning signs.  Wikipedia relates:  "On March 4, 1987, 20-year-old SeaWorld San Diego trainer, Jonathan Smith, was grabbed by one of the park’s 6-ton killer whales. The orca dragged the trainer to the bottom of the tank, then carried him bleeding all the way back to the surface and then spat him out. Smith gallantly waved to the crowd when a second orca slammed into him. He continued to pretend he was unhurt as the whales repeatedly dragged him to the bottom of the stadium pool. Smith was cut all around his torso, had a ruptured kidney and a six-inch laceration of his liver, yet he managed to escape the pool with his life."

• Jonathan Smith is a bona fide hero for "going on with the show" under terrible circumstances to safeguard Sea World's flow of money in 1987.  
• It's not as clear that Sea World looks good in allowing a stream of trainers to be injured before finally banning them from the pool.  And I don't even particularly want to get into the ethics of keeping Orcas at Sea World in the first place.

The point here is that it's a balance.  Your reputation as a successful software delivery person needs to be maintained, and face must always be saved.  But while you save face for yourself and your sponsors by staying positive, you need to be vigilent and powerful in getting the small group of people who have the power to fix your biggest risks to do so as quietly as they like, but quickly and efficiently.

3.  Please, never be optimistic.  Take the time you need to identify and mitigate identifiable risks before you start.  How much time you take, and how much you wait is going to vary by your context, by the stakes, and by the risk appetite of your funders.  Don't go for "fast" on principle.  Put this in context:  at its best, agile software development lets you find and fix your most important problems in a time frame that is months ahead of when the waterfall project would have even started standing up its first environment. 

Please, my friends, don't be macho.  Be smart.  As they said in the Sex Education Road Show at my college,  "Hope is Not a Contraceptive."