13.3 PRINCE2 Agile guidance for the Risk theme
The Risk theme in PRINCE2 brings a level of formality to the management of risk, which can be very effective in any agile environment. In many situations it may be possible to manage risk in a real-time way but PRINCE2 puts a lot of emphasis on planned risk management, clearly defining who is accountable for this.
- It is the responsibility of the role that is managing the team (i.e. the team manager) to manage risk at the delivery level, and the responsibility of the role managing the project (i.e. the project manager) to manage risk at the project level.
- Risk management is formalized and planned, but at a level that is appropriate for the situation.
That does not mean to say that the team-based approach to risk management is no longer needed. The opposite is the case in that when using PRINCE2 with agile the whole team should look out for risks and take ownership of risks when appropriate. Ultimately, the accountability for managing them lies with the person managing the team and/or managing the project.
13.3.1 Level of formality
Formalizing risk management does not mean creating processes or documents that are bureaucratic. The level of formality should be appropriate to the needs of a project. On some projects, a risk register of a few columns manually updated on a team board may suffice (see Figure 13.2) whereas other projects may require a dozen columns electronically held and accessible remotely.
13.3.2 Addressing risk during stand-up meetings
Due to the implicit nature of risk management in some forms of agile, it is good practice to ensure that the delivery teams understand the difference between something that ‘has happened’ or ‘is happening’ (referred to as an ‘issue’ in PRINCE2) versus something that ‘may happen’ (referred to as a ‘risk’ in PRINCE2).
This is particularly relevant in stand-up meetings (or daily Scrums – see Appendix H). When asking team members if anything is blocking their progress (sometimes called an ‘impediment’), it is good practice to also ask if they are aware of anything that ‘may potentially’ block their progress. This does not necessarily need to be a separate question but the distinction is important, as the two questions require different responses.
When dealing with projects and difficult situations it is essential to actively manage risk. PRINCE2 sees this as essential in all situations. It is not optional.
13.3.3 Agile risks
Much of the agile way of working has been created to address the many risks associated with Waterfall projects – for example, avoiding detailed specifications at the early stages because the details may change, or delivering early and often to highlight misunderstandings. Although the agile way of working may reduce many common risks (which is one of the reasons for its growth in popularity) it does have risk areas of its own, such as:
- Agile relies on customer involvement, so what happens if the customer lacks commitment or is not empowered to make decisions?
- Agile relies on people interacting quickly and effectively, so what happens if a team is split over more than one site and in different time zones?
- Agile benefits from iterative and incremental delivery of products, so what happens if this is difficult to do due to the limitations of the existing infrastructure or legislation?
Another risk that should not be overlooked when working in an agile way is that value is delivered before it has been planned. Although this may be a positive situation and will not happen as a surprise (due to frequent customer involvement), it is still a risk and needs to be managed accordingly (e.g. end-users need training earlier or benefits that are delivered earlier can be applied to other projects).
A PRINCE2 project using agile will face many risks faced by any project but it is vulnerable to specific agile risks and these need to be managed. PRINCE2 Agile contains an agile risk assessment tool called the Agilometer and this is described in Chapter 24.