I have been watching (as an observer) a discussion related to one of the core practices within traditional (project) management -Risk Management. It has made me a bit sad to look at these intelligent people once again to fall into trap of naming traditional process with new terminology and continuing with old thinking. Agile changes everything. Whole organization needs to accept that managers are not anymore in charge, they do not know better and certainly are not better than people and teams dealing with value adding work. If this is not realized the ground for change is rotten and we should take the A-word away from the concepts. Or we may approach the challenge in a different way…
We do not need to invent a new risk management process in Agile as this kind of approach will take away one of the most valuable Agile assets: thinking. Traditional risk management processes were just that: outsourcing thinking (and responsibility) from people to management. We do not want to see that happening. But in order this to work in an Agile way you need to have motivated and passionate individuals in your teams.
Great teams mitigate risks automatically. It is part of the self-organization that Agile and Lean promote. On the other hand organization and managers need to take care that structure and boundaries support this. We have to provide coaching for people to understand how to work with the risk aspect. Risk must be seen in different dimensions: technical, business, people and infrastructure (at least). As the subject is wide (see the whole) it is extremely difficult for the teams. Still they have the best view on technical risk. In large-scale we sometimes form team of teams to help on this (We call them System Communities of Practice). This solely will not work. We need self-organization, responsibility and transparency on different levels. If it is not happening, a framework might help. A logical place to support business risk mitigation is on the Product Owner team. They are an integral part of the work other teams are doing and have better business visibility. And likewise people/infrastructure support towards risk mitigation and avoidance is coming from line management.
Risk management in Agile is a task and a duty for the whole organization. When different parts learn to co-operate and transparently communicate, Agile Risk Management as a process is not needed. It has become integrated part of the daily work inside Agile organization.