Editing UNITA Agile Management Guide (section)

== Risks and mitigation measures ==

Risks and issues are different (source pmi.org):  
The key difference is an '''“issue”''' already has occurred and a '''“risk”''' is a potential issue that may or may not happen and can impact the project positively or negatively. We plan in advance and work out mitigation plans for high-impact risks. For all issues at hand, we need to act immediately to resolve them.

'''Examples of risks that can arise in the project are:'''
* suboptimal involvement of team members
* budget overrun
* deliverables not produced on time
* cyber attack to the IT systems

Agile Risk Management involves removing obstacles that impede the work progress of the project team members. Agile projects tend to be less risky by nature, for several reasons:  
* '''Collocated teams''': bringing the project team and the client together leads to better communication and less wasted time.  
* '''Simplicity''': the team should only concentrate on the minimum amount of work that needs to be performed. Wasteful processes should be eliminated.  
* '''Regular Reflection''': by continuously improving processes throughout the project, risk is exponentially reduced. Process improvements should be immediately implemented in the following iterations, ensuring that these same risks do not occur again in the project.

=== Risk management ===

Risk management aims to ensure that risks that might have a potential impact on project scope, time, cost, quality, risk, or stakeholder satisfaction are identified, assessed and a risk response strategy is planned.  
Risks are logged and followed-up in a Risk Log. In each TT meeting, the team must:
* check and update the status (to do, in progress, done) of previousuly assigned risks
* identify new risks (if any) and the affected area (Schedule, Budget, Resources, Quality, Reputation)
* assess their risk level
* assign them (RASCI) for resolution/mitigation by specific actions

The risk level will be calculated by the product of likelihood and impact using the following risk matrix:  
Depending on the risk level, a different respose strategy should be adopted:

{| class="wikitable"
! Risk level !! Response strategy
|-
| High || AVOID: take immediate action that will eliminate the risk in entirety. Depending upon the circumstances, you may need to change project scope, modify project plans, hire additional resources, or adopt different technical solutions.
|-
| Medium || REDUCE: take action that will minimize the potential impact of any given risk through the analysis and consideration of alternative solutions. You can alter detailed plans and schedules, and take specific actions to minimize the chance that a risk will occur. And, you can also develop alternate measures to be enacted should the risk actually occur (contingency measures)
|-
| Low || ACCEPT: acknowledge the risk, but decide that any actions to avoid or mitigate the risk can be too costly or time consuming. Or, it may just be possible that the risk cannot be avoided or mitigated in any meaningful way, and the benefits of the project far outweigh the risks. A low-effort mitigation measure can be proposed just in case.
|}