Upload
ken-rubin
View
9.413
Download
4
Tags:
Embed Size (px)
DESCRIPTION
How applying core agile principles make the development process robust and at times antifragile to the disorder of uncertain events, allowing us to avoid harm and reap the benefits of uncertainty, without the need for heavyweight risk management processes. Many believe that agile is lacking because there is no formally defined risk-management process. To compensate for this “failing” some people introduce a heavyweight risk-management process. Others might not believe that any form of risk-management process is necessary; if a risk matures into a real issue, then just deal with the issue through the normal agile process. In my experience, organizations that successfully “manage” their risks don’t fall into either of these camps. In this presentation, I discuss how a large part of successful risk management in agile is applying core agile principles to prevent risks from occurring rather than using a complex process for dealing with the risks that easily could be avoided in the first place.
Citation preview
1 Copyright © 2014, Innolution, LLC. All Rights Reserved.
Agile IS Risk Management Agile 2014 Orlando, FL
July 29, 2014 by Ken Rubin
2 Copyright © 2007-2014, Innolution, LLC. All Rights Reserved.
Background of Ken Rubin Aut
hor
Trai
ner
Coa
ch
Exp
Trained more than 20,000 people
Coach developers and executives
1st Managing Director
1st Scrum project was in 2000 for bioinformatics
3 Copyright © 2014, Innolution, LLC. All Rights Reserved.
Agenda
Uncertain Events
Managing Risk via the Product Backlog
Maximize Expected Monetary Value
Using Agile to Avoid Some Uncertain
Situations
Traditional Risk Management
Agile Principle-based Risk Management
4
Some questions… and discussion…
Copyright © 2014, Innolution, LLC. All Rights Reserved.
We outsource stress-testing of our application to a third-party and there is a risk it won’t be done when promised. How do we handle this?
How do we manage the risks of a fixed-price contract?
Should we try to avoid the risk of building the wrong product by working longer and harder up front to get its specification right?
We lack knowledge to make an informed technical choice. So there is a risk of a bad decision. How should we proceed?
5
How to handle these risks — a roadmap for our discussion
Copyright © 2014, Innolution, LLC. All Rights Reserved.
When appropriate, apply simple traditional risk management techniques in a good-enough (barely sufficient) manner
Apply agile principles to avoid the self-creation of inherently risky or uncertain situations
Apply agile principles to avoid the harm (be robust) and reap the benefits (be antifragile) from uncertainty in the environment
Manage risk via the product backlog
6 Copyright © 2014, Innolution, LLC. All Rights Reserved.
Uncertain Events
7
Many words for the same concept
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Risk
Randomness
Volatility
Variability
Uncertainty
8
For our purposes we will treat them the same
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Lack of knowledge regarding uncertain events
9
Some more uncertain events
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Earthquake disables California data center housing the development servers
Vendor fails to deliver a component when promised
Application fails to scale to 10 million current users Users
10 Copyright © 2014, Innolution, LLC. All Rights Reserved.
Typical mental model of uncertain events
“Uncertain” event
Probability of
occurrence
Consequence (payoff / exposure function)
Impact of occurrence
sum of all
has a has
Cost Candidate action
Effectiveness
has
has
changes
changes
1..* Can influence
1..*
1..*
Expected monetary
value
used to compute
used to compute
Source: Based on paper by Jerry Gilland, Engineering Management Services, 1996.
11 Copyright © 2014, Innolution, LLC. All Rights Reserved.
Maximize Expected Monetary Value
12
We strive to maximize economic benefit
Copyright © 2014, Innolution, LLC. All Rights Reserved.
“Uncertain” event
Probability of
occurrence
Consequence (payoff / exposure
function) Impact of
occurrence
sum of all
has a
has
Cost Candidate action
Effectiveness
has
has
changes
changes
1..* Can influence
1..*
1..*
Expected monetary value
used to compute
used to compute
Our goal is to maximize the “economic benefit” in the presence of uncertainty
Given that uncertain events will occur…
13
Fragile, Robust, Antifragile
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Fragile
Harmed by disorder
Robust
Resilient to disorder
Antifragile
Benefits from disorder
Agile
Goal is not to eliminate uncertainty, risk, or variability, but to protect ourselves against the variability that harms us and to promote and exploit the variability that benefits us
Waterfall
14
Asymmetric payoffs create economic value or harm
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Positive asymmetric payoff (antifragile)
anything that has more upside than downside from random events
(variability)
Negative asymmetric payoff (fragile)
anything that has more downside than upside from random events
(variability)
Source: Taleb, Nassim, Antifragile: Things That Gain from Disorder, Random House, 2012.
15 Copyright © 2014, Innolution, LLC. All Rights Reserved.
Traditional Risk Management
16
Traditional risk management process
Identification
Qualitative Analysis
Quantitative Analysis Plan
Control
Copyright © 2014, Innolution, LLC. All Rights Reserved.
17
Example traditional risk-management artifacts
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Risk Prob Exposure Mitigation
0
20
40
60
80
100
0% 10% 20% 30% 40% 50%
Cos
t ($K
)
Probability %
1
2
3
4
5 6
7
8
9
10
Risk Management
Plan
18
Assumption – early on we can identify the uncertain events
Copyright © 2014, Innolution, LLC. All Rights Reserved.
19
Assumption – we can identify all uncertain events
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Large-scale unpredictable (or very hard to predict)
events of massive consequences
Source: Taleb, Nassim, The Black Swan: The Impact of the Highly Improbable Fragility , Random House, 2010.
20 Copyright © 2007-2014, Innolution, LLC. All Rights Reserved.
Assumption — we can accurately calculate probabilities
0
20
40
60
80
100
0% 10% 20% 30% 40% 50%
Cos
t ($K
)
Probability %
1
2
3
4
5 6
7
8
9
10
Assumes we can predict the probabilities
21
Example – we can predict the event, but we can’t predict or change probabilities
Copyright © 2014, Innolution, LLC. All Rights Reserved.
We can predict earthquakes will happen in California
We can’t predict the occurrence of a specific earthquake of a given magnitude, or change the
probability of it happening
We can describe the consequences to our business via a disruption in our California-based data center if we are affected by an earthquake
22
More sophisticated process does NOT solve these problems
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Mistaken belief that we need better computation in order to more accurately predict the event and figure out the probabilities
Better approach is to modify our exposure and learn to get out of trouble fast
23
So, do we employ traditional risk management in Agile?
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Like anything else in Agile, we would embrace the minimum (barely sufficient)
amount of process that would be sufficient for dealing with the risks in our particular
environment
Domains where human lives are at risk might choose to employ a more intense risk management process
24
Example of a simple risk
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Vendor might fail to deliver a component on a promised date
“Uncertain” event
Probability of
occurrence
Consequence (payoff / exposure
function) Impact of
occurrence
sum of all
has a
has
Cost Candidate action
Effectiveness
has
has
changes
changes
1..* Can influence
1..*
1..*
Expected monetary value
used to compute
used to compute
We can easily identify the uncertain event
We can derive a probability that isn’t too wrong
There are easily identifiable candidate actions
The consequences are well understood
25
Candidate action 1 – traditional risk management
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Send one or more of our employees to vendor to help expedite
Risk Prob Exposure Mitigation Vendor fails to deliver Component X
50% $1m/month Send Barbara to vendor to help expedite
Manage risk via lightweight traditional techniques
26
Candidate action 2 – also traditional risk management
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Pay expedited charge to move to head of queue
Risk Prob Exposure Mitigation Vendor fails to deliver Component X
50% $1m/month Pay more money to get head of queue privileges
Manage risk via lightweight traditional techniques
27 Copyright © 2014, Innolution, LLC. All Rights Reserved.
Managing Risk via the Product Backlog
28 Copyright © 2007-2014, Innolution, LLC. All Rights Reserved.
Value Cost
Dependencies
Knowledge
Risk
Resources
Risk as a factor in prioritization
29
Example: Develop email system for 10 million concurrent users
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Option 1 Option 2
Spend a lot of money early on to develop core and advanced email features
Then, perform scale-up testing late and hope it works
Run tests earlier to determine if scaling to 10m users is possible
Then, start building email features with confidence system will scale up to 10m users
30
Manage dependency risk via product backlog grooming
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Affects prioritization of other items in the product backlog
This feature is dependent on delivery of the component
Vendor might fail to deliver a component on a promised date
31
Manage risk by creating risk-mitigation items in product backlog
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Employ the parallel hedge strategy
Us Insert one or more product backlog items to develop the component ourselves
First to finish wins!
Partner
32 Copyright © 2014, Innolution, LLC. All Rights Reserved.
Using Agile to Avoid Some Uncertain
Situations
33
Some uncertain events can be avoided altogether
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Avoid the self-creation of inherently risky or uncertain situations
If we don’t go into space, we don’t have to worry about the risk that our spaceship could run out of fuel
Fixed
Fixed Fixed
Contract If we don’t write fixed price subcontracts, we can avoid the risks of fixed price contracts!
34 Copyright © 2014, Innolution, LLC. All Rights Reserved.
Effort saved not having to “manage” uncertain events
“Uncertain” event
Probability of
occurrence
Consequence (payoff / exposure
function) Impact of
occurrence
sum of all
has a
has
Cost Candidate action
Effectiveness
has
has
changes
changes
1..* Can influence
1..*
1..*
Expected monetary value
used to compute
used to compute
Think of the effort saved if we end up injecting less uncertain events into our environment!!!
The art of maximizing the amount of work
not done!
35 Copyright © 2014, Innolution, LLC. All Rights Reserved.
Exercise – identifying uncertain events avoidable by Agile
What are some known risks or uncertainties that we can avoid just by applying Agile
development?
36 Copyright © 2014, Innolution, LLC. All Rights Reserved.
Agile Principle-based Risk Management
37
Applying agile principles to be robust and antifragile
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Applying agile principles make the development process robust and at times
antifragile to the disorder of uncertain events, allowing us to avoid harm and reap the
benefits of uncertainty, without the need for heavyweight risk management processes
38 Copyright © 2014, Innolution, LLC. All Rights Reserved.
Failure to Apply Scrum Principles Throughout the
Value Chain
Variability and Uncertainty
39 Copyright © 2014, Innolution, LLC. All Rights Reserved.
All before any is “risk generating”
All-Before-Any: assumes all” of one
activity can be completed before any of the next activity begins
40
Iterative & incremental is antifragile
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Get things wrong before we get them right
Build some of it before we build all of it
Reduces forecasting errors
Offers opportunity for continuous deployment
41
Inspect and adapt is antifragile
Copyright © 2014, Innolution, LLC. All Rights Reserved.
42 Copyright © 2014, Innolution, LLC. All Rights Reserved.
Failure to Apply Scrum Principles Throughout the
Value Chain
Prediction and Adaptation
43
Risk of trying to get it right upfront
Copyright © 2014, Innolution, LLC. All Rights Reserved.
44
Keep options open (last responsible moment)
Copyright © 2014, Innolution, LLC. All Rights Reserved.
45
Exercise – Architecture A vs. B
Copyright © 2014, Innolution, LLC. All Rights Reserved.
First day of a new product development effort. There are two architectural choices: A or B. Each appears to have viable characteristics. Which one
should we select?
46
Rapidly intermingle exploration and exploitation to address uncertainty
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Knowledge acquisition Predicting
Exploration Exploitation always a tension between
requires involves
in the presence of
Uncertainty Uncertainty
in the presence of
increases
Level of certainty
does not increase
Adaptive processes
Predictive processes
heavily focus on early
interleave small-scale
47
Real options
Copyright © 2014, Innolution, LLC. All Rights Reserved.
The right but not the obligation to do something
Options have value
Options expire
Never commit early to an option unless we know why
48
Managing change risk during a traditional development project
Copyright © 2014, Innolution, LLC. All Rights Reserved.
49
Managing change risk using Scrum
Copyright © 2014, Innolution, LLC. All Rights Reserved.
50 Copyright © 2014, Innolution, LLC. All Rights Reserved.
Failure to Apply Scrum Principles Throughout the
Value Chain Validated Learning
51
Assumptions = accrued risk
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Assumption is a guess or belief that is assumed true, real, or certain
Not-yet-validated assumptions represent significant accrued risk during development
Don’t let important assumptions live long without validation
52
Reduce risk by going fast through the loop
Copyright © 2014, Innolution, LLC. All Rights Reserved.
53
Organize flow of work for fast feedback
Copyright © 2014, Innolution, LLC. All Rights Reserved.
54
Fast feedback is antifragile
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Agile benefits from the uncertainty (unpredictable things we learn) in fast, frequent feedback
Learn fast we are going down the wrong path and then truncate the path
Exploit newly acquired knowledge to realize an emergent opportunity
Asymmetric payoff by limiting downside harm and providing much greater upside potential
55 Copyright © 2014, Innolution, LLC. All Rights Reserved.
Failure to Apply Scrum Principles Throughout the
Value Chain
Work in Process (WIP)
56
Use economically sensible (typically smaller) batch sizes
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Reduced cycle time
Reduced flow variability
Accelerated feedback
Lower risk of failure
Reduced overhead
Increased motivation & urgency
Reduced cost and schedule growth Source: Reinertsen, Donald, The Principles of Product Development Flow: Second Generation Lean Product Development, Celeritas Publishing, 2009.
57
Inventory (WIP) represents a significant economic risk
Copyright © 2014, Innolution, LLC. All Rights Reserved.
58 Copyright © 2014, Innolution, LLC. All Rights Reserved.
Failure to Apply Scrum Principles Throughout the
Value Chain Planning Risks
59
Belief that loading planning on the front-end reduces risk
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Better the planning the better the understanding and therefore the better the execution
Give appearance of orderly, accountable, and predictable approach
Developing a product rarely goes as planned
Beliefs don’t match uncertainty in product development
60
Scope is the risk-reducing degree of freedom
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Scope can be binary
Scope can be shades of grey
Allows us to bound the downside on the asymmetric payoff function
61
Communicate uncertainty with range answers to questions
Copyright © 2014, Innolution, LLC. All Rights Reserved.
62
Teams with T-Shaped skills
Copyright © 2014, Innolution, LLC. All Rights Reserved.
Can offset random increases in demand by quickly compensating with changes in capacity
Example of negative covariance or counter balancing. Changing capacity available to do work a given vertical area (a change in one random variable) counterbalances the variability in demand (a change in a second random variable)
63 Copyright © 2014, Innolution, LLC. All Rights Reserved.
Contact Info for Ken Rubin
Email: [email protected] Website: www.innolution.com Phone: (303) 827-3333 LinkedIn: www.linkedin.com/in/kennethrubin Twitter: www.twitter.com/krubinagile Facebook: www.facebook.com/InnolutionLLC Google+ plus.google.com/+KennyRubin1/ Essential Scrum: A Practical Guide to the Most Popular Agile Process
www.essentialscrum.com
Comparative Agility Website www.comparativeagility.com