What is the Risk Management Game?
The risk management game is a collaborative way for your team to identify risks that you face, categorize those risks based on impact and probability, and determine which risks to address first.
The game was originally created by Ken Clyne based on Steve Bockman’s Team Estimation game.
Here’s an example of a chart that your team may come up with while applying the risk management game at the beginning of an initiative.
You can also find a description of how the risk management game came about and was used to aid release planning in this writeup from Ken Clyne’s and Julie Chickering’s session at Agile2011.
When to Use The Risk Management Game
There’s a variety of occasions where it makes sense to use the risk management game:
- At the start of a new project to identify the risks a team faces across the entire project
- At the start of work on a new product to identify the risks that exist with introducing the product
- During release planning, either the first release or a subsequent one, honing in on the risks in that particular release
- When resetting a project. Your team may find the risk management game a good way to reflect on where you’re currently at and what risks you face going forward.
Why Use the Risk Management Game
There are a variety of reasons why the risk management game may be a useful technique for you.
- The collaborative nature of the activity helps your team ensure that you get a broad based catalog of the risks your team faces.
- The discussion of impact and probabilities of the risks your team faces helps your team build a shared understanding of those risks.
- The heuristic of which risks to address first gives your team a way to structure your planning discussions.
How to Use The Risk Management Game
Identify Risks
- Gather your team together. Include stakeholders and sponsors in this discussion if they are available.
- Meet in front of a white board with sticky notes and sharpies.
- Have everyone start writing risks on the sticky notes, one risk per note. Allow for about 5 minutes for this activity.
- Have a volunteer read off their risks one by one and place them on the white board.
- Have another volunteer read off their risks and put the sticky notes on the white board. If they identified an identical risk to one that has already been listed, the volunteer should place that note on a note that already exists on the white board.
- Continue step 5 until all the risks are on the white board.
- Have the group gather at the white board and look through all of the risks, grouping together any duplicates that haven’t already been identified.
Categorize Risks
- Gather the sticky notes together and put them in a pile.
- Draw a pair of Axises on the white board X Axis is impact, Y Axis is probability.
- A volunteer takes the first sticky note off the pile and places it on the white board in relative position based on its anticipated Probability and Impact.
- The next volunteer has three options:
- Place the next risk on the board relative to the first one
- Move an existing risk somewhere else on the board. If the team member chooses this option they should explain why they are moving the risk.
- Pass – this choice should really only be used when the number of sticky notes is getting low.
- Place the next risk on the board relative to the first one
- Move an existing risk somewhere else on the board. If the team member chooses this option they should explain why they are moving the risk.
- Pass – this choice should really only be used when the number of sticky notes is getting low.
- Repeat Step 4 until all the risks have been placed on the board and everyone has passed.
Address The Risks
- Identify the risks that exists in the upper right hand quadrant of the chart. Those are the risks that you should address first.
- Discuss each of those risks and identify a plan to address. The plan will most likely take one of the following forms:
- Avoid – Take steps to ensure that the risk does not happen.
- Transfer – Find someone outside the team who is better positioned to take care of the risk
- Accept – Realize that you have done all you can to address the risk. Take no action and be comfortable with the results.
- Mitigate – Take steps to reduce the impact and/or probability of the risk.
- Avoid – Take steps to ensure that the risk does not happen.
- Transfer – Find someone outside the team who is better positioned to take care of the risk
- Accept – Realize that you have done all you can to address the risk. Take no action and be comfortable with the results.
- Mitigate – Take steps to reduce the impact and/or probability of the risk.
- For each risk, a team member should volunteer to own that risk (make sure it is getting addressed) and by when so that the team knows when to check back to verify if the risk has been addressed.
Caveats and Considerations
You may find that the risks take a while to settle into a final spot as team members move them back and forth when it comes their turn. Let your team work through this divergence in the group and allow them decide when it is time to stop moving risks. You’ll find that the conversation on these “controversial” risks is important to make sure there’s a shared understanding about the nature of those risks.
If you have remote participants divide the matrix up into a grid, number each square and have each team member indicate which tell you in which square to place the risk. Display the grid electronically so that the participants in the room and remotely see the same visual.
You may want to think about how much conversation occurs during the game. The conversation is important to get thoughts out of people’s heads and to build a shared understanding, but too much conversation can slow progress down to no good purpose. I’ve found that if you have people who like to think out loud to let them voice their reasoning as to why a risk should go some where, but don’t allow challenges to that placement. Instead tell the team that they can move a risk they don’t agree with when it’s their turn and express why they are moving it. When I’ve used this approach, the team quickly falls into agreement with that approach, but when someone places a risk that others don’t agree with, you’ll often hear noises such as “hmmm….” or sharp intakes of breath which provide good signals that others may disagree.
You may find that some on your team want to quantify the risks. Avoid that temptation during the playing of the game as you can get enough information to determine which risks to focus on based their relative impact and probability.
Make sure that your team gets all the way through establishing plans to address the risk and that each plan has an owner. The time spent identifying and categorizing risks is wasted if you don’t have an idea of what you are going to do about the risks.
Your team should play the full risk management game as close to the beginning of your effort as possible. You’ll want to hang on to a representation of the risk’s position relative to probability and impact and revisit the risks on a regular basis. So if your team is following a regular release cycle, you may want to revisit the risks at every release. When you revisit the risks you may find yourself moving the risks off the board entirely or moving them to reflect where their impact and probability exists based on actions you’ve taken. When you revisit risks, you may find that you need to identify new risks, and that the nature of risks that you haven’t done anything about yet may have changed through other means.
Additional Resources
Risk Management Game: Shared Accountability Through Collaborative Risk Analysis. Ken Clyne and Julie Chickering Agile2011