Risk Management & Mitigation

Risk management is not about eliminating risk — it's about making informed decisions under uncertainty." — Barry Boehm ²

What is Software Risk?

Software risk encompasses any uncertain event or condition that, if it occurs, has a positive or negative effect on project objectives (scope, schedule, cost, quality). Unlike traditional project management, software risks are often:

Characteristic	Implication
Invisible	Code/logic flaws aren't visible until execution
Non-linear	Small changes can cause disproportionate failures
Emergent	System-level risks arise from component interactions
Knowledge-dependent	Risk decreases as team understanding increases

Risk Taxonomy

1. Technical Risks

Risk Category	Examples	Detection Approach
Architecture	Scalability limits, tight coupling	Architecture reviews, spike prototypes
Technology	Unproven framework, version incompatibility	Proof-of-concept, tech radar assessment
Performance	Latency, throughput, memory leaks	Load testing, profiling, benchmarking
Security	Injection, auth bypass, data leakage	Threat modelling, SAST/DAST, pen testing
Data	Migration failure, schema drift, loss	Data validation, backup/restore drills

2. Project Risks

Risk Category	Examples	Mitigation
Schedule	Scope creep, estimation error	Iterative delivery, buffer management
Resource	Key person departure, skill gaps	Cross-training, documentation, bus factor analysis
Stakeholder	Changing requirements, misaligned expectations	Regular demos, backlog grooming, clear Definition of Done
Dependencies	Third-party API changes, vendor lock-in	Abstraction layers, contract tests, exit criteria

3. Process Risks

Risk Category	Examples	Mitigation
Quality	Insufficient testing, technical debt	Definition of Done, automated gates, debt budgets
Communication	Silos, handoff delays, knowledge loss	Cross-functional teams, pairing, decision records
Compliance	Regulatory changes, audit failures	Compliance-as-code, automated evidence

Risk Identification Techniques

Technique	Best For	Effort
Pre-mortem	Project kickoff — imagine failure scenarios	Low
Risk Storming	Collaborative brainstorming with sticky notes	Low
Checklist Review	Standard risk categories (OWASP, SEI)	Low
Architecture Decision Records (ADRs)	Capturing rationale for key decisions	Ongoing
Dependency Mapping	Visualising external/internal dependencies	Medium
Threat Modelling (STRIDE)	Security-focused risk identification	Medium
FMEA (Failure Mode Effects Analysis)	Safety-critical systems	High

Risk Assessment Matrix

                    IMPACT
              Low     Medium   High
         ┌─────────┬─────────┬─────────┐
  High   │  Medium │  High   │Critical │
         ├─────────┼─────────┼─────────┤
    L    │  Low    │ Medium  │  High   │
  I       ├─────────┼─────────┼─────────┤
  K   Low │  Low    │  Low    │ Medium  │
  E       └─────────┴─────────┴─────────┘
            Low   Medium   High
           LIKELIHOOD

Quantitative Scoring (Example)

Likelihood	Score	Impact	Score	Risk Score = L × I
Rare (≤10%)	1	Negligible	1	1–3 = Low
Unlikely (10–30%)	2	Minor	2	4–6 = Medium
Possible (30–60%)	3	Moderate	3	7–9 = High
Likely (60–90%)	4	Major	4	10–12 = High
Almost Certain (>90%)	5	Catastrophic	5	15–25 = Critical

Mitigation Strategies

Strategy	When to Use	Example
Avoid	Risk > appetite, alternative exists	Don't use deprecated library
Reduce (Likelihood)	Can prevent occurrence	Code reviews, static analysis, CI gates
Reduce (Impact)	Can limit blast radius	Circuit breakers, feature flags, rollback plans
Transfer	External party better manages	Insurance, SLAs, managed services
Accept	Cost of mitigation > expected loss	Documented risk register entry

Rule of thumb: Mitigate risks scoring >= 8 (High); Accept with monitoring for 4–7 (Medium); Track only for <4 (Low).

Continuous Risk Management Loop

┌─────────────────────────────────────────────────────────────────┐
│                    CONTINUOUS RISK MANAGEMENT                   │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│   ┌────────────┐    ┌────────────┐    ┌────────────┐           
│   │  IDENTIFY  │───▶│  ANALYZE   │───▶│  PLAN      │           
│   │  (weekly)  │    │  (score)   │    │  (mitigate)│           
│   └────────────┘    └────────────┘    └─────┬──────┘           
│         ▲                                    │                 
│         │         ┌────────────┐             │                 
│         └─────────│  TRACK     │◀────────────┘                 
│                   │  (daily)   │                                  
│                   └────────────┘                                  
│                                                                 │
│   Artifacts: Risk Register → Sprint Planning → Retrospective   │
└─────────────────────────────────────────────────────────────────┘

Integration Points

Ceremony	Risk Activity
Sprint Planning	Review top-5 risks; assign mitigation tasks
Daily Standup	Surface new risks/impediments
Sprint Review	Demo risk mitigations (e.g., load test results)
Retrospective	Update risk register; celebrate mitigated risks
Release	Go/No-Go based on residual risk

Tools & Templates

Tool	Purpose	Link
Risk Register Template	Structured logging (ID, desc, L, I, owner, status)	Download
Risk Burn-down Chart	Visualise risk reduction over sprints	Excel/Sheets template
Jira/GitHub Labels	Tag stories with `risk:high`, `risk:tech-debt`	Native
Dependabot/Renovate	Automated dependency risk detection	GitHub/GitLab
OWASP Dependency Check	Known vulnerability scanning	OWASP

Case Study: Migrating Legacy Auth System

Phase	Risk Identified	Likelihood	Impact	Mitigation	Outcome
Analysis	Single-point-of-failure in legacy DB	High	Critical	Strangler Fig pattern; parallel run	Avoided
Design	Token format incompatibility	Medium	High	Dual-write period; adapter layer	Mitigated
Implementation	Session migration edge cases	High	Medium	Canary release; feature flag rollback	Mitigated
Cutover	User lockout during DNS swap	Low	Critical	TTL reduction; parallel auth window	Avoided

Result:: Zero-downtime migration; 3 risks mitigated, 2 avoided.

Resource	Type	Focus
Software Engineering: A Practitioner's Approach ¹	Textbook	Comprehensive risk chapters
The Risk-Driven Model ²	Paper	Foundational risk-driven SDLC
ISO/IEC 16085:2021 ³	Standard	International risk management process
Continuous Risk Management Guidebook ⁴	Guidebook	SEI's practical framework
Accelerate (Forsgren et al., 2018)	Book	Risk reduction via CI/CD & culture

References

Pressman, R.S. & Maxim, B.R. (2019). Software Engineering: A Practitioner's Approach (9th ed.). McGraw-Hill. Chapter 6: Risk Management. https://www.mhprofessional.com/software-engineering-a-practitioners-approach-9781259872976-usa ↩
Boehm, B. (1988). "A Spiral Model of Software Development and Enhancement." Computer, 21(5), 61–72. https://doi.org/10.1109/32.2346 ↩↩
ISO/IEC. (2021). ISO/IEC 16085:2021 — Systems and software engineering — Life cycle processes — Risk management. https://www.iso.org/standard/76624.html ↩
SEI Carnegie Mellon. (1996). Continuous Risk Management Guidebook. CMU/SEI-96-TR-011. https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=3385 ↩