I use a three point scale assigning risk to tasks, most often a feature to be developed at Code and Effect. Each task is assigned a 1, 2, or 3 risk.
Note: I saw this concept on a developer's personal blog some years ago but have not been able to track it down... shoot me a link if you know the source so I can credit it!.
A task that I have completed many times before and can do without hesitation again.
- I have no confusion, unknowns, or uncertainty about what needs to be done or how I should go about it.
- For the type of projects I work on, ~75% of tasks are a 1 risk.
- e.g. Add a Google Analytics tracking snippet to a project.
I've done something similar to this task before but not exactly the same.
- Anything where I need to reference documentation in order to start.
- Anything where I want to give a firm price but am certain there will be back and forth / revisions.
- If there is any uncertainty about a task, it's a 2 risk.
- For the type of projects I work on, ~15% of tasks are a 2 risk.
- e.g. Create a complex nested/dynamic form.
A task where I've never completed something similar to it before.
- If I need to make some Google searches before even estimating the effort, it's a 3 risk.
- If I can't get a clear requirement out of my client, it's a 3 risk.
- For the type of projects I work on, ~10% of tasks are a 3 risk.
- e.g. Integrate with a third party API for the first time.
Why a three point scale?
- It's easy to understand and apply in a variety of situations.
- It’s a “good enough” despite being simple and fast to use.
How should I use this risk?
- Use it to communicate uncertainty to stakeholders.
- Use it to identify less-risky alternatives.
- Use it to calculate an hours to implement as per Hours = (Effort * Risk).
- Use it to make (Quality*Scope)=(Resources*Time) decisions
When should I assign risk?
Assign risk whenever a new task is added to a project. It will have a huge impact on the cost and schedule, and only takes a moment. It feels good when a bad feature is eliminated because of the high risk!
Should I show risk to stakeholders?