Risk Management in Sprints
Risks are not surprises — they are predictions we ignored. In agile sprints, risk management is continuous, not a one-time kickoff activity.
Typical Sprint Risks
| Risk | Probability | Impact | Mitigation |
|---|---|---|---|
| Dependency on external team | High | High | Align before sprint |
| New technology | Medium | High | Technical spike |
| Key member absence | Low | High | Documentation and pair |
| Poorly defined requirements | High | Medium | Definition of Ready |
| Scope creep | Medium | Medium | Protect the sprint |
Risk-Adjusted Planning
When planning the sprint, for each item:
- Identify risks — “What could go wrong?”
- Assess probability — Low/Medium/High
- Assess impact — In additional effort points
- Calculate risk score — Probability x Impact
- Add buffer — high-risk items get +20-50% estimate increase
Example
| Item | Base Estimate | Identified Risks | Adjustment | Final Estimate |
|---|---|---|---|---|
| Integration API | 5 points | Unstable API (High, +3pts) | +60% | 8 points |
| Admin CRUD | 3 points | None | 0 | 3 points |
| Data migration | 5 points | Inconsistent data (Medium, +3pts) | +60% | 8 points |
Risk Board
Maintain a visual board of risks for the current sprint:
🔴 High: Partner API without sandbox
🟡 Medium: Maria (sole module owner) is on vacation week 3
🟢 Low: Design might delay by 1 dayReview during Daily: “Has any risk materialized? Any new risks appeared?”
Risk Mitigation
Technical Spike
“We don’t know if the API can handle our load → 2-day spike to test.”
Pair Planning
“This task is complex and only one person knows it → pair from planning.”
Feature Flags
“If the migration fails, we disable the feature flag.”
Contingency Buffer
“Reserve 10-15% of capacity for risks that materialize.”
Risks You Don’t Mitigate: Accept
If a risk has low probability and low impact, accept it. Don’t spend more time managing the risk than the risk itself is worth.
Risk Retrospective
At the end of the sprint:
- Which risks materialized?
- Which risks did we not foresee?
- Did our mitigations work?
- What should we adjust for the next sprint?
Conclusion
Risks in sprints are manageable with visibility and foresight. Identify them in planning, monitor in dailies, and learn in the retrospective. An identified risk is an avoided problem.