I sometimes wonder; why is product risk not more in focus in many projects? As I see it everything starts with risk… Product risks and project risks – we cannot plan a project or testing in a proper way without identifying and analyzing the risks at hand. Identifying and estimating product risk is an important activity that requires a human effort, and more than that – it requires human interaction and should always be done as a group effort, it is not just a question about giving the risks some abstract number and putting them in a spreadsheet.
There are different approaches to risk analysis for testing, but here comes a couple of favorites; The Product Risk Analysis (PRA) from TMap and the classical risk graph with impact and probability created during a brainstorming session.
So why is PRA so fantastic? Well it makes people talk! When you conduct the PRA as a workshop you will discuss scope, clarify what is going to be done and communicating that within a workshop with relevant stakeholders present. You will focus on the quality attributes affected by the risk, and the consequence if the risk should indeed occur. Of course the outcome is important – that’s our foundation for the test strategy, but the workshop alone adds so much value for the team, not only for the testers. PRA can be used on many different levels; for a product, for a release, for a sprint maybe even for a feature. Maybe use some of the principles but tailor the “process” to the context you are in.
In some you can choose to use the classical risk graph instead – just a graph with impact up the y-axis and the likelihood out the x-axis, drawn on a whiteboard. The risk identification process will then be a brainstorming session with the team where risks are written on post-its and presented to the team while placing them on the graph. Again the communication and clarification is in focus, but also the visualization of the identified product risks.
The main thing is: think and talk about product risks – use them as a basis for your planning, your strategies.