A Simple Scenario
In this section, I'm going to introduce some terms for thinking about risk.
Lets for a moment forget about software completely, and think about any endeavour at all in life. It could be passing a test, mowing the lawn or going on holiday. Choose something now. I'll discuss from the point of view of "cooking a meal for some friends", but you can play along with your own example.
Now, in this endeavour, we want to be successful. That is to say, we have a Goal In Mind: we want our friends to go home satisfied after a decent meal, and not to feel hungry. As a bonus, we might also want to spend time talking with them before and during the meal. So, now to achieve our Goal In Mind we probably have to do some tasks.
Since our goal only exists in our head, we can say it is part of our Internal Model of the world. That is, the model we have of reality. This model extends to predicting what will happen.
If we do nothing, our friends will turn up and maybe there's nothing in the house for them to eat. Or maybe, the thing that you're going to cook is going to take hours and they'll have to sit around and wait for you to cook it and they'll leave before it's ready. Maybe you'll be some ingredients short, or maybe you're not confident of the steps to prepare the meal and you're worried about messing it all up.
These nagging doubts that are going through your head I'll call the Attendant Risks: they're the ones that will occur to you as you start to think about what will happen.
When we go about preparing this wonderful evening, we can choose to deal with these risks: shop for the ingredients in advance, prepare parts of the meal, maybe practice the cooking in advance. Or, we can wing it, and sometimes we'll get lucky.
How much effort we expend on these Attendant Risks depends on how big we think they are. For example, if you know there's a 24-hour shop, you'll probably not worry too much about getting the ingredients well in advance (although, the shop could still be closed).
Hidden Risks
There are also Hidden Risks that you don't know about: if you're poaching eggs for dinner, perhaps you don't know that fresh eggs poach best. The difference is, Attendant Risks are risks you are aware of, but can't be sure of the amount they will impact you. Hidden Risks are ones you are unaware of.
Donald Rumsfeld famously called these "Unknown Unknowns".
Different people evaluate risks differently, and they'll also know about different risks. What is an Attendant Risk for one person is a Hidden Risk for another.
Which risks we know about depends on our knowledge and experience, then. And that varies from person to person (or team to team).
As the dinner party gets closer, we make our preparations, and the inadequacies of the Internal Model become apparent, and we learn what we didn't know. The Hidden Risks reveal themselves. Other things we were worried about don't materialise. Things we thought would be minor risks turn out to be greater.
Our model is forced to Meet Reality, and the model changes. We may be forced to take further, mitigating actions to deal with these new risks, as shown in this diagram.
If we had a good Internal Model, and took the right actions, we should see positive outcomes. If we failed to manage the risks, or took inappropriate actions, we'll probably see negative outcomes.
Here, we've introduced some new terms that we're going to use a lot: Meet Reality, Attendant Risk, Hidden Risk, Internal Model and Goal In Mind. And, we've applied them in a simple scenario.
But Risk-First is about understanding the risks in the software process, so let's examine the scenario of a new software project, and expand on the simple model being outlined above: instead of a single person, we are likely to have a team, and our model will not just exist in our heads, but in the code we write.
On to Development Process...
