As Ops and DevOps leaders we tend to focus on risks. We shoulder the burden of unmitigated risk. We lose sight of probability and cost. These slides outline a way to approach risk in a small company that builds shared accountability across all teams. Everyone is aware of the risks, everyone is aware of the choice to accept them. Everyone sleeps a bit better.

1. How to prioritize non-functional work
Risk is not Fear Boyd E. Hemphill - CTO
Victory CTO

2. Risk is Not Fear
Premise
Even though we deal with risks regularly, we
do not have a basic framework to assess
them and prioritize work generated from
them.
Worse … We as operations personnel tend to
“sell fear” in order to get time to perform
critical non-functional work.
“If the database crashes, then we will be
down for x hours, “ is a classic example.

3. Naive but Effective Starting
Point

4. Risk is (almost) Probability v.
Impact

5. Create a List of Risks
❖ Brainstorming - List your risks.
❖ Get into groups - Break down
each risk into discrete (non-
dependent) tasks
❖ Create a set of index cards
with each task. Extra credit for
color coding them in groups of
tasks.

6. Assemble the Right
Stakeholders
❖ Execs
❖ Product Managers
❖ Engineers
❖ Security
❖ Compliance

7. Wisdom of the Crowd
Exercise

8. Play Poker
❖ Each player holds 10 cards. 5 black
(impact) 5 red (probability)
❖ Use a regular deck.
❖ For each task, ask stakeholders to
“bid” impact and probability. Record
the results on a board on the matrix.
❖ A Lean Coffee style discussion is
great here to ensure the group
comes to agreement.
❖ Consolidate the task into a square.
❖ Move to the next task.

9. Why Play Poker
❖ Wisdom of the crowd
❖ Each stakeholder scores the
task without influence.
❖ Discussion allows for quick
consolidation.
❖ Shared responsibility

10. Playing Poker
Exercise

11. The Missing Dimension

12. Cost
❖ If a project is high risk
and high probability it is
easy to think, “THIS
MUST BE DONE!”
❖ What if the cost of doing
the project is more than is
reasonably affordable.
❖ Cost is a critical factor.

13. Project Planning
❖ What is the definition of
“Done?”
❖ What discrete components of a
project have the largest
impact?
❖ What is the opportunity cost?

14. Steps to Evaluating Risk
❖ List your known risks.
❖ If you feel unsure, hire a consultant to help you identify
them on a short engagement.
❖ Break the large projects into smaller tasks but don’t get
bogged down in the details.
❖ Use Risk Poker to assign a schedule to your risks
❖ Evaluate Costs
❖ Get to work

15. –That Annoying Guy in the Back of the Room
“Did anyone notice this is the same exercise as
breaking down and scheduling feature
development?”

16. Colophon
❖ My favorite Risk Matrix.
❖ https://bit.ly/2FOOodq
❖ What if a Risk Matrix is too simple?
❖ https://bit.ly/2wp8aeE
❖ Planning Poker.
❖ https://bit.ly/2239bQn
❖ Lean Coffee Discussion Format
❖ https://bit.ly/1ThvY54
❖ Wisdom of the Crowd
❖ https://bit.ly/2ekz12n