How do Agile Organizations Manage Risks: An Analysis of the State of Practice in Brazil

The use of agile methods tends to keep risks under control in software projects, due to their inherent characteristics of small increments, work visibility and expectation management. Thus, explicit risk management in agile projects has often been neglected, as the use of agile methods, with a focus on rapid value delivery, tends to lead to implicit risk management. However, software projects that use agile methods also can fail and implicit risk management may often not be sufficient for certain contexts. This has sparked research interest in the possible need for explicit risk management in software organizations that use agile methods. Motivated by the lack of information about risk management in agile software development contexts, in this work a comprehensive survey is carried out to understand how software development organizations that use agile methods are managing risk. We conducted an online survey with a statistically significant sample of 273 agile professionals in Brazil. Our findings indicate that although most organizations engage in some form of explicit risk management, a significant proportion consider agile methods insufficient for comprehensive risk mitigation. We also observed a set of 15 explicit risk management practices in agile contexts, with some agile ceremonies, notably daily and sprint planning meetings, emerging as conducive to the integration of explicit risk management practices. We also verified a statistically relevant association between these agile ceremonies and risk management processes.