Risk-Free Development

it’s just a jump to the left

Risk is a funny thing. We let it influence so much of what we do and yet we barely understand what it is. For example, we might choose not to build a particular product, or add a new feature, because “it’s too high risk” (and yet we laud start-ups who did it anyway). We hold very long meetings to create plans and tracking systems and RAID logs to identify and notify risks and then we create mitigation actions to manage them.

But what is risk?

What does it even mean to manage risk? Is the concept of risk always a bad thing? Or can we use it to our advantage? Is risk even real in the important sense?

The dictionary defines risk as “the possibility of something bad happening” or “exposure to the chance of injury or loss.” It lives in the world of probabilities and perception. Unfortunately, people are not great when it comes to perceiving probabilities.

Imagine a map. On that map is the starting point of your next software delivery. We want to plot a path to a point on the map where the product has been delivered successfully. Along the way, there are turnings to the left and right that lead to bad outcomes. They are not risks. They are decisions we will make to take a different route. More than one route leads to success. We are human so we probably won’t take the most efficient route because we can’t see the whole map ahead of time. Equally, if we see a turning marked “guaranteed failure” we are not going to take it. At each junction, we will choose the best path based on everything we know at that moment. Some choices will prove to be poorer than others after the fact.

Risk in this model is hard to see. It’s just a series of choices where some lead to failure and some lead to success. And that’s kind of the point. Is there any benefit to us sitting down before we embark on the journey to list all the risks? We might fall into a lake. We might get eaten by the dreadful spindly killer fish. But we’re not taking turns where we know that’s the outcome. And yet it’s not risk-free because we could take a route that looks perfectly safe and experience a randomly selected earthquake. Ah. Risk of earthquakes ahead!

In Beating the Odds When You Launch a New Venture, Clark Gilbert and Matthew Eyring identified three kinds of risk.

Types of Risk

Easy-Win Risk

Some risks are fairly obvious. On our journey, if we don’t have good shoes and snacks there’s a risk we won’t make it. These are easy-win risks because they can be addressed through preparation and experience. Preparation might be shoes, snacks, doing a course on map-reading or buying spindly killer fish repellent. And experience can be actual (assign a leader who’s traversed a similar landscape before) or simulated by experiment (take some similar zero-risk journeys first, test our shoes out).

Path-Dependent Risk

Our map, as we’ve just discovered, contains path-dependent risks. If we go one way it’s firm and stable. Go another and there may be earthquakes. Not always, just maybe. Path-dependent risks won’t kill us if we encounter them, but they will delay us and cost us more money. Choosing the right path is very important.

Deal-Killer Risks

A deal-killer risk is just that: if it comes to pass it’s game over. On our map, it could be a path with no onward route to the destination, or we get to the end and someone else got there first. Or, as is the case for software products, we do get there and it turns out no one wants what we built.

Risk Management

Not all risks are clear-cut but you can see from this summary that we can pretty much ignore easy-win risks because it would be foolish not to deal with them, both before we start and along the way.

Path-dependent risks are interesting because, whilst we can’t ignore them, we can pre-emptively reduce the impact they’ll have if they do come true. If we know there might be earthquakes we can train for them, making the earthquake route less of an issue. If we don’t know which path has earthquakes and which doesn’t that’s actually all we can do.

Deal-killer risks are different. We can’t avoid them, but we can use them. Gilbert and Eyring use the example of building an e-commerce website. Path-dependent risks are the product mix you sell (sell the wrong ones and it’s expensive to change but not impossible). A deal-killer risk is that there’s no demand for your site at all. If you build it, market it, drive traffic to it, and still no one buys, you’ll be packing up and going home. That’s not something to find out after the investment has been spent. The good news is you can run cheap experiments to find out before you start (which is why product management thinking is so important)).

An important point here is that no Risk Management Strategy has ever actually avoided risk. Risks are an intrinsic part of product delivery that become real because we didn’t pick off the easy-win risks, train for the path-dependent risks or squash the deal-killer risks. Having risks itemised in a spreadsheet on the side helps no one.

But Is Risk Real?

Paul Slovic is professor of psychology at the University of Oregon and studies risk for a living. He is also the president of Decision Research, an organisation of scientists that investigates how humans make decisions and judgements when influenced by perceived risk.

He wrote an article in 2010 called The Psychology of risk from which this quote is taken:

Risk does not exist “out there,” independent of our minds and cultures, waiting to be measured. Instead, human beings have invented the concept to help them understand and cope with the dangers and uncertainties of life.

Although these dangers are real, there is no such thing as “real risk” or “objective risk”

Logically, this makes sense. Earthquakes are real. My earthquake on the map is a potential danger. There may be a parallel universe where the time the earthquake will strike can be calculated but it’s not this one. All we have to go on here, at best, is a calculated probability, which could never be called real or objective risk.

Emotionally though it’s a different story. In Dan Garder’s book Risk, he talks about the Availability Heuristic, which is basically the human tendency to assign higher priority to things it can recall easily. Like earthquakes. The safest time, earthquakewise, is right after an earthquake has just happened. Logic would therefore say that the worst time to buy earthquake insurance would be when you just had one. And yet, not surprisingly, earthquake insurance sales go up after earthquakes, because people who have just experienced one do not have much trouble recalling the experience, and need to regain a small sense of control.

Luckily tech builds don’t involve earthquakes, but the principle is the same. Read a lot of stories about tech disasters, news of layoffs, talk to project managers just after they leave the CEO’s office, and there’s quite a bit more emotion in the air.

Our chimp brain gets very excited when emotion is in the air, especially threatening emotion. You only needed to take a walk through a supermarket during the early weeks of covid to see how irrationally people respond to threat emotions.

If we can’t produce real objective risk with the logical, calm, rational side of our brain then our chimp system takes over. The way to combat this is with trust.

Trust & Optimism

Trust

Professor Steve Peters in The Chimp Paradox talks about the Computer Brain storing our beliefs and experiences which we defer to when the chimp gets overly excited.

When my chimp brain harasses me late at night about the potential failure of a project I can refer it to my Computer Brain which holds experiences where project threats have been overcome. My belief is therefore that, whatever might come my way, I can deal with it. Because I have done so in the past. I trust my experience and the process. I know the process is to run hundreds of experiments, have constant wide-ranging debates in the team about the next turn to take, look for data, build (and challenge) arguments based on it and create automated tests for the million things we’ll forget a month from now.

And thus, there is no risk. Or rather, there are risks but trust neutralises them.

Trust is key. Both in ourselves and our teams. And consistently maintaining trust is even more important. As Paul Slovic noted in The Psychology of Risk:

One of the most fundamental qualities of trust has been known for ages. Trust is fragile. It is typically created rather slowly, but it can be destroyed in an instant by a single mishap or mistake. Thus, once trust is lost, it may take a long time to rebuild it to its former state. In some instances, lost trust may never be regained.

Optimism

Build experience and nurture those positive beliefs and you get trust, which leads to optimism.

When faced with fears that might make us too risk-averse, optimism is the antidote. Daniel Kahneman, whose book Thinking Fast and Slow eerily mirrors The Chimp Paradox (they were published within months of each other, so would have been written contemporaneously), talks a lot about optimism. He called it the “engine of capitalism” (although given that 90% of start-ups fail we don’t want too much of it).

Once you are on the journey, the teams that have the best culture and solve the problems more efficiently are the optimistic ones. As Kahneman says:

Optimistic people play a disproportionate role in shaping our lives. Their decisions make a difference; they are inventors, entrepreneurs, political and military leaders - not average people. They got to where they are by seeking challenges and taking risks

So there you have it. Risk, as we think about it, isn’t as real as we might believe. It’s useful to worry about things going wrong but we need to temper that with all the tools we have to calm the worry. The chimp brain has its uses when paired with the positive beliefs and experience of our computer brain because it leads to trust in the process and optimistic confidence. It’s not reckless optimism. It’s the balanced, quiet, confident kind that comes from knowing you can respond to adverse change quickly.

Notes

• The picture is called “The Tightrope Walker” and is by Roberto Weigand. You can buy his art at his Deviant Art Shop.

• The subtitle, “Nothing In Life Is As Important As You Think It Is, While You Are Thinking About It” is from Daniel Kahneman’s essay Focusing Illusion . The exception to this being if you are thinking about an earthquake you are experiencing right now.