# Risk Storming

**In short:** Risk storming is a quick, collaborative way to find and show risks in an architecture. The team rates each risk by probability and impact, then tackles the highest-priority ones first.

## Explanation

Risk storming is a quick technique for identifying and visualizing risks together as a group. Simon Brown created it.

The team works from architecture diagrams. The method recommends the C4 model for these (see the article C4 Model).

**Rating risks**

Each risk gets two ratings: how likely it is (probability) and how bad it would be (impact). A rating can be low, medium or high. It can also be a number, such as 1-3 or 1-5.

**Prioritizing and acting**

The ratings let the team rank the risks. The team then works on the highest-priority risks first.

Mitigation means reducing a risk. Examples are training sessions, refactoring and new processes. Each task gets an owner and a schedule.

**Link to arc42**

Section 11 of arc42 holds a list of technical risks and technical debts, ordered by priority. It also suggests listing measures to minimize, mitigate or avoid each risk. A risk storming result fits there.

## Example

A team draws a C4 diagram of an online shop. Each member marks the spots that worry them. Several people mark the connection to the payment provider. The team rates it medium probability and high impact, and ranks it near the top. They schedule a task to reduce the risk. The risk and its planned measure go into the risk list.

## Trade-offs

The sources describe risk storming as quick. They say little about how deep it goes, so look at other evaluation methods if you need more depth. The facts here do not compare it with those methods.

Generic risk storming flow

```mermaid
flowchart LR
 A[Architecture diagrams] --> B[Identify risks]
 B --> C[Rate probability and impact]
 C --> D[Prioritize]
 D --> E[Mitigate highest first]
 E --> F[Risk list]
```

## Checks

- Each identified risk has a probability and an impact rating, on a low/medium/high or numeric scale.
- The risk list is ordered by priority.
- Each high-priority risk has a mitigation measure, with tasks assigned and scheduled.

## Related

- [C4 Model](https://arc.fuet.ch/concepts/documentation/c4-model.md)
- [Software Architecture Evaluation](https://arc.fuet.ch/concepts/evaluation/software-architecture-evaluation.md)
- [Architecture Tradeoff Analysis Method (ATAM)](https://arc.fuet.ch/concepts/evaluation/architecture-tradeoff-analysis-method-atam.md)
- [Technical Debt](https://arc.fuet.ch/concepts/evaluation/technical-debt.md)
- [Risk Identification and Safe Integration](https://arc.fuet.ch/concepts/quality-attributes/risk-identification.md)
- [Lightweight ATAM](https://arc.fuet.ch/concepts/evaluation/lightweight-atam.md)

## Sources

- [Risk-storming](https://riskstorming.com) — riskstorming.com, accessed 2026-11-09
- [Risk storming](https://icepanel.io/blog/risk-storming) — icepanel.io, accessed 2026-11-09
- [11 - Risks and technical debt | arc42 Documentation](https://docs.arc42.org/section-11/) — docs.arc42.org, accessed 2026-11-09