Skip to content
Software Architecture Guide

Risk Storming

Explanation

Section titled “Explanation”

Risk storming is a quick technique for identifying and visualizing risks together as a group. Simon Brown created it.

The team works from architecture diagrams. The method recommends the C4 model for these (see the article C4 Model).

Rating risks

Each risk gets two ratings: how likely it is (probability) and how bad it would be (impact). A rating can be low, medium or high. It can also be a number, such as 1-3 or 1-5.

Prioritizing and acting

The ratings let the team rank the risks. The team then works on the highest-priority risks first.

Mitigation means reducing a risk. Examples are training sessions, refactoring and new processes. Each task gets an owner and a schedule.

Link to arc42

Section 11 of arc42 holds a list of technical risks and technical debts, ordered by priority. It also suggests listing measures to minimize, mitigate or avoid each risk. A risk storming result fits there.

Example

Section titled “Example”

A team draws a C4 diagram of an online shop. Each member marks the spots that worry them. Several people mark the connection to the payment provider. The team rates it medium probability and high impact, and ranks it near the top. They schedule a task to reduce the risk. The risk and its planned measure go into the risk list.

Trade-offs

Section titled “Trade-offs”

The sources describe risk storming as quick. They say little about how deep it goes, so look at other evaluation methods if you need more depth. The facts here do not compare it with those methods.

Generic risk storming flow

Diagram source 
flowchart LR
 A[Architecture diagrams] --> B[Identify risks]
 B --> C[Rate probability and impact]
 C --> D[Prioritize]
 D --> E[Mitigate highest first]
 E --> F[Risk list]

Checks

Section titled “Checks”
  • Each identified risk has a probability and an impact rating, on a low/medium/high or numeric scale.
  • The risk list is ordered by priority.
  • Each high-priority risk has a mitigation measure, with tasks assigned and scheduled.
Section titled “Related”

Sources

Section titled “Sources”