Towards integrating agile development and risk management

Risk management has become recognized as a best practice in the software industry. Controlling risks improves essential software development features such as product quality, planning precision and cost-efficiency. For this reason, the inclusion of risk management in software development is an important factor to consider if one wishes to achieve project success. Agile software development models claim to be risk-driven. They state that their iterative approach enables continuous attention to risks and that the risks can be reduced by practices such as continuous software integration and early testing. In reality, however, the agile development models implement few risk management practices. The research problem addressed in this thesis is multi-faceted. The problem concerns the lack of explicit risk management practices in agile development. However, it also concerns the need to address risk management on an organization-wide basis. In addition, it concerns the conflict that emerges from trying to merge the agile process with standard industrial processes, such as risk management, without compromising agility. The goal of this thesis is to explore integration as a solution for addressing the lack of risk management in the agile model based on empirical research. It involves (a) outlining a model integrating the agile and risk management processes on an organization-wide basis, and (b) providing a foundation for its extension. The results show that, within the scope of this research, the proposed solution is a valid candidate for improving the agile situation. However, it is still in its infancy. It does not claim to be complete but needs to be further elaborated and complemented with details. Hence, we outline the model and provide a foundation established in empirical investigation for extending it in future research