Risk Management - Azure DevOps Services Extension

Manage your risks in Azure DevOps Services. Key functionality:

Manage multiple query-based risk registers per project
View your risks in an easy-to-navigate risk register view, perfect for risk meetings and management reviews
3x3 and 5x5 risk configurations available catering for faster/simpler to more complex risk evaluation
Risk mitigations and progress roll-up percentage on each risk
Automatic risk severity calculated based on impact and likelihood field values
Use the risk register view to quickly update:
- Impact, Likelihood and Risk Category from a context menu
- Assign or change risk owner
- View or add a new comment against a risk
Share your risk register with colleagues through an easy web link
Configure custom Risk and Mitigation workitem types in ADO
Choose your own custom risk fields in configuration
All data is stored and remains secure on the workitem in your ADO instance, no external service or data is used

Example

example Azure DevOps Services Risk Management example Mitigations Risk Management Matrix 5x5 Example

How to set up the risk extension (Summary)

Set up your Risk and Mitigation workitem types with custom fields
Configure the Risk Management extension
Create your first Risk Register using a query

Detailed Steps

1 Risk Workitem Configuration in Azure DevOps Services

1.1 Risk Matrix type

Decide between a 3x3 or 5x5 Risk Matrix configuration. For the extension to work correctly, the Risk custom fields require a consistent set of values based on this decision.

Risk Matrix Type	Summary
3x3 Risk Matrix	Risk custom fields will have three values (1-3) for impact, likelihood and severity. 3x3 Risk is recommend for small and medium sized projects, or for faster risk assesement and a simpler risk process.
5x5 Risk Matrix	Risk custom fields will have five values (1-5) for impact, likelihood and severity. 5x5 Risk is recommend for larger projects, complex environments or for a more thorough risk process.

1.2 Workitems in Azure DevOps Services

The Risk Management extension works with two workitem types, one for Risk and one for Mitigation. We recommend creating a new custom type for Risk and for Mitigation, however you can use an existing workitem type for either of these. The Risk workitem will require custom fields to work correctly with this extension. Once you have the workitems created, or selected, proceed to the workitem field configuration.

1.3 Add Risk workitem fields

Custom fields need to be created for Severity, Impact and Likelihood as well as Category. These fields can be named however you choose, as long as they exist and are configured with three values each (for the 3x3 risk selection) or five values each (for the 5x5 risk selection).

Note: All three severity-related custom fields (Severity, Impact and Likelihood) must be of picklist(string) type, contain the correct number of values based on the matrix selected, and each picklist item must start with either "1." "2." "3." for the 3x3 risk selection, or "1." "2." "3." "4." "5." for the 5x5 risk selection. The remainder text of the picklist string can be anything you choose. The Category field must be a picklist field, but can have any values you choose. This field allows categorisation of the risk.

For example: You select the 3x3 risk matrix type and configure the risk custom fields as:

Custom Field	Values
RiskSeverity	1. Minor
	2. Medium
	3. Major
Impact	1. Low
	2. Average
	3. High
Likelihood	1. Rare
	2. Medium
	3. Frequent
Category	Schedule
	Budget
	Reputation
	Compliance

Notice the starting digits required on each custom field value to support a 3x3 risk matrix

example Azure DevOps Services Risk Management severity values

1.4 Mitigation workitem fields

No custom fields are required on the mitigation workitem type. You can also use an existing type, for example "Task" or "User Story", for the mitigation workitem type if you prefer.

You are now ready to configure the extension

2 Risk Extension Configuration in Azure DevOps Services

2.1 Risk Extension Settings

Once the extension is installed, you will see a new "Risk Management" hub under "Boards". example Azure DevOps Services Risk Management severity values
Click on the gear icon on the bottom-left of the main Risk Register landing page.

2.2 Configure Risk Workitem and Risk Matrix Style

example Azure DevOps Services Risk Management severity values
Select the Risk workitem type created in the steps above of this guide. Select the appropriate Risk Matrix style which matches your custom fields.

2.3 Configure Risk Workitem Fields

example Azure DevOps Services Risk Management severity values
Configure the Risk workitem fields created in the steps above of this guide. Note that selecting a "Category" field for your risk workitem is mandatory and further down the screen.

2.4 Configure Risk Mitigation

example Azure DevOps Services Risk Management severity values
Configure the Mitigation workitem type created in the steps above of this guide.

2.5 Validate and Save

example Azure DevOps Services Risk Management severity values
Click on "Validate" to ensure your fields are set up correctly. This will check that your chosen Severity, Impact and Likelihood fields have the correct number of picklist items to match your Risk Matrix selection. Click on "Save" and...

You're ready to go!

A detailed step-by step guide is available here @ e9-agile.com. If you would like support setting up this extension, or need us to work with your administration team, get in contact and we are happy to help Support Page

Support

Support Page

More Examples:

example Azure DevOps Services Risk Management example update severity

Risk Management

Executive-9