Document the risk assessment process

[GuySartorelli]

In a recent discussion about our risk assessment process we discovered that we don't have any clear documentation about what that process actually is.

Notes

• This is the risk assessment spreadsheet
• In the meeting, we discussed that most new features and releases probably don't need a risk assessment, but new modules might, and new processes probably do.

Acceptance criteria

• There is a document (probably in confluence) that explains the full risk assessment process.
• The document explains the criteria for when to do a risk assessment.
• The document contains a link to our risk assessment spreadsheet
• The document contains a link to the risk assessment matrix, which is also on confluence.

Possible points that could need a risk assessment

• New EPICs
• New features
• New cards with specific risk implication
• New releases (Major and/or minor)
• New processes