Trust, Risk, and Scrum: Lessons from Agile Coach Camp Romania, first edition

Published on October 5, 2025

Some time ago I attended Romania’s first Agile Coach Camp edition. It was refreshing and nice to meet people eager to come open with their daily problems, trusting the group, while seeking useful insights and advices that would otherwise be hard to get. 

One of the open space sessions that grabbed my attention was about risk management while working with an Agile mindset in a highly regulated and restrictive environment (in this case investment banking). 

As an image speaks a thousand words, this is the working material. Sharing it openly, since when this piece goes out there will be around 10 years since that event…

 

formal-risk-management-embeded-in-agile-process

Why risk management? 

Firstly, scrum is intended to work in complex environments. By Cynefin jargon, complex is the place where coherence exists only in retrospect. All is clear in the rearview mirror, yet on the windshield things are less coherent. The path forward has not yet been traced, and this is where scrum’s approach of probing, iterative and incremental delivery works best. 

Second, because banking is mostly about managing trust. Many say that banking is about money, but deep inside the money making machine people say that it would not work without trust, given all the money in the world. So, when operating with trust, what is a risk? Is a lack of trust in a future prediction, is lack of certainty.  Banking is all about managing trust via risk layers. This makes the banking industry quite well adapted to risk based models, so it makes all sense to frame scrum’s patterns and mechanisms for risk. 

Third, because scrum works using an aggregation pattern, thus compounding work and risks. Scrum works on team level, creating a push for breaking things down in parts deliverable by small teams. This builds a compounding pattern that lowers risk on local level, yet creates dependencies within the system of work. These dependencies induce other kinds of risks (e.g. dependency). This indirect type of risk creation requires specific approaches.