Risk identification starting in the discovery phase -- before development begins -- using a structured risk assessment that covers: technical risks (dependencies on third-party APIs with unreliable documentation, integration complexity with legacy systems, unfamiliar technology requiring team upskilling), resource risks (key person dependency, consultant availability windows, holiday blackout periods during critical phases), timeline risks (external dependencies outside the team's control: regulatory approvals, client content delivery, third-party integration timelines), and scope risks (requirements from stakeholders with a history of changing priorities mid-sprint). Each identified risk is assigned a probability (high/medium/low), impact (high/medium/low), owner responsible for monitoring it, and a mitigation plan (action to reduce probability) plus a contingency plan (action to execute if the risk materialises despite mitigation). Risk probability and impact reviewed each sprint so the register reflects current project reality rather than a pre-project assessment. Dependency mapping across the project: a directed dependency graph showing which features depend on other features being complete, which require external inputs (approved designs, third-party API credentials, content from the client, business decisions from stakeholders), and which items are on the critical path where a delay propagates to the project delivery date. Any external dependency without a confirmed delivery date becomes a tracked risk with an owner. Post-sprint retrospectives structured with three questions (what went well, what could improve, what is one specific action we will take next sprint) and action items assigned with owners and due dates -- reviewed at the start of the following retrospective to confirm they were completed, not discussed and forgotten.
Team health metrics tracked weekly: sprint commitment accuracy (story points committed vs completed -- consistently below 80% signals planning problem; consistently at 100% signals sandbagging); PR cycle time (time from PR opened to merged -- above 3 days signals review bottleneck or unclear ownership); bug escape rate (defects found in QA vs defects found in production -- rising production bugs signal QA coverage problems). These metrics are shared with the engineering lead weekly in a 10-minute sync, not saved for the quarterly retrospective after the problem has compounded. When a metric trend indicates a structural problem (velocity declining for 3 consecutive sprints), the PM produces a root cause analysis with specific remediation actions -- not a note in the retrospective that the team "needs to improve estimation."