“At some point you’ve got to look at a set of risks and say, how do we feel about our overall stance?” — Mark Richards

In this episode of SPCs Unleashed, hosts Mark Richards, Niko Kaintantzis, and Stephan Neck unpack the complexity of risk management in SAFe. Too often, risk management is reduced to ROAMing during PI Planning. While useful, ROAMing is only a starting point. The discussion centers on the continuum — from identifying risks to shaping an organizational risk posture that balances ownership, experimentation, and resilience.

The hosts explore who owns risk, how unforeseen disruptions like COVID expose organizational resilience, and why AI both enables and complicates risk management. The message is clear: effective risk management requires more than visibility. It demands ownership, accountability, and a proactive stance across all levels of SAFe.

1. Think in terms of risk posture first Instead of obsessing over individual risks, ask: What is our overall stance? This broader view helps leaders balance tradeoffs and set expectations.
2. ROAMing is only the beginning ROAMing surfaces and socializes risks, but it does not ensure ownership, tracking, or mitigation. Treat it as examination, not management.
3. Shared responsibility, clear accountability Risk is everyone’s job, but accountability sits with roles like business owners, product managers, and RTEs to ensure protocols are in place.
4. Build resilience for the unforeseen Events like COVID remind us that Lean-Agile ways of working prepare organizations to adapt faster. Investing in agility is investing in resilience.
5. AI is both a tool and a risk Artificial intelligence can enhance prediction and monitoring but also introduces new risks around bias, governance, and misuse.

Risk management in SAFe cannot stop at ROAMing. That practice creates visibility, but true effectiveness comes from moving along the continuum — toward a well-understood and actively managed risk posture. For SPCs, RTEs, and change leaders, the challenge is to foster transparency, ensure accountability, and guide organizations toward resilience.

In your next PI Planning, go beyond simply documenting risks. Ask what risk posture your teams and business owners are really taking — and ensure that stance is owned, shared, and actively managed.