Risk identification workshop — add what is missing

Cadence: every two weeks, 20 minutes at the end of sprint planning. Owner: rotates.

Registers go stale because nobody adds to them, not because the entries are wrong.

Prompts that surface real risks:

• What are we assuming is true that we have not verified?
• What depends on someone outside this team?
• What would we be embarrassed to have missed if it happened?
• What went wrong on the last project that could go wrong again here?

Add anything raised straight into the register with a provisional score. Refine it at the next monthly. A rough entry beats a missing one.