Teams hide risk by turning it into backlog items. “Investigate migration approach.” “Evaluate auth provider.” “Clean up billing edge cases.” The wording is calm. The blast radius is not.
The backlog makes risky work look like normal work because everything is the same shape: title, owner, points, priority. That is convenient and dangerous. A task that can delete customer data should not sit beside a button color change with the same visual weight.
Separate uncertainty from labor
There are two kinds of work:
- Known labor. You understand the path. It just takes time.
- Unknown risk. You do not yet know where the path breaks.
Treat them differently. Unknown risk needs a spike, a decision date, and a written exit condition. It should not be estimated like a normal ticket because the estimate is mostly theater.
The useful question is not “how many points is this?” The useful question is “what do we need to learn before we let this near production?”
If the backlog is the only place risk lives, planning becomes a sorting exercise when it should be a conversation about exposure. Move the risk into the room.