I disagree with the statement,that in SCRUM risk analysis is not done upfront
What about --
Risk analysis when a story is groomed & estimated during SPRINT plannnig --->
Considering & factoring in risks ( and considering mitigation - new stories ?? , "story is too big and risk -- break it down " , "no test to catch regression -- can not committ to this story unless regression tests are written " etc etc ) when story is groomed ?
Considering & factoring in risks when story points are being estimated ?
I do not think one is implementing SCRUM properly if formal risk analysis is not part of the SPRINT planning process ! I would be very nervous as a PM,if risks are not analysed,discussed and mitigations proposed before committing a story to the board