Background: The sensitivity of Requirements Engineering (RE) to the context makes it difficult to efficiently control problems therein, thus, hampering an effective risk management devoted to allow for early corrective or even preventive measures. Problem: There is still little empirical knowledge about context-specific RE phenomena which would be necessary for an effective context- sensitive risk management in RE. Goal: We propose and validate an evidence-based approach to assess risks in RE using cross-company data about problems, causes and effects. Research Method: We use survey data from 228 companies and build a probabilistic network that supports the forecast of context-specific RE phenomena. We implement this approach using spreadsheets to support a light-weight risk assessment. Results: Our results from an initial validation in 6 companies strengthen our confidence that the approach increases the awareness for individual risk factors in RE, and the feedback further allows for disseminating our approach into practice.
Software risk management constitutes means to efficiently assess and control risk factors affecting the overall software development activities @cite_20 (planned ones and deviations) and is often associated with project management for adults'' as baptised by @cite_23 . The importance of risk management for software engineering in general and requirements engineering in particular has been addressed in several risk management approaches tailored to software engineering processes @cite_5 . Already the spiral model of Boehm @cite_21 explicitly includes risk management within software development. The Riskit method @cite_4 provides a sound theoretical foundation of risk management with a focus on the qualitative understanding of risks before their possible quantification. Karolak @cite_12 proposes a risk management process for software engineering that contains the activities risk identification, risk strategy, risk assessment, risk mitigation, and risk prediction. With ISO 31000 @cite_26 , which was released in 2009, there is even a family of standards for risk management available that can also be instantiated in software engineering and its subareas like testing, where ISO 31000 has already been applied in the context of risk-based testing @cite_24 , or requirements engineering.
@cite_26 @cite_4 @cite_21 @cite_24 @cite_23 @cite_5 @cite_12 @cite_20
2042758283 2070415069 196328223 2028978693
Decision making in software engineering requires the consideration of risk information. The reliability of risk information is strongly influenced by the underlying risk estimation process which consists of the steps risk identification, risk analysis and risk prioritization. In this paper we present a novel risk estimation tool for software engineering pruposes called RisCal. RisCal is based on a generic risk model and supports the integration of manually and automatically determined metrics into the risk estimation. This makes the tool applicable for arbitrary software engineering activities like risk-based testing or release planning. We show how RisCal supports risk identification, analysis and prioritizations, provide an estimation example, and discuss its application to risk-based testing and release planning. Explicit and systematic management of risks in software projects has become a more common practice amongst leading software organizations, However, often the methods used have severe theoretical and practical limitations that may lead to biased or inappropriate control of risks. The first part of this tutorial presents a critical overview of the current risk management technology, discussing the pros and cons of main approaches, as well as guidelines for their use. The second part of the tutorial presents the Riskit method with concrete examples and exercises. Riskit is a risk management method that has been developed to provide a theoretically sound, yet practical risk management approach. The method has been used and evaluated in several industrial projects in Europe and in the U.S. From the Publisher: This book explores software and risk management both from a technology and a business perspective. Dale Karolak approaches software development from a just-in-time viewpoint and presents strategies that you can use to implement and plan software projects in a cost-effective and timely manner. This book discusses vital issues and, in particular, their costs, schedules, technical performance, and risk-based approaches for software development. It is especially designed to assist those who manage software development projects. The book provides a significant discussion of software risk issues pertaining to technical performance, costs, and schedules; metrics and several models for measuring and predicting risk; information supported by actual proven case studies derived from the author's experience; and many different concepts, strategies, and tools that can make the management of your next software development project less of a guess and more predictable. Software testing has often to be done under severe pressure due to limited resources and a challenging time schedule facing the demand to assure the fulfillment of the software requirements. In addition, testing should unveil those software defects that harm the mission-critical functions of the software. Risk-based testing uses risk (re-)assessments to steer all phases of the test process to optimize testing efforts and limit risks of the software-based system. Due to its importance and high practical relevance, several risk-based testing approaches were proposed in academia and industry. This paper presents a taxonomy of risk-based testing providing a framework to understand, categorize, assess, and compare risk-based testing approaches to support their selection and tailoring for specific purposes. The taxonomy is aligned with the consideration of risks in all phases of the test process and consists of the top-level classes risk drivers, risk assessment, and risk-based test process. The taxonomy of risk-based testing has been developed by analyzing the work presented in available publications on risk-based testing. Afterwards, it has been applied to the work on risk-based testing presented in this special section of the International Journal on Software Tools for Technology Transfer.