Software Risk Analysis

Risk is an expectation of loss, a potential problem that may or may not occur in the future. It is generally caused due to lack of information, control or time. A possibility of suffering from loss in software development process is called a software risk. Loss can be anything, increase in production cost, development of poor quality software, not being able to complete the project on time.

Software risk exists because the future is uncertain and there are many known and unknown things that cannot be incorporated in the project plan.

Types of Software Risks

Software risk encompasses the probability of occurrence for uncertain events and their potential for loss within an organization. The following are some of the risks related to project, product, and business risks.

Project Risks: Project risk is an uncertain event or condition that, if it occurs, has an effect on at least one project objective. Risk management focuses on identifying and assessing the risks to the project and managing those risks to minimize the impact on the project.

Technical Risks: The probability of loss incurred through the execution of a technical process in which the outcome is uncertain. Untested engineering, technological or manufacturing procedures entail some level technical risk that can result in the loss of time, resources, and possibly harm to individuals and facilities.

Business Risks: Business risk is the possibilities a company will have lower than anticipated profits or experience a loss rather than taking a profit. ... A company with a higher business risk should choose a capital structure that has a lower debt ratio to ensure it can meet its financial obligations at all times.

Known Risks: Known risks are those that can be uncovered after careful evaluation of the project, the plan, the business and technical environment in which the project is being developed.

Predictable Risks: Predictable risks are extrapolated from past project experience.

Unpredictable Risks: These are the risks, which are extremely difficult to identify in advance.

Risk Management Process

Two type of risk managements are available

Reactive risk management: Reactive risk management attempts to reduce the tendency of the same or similar accidents which happened in past being repeated in future.

Proactive risk management: Proactive risk management attempts to reduce the tendency of any accident happening in future by identifying the boundaries of activities, where a breach of the boundary can lead to an accident.

Risk management is the identification, projection, refinement and management of risks.

1. Risk identification

Risk identification is a systematic attempt to specify threats to the project plan (estimates, schedule, resource loading, etc.). By identifying known and predictable risks, the project manager takes a first step toward avoiding them when possible and controlling them when necessary.

The checklist can be used for risk identification and focuses on some subset of known and predictable risks in the following generic subcategories:

1. Product Size
2. Business Impact
3. Customer Characteristics
4. Process Definition
5. Development Environment
6. Technology to be build
7. Staff size and experience

2. Risk Projection: Risk projection, also called risk estimation, attempts to rate each risk. The project planner, along with other managers and technical staff, performs four risk projection activities:

1. Establishes a scale that understands the probability of the risk
2. Describes the consequences of the risk
3. Estimate the impact of the risk on the project and on the product
4. Identifies the overall accuracy of the risk projection.

3. Risk Refinement: Risk refinement is the Process of restating the risks as a set of more detailed risks that will be easier to mitigate, monitor, and manage. CTC (condition-transition-consequence) format may be a good representation for the detailed risks. 

RMMM Plane (Risk Mitigation, Monitoring and Management)

Risk analysis activities are used to assist the project team in developing a strategy for dealing with risk. An effective strategy must consider three issues:

1. Risk Avoidance – Leads to mitigation
2. Risk Monitoring – The project manager monitors factors those indicate whether the risk is being more or less likely.
3. Risk Management – It assumes that mitigation efforts have failed and the risk has become a reality.