Risk Management

Risk Management

1. Risk Identification

   • Process-related/product-related
   • Risk tree
     • Failure node
     • Cut set of risk tree
   • Use scenarios
   • Knowledge reuse
   • Group sessions

2. Risk Assessment

   • Qualitative for likelihood and severity
     • Limited conclusions
     • Subjective estimates
     • Easy to use
     • Likelihood of consequences not considered
   • Quantitative for likelihood and severity
     • Risk exposure = Sumc Likelihood(c) x Severity (c)
     • Finer grained than qualitative
     • Not grounded on system phenomena
     • Elicited from domain experts

3. Risk Control

   • Countermeasures
     • Reduce high-exposure risks
     • Should be cost-effective
       • Measured by Risk Reduction Leverage
         • Exposure of R - New exposure of R if CM is selected, then divide by Cost
         • Select CM with highest RRL values
     • Use elicitation techniques
     • Risk reduction tactics
       • Reduce risk likelihood
       • Avoid risk
       • Reduce consequence likelihood
       • Avoid risk consequence
       • Mitigate risk consequence
     • Reusing known CM

4. Assess likelihood of risks + severity, likelihood of consequences to control high priority risk

5. Quantitative risk management

   • Defect Detection Prevention
     • Impact matrix
       • Impact(r, obj) = estimated loss of satisfaction (0 to 1)
       • LAST LINE -> Criticality(r) = Likelihood(r) * Sum(obj)(Impact(r,obj) * Weight(obj))
       • Loss(obj) = Weight(obj) * Sum(r) (Impact(r, obj) * Likelihood(r))
     • CM effectiveness matrix
       • Reduction(cm, r) = estimated reduction of r if cm applied
         • 0 --> no reduction, 1 --> risk elimination
       • LAST LINE -> combinedReduction(r) = 1 -Pcm(1 -Reduction(cm,r))
       • LAST COL -> overallEffect(cm) =Sum(r) (Reduction(cm,r) * Criticality(r))
     • Determine optimal balance risk reduction/CM cost
       • Cost of each CM
       • Risk balance chart -> impact of each R on all obj if CM is selected