Software Risk Management

Technical Report CMU/SEI-96-TR-012 ESC-TR-96-012

Software Risk Management

Ronald P. Higuera Yacov Y. Haimes
June 1996

Technical Report
CMU/SEI-96-TR-012 ESC-TR-96-012 June 1996

Software Risk Management

Ronald P. Higuera Software Risk Management Program Software Engineering Institute

Yacov Y. Haimes Center for Risk Management of Engineering University of Virgia

Risk ProgramUnlimited distribution subject to the copyright.

Software Engineering Institute
Carnegie Mellon University Pittsburgh, Pennsylvania 15213

This report was prepared for the SEI Joint Program Office HQ ESC/ENS 5 Eglin Street Hanscom AFB, MA 01731-2116 The ideas and findings in this report should not be construed as an official DoD position. It is published in the interest of scientificand technical information exchange.

FOR THE COMMANDER (signature on file)
Thomas R. Miller, Lt Col, USAF SEI Joint Program Office This work is sponsored by the U.S. Department of Defense. Copyright © 6/28/96 by Carnegie Mellon University. Permission to reproduce this document and to prepare derivative works from this document for internal use is granted, provided the copyright and “No Warranty”statements are included with all reproductions and derivative works. Requests for permission to reproduce this document or to prepare derivative works of this document for external and commercial use should be addressed to the SEI Licensing Agent. NO WARRANTY THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON UNIVERSITYMAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTIBILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. This work was created in the performanceof Federal Government Contract Number F19628-95-C-0003 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. The Government of the United States has a royalty-free government-purpose license to use, duplicate, or disclose the work, in whole or in part and in any manner, and to have or permit others to do so, forgovernment purposes pursuant to the copyright license under the clause at 52.227-7013. This document is available through Research Access, Inc., 800 Vinial Street, Pittsburgh, PA 15212. Phone: 1-800-685-6510. FAX: (412) 321-2994. RAI also maintains a World Wide Web home page. The URL is http://www.rai.com Copies of this document are available through the National Technical Information Service(NTIS). For information on ordering, please contact NTIS directly: National Technical Information Service, U.S. Department of Commerce, Springfield, VA 22161. Phone: (703) 487-4600. This document is also available through the Defense Technical Information Center (DTIC). DTIC provides access to and transfer of scientific and technical information for DoD personnel, DoD contractors and potentialcontractors, and other U.S. Government agency personnel and their contractors. To obtain a copy, please contact DTIC directly: Defense Technical Information Center, Attn: FDRA, Cameron Station, Alexandria, VA 223046145. Phone: (703) 274-7633. Use of any trademarks in this report is not intended in any way to infringe on the rights of the trademark holder.

Contents
Acknowledgements 1 Preface 2 3Introduction A Holistic Vision of Software Risk Management 3.1 Temporal Dimension 3.2 Methodological Dimension 3.3 Human Dimension 3.4 Graphic Representation of the Holistic Vision of Software Risk Management Software Risk Management Methodologies 4.1 Basic Constructs to Risk Management 4.1.1 Risk Management Paradigm 4.1.2 Risk Taxonomy 4.1.3 Risk Clinic 4.2 Supporting Practices 4.2.1 Software Risk...