A Novel Risk Assessment Model for Software Projects

A Novel Risk Assessment Model for Software Projects Masood Uzzafer Department of Computer Science University of Nottingham, UK e-mail: keyx8muz@nottingham.edu.my Abstract This paper presents a novel risk assessment model for software jects. Traditional software risk assessment models lack the capability of classifying risk events based on their (in)dependence and statistical (in)dependence. The posed risk assessment model relies on a scheme to classify the risk events of the software ject based on their (in)dependence to occur and statistical (in)dependence of their impacts. Further, the posed risk assessment model is integrated with a generic software cost estimation model to generate the cost estimates with integrated impact of the risk events of the software ject. Keywords Software Risk Impact, Software Risk Classification, Software Risk Assessment, Estimated Software Project Cost. S I. INTRODUCTION oftware risk assessment is an integral part of risk management of software jects. Two main components of a software risk assessment cess are qualitative risk assessment and quantitative risk assessment. Qualitative risk assessment focuses on the identification of risk events, while quantitative risk assessment studies the impacts and the bability of impacts of the identified risk events. Central notion of risk is that it is an event which may or may not take place hence its occurrence is uncertain and it brings out adverse monetary sequences to a software ject. Monetary loss due to a risk event is defined in terms of risk impact and the bability of risk impact. Risk impact is a random quantity therefore it is modeled with random variables having an underlying bability distribution. The actual risk impact cannot be realized unless the risk event takes place; the inability to fully understand risk events and their impacts before they occur is the uncertainty around the risk events. There are various software risk assessment models for the risk assessment of software jects. Based on different techniques, software risk assessment models apply qualitative and quantitative risk assessment to risk events of the software ject. While traditional risk assessment models vide a foundation for risk assessment of software elopment and tractual jects, these software risk assessment models lack the capability to qualitatively and quantitatively classify and treat the impacts of the risk events based on their (in)dependence and statistical (in)dependence. Qualitatively, the identified risk events can be classified as dependent and independent, whereas quantitatively the impacts of the identified risk events can be classified as statistically dependent and statistically independent. In simple terms, the dependent risk events are caused by other risk events, whereas the independent risk events are independent of the occurrences of the other risk events. The impacts of the statistically dependent risk events are said to be correlated, whereas, the impacts of statistically independent risk events are said to be uncorrelated. This paper presents a novel software risk assessment model which qualitatively classifies risk events as dependent and independent and further treats the impacts of the risk events based on their statistical (in)dependence. The paper is structured as follows; some software risk assessment models off interest are discussed in section II for illustration purposes [1, 2, 3], a novel risk assessment model is presented in section III and finally section IV draws some clusions. II. SOFTWARE RISK ASSESSMENT MODELS The foundation work for qualitative and quantitative risk assessment of software jects was carried out by Barry Boehm [1]. He outlined a cedure for the qualitative risk assessment, and used decision tree model for the quantitative risk assessment of software jects. The model assigns a value called risk exposure (RE) to each identified risk event expressed as follows: RE = P*L (1) Where RE is the risk exposure P is the bability of the risk event, and L is the monetary loss due to the risk event. Risk exposures of different risk events are loaded into the decision tree, and different software risk management options are analyzed to select the most optimum software risk management option, which shows the most optimum risk exposure. Another software risk assessment model, posed by Richard discussed a detailed cedure for risk

assessment of software jects [2]. The model integrates the software risk assessment model with the Constructive Cost Model (COCOMO) for software cost estimation [8]. This integrated model vides rich insight into the loss and tingency resources required for the software ject to combat the risk events. In an illustrated example, the risk events of a software ject are identified that are; cplx: the effects of algorithmic complexity, time: the timing straints, stor: the system memory straints, size: the uncertainty in the estimated code size. The identified risk events are classified as related with each other such that the complex algorithm, cplx, cause the software code size to increase, size, that increases the system execution time, time, and the system memory, stor. The risk impact of the risk events cplx, stor and time are mapped on a scale of { i : i [0,1]} 1.The impacts of the size and cplx are modelled with the bability distributions while the impacts of stor and time are selected from the COCOMO table which is based on the size of the software ject. The Monte Carlo simulation randomly selects the values of size and cplx from the respective distributions while the impact values of stor and time are selected from the COCOMO table that is based on the software size. These values are plugged into an integrated model of COCOMO and risk assessment represented by equation (2), b E a size cplx stor time (2) Where, E is the effort in man-months, size is the software size in kilo-lines of code, a and b are empirically driven COCOMO stants that are based on the type of the software. Running the Monte Carlo simulation few hundred times generate a histogram of the effort, E, required for the software ject. Say-Wei et al. presented a risk assessment model for software jects by using a questionnaire to identify the risk events and their impacts. The questionnaire sists of nine different categories of risk where each risk category tains a list of questions. The bability for each risk event, r i, is assessed through a set of questions in the questionnaire. The questionnaire vides three choices for a specific question, where each choice is mapped on a scale of 1-3, with 1 being the least and 3 being the highest risk impact. The numerical values from all the questions related to a risk event are accumulated and normalized by dividing it with the number of the questions. The value of impact, r i, of each risk event is scaled by a weight factor, w i, where each weight factor corresponds to different types of software jects. The overall software ject risk level, R, is obtained n through, R 1 r * w, which is normalized as follows, Where R n i i i R R R R max min min R min and R max (3), are the minimum and maximum risk when answers to all the questions are 1 and 3, respectively. Rn is the normalized overall risk level of the software ject on a scale of [0-1] referred as the software ject risk. Finally, the impact of risk on the quality, schedule and cost of the software ject are assessed. The risk assessment models [1, 2, 3] discussed established a foundation for the further elopment of the risk assessment models for the software jects. The main drawback of these traditional risk assessment models is that the risk events are not classified based on their (in)dependence on each other, in-addition the impacts of the risk events are not treated based on their statistical (in)dependence, which cause double counting the impacts of the statistically dependent risk events. Uzzafer [11] presented a scheme to classify the risk events of software jects based on their (in)dependence and statistical (in)dependence. The Barry s model uses the decision tree to model the impact of the different risk events of the software jects which helps to classify the risk events based on their dependence but fails to treat the impacts of the risk events based on their statistical (in)dependence. The Richards s model recognizes the statistical dependence of the risk events by stating that size, cplx, stor and time risk events are related, but do not treat the risk events based on their relation or in other words, based on their statistical dependence. This model defines the risk events of size and cplx as correlated while Monte Carlo simulation randomly selects the impact values of the size and cplx, which cause uncorrelated samples of the size and cplx to be selected and cause double counting of their impacts. Further, the impact of the risk events stor and time are taken from the COCOMO table and described as correlated. The COCOMO makes no assumptions about the statistical (in)dependence of the stor and time risk events and estimates the values of the stor and time without any sideration of their correlation with each other. While Richard s model describes the stor and time risk events as related i.e., statistically dependent, but uses the un-correlated impact values of the stor and time risk events from the COCOMO table. The Sya-Wei et al. s risk assessment model treats the risk events without sidering their statistical (in)dependence. A risk assessment model for the software jects is needed that can classify the risk events based on their (in)dependence and statistical (in)dependence for the per classification and treatment of the risk events of the software ject. Further, the software cost is the single most important factor in managing the software jects. The software ject risk events render an adverse impact on the estimated cost of the software ject. All the risk assessment models sider the impacts of risk events on the estimated cost of the software ject, directly [2] or indirectly [1, 3]. Directly, when the risk assessment model is integrated with a specific software cost estimation

model which causes the risk assessment model unusable with other software cost estimation models and indirectly, when the risk assessment is performed without any reference to the estimated software ject cost making it difficult to model the integrated behavior of the risk impact with the estimated cost of the software ject. The risk assessment model should not depend on any specific software cost estimation model and should be flexible so that it could be integrated with any software cost estimation model. Therefore, the goal is to elop a risk assessment model that overcomes the risk classification issue mentioned with the traditional risk assessment models. The qualitative component of the risk assessment model should classify the identified risk events based on their dependence and independence, while the qualitative component should combine the impacts of all the risk events by taking into the sideration their statistical (in)dependence. In-addition the risk assessment model should be independent of specific software cost estimation model so that it could be integrated with any software cost estimation model. III. A NOVEL SOFTWARE RISK ASSESSMENT MODEL Main steps of the posed software risk assessment model are as follows: 1. Identification and classification of the risk events 2. Impact modeling of the risk events 3. Estimating the overall impact of the risk events 1. Risk Impact identification and classification Risk event identification is the foremost step of a risk assessment cess. For risk identification and classification Uzzafer s [11] scheme is used. The scheme relies on the Software Engineering Institutes (SEI) Taxonomy Based Questionnaire (TBQ) [5,6] and presents four classifications of the risk events namely: Independent and Statistically Independent (ISI), Dependent and Statistically Independent (DSI), Independent and Statistically Dependent (ISD) and Dependent and Statistically Dependent (DSD). 2. Risk Impact modeling The random risk impact, X, is defined as the mapping from the space of the risk events to the real line bounded within the closed interval (0,1], having a known bability distribution. The Beta distributions are defined in the interval [0,1] and are used to model the random risk impacts of the risk events [8]. The Beta bability density function, f X ( x;, ), for the random risk impact, X, has the following form [9]: f X ( 1) ( 1) x (1 x) ( x;, ) (0,1) (4) B (, ) 1 1 1 d A A A (5) 0 B(, ) (1 ) Where B () is the Beta function, (, ) are the shaping parameters and (0,1) is the indicator function which ensures that only values in the interval (0,1] has associated babilities, we write X : Beta(, ) to represent it. The expectation, EX [ ], and the variance, Var [ X ], of the Beta distributed random risk impact, X, are defined as, EX [ ] Var [ X ] 2 ( ) ( 1) The shape of the Beta distribution could be positively or negatively skewed depending upon the shaping parameters, (, ). The positively skewed Beta distribution represents that most of the risk impact observations are less than 0.5 and the expectation, EX [ ], of the random risk impact, X, is below 0.5. While the negatively skewed Beta distribution represents that most of the random observations of the risk impact are more than 0.5, therefore the expectation, EX [ ], of the random risk impact, X, is over 0.5. To represent the risk impact as the percentage of loss, the risk impact is mapped to a percentage of loss. For example, the risk impact with the expectation EX [ ] 0.1 can be mapped to represent 10% of the losses. Other risk impact observations can be similarly mapped to the percentage of the losses based on the linear and non-linear mapping depending upon the nature of the risk events, e.g. the risk impact EX [ ] 0.2 can be mapped to 40% of the losses. (6) (7) Figure 1: X : Beta(, ) for different values of (, ) Figure 1 shows the Beta distribution which is positively skewed on the left that has EX [ ] 0.1667, not skewed in the middle having EX [ ] 0.5 and negatively skewed on the right having EX [ ] 0.8333, each distribution has the different shaping parameters, (, ).

3. Estimating the overall risk impact The next step in the risk assessment of the software ject is to estimate the overall risk impact of the software ject due to all the identified risk events of the software ject. The risk events are identified using the SEI risk taxonomy TBQ, where each risk class attribute is a potential risk event [11]. Each identified risk event is assigned a risk impact on a scale of (0,1] based on the export opinion. The identified risk events of a SEI class are classified as independent and statistically dependent (ISI). To estimate the risk impact of a SEI risk class due to all the attributes of the SEI class, the histogram of the risk impacts of all the attributes of the SEI class is structed, which reveals the range and the spread of the risk impacts due to all the risk events of the SEI class. The Beta distribution parameters, (, ), are estimated from the histogram of the SEI class and based on the estimated parameters, (, ), the histogram of the SEI class is fitted with the Beta distribution. The Beta distribution fit, X class ~ Beta( calss, class ), captures the random risk impact, X class, due to the risk events of the SEI class having the bability distribution, f X ( x ;, ) class class class class Beta( class, class ), of overall random risk impact, X. This cess is repeated for all the SEI risk classes. The risk events of the three SEI risk classes, Program Engineering, Development Environment and Program Constraints generates three Beta distributions Beta(, ), Beta(, ) and Beta(, ), where each models the random risk impact X r : Beta(, ), X : Beta(, ) p o and X : Beta(, ) due to the risk events of the Program Engineering, Development Environment and Program Constraints SEI classes, respectively. Figure 2 shows the histograms of the SEI classes fitted with the Beta distributions. The single realization of the overall risk impact, x, is the duct of the risk impact of all the because all the SEI risk classes are said to be statistically independent [11]. First we get the random risk impacts on a scale of { xclass : xclass (0,1]} 1 for all the SEI classes, then the overall risk impact, x, is calculated using equation (8), x ( x 1)*( x 1)*( x 1) (8) where x, x and x are the single realizations of the random risk impacts X, X and X at some instance. The distribution of the random overall risk impact, X, of the software ject is the joint distribution of the distributions of random overall risk impacts of all the SEI classes. The SEI classes are classified as independent and statistically independent, ISI. Therefore, the joint distribution, f X ( x, x, x ), of all the SEI classes is the duct of the marginal distributions of all the SEI classes as represented by equation (9) and shown in Figure 3, f X ( x, x, x ) f ( x ;, ) X f ( x ;, ) f ( x ;, ) (9) X X The bability that the overall risk, x, of the software ject is within the region bounded with x, x and x, is represented as, FX ( x, x x ) P{ X x, X x, X x }, that is defined as follows, FX ( x, x x ) x x x ( ) X 0 0 0 F x F ( x ) X FX ( x ) dx dx dx (10) The posed risk assessment model does not depend on any specific software cost estimation model it generates the random overall risk impact, X, of the software ject that can be integrated with any estimated cost of the software ject. If fy ( y ) is the distribution of the estimated cost of the software ject estimated by using any software cost estimation model [7,10] and Y represents the random cost required for the software ject. Then the following expression integrates the risk assessment and the cost estimation models of the software ject, XY X * Y (11) Figure 2: Histograms with Beta Distribution fit Where X is the random overall risk impact of the software ject having the bability density, f X ( x, x, x ), Y is the random estimated cost of the software ject having the bability distribution fy ( y ) and XY is the random estimated software ject cost that bears the impacts of risk events of the software ject.

integrated it with the estimated cost of the software ject. Figure 3: Joint Probability Distribution f X ( x, x, x ) The Monte Carlo simulation selects the random risk impact samples of the X, X and X from their respective distributions i.e., Beta(, ), Beta(, ) and Beta(, ) to estimate the x from equation (8) and selects the random cost samples, Y, from the estimated cost distribution, fy ( y ), of the software ject then uses the equation (11) to estimate the cost of the software ject, XY, with the integrated impact of the risk events, XY. Running the Monte Carlo simulation few hundred times struct the histogram of the cost samples, XY, that bears the impacts due to all the identified risk events of the software ject, as shown in Figure 4. Software cost estimation models that duce single value cost estimates, Y, can also be integrated with the risk assessment model represented by the equation (11), using the cedure described above. I. CONCLUSIONS A novel risk assessment model for software jects is presented. The posed risk assessment model classifies the risk events of software jects based on their (in)dependence and statistical (in)dependence on other risk events of the software ject and helps to avoid double counting the impact of statistically dependent risk events. The model relies on the SEI s TBQ for the risk identification and classifies the SEI classes and attributes based on their (in)dependence and statistical (in)dependence. The classes of SEI s TBQ are classified as independent and statistically independent, while the attributes of a class are classified as independent and statistically dependent on the attributes of the same SEI class. Further a cess of risk impact assessment is shown to get the overall software ject risk impact due to all the identified software ject risk events, and Figure 4: Overall Estimated Cost with Risk Impact REFERENCES [1] Software Risk Management: Principles and Practices, Barry W. Boehm, IEEE Software, January 1991, Pages 33-40. [2] Richard Fairley, Risk Management for Software Projects, IEEE Software, vol. 11, issue 3 Pages 57 67, May 1994. [3] Say-Wei Foo, Arumugam Muruganantham, Software Risk Assessment Model, Proceedings of International Conference on Management of Innovation and Technology, vol. 2, pages, 536-544, November 2000. [4] Athanasios, Papoulis, Probability Random Variables and Stochastic Process, 3 rd Edition, McGraw Hill Companies, 1991. [5] Software Engineering Institute, Software Risk Evaluation Method Description, version 2.0, CMU/SEI-99-TR-029, Dec. 1999. [6] Marvin Carr, Suresh Konda, Ira Monarch, Clay F. Walker, F. Carol Ulrich, Software Engineering Institute, Taxonomy Based Risk Identification, Technical Report SEI-93-TR-006, June 1993. [7] Boehm, B.W., Software Engineering Eomics, Pages: 329-342, Prentice-Hall Inc., Englewood Cliffs, N.J., 1981. [8] Dale F. Cooper, Stephen Grey, Geoffrey Raymond, Phil Walker, Project Risk Management Guidelines, John Wiley & Sons Ltd, 2005. [9] Douglas C. Montgomery, George C. Runger, Applied Statistics and Probability for Engineers, Third Edition. John Wiley & Sons Inc. [10] Lum Karen, Michael Bramble, Jairus Hihn, John Hackney, Mori Khorrami, Erik Monson, Handbook for Software Cost Estimation, Jet Propulsion Labarotry, California, May 2003 [11] Uzzafer, Masood, Impact of Dependent and Independent Risk of Software Proejcts, IEEE International Conference on Management Science and Information Engineering (ICMSIE 2010), December 2010, Zhengzhou, China.