Software Engineering
Home Planning Requirements Writing Hazard Analysis Requirement Analysis Config Control Software Design Software Testing Software Standards Basic Logic

Software Project Planning - Managing Project Risks

True Story: The day before delivery of a multi-million dollar project, the vendor informed us that the project would be delayed another three months. Three months later, one day before delivery, they said it would be delayed another three months. Needless to say, we were not happy.

Project Risks are risks that can damage the Project. Risks can include:

  • Schedule feasibility
  • Technical feasibility
  • Staffing
  • Budget

Project Risk Management allows the team to identify, assess, prioritize, and mitigate project risks. Using one of the models below, risks are identified. Once project risks are identified, risk are then assessed for severity and probability. Lastly, risks are mitigated and then tracked throughout the project.

Informal Model - S.W.O.T. Analysis

(Strengths, Weaknesses, Opportunities, and Threats.)

  • Strengths and Weaknesses are internal forces.
  • Opportunities and Threats are external forces.

SWOT is a brainstorming tool that is useful for identifying potential risks. This is often employed by Marketing people at the start of a project.


Formal Models

Construx Software Model (based on NASA model). This is a spreadsheet downloaded from: McConnell, Steve. Software Project Survival Guide. Microsoft Press.

Construx is a series of questions that rate various aspects of the project, and gives a best case scenario of what to expect.

SERIM (Software Engineering Risk Management).
This is a program that I wrote to implement the SERIM model as described by: Karolak, Dale Walter. Software Engineering Risk Management. IEEE Computer Society Press.

SERIM is a more complex series of detailed questions that rate various aspects of the project, and gives an estimate of the project's ability to withstand project risks.

Construx and SERIM together give a good range of best case to worst case, and the ability to do "what-if" scenarios to determine the effect of risk mitigation.