Risk Management: Implicit and Explicit

Experience has shown that software development involves substantial risk. It follows therefore that risk must be addressed effectively within the software development process. This can be achieved by identifying risks explicitly at various stages in the process and then determining how best to deal with those risks. Alternatively, some (perhaps most) of the significant risks can be handled covertly by building risk reduction techniques into the development process. This paper argues that both forms of risk management are needed, with initial emphasis placed on the implicit approach as that is where the greatest return for effort is likely to be obtained. This point is illustrated by considering the earliest stages of requirements engineering for software in which the business context for change is examined. Two particular techniques are discussed: (i) Checkland and Wilson's Soft Systems Methodology (SSM); and (ii) Gilb's Evolutionary Delivery. In each case the implicit risk reduction value of the technique is identified and then the further advantage of an explicit risk treatment explored. This work is contributing to the development of RACE (Requirements Acquisition and Controlled Evolution), a new requirements engineering method.