State of Software Risk Management Practice
Mira Kajko‐Mattsson, Jaana Nyfjord · 2008
Abstract—Despite the fact that risk management has been with us for some time, little has been reported about its industrial status, its co-existence with the development models, and its compliance to standard risk management process models. In this paper, we explore the domain of risk management practice within 37 software organizations. We do this by first comparing the industrial status against a process model that is synthesized from a set of current standard risk management process models. We then investigate how the companies studied have integrated their risk management with software development. Regarding the state of industrial risk management practice, our results show that there are some discrepancies between the industrial practice and the standard models studied. The industrial organizations have not implemented all the important activities as prescribed by the standard models. The standard models, on the other hand, have failed to identify some of the important risk management phases and activities. Hence, this paper suggests a list of issues that need be addressed in both the standards and the industry. Regarding the integration practice, our results recognize that process integration in this domain is still in its infancy. Index Terms — process model, software development, process integration, agile methods.