Internati
o
nal
Journal of Ele
c
trical
and Computer
Engineering
(IJE
CE)
V
o
l.
6, N
o
. 1
,
Febr
u
a
r
y
201
6,
pp
. 34
9
~
35
6
I
S
SN
: 208
8-8
7
0
8
,
D
O
I
:
10.115
91
/ij
ece.v6
i
1.9
026
3
49
Jo
urn
a
l
h
o
me
pa
ge
: h
ttp
://iaesjo
u
r
na
l.com/
o
n
lin
e/ind
e
x.ph
p
/
IJECE
3LRM-3 Layer Risk Mitigation
Modelling of ICT Software
Devel
o
p
m
ent P
r
oj
ect
s
Sa
lma
Firdo
s
e*
, L
.
M
a
nj
unat
h
R
ao*
*
* Bhara
t
hiar
Uni
v
ers
i
t
y
,
Co
imbatore, Tamiln
adu, India
** Dept. of MC
A, Dr. Am
bedkar Institu
te o
f
T
e
chnolog
y
,
B
a
ngal
o
re,
India
Article Info
A
B
STRAC
T
Article histo
r
y:
Received Sep 14, 2015
Rev
i
sed
No
v
19
, 20
15
Accepte
d Dec 3, 2015
With the
adoption of new tech
nolog
y
a
nd qu
ality
standards, the software
developm
ent
fir
m
s are still
en
co
untering
the
cri
t
i
cal
issues of risk
m
odelling
.
W
ith the chang
i
ng d
y
nam
i
cs
of
cus
t
om
er needs
,
potent
i
al
com
p
etit
ion has
being mushrooming in the glo
b
al IT
mark
ets
to relay
a n
e
w standard of
software eng
i
n
eering wh
ich
has highe
r
cap
ability
of sustaining r
i
sk.
However, til
l date
, it is still theore
tic
al to l
a
rge ext
e
nt fro
m
research
viewpoint. Hence, this pap
e
r pre
s
ents
a m
a
them
atic
al m
odel ca
ll
e
d
as
3LRM
that is design
ed
with the sim
p
l
e
approa
ch ke
e
p
ing in m
i
nd th
e rea
l
-tim
e
issue
s
of risk fac
t
ors in softwa
re
e
ngin
eer
ing fo
r ICT software
development
project. Th
e stud
y
has also identified
r
e
quirem
e
nt volatility
as
one of the
prominent source of risk and hence,
th
e fr
am
ework intends to id
entif
y
a risk
as well
as m
itig
ating
the r
i
sk to
a l
a
rge
ext
e
nt.
The pap
e
r
is illu
strated wi
th
som
e
of the
sim
p
le st
atist
i
ca
l
ap
proaches o
f
ran
d
o
m probability
.
Keyword:
ICT
Risk
An
alysis
R
i
sk M
a
na
gem
e
nt
Risk
Mitig
atio
n
Soft
ware
P
r
o
j
e
c
ts
Copyright ©
201
6 Institut
e
o
f
Ad
vanced
Engin
eer
ing and S
c
i
e
nce.
All rights re
se
rve
d
.
Co
rresp
ond
i
ng
Autho
r
:
Salm
a Firdose,
Research Sc
holar, Bha
r
athia
r
Uni
v
ersity,
C
o
i
m
bat
o
re, T
a
m
i
l
n
adu,
I
ndi
a.
Em
a
il: lsn
tl@c
c
u
.
ed
u.tw
1.
INTRODUCTION
The
pr
om
i
s
e of IC
T e
x
pansi
o
n i
n
di
st
resse
d
regi
ons ca
n
not
be o
v
e
r
st
at
ed.
B
a
si
c el
em
ent
s
of
IC
T [
1
]
have bec
o
m
e
expect
e
d
a
nd essent
i
a
l
l
y
m
a
ndat
o
ry
re
so
ur
ces i
n
de
vel
o
p
e
d nat
i
ons
w
h
i
l
e
m
a
ny
part
s
of t
h
e
gl
o
b
e rem
a
i
n
vi
rt
ual
l
y
i
s
ol
at
ed. T
h
ere a
r
e
m
a
ny
fact
ors
t
h
at
have c
o
nt
ri
b
u
t
e
d t
o
t
h
e cu
rre
nt
st
at
e, and
th
erefore th
e lack
o
f
co
nn
ectiv
ity and
co
m
p
u
tin
g resou
r
ces is no
t surprisin
g
.
As t
h
e
u
s
e
o
f
ICT in
v
i
rt
ually al
l
facets of life
in devel
o
ped
nations has c
ontinue
d to
grow, the call to introd
uce the sa
m
e
information
t
echn
o
l
o
gi
es i
n
t
o
u
nde
vel
o
p
e
d re
gi
o
n
s
has
bec
o
m
e
i
n
creasi
ngl
y
u
r
gent
.
To
day
we a
r
e pre
s
ent
e
d wi
t
h
t
h
e
op
p
o
rt
uni
t
y
t
o
m
a
ke pot
e
n
t
i
a
l
l
y
hi
st
ori
c
and
wi
des
p
rea
d
i
m
provem
e
nt
s in t
h
e l
i
v
es o
f
m
i
ll
i
ons by
ext
e
ndi
n
g
the reac
h of te
chnologies s
u
c
h
as
broadba
n
d net
w
orki
ng to drive acce
ss
to hea
lthca
re, e-governm
ent, and
educat
i
o
n re
so
urces t
h
at
wo
ul
d
ot
her
w
i
s
e
neve
r reac
h
t
hose
wh
o ar
gua
bl
y
nee
d
t
hos
e m
o
st
. Despi
t
e
t
r
em
endous
p
r
og
ress,
t
h
e
de
p
l
oym
ent
of
IC
T f
o
r
de
vel
o
p
m
ent
has
pr
o
v
e
n t
o
be
a si
gn
i
f
i
cant
chal
l
e
n
g
e.
Thi
s
is du
e to fact
ors su
ch
as
h
i
gh
co
sts
o
f
tech
no
log
i
es, reg
i
o
n
a
l
sho
r
tag
e
s in
a
sk
illed
l
a
b
o
r
po
o
l
t
o
su
ppo
rt
depl
oy
m
e
nt
, poo
r p
h
y
s
i
cal
securi
t
y
an
d i
n
som
e
cases arm
e
d confl
i
c
t
,
and
ot
he
rs A
n
ar
ray
of a
d
d
i
t
i
onal
eco
no
m
i
c, p
o
litical, an
d
so
cial ch
allen
g
e
s
h
a
s co
n
t
ri
b
u
t
ed
to
th
e d
i
fficu
lties. In
t
o
d
a
y's scen
ari
o
, rap
i
d
g
r
o
w
t
h
of
reg
u
l
a
t
i
ons
suc
h
as i
n
t
e
r
n
a
t
i
onal
an
d d
o
m
e
st
i
c
regul
at
i
o
ns an
d m
oder
n
wo
rl
d m
a
rket
are ap
pr
o
p
ri
at
e
i
n
t
h
e
n
a
tio
n wh
ere
activ
ities o
f
bu
sin
e
sses are
co
ndu
cted
t
o
mak
e
risk
m
a
n
a
g
e
m
e
n
t
a prerequ
i
site fo
r
stab
le
busi
n
ess.
The
una
v
o
i
d
a
b
l
e
p
a
rt
of e
v
e
r
y
b
u
si
ness
act
i
v
i
t
y
i.e. risk
s
with
in
th
e
IT sy
st
e
m
are also a part
of
m
a
nagem
e
nt
and
ri
sk m
a
nage
m
e
nt
pr
ocess.
R
i
sk t
r
eat
m
e
nt
wi
t
h
i
n
t
h
e
IT s
y
st
em
i
s
predo
m
i
n
ant
l
y
val
u
a
b
l
e
as
because
of t
h
e
vibra
n
t nat
u
re
of intim
idatio
n a
n
d acceler
a
t
ed de
vel
opm
ent of tec
h
no
logy [2]. T
h
e la
ck
of
ab
ility o
f
ti
m
e
ly ap
p
r
eciation o
f
all scen
ario
s wh
ich
b
r
i
n
g
s
threat to
IT syste
m
s can
effect in
u
n
p
r
od
u
c
tiv
e
and e
x
pensi
v
e
securi
t
y
pr
oce
d
u
r
es.
An i
m
port
a
nt
charact
e
r
i
s
t
i
c
i
n
t
h
e de
pl
oy
m
e
nt
of an
y
i
n
fo
rm
ati
on sy
st
em
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
IJEC
E V
o
l
.
6, No
. 1, Feb
r
uar
y
20
1
6
:
34
9 – 35
6
35
0
is reliab
ilit
y.
Th
ere is a n
e
ed
for resilient ICT. Stated
an
o
t
h
e
r way,
max
i
m
i
zin
g
resilien
c
y in
IC
T will
co
n
t
ribu
te to
max
i
m
i
zin
g
retu
rn
on
ICT i
n
v
e
stm
e
n
t
as
a reliab
l
e syste
m
th
at will
meet ex
p
ectatio
n
s
i
n
deliveri
n
g crit
ical services
m
o
re closely. Today ris
k
i
s
g
e
n
e
rally increasing
d
u
e
to
th
e ch
alleng
es
o
f
globalization, t
echnological c
o
m
p
lex
ity, increased tec
hnical
and process i
n
t
e
rde
p
en
de
nci
e
s, an
d
ot
he
r f
a
c
t
ors.
The p
r
op
ose
d
pape
r di
sc
usse
s abo
u
t
suc
h
new m
odel
.
T
h
e pa
per
pres
ent
s
a
m
a
t
h
em
at
i
cal
m
odel
of ri
s
k
id
en
tificatio
n
&
mitig
atio
n
.
Sectio
n-1.1
d
i
scu
sses
abo
u
t
t
h
e b
a
ckg
r
ou
nd o
f
t
h
e stud
y discu
ssing
an
im
p
act o
f
t
h
e ri
sk fact
ors
on t
h
e st
an
da
r
d
m
odel
s
fol
l
o
wed
by
pr
o
b
l
e
m
i
d
ent
i
f
i
cat
i
on di
sc
ussi
o
n
o
n
Sect
i
o
n
-
2 di
s
c
usses
ab
ou
t Resu
lt
Discu
ssi
on
. Fi
n
a
lly, so
m
e
con
c
lud
i
ng
rem
a
rk
s are m
a
d
e
in
Sectio
n-3.
1.
1. B
a
ck
gr
ou
nd
It is v
e
ry i
m
p
o
rtan
t to
cho
s
e
a rig
h
t
m
o
d
e
l for m
i
tig
atin
g
requ
irem
en
t v
o
l
atility
in
th
e field
of risk
sche
dul
i
n
g
pr
o
cess, as al
rea
d
y
reso
urces a
n
d cost
a
r
e de
p
l
oy
ed i
n
t
h
e
r
i
sk sche
d
u
l
i
n
g
pr
ocess a
nd i
f
i
n
appropriate m
o
del is selected, then,
ot
her than
slicin
g
do
wn
th
e co
st and
sch
e
d
u
l
e, it can
in
crem
en
t it.
It h
a
s
been see
n
t
h
at
t
h
e st
ruct
u
r
e, c
a
t
e
go
ri
zat
i
on a
nd
voca
b
ul
ary
of pa
ram
e
t
e
rs
and m
e
t
r
i
c
s appl
i
cabl
e
t
o
soft
ware
q
u
a
lity m
a
n
a
g
e
m
e
n
t
h
a
v
e
b
e
en
d
e
riv
e
d
o
r
ex
tracted
fro
m
th
e ISO
9
126-3
and
th
e subsequ
e
n
t
2
500
0:2
005
q
u
a
lity
m
o
d
e
l [3
] [4
] [5
]. In
th
e area of In
fo
rm
atio
n
tech
no
log
y
, software p
r
o
cess im
p
r
o
v
e
m
e
n
t
is a maj
o
r
conce
p
t
i
o
n a
n
d i
t
h
a
s act
ual
l
y
a p
o
t
e
nt
i
a
l
o
f
m
i
ti
gat
i
ng
va
ri
o
u
s s
o
ft
ware
pr
o
j
ect
ri
s
k
sc
hed
u
l
i
n
g i
n
t
e
r
m
s of
requirem
ent volatility prom
in
ently [6]
[7].
Am
ong t
h
e e
n
t
i
re quality st
andards, the
frequently
used sta
nda
rds
are ISO standard
s, To
tal Qu
ality Man
a
g
e
men
t
(TQM
),
Kaizen
, and
C
a
p
a
b
ility Matu
rity Mo
d
e
l
(CMM).
M
a
jo
ri
t
y
of t
h
e M
N
C
o
r
ga
ni
zat
i
on i
s
seen
to
practice CMM wh
ich
is
d
e
sign
ed
b
y
So
ft
ware Eng
i
neering
In
stitu
te
(SEI). CMMI (Cap
ab
ility Matu
rity
Mod
e
l In
tegratio
n
)
wh
ich facilitates o
r
g
a
n
i
zatio
n
s
t
o
g
a
u
g
e
th
ei
r
“
m
atu
r
ity” o
n
a scale o
f
o
n
e
to
fiv
e
which
is rep
r
esen
ted
as in
itial, rep
eatab
le,
defin
e
d
,
m
a
n
a
g
e
d
and
optim
izing in worki
n
g on software
enginee
r
ing. E
n
hancem
ent is accom
p
li
she
d
by action
policy for ne
gl
ecte
d
areas. R
e
qui
re
m
e
nt
speci
fi
cat
i
on i
s
ve
ry
fre
q
u
ent
l
y
i
s
ne
ve
r
pre
d
i
c
t
a
bl
e as i
t
i
s
uni
fo
rm
ly
chan
gi
n
g
al
on
g
wi
t
h
th
e p
r
oj
ect d
e
v
e
lop
m
en
t is i
n
prog
ress. Such
typ
e
s of org
a
n
i
zation
s
in
th
is lev
e
l d
o
no
t h
a
ve an
efficien
t
p
r
oj
ect
m
a
n
a
ge
m
e
n
t
p
r
o
c
esses in
clu
d
i
n
g
risk
sch
e
d
u
l
i
n
g p
r
o
cess and
will n
o
t
sup
p
o
r
t app
r
op
riat
e risk
sche
dul
i
n
g.
The
fu
n
d
am
ent
a
l
of t
h
e
p
r
o
j
ect
m
a
nagem
e
nt
p
r
oce
sses are firm
ly estab
lish
e
d
in th
e seco
nd
lev
e
l
whe
r
e m
a
nagi
ng a
n
d pl
an
ni
ng
of
new
req
u
i
r
em
ent
i
s
based o
n
p
r
e
v
i
o
u
s
l
y
m
a
i
n
t
a
i
n
ed
reco
rds a
nd l
e
vel
of
accom
p
lish
m
e
n
ts in past
wi
ll be re
peate
d
. So this le
vel can
assure m
o
re
error
free
results c
o
m
p
ared to
pre
v
i
o
us l
e
vel
i
n
ri
s
k
sc
hed
u
l
i
ng
[9]
[1
0]
. T
h
i
s
l
e
vel
l
a
c
k
s
t
h
e su
p
p
o
r
t
of
or
ga
ni
zed a
n
d
doc
um
ent
e
d pl
an f
o
r
ri
sk m
a
nagem
e
nt
t
h
o
u
gh
fi
rst
m
odel
can be
m
echani
zed i
n
t
h
i
s
st
age.
Al
o
ng a
di
st
i
n
ct
i
o
n wi
t
h
pre
v
i
o
u
s
l
e
vel
,
t
h
i
s
l
e
vel
can l
e
t
t
h
e organi
z
a
t
i
on t
o
use se
con
d
m
odel
as t
h
ey
execut
e
s requi
rem
e
nt
m
a
nagem
e
nt
proces
s
here
. S
o
ft
wa
re
Pro
d
u
ct
En
gi
neeri
ng
of l
e
v
e
l
2 rec
o
m
m
e
nds t
h
at
t
h
e r
e
qui
rem
e
nt
do
cum
e
nt
s be m
a
nage
d
t
h
r
o
u
g
h
versi
o
n-c
o
nt
rol
an
d
chan
ge co
nt
r
o
l
pract
i
ces, t
h
i
s
can hel
p
i
n
cal
cul
a
t
i
ng m
e
t
r
i
c
s whi
c
h a
r
e re
qui
red
for secon
d
m
o
d
e
l to
avo
i
d the m
o
st frequ
ent p
r
ob
lem
o
f
req
u
i
rem
e
n
t
v
o
l
atili
ty.
It can
b
e
ev
enly said
th
at a
co
m
p
an
y with a
d
i
stin
ct set
o
f
qu
ality stand
a
rd
s
fo
r risk
man
a
g
e
m
e
n
t
p
r
o
cesses an
d
p
r
ov
id
es m
ech
an
ism
to
su
pp
ort for ex
ecu
tin
g
su
ch
qu
ality
stan
d
a
rds can
b
e
con
s
id
ered
as
m
o
re
matu
re th
an
a co
m
p
an
y with
on
ly in
fo
rm
al stan
d
a
rd
defin
itio
n
s
. Fo
r o
v
e
rco
m
in
g
th
e risk
issu
es lik
e
requirem
ent volatili
ty, any undoc
um
ented ri
sk related
pa
ra
meters cannot
be accounted t
o
m
i
tigate risks. The
devel
opm
ent
s
cenari
o
m
u
st
al
l
o
ws
pr
o
p
er
d
o
cum
e
nt
at
i
on
of
al
l
t
h
e st
e
p
s o
f
t
h
e
re
q
u
i
r
em
ent
un
de
rst
a
ndi
ng
fr
om
t
h
e cl
i
e
nt
as wel
l
as al
l
t
h
e f
o
rm
al
com
m
uni
cat
i
on f
o
r
re
qui
rem
e
nt
s wi
t
h
cl
i
e
nt
a
nd t
h
e
devel
o
p
m
ent
tea
m
sh
ou
ld
be pr
op
er
ly an
al
yzed
and do
cumen
t
ed
to
avoi
d
requirem
ent change i
n
t
h
e
progress
stage
of the
ICT
s
o
ft
ware p
r
o
j
ect devel
o
p
m
ent.
1.
2. T
h
e Pr
obl
em
As t
h
e ra
n
g
e
and c
o
m
p
l
e
xi
t
y
of com
put
er ap
pl
i
cat
i
ons
ha
ve g
r
o
w
n
,
t
h
e cost
of so
ft
wa
re
devel
opm
ent
h
a
s becom
e
t
h
e
m
a
jor e
xpe
ns
e of c
o
m
put
er
-base
d
systems. Researc
h
shows t
h
at in private
i
n
d
u
st
ry
as
we
l
l
as i
n
go
ver
n
m
e
nt
envi
ro
nm
ent
s
, sc
he
dul
e
and
co
st
o
v
er
r
uns
are
t
r
a
g
i
cal
l
y
co
m
m
on. D
e
spi
t
e
i
m
provem
ents
in tools a
n
d
methodologies, there is
little
evide
n
ce of success in
im
proving the
proce
ss of
m
o
v
i
n
g
fro
m
th
e con
cep
t
to
th
e pro
d
u
c
t, and
little p
r
og
ress
h
a
s b
een
m
a
d
e
in
m
a
n
a
g
i
n
g
so
ft
ware
devel
opm
ent
pro
j
ect
s. R
e
sear
ch sh
ows t
h
at
45
perce
n
t
of
al
l
t
h
e causes
fo
r del
a
y
e
d so
ft
ware
del
i
v
eri
e
s are
related to
organizational iss
u
es. Des
p
ite t
h
e
recent
im
p
r
ovem
ents introduce
d
i
n
s
o
ftware
proces
s
e
s and
aut
o
m
a
t
e
d t
ool
s, ri
sk a
ssessm
ent
f
o
r s
o
ft
war
e
pr
o
j
ect
s rem
a
i
n
s an
u
n
st
r
u
c
t
ure
d
p
r
o
b
l
e
m
depe
n
d
ent
on
hum
an
ex
p
e
rtise. Th
e
acq
u
i
sition
and
d
e
v
e
l
o
p
m
en
t co
mm
u
n
ities, b
o
t
h
g
o
v
e
rn
m
e
n
t
al and
indu
st
rial, lack
systemati
c
ways
o
f
id
en
tifyin
g
,
co
mm
u
n
i
catin
g
and
resolv
in
g techn
i
cal un
certain
ty. So
lv
ing th
e
risk
assessm
en
t p
r
ob
lem
with
ind
i
cato
r
s
m
easu
r
ed
i
n
th
e early ph
ases wou
l
d
con
s
titu
te a g
r
eat b
e
nefit to
so
ft
ware en
g
i
n
eeri
n
g. In
th
ese
earl
y
phases
,
c
h
an
ges ca
n be
m
a
de wi
t
h
t
h
e
l
east
im
pact
o
n
t
h
e b
u
dget
a
nd sc
he
dul
e. P
a
rt
of t
h
e
pr
o
b
l
em
is
m
i
si
nt
erpret
i
n
g
t
h
e i
m
port
a
nc
e of
ri
s
k
m
a
nagem
e
nt
. A sec
o
n
d
s
o
urce
o
f
pr
o
b
l
e
m
s
i
n
ri
sk m
a
nagem
e
nt i
s
t
h
e
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ECE
I
S
SN
:
208
8-8
7
0
8
3LRM
-3 Layer
Risk Mitigation M
o
delling
of ICT Software
Developme
nt
P
r
ojects
(
Sal
ma
Fi
rdo
s
e)
35
1
lack
of t
o
o
l
s.
Th
e m
a
in
reaso
n
fo
r th
is lack
o
f
too
l
s
is t
h
at ris
k
asse
ss
ment is appare
ntly an
unstructure
d
pr
o
b
l
e
m
.
To s
y
st
em
ati
ze uns
t
r
uct
u
red
pr
ob
l
e
m
s
i
t
i
s
necessary
t
o
de
fi
ne st
r
u
ct
u
r
e
d
pr
ocesses
.
St
r
u
ct
u
r
ed
p
r
o
cesses i
n
vo
lv
e rou
tin
e
an
d
rep
e
titiv
e p
r
o
b
l
em
s fo
r wh
ich
a stan
d
a
rd
so
l
u
tio
n ex
ists. Un
stru
ctured
processes
re
quire decision-m
aking ba
sed
on a three
-
phas
e m
e
thod (intelligence
,
design
,
choice
) [12] [13]. An
unst
r
uct
u
re
d
p
r
o
b
l
e
m
i
s
one
i
n
w
h
i
c
h
n
o
n
e
o
f
t
h
e t
h
ree
p
h
ases
i
s
st
r
u
ct
ure
d
. C
u
r
r
e
n
t
ap
pr
oache
s
t
o
ri
sk
m
a
nagem
e
nt
are hi
g
h
l
y
sensi
t
i
v
e t
o
m
a
nager’s
perce
p
t
i
o
ns
and
pre
f
ere
n
c
e
s, w
h
i
c
h a
r
e
di
ffi
c
u
l
t
t
o
re
p
r
esent
by
an al
go
ri
t
h
m
.
Depen
d
i
n
g
on t
h
e d
ecisi
on-m
akers attitude towards risk,
he or she
can decide ea
rly with
litt
le in
fo
rm
ati
o
n, or can
po
stp
o
n
e
th
e
d
ecisio
n
, g
a
i
n
ing
ti
m
e
to
o
b
t
ain
m
o
re in
form
at
io
n
,
bu
t lo
sing so
m
e
cont
rol
.
A t
h
i
r
d so
urce o
f
ri
s
k
m
a
nagem
e
nt
pro
b
l
e
m
s
i
s
t
h
e conf
usi
on cr
eat
ed by
t
h
e i
n
fo
rm
al use of t
e
rm
s.
Oft
e
n, t
h
e s
o
ft
ware e
n
gi
neeri
ng c
o
m
m
uni
t
y
(an
d
m
o
st
par
t
s of t
h
e
p
r
o
j
e
c
t
m
a
nagem
e
nt
com
m
uni
t
y
u
s
es t
h
e
t
e
rm
"ri
s
k" casual
l
y
. Thi
s
t
e
rm
i
s
oft
e
n us
ed t
o
desc
ri
be
di
ffer
e
nt
co
n
cept
s
. It
i
s
err
one
o
u
sl
y
used
as a
sy
no
ny
m
of "unce
r
t
a
i
n
t
y
" and "t
h
r
eat
" [1
4]
[1
5]
. Ge
ner
a
l
l
y
, soft
ware
ri
sk i
s
vi
ewe
d
as a
m
easure of t
h
e
l
i
k
el
i
hoo
d
of
an u
n
sat
i
s
fact
ory
o
u
t
c
om
e and a l
o
ss a
ffe
ct
i
ng t
h
e so
ft
ware f
r
o
m
di
f
f
ere
n
t
poi
nt
s of
vi
ew:
pr
o
j
ect
, pr
oce
ss, an
d pr
o
d
u
c
t
.
Ho
weve
r,
t
h
i
s
defi
ni
t
i
o
n
of ri
sk i
s
m
i
sl
eadi
n
g beca
use i
t
conf
o
u
nds t
h
e
conce
p
t
s
of
ri
sk an
d
unce
r
t
a
i
n
t
y
. In
ge
neral
,
m
o
st
part
s of
deci
si
o
n
-m
aki
ng i
n
so
ft
wa
re
pr
ocesses a
r
e
un
de
r
u
n
c
ertain
ty rat
h
er th
an
un
d
e
r risk
.
Un
certai
n
ty is a
situ
atio
n in wh
ich t
h
e
p
r
ob
ab
ility d
i
stri
b
u
tion
fo
r th
e
p
o
s
sib
l
e ou
tcomes is n
o
t
kno
wn
.
We ad
dress th
e issu
e
o
f
risk
assessmen
t
b
y
esti
matin
g
th
e
p
r
obab
ility
d
i
str
i
bu
tio
n
for
th
e po
ssib
l
e ou
tco
m
es
o
f
a pr
oj
ect, b
a
sed
on observed values of
m
e
trics
that
can
be
m
e
asure
d
early in t
h
e
process. T
h
e m
e
trics we
re c
hosen
base
d
on
a causal
analy
s
is to i
d
en
tify
th
e m
o
st im
p
o
rtan
t
th
reats and
a statistical an
alys
is to
ch
oo
se the sh
ap
e
o
f
t
h
e p
r
ob
ab
ility d
i
stribu
tio
n
an
d
relate its p
a
ra
m
e
t
e
rs to
read
ily m
easu
r
ab
le m
e
trics.
1.
3. T
h
e Pr
op
osed
Sol
u
ti
o
n
Th
e
p
r
im
e g
o
al o
f
th
e
p
r
opo
sed
stud
y is
to
presen
t a math
em
at
ical
mo
d
e
lling
o
f
risk
m
i
t
i
g
a
tio
n
schem
a
consi
d
eri
n
g t
h
e real
-t
im
e project
m
a
nagem
e
nt
i
ssu
es of ICT s
o
ftware
pr
o
j
ect developm
ent. The study
i
s
done f
r
o
m
soft
ware en
gi
ne
eri
n
g vi
ew
poi
n
t
. The pr
o
pose
d
m
odel
prese
n
t
s
3 l
a
y
e
r of m
i
ti
gat
i
on ap
p
r
oac
h
i
n
risk
m
a
n
a
g
e
men
t
and
h
e
n
ce
is ter
m
ed
as 3LRM Mo
d
e
l,
wh
ich
m
ean
3
-
layer o
f
Risk
Mitig
atio
n
Mod
e
l. Th
e
di
scussi
o
n
s
on
t
h
e 3
i
n
di
vi
dua
l
l
a
y
e
rs are st
at
ed
bel
o
w:
1.
3.
1. L
a
yer-
1
Appr
o
a
ch
Th
is is pr
eli
m
i
n
ar
y layer
under
d
i
scu
ssion
w
h
ich
is b
a
sically a f
r
a
m
e
w
o
rk
fo
r
i
d
en
tifyin
g
I
C
T
r
i
sk
i
n
v
o
l
v
e
d
i
n
pr
oject
de
vel
o
p
m
ent
pert
ai
ni
n
g
t
o
soft
ware
engi
neeri
n
g.
Prim
arily
is
th
i
s
layer, p
r
oj
ects an
d
envi
ro
nm
ent are ren
d
e
r
ed
ve
ry
m
u
ch dissi
m
ilar from
th
e instance when the work is
presented. Secondarily,
technology as well as organiz
a
tion st
ructure
is assum
e
d to have e
n
orm
ous
ly unde
rgone c
h
ange
d. T
h
at will be
the rea
s
on t
h
at
an a
n
alysis to
discover
uni
ve
rsal re
quirem
e
n
t volatility r
ecord i
n
recent
devel
opm
ent has bee
n
p
e
rform
e
d
with
th
e certain
ob
j
ectives. Fi
rst g
o
a
l
o
f
t
h
is
layer is to
find
t
h
e p
a
ram
e
ter, wh
ich
pro
j
ect l
ead
ers,
d
i
stin
gu
ish
e
s as risk and
also
id
en
tifying
th
at wh
ich
fact
o
r
s are m
o
re
v
ital in
v
i
ew
of project leade
r
s.
Se
cond
is to classify risk pa
ram
e
ters
in a way that c
o
mm
on
im
provem
e
nt policy
can be us
e
d
for each classification.
R
o
b
u
st
ass
o
ci
at
i
on bet
w
ee
n
im
port
a
nce
o
f
m
i
t
i
g
at
i
ng i
m
preci
se requ
i
r
em
ent
and appa
re
nt
i
n
t
e
ns
i
t
y
of
m
a
nagi
n
g
was
obs
er
ved
ve
ry
cruci
a
l
;
as e
v
e
n
wi
t
h
hi
g
h
ri
s
k
, l
o
w
ap
pare
n
t
i
n
t
e
nsi
t
y
of
p
r
o
j
ect
ri
s
k
sc
he
dul
i
n
g
p
e
rm
its a few
for en
co
un
teri
n
g
th
at ICT
p
r
o
j
ect risk
. Th
is is a v
e
ry si
m
p
listic an
d
i
m
p
l
e
m
en
tab
l
e laye
r th
at
will su
b
s
tan
tially co
n
cen
trates o
n
sch
e
du
lin
g risk
related
to a v
e
ry v
a
g
u
e
o
r
im
p
r
ecise req
u
i
rem
e
n
t
s o
n
l
y are
hi
g
h
l
y
qual
i
f
i
e
d pr
o
f
essi
o
n
al
s. The w
o
r
k
has an i
m
port
a
nce o
f
sche
d
u
l
i
ng ri
s
k
an
d
vari
o
u
s i
n
t
e
n
s
i
t
y
of
managing a
project those te
chnical leade
r
s has. Ba
sically, it recommends an
a
n
aly
tical fram
e
work for
sch
e
d
u
ling
risk
with
resp
ect
to
requ
irem
en
t v
o
l
atility
fo
r
d
i
v
e
rsified
types o
f
o
t
h
e
r
risk
classificatio
ns with
Strategical s
o
lution for each
classification
of ris
k
.
1.
3.
2. L
a
yer-
2
Appr
o
a
ch
Th
is is th
e seco
nd
layer
un
der
d
i
scussion
w
h
ich
is about
a form
at risk
assessm
ent fram
e
work for
an
alyzin
g
software eng
i
n
e
erin
g
.
In
case
o
f
trad
ition
a
l so
ft
ware
d
e
v
e
lo
p
m
en
t, ICT p
r
oj
ect req
u
i
rem
e
n
t
fre
que
ntly cha
nge
s as
developm
ent proceeds. In
fact the
s
u
rfacing viewpoint
has now
turned into the sta
nda
rd
i
n
IC
T p
r
o
j
ect
ri
sk m
a
nagem
e
nt
an
d as suc
h
a q
u
ery
o
f
s
c
hed
u
l
e
an
d e
xpe
n
d
i
t
u
re
ove
rr
un
bec
o
m
e
s
seri
o
u
s
wh
ere t
h
e so
lutio
n
lies in ex
ecu
tin
g appropriate risk
sc
h
e
du
lin
g. Recen
tly early req
u
i
remen
t
v
o
l
atility
is an
am
orp
h
ous
pr
o
b
l
e
m
,
whi
c
h d
e
pen
d
s
on i
n
di
vi
d
u
al
h
u
m
a
n
ju
d
g
m
e
nt
s and
un
reaso
n
a
b
l
e
hy
p
o
t
h
esi
s
s
u
c
h
as,
n
o
t
alterin
g
n
e
cessities
an
d work b
r
eakd
own
stru
cture.
To
h
i
gh
ligh
t
su
ch issues,
risk
assessm
en
t h
a
s t
o
b
e
m
o
re o
r
d
e
red
,
efficien
t, and
go
al orien
t
ed
. Th
ere is
no
co
nsid
eration
o
f
req
u
i
rem
e
n
t
v
o
l
atili
ty in
th
e ex
i
s
tin
g
m
odel
s
, whi
c
h
i
s
one
o
f
t
h
e
si
gni
fi
cant
para
m
e
t
e
r i
n
IC
T
p
r
o
j
ect
s.
Som
e
ot
he
r i
m
port
a
n
t
param
e
t
e
rs w
e
re al
so
n
o
t
con
s
id
ered lik
e co
m
p
lex
ity o
f
th
e project, sk
ill g
a
p
an
alysis, hu
m
a
n
resou
r
ces, an
d efficien
cy
o
f
t
h
e
project team
invol
ved. T
h
is la
yer is
basically form
ulated to
analyze and a
d
dress
all these
critical issues.
This
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
IJEC
E V
o
l
.
6, No
. 1, Feb
r
uar
y
20
1
6
:
34
9 – 35
6
35
2
layer is b
a
sed
o
n
requ
irem
en
t v
o
l
atility, com
p
lex
i
t
y
an
d
efficien
cy. The Requ
irem
en
t vo
latility (
α
) can
be
est
i
m
a
t
e
d by
sum
m
i
ng u
p
R
e
qui
rem
e
nt
B
i
rth R
a
t
e
(
β
) an
d
R
e
qui
rem
e
nt
Deat
h R
a
t
e
(
γ
)
of the ICT s
o
ftware
project, a
n
d ca
n
be m
a
the
m
atically represe
n
ted as
,
(
1
)
}
100
.
{
}
100
.
{
(
2
)
Whe
r
e,
σ
represents num
b
er of ne
w re
quirem
ents,
η
represe
n
t
s
n
u
m
b
er o
f
re
qui
re
m
e
nt
s del
e
t
e
d,
and
ω
r
e
pr
esen
ts gr
oss nu
m
b
er
of
r
e
qu
ir
em
en
ts.
A
s
th
e pr
opo
sed
stud
y r
e
vo
l
v
es ar
oun
d
sof
t
w
a
r
e
eng
i
n
e
er
ing
,
wh
ere
u
n
d
e
rstan
d
a
b
ility, learnab
ility, an
d
operab
ility are some
o
f
th
e prime attrib
u
t
es i
n
m
o
d
e
llin
g
,
h
e
nce, its
co
m
p
lex
ity-facto
r
o
f
th
e risk
a
r
e em
pirically
represe
n
ted as:
3
2
1
F
C
(
3
)
Whe
r
e,
δ
1
= No. of state
m
achine
δ
2
= No. of dat
a
connecti
o
n
between operat
or
δ
3
= No. o
f
ab
stract
d
a
ta
typ
e
requ
ired
for
the
syste
m
Fin
a
lly, th
e syste
m
will co
m
p
u
t
e pro
d
u
c
tiv
ity o
f
th
e layer-2 app
r
o
a
ch
b
y
usin
g eq (6
)
Produ
ctiv
ity =
Direct Lab
o
r
Ti
m
e
/ Id
le Time
(4)
As
per
t
h
e
m
odel
,
a
ra
n
dom
vari
a
b
l
e
x
is said
to h
a
v
e
a
rando
m
p
r
ob
ab
ility d
i
strib
u
t
i
o
n wit
h
th
e
param
e
ter
Ω
1
,
Ω
2
and
Ω
3
(with
α
> 0,
β
> 0
)
pro
b
a
b
i
lity d
i
strib
u
tio
n
fu
n
c
tion
(PDF) and
cu
m
u
lativ
e
d
i
stribu
tio
n fun
c
tio
n (C
DF) are
o
f
x
are
res
p
ectively.
)
)
/
)
((
exp(
)
(
)
/
(
0
)
,
,
:
(
1
1
1
2
3
1
3
2
1
3
2
1
x
x
x
f
(
5
)
)
)
/
)
((
exp(
1
(
0
)
,
,
:
(
1
2
3
3
2
1
x
x
f
(
6
)
Th
e abo
v
e
equatio
n
s
(7) and
(8) sho
w
s PDF and
C
D
F
wh
ere th
e first cond
itio
n is v
a
li
d
for
(x
<
Ω
3)
,
wh
ile th
e secon
d
co
nd
itio
n
i
s
v
a
lid
for (x
Ω
3
)
. T
h
e ra
nd
om
vari
abl
e
un
der st
u
d
y
,
x can be i
n
t
e
r
p
ret
e
d as
devel
opm
ent
tim
e
i
n
our c
o
nt
ext
.
T
h
e sha
p
e param
e
t
e
r
Ω
1
con
t
ro
ls th
e sk
ew of th
e PDF, wh
ich
is n
o
t
sy
mm
e
t
ric.
We fo
und
th
at
this is m
o
stly rel
a
ted
to
th
e
prod
u
c
tiv
ity
o
f
t
h
e org
a
n
i
zatio
n. Th
e scale
p
a
ra
m
e
ter
Ω
2 st
ret
c
hes
o
r
c
o
m
p
resses t
h
e
gra
p
h i
n
t
h
e x
di
r
ect
i
o
n
.
I
t
can
b
e
seen t
h
at th
is p
a
rameter is
related
to
th
e
p
r
od
u
c
tiv
ity (P), requ
irem
en
ts v
o
l
atility (
α
),
an
d co
m
p
lex
ity (CF).
Th
e sh
i
f
tin
g
p
a
ram
e
te
r
Ω
3 sh
i
f
ts th
e
o
r
i
g
in
o
f
th
e cu
rv
es to
th
e righ
t. This
m
o
d
e
l is p
e
rfectly su
i
t
e
d for p
r
oject
s
,
w
h
i
c
h are ev
ol
ut
i
ona
ry
i
n
nat
u
r
e
. Th
e
resul
t
s
of
t
h
e m
odel
can
b
e
v
a
l
i
d
at
ed by
C
O
C
O
M
O
[1
6]
[
1
7]
.
1.
3.
3. L
a
yer-
3
Appr
o
a
ch
The t
h
ird layer is about s
o
ftware ris
k
asse
ss
ment
whic
h highlights
a
n
iss
u
e of uns
u
cces
sful failure
fo
r
desi
g
n
i
n
g
p
r
o
d
u
ct
wi
t
h
i
n
s
p
eci
fi
ed
t
i
m
e
fram
e
and al
l
o
c
a
t
e
d c
o
st
.
It
al
s
o
di
scus
ses a
n
ot
he
r
pr
obl
em
whi
c
h
eith
er th
e prod
u
c
t is in
acco
r
d
a
n
ce to
clien
t
’s co
nd
ition
alon
g
with
th
eir satisfaction
lev
e
l. It assu
m
e
s 9
p
a
ram
e
ters
which
g
i
v
e
b
i
rth
o
f
d
i
versified
categ
ory
of
req
u
i
rem
e
n
t
v
o
l
atili
ty in
th
e stag
e
o
f
n
e
ar co
mp
letio
n
o
f
th
e ICT project an
d
will th
en
d
e
fi
n
itely in
flu
e
n
ce th
e d
e
fin
e
d
proj
ect d
e
v
e
lop
m
en
t t
i
m
etab
le, q
u
a
lity alo
ng
wi
t
h
cost
i
n
v
o
l
v
ed
. Param
e
t
e
rs are pr
od
uct
’
s
com
p
l
e
xi
t
y
, h
u
m
a
n resou
r
ce
s i
nvol
vem
e
nt
i
n
t
h
e IC
T pr
o
j
ect
,
targets for
reliability, require
m
e
nt of product, cost
estim
a
tion m
e
thodol
ogy,
pro
cess m
onitoring,
softwa
re
devel
opm
ent life cycle adopted, softwa
re
usa
b
ility a
nd project de
velopm
ent tec
hnol
ogy. It
associa
t
es
the
C
l
i
e
nt
’s Fee
d
b
ack
In
de
x
wi
t
h
t
h
e
pr
o
j
ect
w
hol
es
om
e ri
sk
and
o
ffe
rs
f
o
llowi
ng
im
plications
. For exam
ple if
Client’s Fee
d
back Inde
x is le
ss tha
n
5, t
h
an
we ca
n ca
ll tha
t
project is not
acceptable, if it is betwee
n
5 a
n
d
10
t
h
en t
h
e p
r
o
j
ec
t
m
a
y
be ende
d wi
t
h
fa
r-
reac
hi
n
g
sc
hed
u
l
e
and
su
bst
a
n
d
a
r
d.
If i
t
i
s
bet
w
een 1
5
a
n
d 1
0
t
h
en
p
r
oj
ect co
m
p
leted
with
i
n
du
e sp
ecified
d
a
tes in
p
r
e-allo
cat
ed c
o
st a
n
d as
per term
s and
specifications
of the
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ECE
I
S
SN
:
208
8-8
7
0
8
3LRM
-3 Layer
Risk Mitigation M
o
delling
of ICT Software
Developme
nt
P
r
ojects
(
Sal
ma
Fi
rdo
s
e)
35
3
client. For eval
uation t
h
e project
m
a
nager a
n
swers t
h
e ques
tionnai
r
e, rec
o
m
m
e
nded by t
h
is m
odel, according
to
th
e typ
e
o
f
th
e proj
ect. Esti
m
a
te
th
e statistical v
a
lue connected
with the sel
ected c
hoice.
Eval
uate the
no
rm
al
i
zed fi
gure f
o
r eac
h o
f
t
h
e ni
ne ri
sk
param
e
t
e
rs by
appen
d
i
n
g t
h
e st
at
i
s
t
i
cal scores
of t
h
e q
u
est
i
o
n
pr
o
j
ect
m
a
nag
e
r t
r
i
e
d an
d
b
y
di
vi
di
n
g
t
h
e
t
o
t
a
l
num
ber of q
u
e
r
y
t
r
i
e
d. T
h
en est
i
m
at
e t
h
e no
rm
al
i
zed
requ
irem
en
t volatili
ty fo
r t
h
e
p
r
oj
ect b
y
u
s
ing
fo
llo
wing
form
u
l
a fo
r
Normalized
Requ
iremen
t Vo
latility
min
max
min
norm
(
7
)
It
gi
ve
s an
o
b
j
ect
i
v
e
num
eri
cal
fi
gu
re
fo
r
ni
ne
a
r
eas
of the project a
nd
also
recom
m
ended an
em
pirical for
m
ula to evalu
a
te for
e
n
t
i
r
e pr
o
j
ect
usi
n
g
t
h
e ni
ne
-ri
s
k
param
e
t
e
r of t
h
e p
r
o
j
ect
. It
can be
estim
a
ted. It a
ssociates the risk
value
with the custom
er
feed
back i
n
d
e
x, w
h
i
c
h i
s
an i
n
di
cat
i
on
of t
h
e
custom
er feedback t
h
at relates to
the standard
of the
product. It has
m
i
nim
u
m e
m
pirical score
whe
n
it com
e
s
to
ass
o
ciate
ris
k
value with client’s feedbac
k
inde
x
a
s
re
sul
t
s are
base
d
o
n
sam
e
cat
egori
e
s o
f
IC
T
pr
ojec
t
s
.
Th
e m
o
d
e
l is
in
teg
r
ated
and
ev
alu
a
ted
fo
r th
e pur
pos
e
of testing its efficiency.
A survey is
co
ndu
cted
o
n
l
i
n
e with
d
i
fferen
t lev
e
l o
f
qu
ality stan
d
a
rds in
o
r
d
e
r to
recogn
ize m
o
re seriou
s issues o
f
requ
irem
en
t v
o
l
atility. Th
e find
ing
s
was i
n
tend
ed
t
o
con
c
lud
e
wh
ich
fram
e
wo
rk
is
th
e b
e
st su
ited
for
co
m
p
an
ies en
co
un
teri
n
g
failures in
m
a
in
tain
ing
risk
sch
e
d
u
ling
sch
e
m
e
s. Th
e targ
et o
f
t
h
e ev
alu
a
tio
n b
y
n
u
m
b
e
r of project lead
ers is esti
m
a
te
th
e risk
id
en
tifi
cat
i
o
n
whi
c
h co
ul
d p
o
ssi
bl
y
ha
ve se
ri
o
u
s i
m
pact
o
n
IC
T
pr
o
j
ect
sch
e
d
u
l
es, ex
pe
ndi
t
u
r
e
et
c. T
h
e
next
im
port
a
nt
p
h
a
s
e o
f
t
h
e
3
L
R
M
M
odel
i
s
t
o
f
o
rm
ul
at
e st
rat
e
gi
es
for m
a
j
o
r risk
id
en
tificatio
n. Th
ere is a d
i
v
e
rsified
o
u
t
co
me of the survey
where the
si
milar risk
is ev
alu
a
ted
b
y
d
i
fferen
t particip
an
ts with
v
a
ri
ed
p
r
i
o
r
i
t
i
zat
i
on. A
n
ont
ri
vi
al
st
rat
e
gy
i
s
ad
opt
e
d
t
o
u
n
d
erst
a
n
d t
h
e
seri
o
u
s
n
ess o
f
ri
sk i
n
v
o
l
v
e
d
.
A Pse
u
d
o
r
a
n
d
o
m
wei
ght
of
1,
2, an
d
3 i
s
assi
gne
d t
o
ri
sk
wi
t
h
3
r
d
,
2
nd
and
1st
pri
o
ri
t
y
or
der
.
There
f
ore, i
f
t
h
e sam
e
ri
sk is fo
un
d i
n
var
i
ed or
der t
h
an
i
t
wi
l
l
posses
s
t
h
e cum
u
l
a
t
i
ve ri
s
k
wei
g
ht
age val
u
e as est
i
m
a
t
e
d
by
pr
od
uct
of
r
i
sk wei
g
ht
val
u
e wi
t
h
n
u
m
b
er of h
u
m
a
n resou
r
ce sel
ect
ed at
1st
pri
o
ri
t
y
w
h
i
c
h
i
s
agai
n
sum
m
e
d
up
wi
t
h
ri
s
k
wei
g
ht
val
u
e
wi
t
h
num
ber
o
f
h
u
m
a
n res
o
ur
ces at
t
h
e
2
n
d
pri
o
ri
t
y
an
d it con
tin
u
e
s. Th
ere
fo
r
final risk
weigh
t
was
n
o
rm
alize
d
. Th
e
ev
al
u
a
tio
n can b
e
cond
u
c
ted
b
y
estimatin
g
ran
k
of
ris
k
is:
R
rank
= (
ψ
1
.
λ
1
) +
(
ψ
2
.
λ
2
) +
(
ψ
3
.
λ
3
)
(
8
)
Whe
r
e, (
ψ
1.
λ
1)
, (
ψ
2.
λ
2)
, and
(
ψ
3.
λ
3) are the set of ris
k
values (
ψ
) an
d
freq
u
e
n
cy
(
λ
) o
f
th
e r
i
sk
mapping with
1st, 2nd, and 3rd
prior
ity. The
m
odel proposes that project
leaders should first accept those ris
k
fact
or
s
whi
c
h
have
c
o
m
p
arat
i
v
el
y
m
a
xim
u
m
rel
a
t
i
v
e si
gni
ficance a
n
d
have
greater
profes
sed sc
ore
of control.
It
i
s
t
h
en feasi
b
l
e
t
o
desi
g
n
ri
sk enc
o
unt
e
r
i
ng
pol
i
ces de
p
e
ndi
ng
on t
h
e
nat
u
re o
f
ri
sk
can be de
vel
o
p
e
d
.
Freq
u
e
n
c
y of risk
s in
1
s
t priority can
no
t b
e
efficien
tly
controlled
by project leaders.
T
h
erefore
,
form
al step
for ex
ecu
tin
g
th
e fram
e
wo
rk will b
e
p
r
i
m
arily to
es
ti
mate th
e risk
ran
k
i
n
g
acco
r
d
i
n
g
to
ICT so
ftware,
seco
nda
ri
l
y
t
o
cl
assi
fy
i
t
i
n
t
h
e
hi
g
h
l
i
g
ht
ed
m
odel
,
an
d
fi
nal
l
y
t
o
rel
a
t
e
cert
a
i
n
presc
r
i
b
ed
m
e
t
hod t
o
t
h
o
s
e
risk
s
factors
wh
ich
lie i
n
th
ird co
lu
m
n
.
2.
RESULT AND DIS
C
USSI
ON
The ab
o
v
e di
s
c
usse
d m
odel
i
s
eval
uat
e
d i
n
di
versi
f
i
e
d co
m
p
ani
e
s onl
i
n
e whi
c
h
fol
l
o
ws di
f
f
ere
n
t
q
u
a
lity stand
a
rd
s and
p
r
actices. A
q
u
a
litativ
e tech
n
i
q
u
e
o
f
stan
d
a
rd surv
ey h
a
s b
e
en
con
d
u
c
ted
t
o
v
a
lid
ate th
e
effectiv
en
ess
of layer-b
a
sed
ap
pro
ach
and
third
layer ap
proach. T
h
e
outcomes of the
survey were s
u
bjec
ted to
q
u
a
n
titativ
e analysis to
fin
d
th
at th
e p
r
op
osed
m
o
d
e
l d
o
produ
ce con
s
isten
t
m
easu
r
es o
f
risk
sch
e
dule fo
r
th
ese typ
e
s of
p
r
oj
ect d
e
v
e
lop
m
en
t. Bu
t it
d
o
e
s no
t sp
eci
fy that this fra
m
ework is not
effectual as c
e
rtain
i
m
p
licatio
n
s
fo
und
i
n
th
is fram
ew
ork indi
cate that the
fram
ework ca
n
b
e
appr
op
r
i
at
e on
t
r
ad
itional I
C
T
project de
velopm
ent. It has
been seen that
in
order t
o
ge
nerate
Weibull curve t
h
e fact
or
Ω
2
has
t
o
b
e
m
u
ch
hi
g
h
er t
h
a
n
Ω
3
, an
d
in
con
t
ex
t o
f
th
is framework
,
it is o
n
l
y feasib
le wh
en
requ
irem
en
t v
o
l
atility is
m
u
ch
g
r
eater
wh
ich
is an
in
trin
sic characteristics the environm
ent of trad
i
t
i
onal
IC
T pr
o
j
ect
de
vel
o
pm
ent
.
B
a
sed o
n
th
is fact, it can b
e
stated
that th
is fram
e
work wou
l
d
b
e
efficien
t for trad
ition
a
l ICT
p
r
oj
ect d
e
v
e
l
o
p
m
en
t. Th
e
ev
alu
a
tion
h
a
s also
id
en
tified
certain
issu
es
with
th
is framewo
rk
. Ho
wev
e
r,
th
is will
b
e
th
e focu
s o
f
our
fut
u
re
wo
r
k
. T
h
e f
r
am
ewor
k
was f
o
un
d t
o
be com
p
l
i
cated, estim
ating factors re
qui
red by the m
odel like
requirem
ent volatility and risk sc
hedu
ling will
require prope
r
eluci
d
ation
of vari
ous m
u
l
tifaceted
factors,
wh
ich
if esti
mated
in
app
r
op
ri
ately will
resu
lt in
h
i
g
h
co
st
expe
n
d
i
t
u
re
. Th
e t
i
m
e
for exec
ut
i
on i
s
f
o
un
d
t
o
b
e
hi
g
h
,
w
h
i
l
e
t
h
e p
r
o
j
ect
l
e
a
d
e
r
s
no
rm
al
ly
do
n’t
ha
ve m
u
ch ti
m
e
. No way
,
it is ap
propriate for
ICT software
pr
o
j
ect
devel
o
pm
ent
ot
her t
h
an t
r
a
d
i
t
i
onal
t
y
pe. In sh
or
t
,
t
h
i
s
fram
e
wor
k
can o
n
l
y
be use
d
f
o
r f
r
e
que
nt
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
IJEC
E V
o
l
.
6, No
. 1, Feb
r
uar
y
20
1
6
:
34
9 – 35
6
35
4
chan
ges i
n
re
qui
rem
e
nt
s for
IC
T pro
j
ect
of com
p
l
e
x t
y
pe wi
t
h
som
e
t
a
rget
ed eval
uat
i
on re
q
u
i
r
e
d
. The
fram
e
wo
rk
of first layer is o
n
ev
alu
a
ting
th
e
maj
o
r risk
and
then analyzing the ICT
pr
oje
c
t
sub
j
ect
ed t
o
t
hose
risk
s.
It assu
mes th
at if th
e ri
sk
is raised
b
y
p
r
oj
ect
lead
ers th
an
th
ey can
tak
e
up
appropriate risk
sch
e
du
lin
g
measures t
o
e
n
counter it. In c
a
se th
e project leaders ha
ve
m
a
xim
u
m
score of
sche
duling t
h
e
risk
and t
h
a
t
risk
has c
o
m
p
aratively greate
r
si
gni
ficance tha
n
a
project le
ader s
h
oul
d as
sum
e
t
hose ri
s
k
fi
r
s
t
f
o
r e
n
c
o
u
n
t
e
r
strategy. As there are
very
fe
w project
leaders can do for
those
risks
fac
t
or
s,
w
h
i
c
h a
r
e
not
i
n
t
h
ei
r c
o
nt
r
o
l
.
Th
e
o
t
h
e
r
t
w
o layer
s
(
s
econd
and
th
ird)
d
i
d
no
t assu
m
e
t
h
is factor.
All th
e th
ree layers o
t
h
e
r th
an
seco
nd
layer are b
a
sed
on
targ
eted
ev
alu
a
tion
.
Bu
t
th
e p
r
ob
le
m with
seco
nd
layer is it’s d
i
fficu
lt fo
r estim
ati
n
g
th
e
fact
or
s
whi
c
h i
s
nee
d
e
d
by
t
h
e fr
am
ework
,
besi
des
i
t
i
s
a
p
pr
o
p
ri
at
e f
o
r
I
C
T so
ft
wa
re
pr
oject
s
.
In
com
p
ari
s
on
to
d
e
riv
e
d
m
o
del with
first layer, it is ob
serv
ed th
at
t
h
i
s
f
r
a
m
e
wor
k
has s
i
gni
fi
ca
nt
ri
s
k
fact
or
s whi
c
h are not
descri
bed
by
fi
rst
l
a
y
e
r.
There
f
ore,
t
h
e
pr
o
pose
d
st
udy
fu
rni
s
hes
a hi
g
h
l
y
o
p
t
im
i
zed o
u
t
c
o
m
e for
id
en
tificatio
n of th
e
un
certain
t
y
th
at is m
a
in
ly in
terpre
t
e
d a
s
a ri
s
k
fact
or
.
The
pr
o
pose
d
m
e
t
hod
ol
o
g
y
a
d
o
p
t
e
d
for the stud
y is b
a
sed
on
t
h
e
fact th
at it is
n
o
t p
o
ssib
l
e
t
o
ascertain
an
d m
i
t
i
g
a
te co
m
p
lete risk fact
o
r
,
b
u
t it is
pos
si
bl
e t
o
m
odel
a fram
e
wo
rk
on a gi
ven
con
s
t
r
ai
nt
o
f
case study and
its associated resources to m
e
asure
unce
r
t
a
i
n
t
y
fac
t
or i
n
t
h
e s
o
ft
w
a
re de
vel
o
pm
ent
m
e
t
hod
ol
o
g
i
e
s. The
pr
o
pos
ed st
u
d
y
i
s
eva
l
uat
e
d wi
t
y
h re
spect
to
n
o
rm
al
ized
requ
irem
en
t
vo
latility
(
α
) as t
h
e
pe
rf
orm
a
nce pa
ram
e
t
e
rs al
on
g
wi
t
h
R
e
qui
rem
e
nt
B
i
rt
h R
a
t
e
(
β
)
an
d R
e
qui
r
e
m
e
nt
Deat
h
R
a
t
e
(
γ
) for enha
nced precisene
ss in t
h
e
outc
o
mes.
Figure 2.
Risk Factor
Identifi
cation
The re
prese
n
t
a
t
i
on o
f
t
h
e ri
sk
fact
or o
n
t
h
e i
n
creasi
ng
num
ber o
f
o
b
se
rvat
i
on i
s
sh
ow
n i
n
Fi
g
u
re 2
.
The
outc
o
m
e
c
l
early exhi
bits that ther
e a
r
e t
h
ree c
u
rves
conside
r
ed for co
m
p
arative analysis i.e. re
qui
re
m
e
nt
v
o
l
atility (
α
), R
e
qui
rem
e
nt
B
i
rt
h R
a
t
e
(
β
), and Requirem
ent Death Rate (
γ
) f
o
r e
nha
nc
ed p
r
eci
seness
i
n
t
h
e
out
c
o
m
e
s. Owi
ng t
o
t
h
e
opt
i
m
i
zat
i
on pri
n
ci
pl
e i
n
co
rp
orat
e
d
i
n
t
h
e p
r
o
p
o
s
e
d sy
st
em
, t
h
e
sy
st
em
cont
i
n
u
ousl
y
seek
s th
e b
e
lite o
u
t
co
m
e
s o
f
mit
i
g
a
tin
g
u
n
c
ertain
ty
m
eas
u
r
es. Th
is is th
e p
r
im
e reaso
n
fo
r
requ
irem
en
t d
eat
h
rat
e
i
s
f
o
un
d t
o
be
di
m
i
ni
shed
fo
r t
h
e
gi
ven
e
x
am
pl
e i
n
Fi
g
u
r
e
2.
Fi
gu
re 3.
α
-Norm
a
lization curve
0
20
40
60
80
100
123456789
1
0
Risk
Factor
‐
identification
Number
of
Observation
β
γ
0.00
0.20
0.40
0.60
0.80
1.00
123456789
1
0
α
-Normaliz
ation
Iteration
α
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ECE
I
S
SN
:
208
8-8
7
0
8
3LRM
-3 Layer
Risk Mitigation M
o
delling
of ICT Software
Developme
nt
P
r
ojects
(
Sal
ma
Fi
rdo
s
e)
35
5
Aft
e
r
per
f
o
rm
ing em
pi
ri
cal
eval
uat
i
o
n o
f
t
h
e pr
op
ose
d
m
a
them
a
tical
m
o
delling, t
h
e sc
ore
of effectiveness of
t
h
e p
r
o
p
o
se
d s
y
st
em
i
s
eval
uat
e
d by
ob
ser
v
i
ng i
)
p
o
t
e
n
tial o
f
m
o
d
e
l for id
en
tifying
risk
facto
r
and
ii)
α
-
n
o
rm
aliza
tio
n
cu
rv
e. C
o
n
s
i
d
ering
10
lev
e
ls
o
f
o
b
s
erv
a
tio
ns u
s
ing
ran
dom p
r
ob
ab
ility d
i
stribu
tio
n
m
o
d
e
l, t
h
e
o
u
t
co
m
e
sh
o
w
s po
ten
tial risk id
en
tification
cap
ab
ilities as
ex
h
i
b
ited
in
Fig
u
re
2
th
at sh
ows risk
-i
d
e
n
tifi
cation
(
α
) i
s
qui
t
e
hi
g
h
as com
p
ared
t
o
requi
rem
e
nt
bi
rt
h rat
e
and
requi
rem
e
nt
deat
h rat
e
. Si
m
i
l
a
rl
y
,
t
h
e
m
odel
al
so
sho
w
s
bet
t
e
r gra
d
i
e
nt
desce
n
t
fo
r ri
sk
no
rm
ali
zat
i
on us
i
ng eq
uat
i
o
n (
7
)
.
Hen
ce, i
t
can be sai
d
t
h
at
t
h
e
p
r
op
o
s
ed
m
o
d
e
l h
a
s b
e
tter cap
ab
ilities fo
r
id
en
tifying
risk
(Fi
g
ure 2) an
d
m
itig
atin
g
risk
(Figu
r
e
3
)
. The
ext
e
nsi
v
e i
n
ves
t
i
g
at
i
onal
a
n
al
y
s
i
s
has
bee
n
c
o
n
d
u
ct
ed i
n
pr
evi
o
us
pa
per
[
18]
.
3.
CO
NCL
USI
O
N
Th
e
p
r
op
o
s
ed
stu
d
y
p
r
esen
ts
a m
a
th
e
m
atical
m
o
d
e
l th
at h
a
s th
e cap
a
b
ility o
f
i
d
en
tifying
th
e
risk as
well as
m
i
t
i
g
a
tin
g
th
e
risk
.
It is also
h
e
lpfu
l
to
d
e
p
l
oy the e
ffective
fram
e
work
which is
very expa
nda
ble and
scalab
le in
sp
ite of
wasting
resou
r
ces
for mechanizing new fram
e
work.
Base
d
on the analyzation
of the
fram
e
wor
k
s di
scusse
d, a f
r
a
m
ewor
k has
b
een f
o
rm
ul
at
ed f
o
r c
o
m
p
ani
e
s, w
h
i
c
h com
e
s un
der t
h
e d
i
ffere
nt
lev
e
ls o
f
qu
ality stan
d
a
rd
s. Variou
s risk
sched
u
ling
p
r
o
cess are th
e m
a
j
o
r lo
cal o
r
g
a
n
i
zatio
n
a
l factor that can
im
pact on the
effective
n
ess
of the
fram
e
work, s
o
it
is i
m
p
e
rativ
e to ch
oo
se
the a
p
propriate eva
l
uation
fram
e
wo
rk
b
y
asso
ciatin
g
t
h
e q
u
a
lity stan
d
a
rd
s
o
f
an
org
a
n
i
zatio
n
with
th
e fram
e
work. In
ord
e
r to
facilitat
e
p
r
oj
ect lead
er fo
r ad
op
ting
th
e rig
h
t
fram
ework, th
e d
e
scribed
fram
ewo
r
k
h
a
s correla
ted
with
d
i
fferen
t
q
u
a
lity
stan
d
a
rds. Th
e
ex
istin
g
research
on
risk
sch
e
d
u
ling
and
requ
irem
en
t v
o
l
atility
h
a
s en
ormo
u
s
feasib
ility
to
rise
in
m
u
lti-d
i
rectio
n
s
.
REFERE
NC
ES
[1]
M
.
Laz
zaron
i, “
Reliab
ility Engineeri
ng: Basic
Concepts and
Applications in I
C
T
”, S
p
ringer S
c
ien
ce & Bus
i
n
e
s
s
Media. Technolog
y
&
Engi
neering, pp
. 176
, 201
1.
[2]
J.C. Cummings, “
Modelling and
simulation to support risk
management in complex en
vironment
”, Retr
eived from
http://www.tisp.org/tisp/file/CU
MMINGS_Pa
per_Mod-Sim-Risk-Mgmt_Paper.pdf, 2014
.
[3]
J.
Münc
h,
O.
Ar
mbrust,
M.
Soto
,
M.
Kowa
lc
zy
k,
“Software Process Definition and Improvement
”,
Distance and
International Stu
d
ies Cen
t
er. Springer
, 2012
.
[4]
N.
O.
Gass,
“
Deployment o
f
Rad
i
o Frequen
c
y Id
entification (
RFI
D)
in the oil and
gas industry Pa
rt 2 Architecture
and integration
”,
Norwegian Oil and Ga
s Guideline 112
, Part 2
approved b
y
:
Norwegian Oil and Gas’s Director
General, 2012
.
[5]
A.M.A. Khouri, “Using Qua
lity Models to Evaluate National I
D
Sy
stems: the
Case of the UAE”,
Internationa
l
Journal of Socia
l Sciences
. Vo
l.
1 No. 2
,
2007
.
[6]
N. Nurm
uliani, D. Zowghi, and S.P. W
illiam
s
, “
Requiremen
t
s volatility and its im
pact on change effort: eviden
ce-
base
d
re
se
arc
h
in softw
ar
e deve
lopment pr
o
j
ec
ts
”, Proceedings of the Eleventh Australian Workshop o
n
Requirements Engineer
ing,
2006
.
[7]
R. Thakur
ta, S.
Dasgupta, “Using S
y
st
em D
y
n
a
mics Modeling to Investigate
the Impact of Reso
urce Man
a
gement
Policies on Pro
j
ect Quality
Assura
nce under
Requirement V
o
latility
”
,
In
ter
national Journa
l of Informatio
n
Processing and
Management
, V
o
l.2, No. 3, 2011
.
[8]
P
.
K. De
y, “
P
roject ris
k
m
a
nage
m
e
nt: a com
b
in
ed anal
yt
i
c
hier
arch
y proc
es
s
and decis
i
on tr
ee
approach
”,
Cost
Engineering
, Vol. 44(3)
, pp
. 13
-2
7, 2002
.
[9]
HY, C., X. Lian
g, and
C. Song,
Z,
“Project Duration Risk
Trans
m
ission
and Control b
a
sed on
CCPM.Research
”,
Journal of Applied Scien
ces, Eng
i
neering
and Technology
, Vol. 7(
3), pp
. 619-624
,
2014
[10]
S.V. Bharathi,
R. Ra
man,
and
D. Pramod, “A FPN
Ba
se
d Risk Asse
ss
me
nt Mode
l for ERP
Imple
m
e
n
ta
tion in
Small and Med
i
um Enterprises
”
,
Middle-East Jo
urnal of S
c
ien
tific Research
, Vol. 19 (6)
,
pp
.747-7
59, 2014
.
[11]
A.K. Madan, M
.
S. Rangan
a
th,
“Multiple Crit
er
ia D
ecision Making Techn
i
ques in Manufactur
ing Industries-A
Review Stud
y
with the Application of Fuzzy
”
,
International C
onference of Ad
vance
Research
and Innovation
,
2014
[12]
A. Ugale, S.D. Kam
b
le, P. Mishra,
P, “Classification of Da
t
a
set Using Business Intellig
ence for IT Suppo
rt
S
e
rvices
”
,
In
tern
ational Journal of
Re
search
in Advent Technolog
y
, Vol. 2
,
No
.2,
E-ISSN: 2321-9637, 2014
.
[13]
D. Hillson,
“
M
anaging Over
al
l P
r
ojec
t Risk”
,
Project Managem
e
n
t
Institur
e
, 2014.
[14]
A.
A.
Khan,
R.
Gowda,
“Risk
and Uncertainty in Business”,
IRACST – International Journa
l of Commerce,
Business and M
anagement (
I
JC
BM)
, ISSN: 2319–2828 Vol. 3,
No. 1, 2014.
[15]
K. Garg, P. Kaur, S.Kapoor, S. Naru
la, “Enhan
cement in COCOMO
Model
Using Function Point Analy
s
is to
Increas
e
Effor
t
Es
tim
ation”
,
In
ternational
Jour
nal of Comput
er
Science and M
obile Computing
, Vol. 3, Issue.
6,
pp. 265-572
, 20
14.
[16]
I.
K.
Wa
li
a,
a
n
d M.
Ka
ur,
M,
“Combining COCOMO and use case fo
r b
e
tter
effort
estim
at
io
n”,
In
ternationa
l
Journal of Current Eng
i
neering
a
nd Technolog
y
,
Vol. 4
,
No. 2, 20
14.
[17]
A. Kinra, “A Fuzzy
B
a
sed
Model
for Software Quality
Estimation Us
ing Risk Pa
ra
me
te
r Asse
ssme
n
t”
,
International Jo
urnal
of Computer Science and
Mobile Computing
, Vol. 3
,
Issue. 3, pp. 807-814,
2014.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
IJEC
E V
o
l
.
6, No
. 1, Feb
r
uar
y
20
1
6
:
34
9 – 35
6
35
6
[18]
S. Firdose, and
L.M. R
a
o, “Inv
estig
at
iona
l Ana
l
y
s
is of
existing
Risk Ma
nagem
e
nt Models
and
Prior Resear
ch
Contribution
:
A Review”,
International Journ
a
l of Advan
ced
Rese
arch in
Computer Scien
ce and Software
Engineering
. Vol. 4
,
Issue. 12
, p
p
. 882-
889, 201
4
BIOGRAP
HI
ES OF
AUTH
ORS
Salma Firdose d
i
d her Bachelor of Science fro
m Bangalore University
f
r
om 2000 to 2003. In
2003 received
the Bachelor
d
e
gree. She Stu
d
ied Masters o
f
Computer Application from
Bangalor
e
University
from 2003 to 2006 and was aw
arded masters in the same
y
ear.In 2007 to
2009 did Master of Philosoph
y
from Bharathiar Universiy
,
Co
imbatore. Now she is a Ph.D.
student 3rd
y
e
ar
of CSE at Bh
arathiar Univ
ersity
,
Coim
batore,
In
dia. S
h
e
worked
as
lec
t
urer
for
6
years
at
Bang
a
l
ore,
Indi
a
and 2
ye
ars
in
ab
ro
ad.
Now currently
w
o
rking at B
a
ngalore,
India
Dr. L. Manjun
atha R
a
o is
working as Profes
s
o
r and H
ead, D
e
partment of M
C
A, Dr. AIT,
Bangalor
e
. He h
a
s got 25
y
e
ars of teaching
exp
e
rien
ce. He did
his Bachelor of
Science from
Bangalor
e
Univ
ersity
in th
e
y
e
ar 1990. He St
udied Masters
of Computer Application from
Madhurai Kamaraj University
and was awarde
d in the
y
e
ar 1999. In 2002 d
i
d Master of
Philosoph
y
from Mononmanium Sundaranar Universi
ty
. He has
awarded Ph.D from Vinay
a
ka
Mission University
, Tamil Nadu. He has publis
hed research
papers in both national and
intern
ation
a
l Jou
r
nals and
h
a
s au
thored 2
textboo
ks.
Evaluation Warning : The document was created with Spire.PDF for Python.