Work Aid: Risk Identification Questionnaire
Click here to download the MS Word (390 KB)
This table is used by the risk analysis to identify sources of risk. The risk Analyst regularly assesses the completeness of the initiative documents to identify initiative risks. This table is organized in terms of three major classes of risk:
· Organizational Risks. These risks involve the aspects of the different approaches and capabilities that an organization can bring to a software-intensive development. Organizational risks are subdivided into organizational structure, organizational politics, organizational capability, and individual personnel capability risks.
· Process Risks. These risks involve the aspects of software/system engineering approaches used to develop the software-intensive system in question. Process risks are subdivided into life-cycle processes, phase-independent activities, phase-dependent activities, methods and automation risks. For the phase dependent activities, only the Initiative Definition phase was investigated for risks at this time. The other phases will be investigated at the appropriate time in the development.
· Product Risks. These risks are inherent within the software-intensive system itself. Product risks are subdivided into algorithm, architecture, and physical risks.
This questionnaire was based on the questionnaire developed by the Software Productivity Consortium. The Software Productivity Consortium has refined their questionnaire based on inputs from member companies who have used the questionnaire and by investigating other questionnaires such as the risk questionnaire proposed by the Software Engineering Institute. A " yes " answer to a question implies lack of risk, and a " ? " or " no " answer implies that a risk exists.
Organizational Risks
|
Risk Question |
Y |
? |
N |
Notes |
|---|---|---|---|---|
|
Organizational Structure |
||||
|
Is the organization's current structure adequate to support this initiative |
||||
|
Have all managers for the initiative been designated? |
||||
|
Has management authority and responsibility been clearly established and accepted? |
||||
|
Do all managers communicate timely and effectively both up and down the organizational structure? |
||||
|
Do those responsible for decisions consistently make good, rational choices? |
||||
|
Other |
||||
|
Organizational Policies | ||||
|
Have conflicting organizational objectives been identified and resolved? |
||||
|
Do personnel cooperate effectively across functional and organizational boundaries? |
||||
|
Are all personnel oriented toward quality procedures? |
||||
|
Is organizational morale good? |
||||
|
Other |
||||
|
Organizational Capability |
||||
|
Are the current support facilities sufficient for the initiative's needs? |
||||
|
Is current customer support sufficient for the initiative's needs? |
||||
|
Is the current customer communication sufficient for the initiative's needs? |
||||
|
Are current policy guidelines clear, appropriate, and sufficient for the initiative's needs? |
||||
|
Do the current procedures create plans that are sufficiently accurate and detailed for the initiative? |
||||
|
Are existing procedures adequate for monitoring the status of the initiative? |
||||
|
Are existing directing procedures appropriate and sufficient for the needs of this initiative? |
||||
|
Are current staffing procedures sufficient for the needs of this initiative? |
||||
|
Does the initiative currently have staffing for all currently required technical skills? |
||||
|
Are all contract agreements and understandings in writing? |
||||
|
Is the contract vehicle or customer agreement appropriate for this initiative? |
||||
|
Is the current contract administration appropriate and sufficient for the needs of this initiative? |
||||
|
Are the organization's standards sufficient and appropriate for the needs of this initiative? |
||||
|
Is the staff adequately trained to accurately complete all the work required for this initiative? |
||||
|
Is personnel turnover within the expected range? |
||||
|
Is the current level of personnel back-up adequate to ensure proper completion of the initiative? |
||||
|
Other |
||||
|
Individual Capability |
||||
|
Do initiative personnel have sufficient relevant experience to perform their duties? |
||||
|
Have all critical personnel previously performed in their current position? |
||||
|
Do all initiative personnel have sufficient experience in the organization? |
||||
|
Do all of the involved managers understand the initiative well enough to make informed decisions? |
||||
|
Are the estimators known to produce estimates that are sufficiently accurate and precise for the initiative's needs? |
||||
|
Are the available computer facilities sufficient and appropriate for all the needs of the initiative staff? |
||||
|
Is current computer system and tool training sufficient and appropriate for the needs of the initiative staff? |
||||
|
Other |
||||
|
Subcontractor Management |
||||
|
Is the coordination with subcontractors documented? |
||||
|
Is the coordination with subcontractors appropriate and sufficient? |
||||
|
Are all subcontract agreements and understandings in writing? |
||||
|
Are the subcontract vehicles appropriate for this initiative? |
||||
|
Is the current subcontract administration appropriate and sufficient for the needs of this initiative? |
||||
|
Are there several possible suppliers for each segment (i.e., is competitive acquisition possible)? |
||||
|
Do subcontractors have track records of quality, on time delivery? |
||||
|
Do subcontractors practice effective risk management? |
||||
|
Other |
PROCESS RISKS
|
Risk Question |
Y |
? |
N |
Notes |
|---|---|---|---|---|
|
Phase-Independent* |
||||
|
Is resource management adequate to the needs of the initiative? |
||||
|
Are the initiative objectives clear and feasible? |
||||
|
Are the budget estimates stable, reasonable, and precedented? |
||||
|
Are the schedule estimates stable, reasonable, and precedented? |
||||
|
Is existing cost and schedule monitoring sufficient and appropriate to the needs of the initiative? |
||||
|
Are all support requirements specified and understood? |
||||
|
Are all evolution requirements specified and understood? |
||||
|
Is sufficient budget available for unanticipated updates? |
||||
|
Is sufficient time scheduled for unanticipated updates? |
||||
|
Is the available process documentation adequate for the needs of the initiative? |
||||
|
Is the available product documentation adequate for the needs of the initiative? |
||||
|
Is the available development tool documentation adequate for the needs of the initiative? |
||||
|
Are contingency plans and reserves adequate to cover all likely situations? |
||||
|
Is the amount of anticipated reuse of components reasonable and adequate for the initiative's needs? |
||||
|
Is current productivity adequate to meet the budget and schedule? |
||||
|
Is the likelihood of exceeding the initiative's budget acceptable? |
||||
|
Is the likely schedule slippage acceptable? |
||||
|
Other |
||||
|
Configuration Management |
||||
|
Is the existing identification of components sufficient and appropriate for the initiative's needs? |
||||
|
Is the existing configuration control of components sufficient and appropriate for the initiative's needs? |
||||
|
Is the auditing of components sufficient and appropriate for the initiative's needs? |
||||
|
Is the existing status accounting sufficient and appropriate for the initiative's needs? |
||||
|
Other |
||||
|
Quality Management |
||||
|
Are the existing risk management practices sufficient and appropriate for the initiative's needs? |
||||
|
Are the existing verification and validation techniques sufficient and appropriate for the initiative's needs? |
||||
|
Other |
||||
|
Methods |
||||
|
Do the methods adequately support all aspects of the development initiative? |
||||
|
Do the methods adequately support the application domain? |
||||
|
Do the methods adequately embed sound engineering principles? |
||||
|
Other |
||||
|
Automation |
||||
|
Do the selected tools adequately support the selected methods? |
||||
|
Do the selected tools provide adequate support throughout the product development? |
||||
|
Are the selected tools adequately integrated with one another and with the development environment? |
||||
|
Are the selected tools well documented and easy to use? |
||||
|
Other |
Phase-Dependent |
|||
|
Initiative Definition |
||||
|
Are you sure that everybody understands the RFP or customer request? |
||||
|
Are all required technologies stable and familiar? |
||||
|
Is the customer's mission stable and familiar? |
||||
|
Is the scope of work stable and well understood? |
||||
|
Are all assumptions documented and based on a reasonable interpretation of the situation? |
||||
|
Are the completion criteria well defined (can a test procedure be written to verify the completion criteria)? |
||||
|
Are the users' current operations defined? |
||||
|
Does the documentation of the user's operations reflect the way things are currently done? |
||||
|
Are all assumptions about the users' current operations documented? |
||||
|
Is there a clear distinction among the users' organizational roles? |
||||
|
Is each current activity assigned to one responsible user role? |
||||
|
Are the users' lines of reporting clear and effective? |
||||
|
Are the users' current operations stable? |
||||
|
Is the definition of the users' current operations verifiable? |
||||
|
Are the users' current operations under change control? |
||||
|
Do the users' internal operations currently control all of their inputs? |
||||
|
Is the current training program sufficient and appropriate for the users' needs? |
||||
|
Do you have sufficient understanding of how the data maintained by the system is used? |
||||
|
Is the client sure that what they have requested is what they actually need? |
||||
|
Have all required technologies been used previously in a similar context? |
||||
|
Other |
||||
|
Concept of Operations |
||||
|
Are all critical operations identified? |
||||
|
Are all external interfaces documented? |
||||
|
Are all changes to external interfaces under our control or visible to us? |
||||
|
Are all changes to external systems under our control or visible to us? |
||||
|
Is the planned system better than all the rejected alternatives? |
||||
|
Are the users' planned operations supported within the initiative constraints? |
||||
|
Are all assumptions about the users' planned operations documented? |
||||
|
Is each intermediate stage well enough defined to represent as a system? |
||||
|
Are the transitions between the stages well defined? |
||||
|
Have human factors issues affecting the system deployment been sufficiently addressed? |
||||
|
Can the user organization absorb each change in the time frame requested? |
||||
|
Is the time required to deploy the system reasonable for the developers? |
||||
|
Can the user organization function well at the end of each intermediate stage? |
||||
|
Are the users' planned operations well-defined (look for words like "better," "more efficient")? |
||||
|
Are the users' planned operations verifiable? |
||||
|
Does every operation trace back to the mission (is there a reason for the change)? |
||||
|
Are all proposed business or mission processes compatible with each other? |
||||
|
When all changes are completed, will the user organization be operating under the concept of operations? |
||||
|
Are the degraded modes reasonable and adequate for all expected situations? |
||||
|
Are the maintenance modes reasonable and adequate for all expected situations? |
||||
|
Is each planned activity assigned to one responsible user role? |
||||
|
Are the new operations easy to perform (not overly demanding)? |
||||
|
Do the documented changes include all actions necessary to get to the planned operations or mission? |
||||
|
Are the planned changes within the initiative constraints? |
||||
|
Will the changes be acceptable to user personnel (e.g., not decrease morale)? |
||||
|
Will changes in the users' staffing profile be easy to effect? |
||||
|
Are assumptions about the users' facilities and services explicitly stated? |
||||
|
Are assumptions about the users' facilities and services reasonable? |
||||
|
Can the users' facility and service changes be made without disrupting the organization? |
||||
|
Are you confident that all facility and service changes will be well managed? |
||||
|
Are assumptions about the need for the users' business or mission data stated? |
||||
|
Are the new lines of reporting clear and effective? |
||||
|
Are assumptions about the training requirements explicitly stated? |
||||
|
Are assumptions about the training requirements reasonable? |
||||
|
Do the current user personnel match the input into the training profile? |
||||
|
Is existing training sufficient for new processes? |
||||
|
Are the available training facilities adequate? |
||||
|
Other |
||||
|
Requirements |
||||
|
Do existing and planned prototypes provide a realistic interpretation of the system? |
||||
|
Are all requirements justified (does each one address a specific direct or indirect business or mission need)? |
||||
|
Are the requirement specifications unambiguous? |
||||
|
Are all requirements compatible with each other? |
||||
|
Are the requirement specifications testable? |
||||
|
Are the functional requirements complete and feasible? |
||||
|
Are the safety requirements clear and reasonable? |
||||
|
Are the reliability requirements clear and reasonable? |
||||
|
Have all other nonfunctional requirements been considered? |
||||
|
If the requirements are satisfied, will the system match the new business process or mission? |
||||
|
For each "shall" in the specification, is the requirement needed for the system to fulfill its purpose? |
||||
|
Is every requirement specific (can they be verified by a test procedure)? |
||||
|
Do the defined tests provide adequate coverage? |
||||
|
Has every requirement been validated (matches users' needs and expectations)? |
||||
|
Can the requirements be allocated into stages? |
||||
|
Are the requirements reasonable to implement (not unusually demanding)? |
||||
|
Are all new support requirements identified? |
||||
|
Are all applicable standards included? |
||||
|
Are all cited standards applicable? |
||||
|
Have all new facility requirements (power, cooling, etc.) been identified? |
||||
|
Other |
||||
|
Design |
||||
|
Is the current architecture description accurate? |
||||
|
Is each segment description complete? |
||||
|
Are all required changes documented? |
||||
|
Are all segment architecture (hardware, network, software, database, etc.) elements identified? |
||||
|
Are all segment architecture elements described? |
||||
|
Is each segment defined well enough to develop an acceptance test procedure for that segment? |
||||
|
Are all segment architecture element descriptions complete? |
||||
|
Can each segment architecture element be mapped to a specific planned requirement? |
||||
|
Are derived requirements for the segment compatible with the initiative requirements? |
||||
|
Is the planned architecture within the initiative constraints? |
||||
|
Are all architecture elements (hardware, network, software, database, etc.) identified? |
||||
|
Are all architecture elements described? |
||||
|
Are all architecture element descriptions complete? |
||||
|
Are all architecture elements justified (traceable to requirements)? |
||||
|
Are all interfaces between architectural elements described clearly and completely? |
||||
|
Is the attainment of the system requirements well within the architecture's ability? |
||||
|
Are all modifications to the architecture (hardware, network, software, database, etc.) elements described? |
||||
|
Can a mapping from the existing system to the planned architecture be developed? |
||||
|
Are all modifications to the architecture element descriptions complete? |
||||
|
Can each modification be mapped to a specific requirement? |
||||
|
Are all modifications to the interfaces between elements described? |
||||
|
Is the new architecture designed in a modular fashion? |
||||
|
Does the architecture allow for reasonable growth? |
||||
|
Is the architecture and design flexible enough to absorb unanticipated changes? |
||||
|
Is the new architecture designed to take advantage of newer technology? |
||||
|
Have the feasibility and predictability of any new technology been evaluated? |
||||
|
Is the design straightforward (not overly complex)? |
||||
|
Does the design provide for efficient implementation? |
||||
|
Are the design specifications unambiguous and consistent? |
||||
|
Are the design specifications feasible? |
||||
|
Are the design specifications testable? |
||||
|
Do the design specifications satisfy the requirements accurately? |
||||
|
Do the design specifications satisfy the requirements completely? |
||||
|
Are internal interfaces clear and adequate? |
||||
|
Is the build strategy consistent with the planned changes in the user's business process or mission? |
||||
|
Is the rationale for each build clear and convincing? |
||||
|
Can elements of each build be deployed in the existing environment? |
||||
|
Are the system integration processes defined? |
||||
|
Are the system integration processes feasible? |
||||
|
Are the system integration processes testable? |
||||
|
Do the integration procedures adequately identify undiscovered logic errors? |
||||
|
Do the integration procedures adequately identify undiscovered timing errors? |
||||
|
Do the integration procedures adequately identify undiscovered throughput errors? |
||||
|
Do the integration procedures adequately identify undiscovered recovery errors? |
||||
|
Other |
||||
|
Implementation |
||||
|
Are the system components known to be of good quality? |
||||
|
Does the implementation allow for reasonable growth? |
||||
|
Does the implementation take advantage of newer technology? |
||||
|
Has the feasibility and predictability of substituting new technology been evaluated? |
||||
|
Is the implementation straightforward (not overly complex)? |
||||
|
Does the implementation satisfy the design specification accurately? |
||||
|
Does the implementation satisfy the design specification completely? |
||||
|
Are internal interfaces clear and adequate? |
||||
|
Is the implementation adequately defined by the product design? |
||||
|
Are all nonfunctional (e.g., reliability) requirements satisfied? |
||||
|
Are assigned personnel capable of performing all likely updates? |
||||
|
Other |
||||
|
Installation |
||||
|
Do the installation procedures adequately identify required materials? |
||||
|
Do the installation procedures adequately identify site specific data? |
||||
|
Do the installation procedures adequately define all power requirements? |
||||
|
Have all sites been surveyed prior to installation? |
||||
|
Are local laws regarding installation materials and procedures understood? |
||||
|
Have proper plans been made to minimize impact to current operations? |
||||
|
Are all materials marked properly before shipment to installation site? |
||||
|
Are sufficient spare parts and consumables identified and available? |
||||
|
Is the installation straightforward (not overly complex)? |
||||
|
Does the installation plan include an accurate current layout? |
||||
|
Do sufficient test procedures exist to verify proper installation? |
||||
|
Is all necessary equipment defined and available for installation? |
||||
|
Are assigned personnel capable of performing all installation procedures? |
||||
|
Other |
||||
|
Deployment |
||||
|
Has each site received the necessary training? |
||||
|
Are all affected personnel certified for the new system? |
||||
|
Are all maintenance procedures documented and available to site personnel? |
||||
|
Have all hot line connections been made? |
||||
|
Have all personnel been checked out on the new system? |
||||
|
Have all consumables necessary for operation been deployed to site? |
||||
|
Are all materials marked properly before shipment to site? |
||||
|
Are sufficient spare parts and consumables identified and available? |
||||
|
Is the implementation straightforward (not overly complex)? |
||||
|
Have all installation procedures been successfully completed? |
||||
|
Have proper contractor personnel been identified to support site as needed? |
||||
|
Is all necessary support equipment defined and available for use at site? |
||||
|
Are site personnel now capable of operating the system? |
||||
|
Other |
PRODUCT RISKS
|
Risk Question |
Y |
? |
N |
Notes |
|---|---|---|---|---|
|
Architecture |
||||
|
Does the architecture provide a modular structure for the product? |
||||
|
Are all defined interfaces necessary and appropriate? |
||||
|
Are all defined components necessary and appropriate? |
||||
|
Will any planned decentralized processing provide adequate and reliable performance? |
||||
|
Will any planned decentralized database processing provide adequate and reliable performance? |
||||
|
Will any planned, decentralized control provide adequate and reliable performance? |
||||
|
Other |
||||
|
Physical Realization |
||||
|
Does the selected computer system provide adequate processing power? |
||||
|
Does the selected computer system provide adequate memory? |
||||
|
Does the communications environment provide adequate bandwidth? |
||||
|
Have all availability requirements been met? |
||||
|
Does each system component have sufficient reliability to meet system reliability? |
||||
|
Have all maintainability requirements been verified? |
||||
|
Does system usability match the ability of intended users? |
||||
|
Have all interfaces to external systems been defined and implemented? |
||||
|
Other |
||||
|
Producibility |
||||
|
Can the system be reproduced for each deployed site? |
||||
|
Other |

