Taking SpiCE to the Third Dimension: Adding Risk Analysis to ISO/IEC TR 15504

Abstract

The SPICE-R risk model defines a binary correlation between a list of generic risks and the ISO/IEC TR 15504 processes. The likelihood for a given risk depends on the gaps between the target or required capability level and the capability level actually achieved for the correlated processes. Process Risk Factors (PRF) are applied to modulate the influence of gaps at the different process attributes. Concepts from the S:PRIME risk method, the SPEC study project and the Risk Taxonomy defined by the Software Engineering Institute were used as input to define the risk vs. process matrix.

The method for risk likelihood calculation defines the process-oriented probability calculation and maps the results on the probability-scaling scheme as recommended by standards for space industry. The method follows a quantitative implementation of the path outlined in ISO/IEC TR 15504-8.

The risk impact estimate is subject to the expert judgement of managers, assessment team, and other experts within the organisation as a universal method is not applicable in this case. ISO/IEC TR 15504-8 provides some guidance to estimate the impact with regard to capability levels at which the related processes were not Fully or Largely achieved.

The product of the likelihood by the impact defines the risk magnitude as a basis for acceptable and non-acceptable risk ranking. All unacceptable risks are submitted to risk reduction (mitigation and/or prevention) as defined in ECSS risk management paradigm. This risk reduction may imply process improvement activities following the an ISO 15504 assessment.

The method is expected to provide a new view on process assessment results, which highlights the most significant software process risks and focuses process improvement activities on the key problems of the organisation.