Software Engineering Institute

This report establishes a representation of software risk wherein the risks associated with software-dependent development programs are defined as distinct, manageable risk entities. The risk entities and their descriptive statements of risk are based on a Condition-Transition-Consequence (CTC) construct. The CTC construct arises out of a systems representation, where time and value are identified as fundamental to the concept of risk. The CTC construct is also shown to provide a common representation for both program risks and program tasks and to fit into a heuristic framework for identifying risks within software-dependent development programs. Examples of risks are used to demonstrate that the approach facilitates the management of risk as an integral part of routine program management.