Goal-driven risk assessment in requirements engineering
Risk analysis is traditionally considered a critical activity for the whole software systems lifecycle. Risks are identified by considering technical aspects (e.g., failures of the system, unavailability of services, etc.) and handled by suitable countermeasures through a refined design. This, however, introduces the problem of reconsidering system requirements. In this paper, we propose a goal-oriented approach for analyzing risks during the requirements analysis phase. Risks are analyzed along with stakeholder interests, and then countermeasures are identified and introduced as part of the systems requirements. This work extends the Tropos goal modeling formal framework proposing new concepts, qualitative reasoning techniques, and methodological procedures. The approach is based on a conceptual framework composed of three main layers: assets, events, and treatments. We use loan origination process case study to illustrate the proposal, and we present and discuss experimental results obtained from the case study.
risk assessment requirement analysis goal-oriented requirement engineering