Requirements Development and Risk Management

Guest Post by Paul Kostek (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

One of the keys to a successful project is having a set of requirements that are well defined and stable. We’ve all worked on projects where a lack of defined and controlled requirements has led to scope creep which result in schedule delays.  

The requirements development process must also include mitigations for the risks identified in the Risk Management Plan. To accomplish this the initial risk assessment must be completed before the requirements development process begins.

With the initial risks the requirements team (whether systems engineers or business analyst) can focus on the requirements development and ensure that mitigations are identified for the program risks.  A mitigation must eliminate the risk but also be assessed for the impact on the overall design of the system.  Will the requirement add greater cost than the impact of the risk?  Impact the schedule, or require a new technology or add design constraints?

As an example let’s look at driverless cars and the risk associated with transferring control to the user.  The risk, a failure (e.g. lane sensor system) has occurred and the vehicle  needs to turn control to the user. First issue, is the user paying close enough attention to safely take control of the vehicle?  If not, do we need a default operation to prevent putting the user(s) at risk by turning over control?  Do we need to include a system to provide the vehicle’s status the user?  Or is a better solution to require the vehicle to take appropriate action, e.g. stop/turn, rather than transfer control?

Adding a system to provide status will increase costs and also require the user to be aware of the meanings of the messages.  Perhaps instead of the vehicle providing the message to the user via a vehicle system it could be done via text or tweet (I’m assuming many users of vehicles will be on their smart phones or tablets).  As you can see mitigating this type of risk will involve an analysis to determine the optimum response that ensures safe operation, user awareness and minimizes the need for additional equipment.

Bio:

Paul Kostek is a Principal of Air Direct Solutions LLC a Seattle based systems engineering and project management firm.