![](bg4.png)
Intended as a support to all risk management pro-
cesses (PMI, 2013)(SEI, 2010), the semi-automated
tool proposed by Knob et al. (2006), RiskFree, aims
to help software development project teams to colla-
boratively manage risks in their projects. Due to the
fact that processes can be executed by various techni-
ques, the tool RiskFree is designed to allow organi-
zations to develop components that meet their own
needs. In such approach, the only process that is truly
semi-automated is the Qualitative Analysis performed
through the Probability and Impact Matrix technique,
denoting that the manager or person in charge is re-
sponsible for the manual execution of the other pro-
cesses.
In a technical report, Rad (2013) describes the
GOES-R Series RM, a decision-making tool used to
ensure safety and functionality of the Geostationary
Operational Environmental Satellite - GOES system.
The GOES-R Series RM has the risks in a Risk Dis-
tribution Matrix — a more robust version of the Pro-
bability and Impact Matrix — and positions them ac-
cordingly with the value of their risk exposure (RE).
When some significant change occurs in the project,
the affected risks are updated and repositioned in the
matrix. The tool provides reports, suggestions for mi-
tigation actions and supports all risk management pro-
cesses (PMI, 2013) (SEI, 2010). Although this tool is
developed privately for a specific domain, the theo-
retical approach of this work can be adapted to other
application domains.
The use of project metrics can also be observed as
a technique for supporting risk management proces-
ses. Fontoura et al. (2004) proposed an approach for
risk prevention based on the customization of the or-
ganization’s software process. The approach is orien-
ted as defined metrics from the Goal/Question/Metric
paradigm, and supports the Identification, Qualitative
Analysis, Response Planning, and Risk Control pro-
cesses. Considering the previously cited works, the
approach also uses the Probability and Impact Matrix
technique in its most simplistic version to calculate
the effect of a risk. In an extended version of this
work, Fontoura and Price (2008) presented a tool that
implements such an approach, but the tool is not avai-
lable online.
The use of agents in the context of software ma-
nagement projects, in particular, is a relatively new
field of research, and as such the literature is not wi-
dely available. Based on the analysis of the works,
RBS and the Impact and Probability Matrix are struc-
tures commonly used in the detection and evaluation
of risks. This is justified by the fact that RBS pro-
vides the visualization of complex projects and sys-
tems in smaller segments; and the Probability and Im-
pact Matrix is a simple, quick, and inexpensive way
to obtain the critical level of each risk. However, both
techniques are static strategies, applied at specific ti-
mes of the project. Another observation is the simpli-
city and the limitation of the mathematical formula-
tions that calculate the risk exposure (ER), which ex-
clude project or organization factors contributing to
the criticality of the risks. Finally, parameters that
confirm the obtained results are lacking in the majo-
rity of works, since many of them do not contain an
automated support tool. In the next section, a pro-
active approach to risk management in software pro-
jects will be discussed in detail.
4 PROPOSED APPROACH
Aiming to assist software project managers with the
Risk Management Process (RM) as suggested by the
PMI (2013) and SEI (2010), we propose the develop-
ment of an intelligent agent to treat risks (ARis) in an
integrated way with diverse aspects of the project such
as scope, schedule, cost, and changes management.
To perform a robust analysis of the project’s risks, the
mathematical formulation developed in our approach
takes into account these parameters: (i) the impact of
each risk for the various project aspects (cost, sche-
dule, scope and others); (ii) requested changes in the
project; and (iii) the amount of available contingency
reserve.
The proposed approach is divided into four macro-
process — Risk Analysis, Simulation Environment,
Updating Environment and Monitoring Project Me-
trics — which are performed by the risk agent accor-
ding to the current state of the project environment.
Figure 2 shows the execution flow diagram of these
processes implemented by the risk agent ARis in the
approach.
At the onset of the project, the properly identi-
fied and documented risks as explained in Section 2
are incorporated into the internal state of ARis. Once
the existence of risk factors jeopardizing the project
is detected, the agent executes the process Risk Ana-
lysis, which consists of calculating the priority of each
risk factor and updating its internal state. The occur-
rence of changes must be predicted during a project,
but only formally approved change requests can be
incorporated into the project’s baseline (PMI, 2013).
To be approved, a change request needs to be evalu-
ated because it might result in one or more modifi-
cations in the project attributes. In this scenario, ac-
cording to the approach proposed here, whenever the
agent ARis is notified of any change request, it per-
forms the Simulation Environment process to simulate
ICEIS 2018 - 20th International Conference on Enterprise Information Systems
418