requirements-risk-assessment

Purpose

Identify, analyze, and mitigate risks that originate from requirements engineering activities. Requirements problems are the single largest source of project failures -- defects introduced during requirements cost 50-200x more to fix after deployment than during elicitation. Use this to make those risks visible and manageable before they become costly downstream problems.

This is not a general project risk assessment. It focuses specifically on risks arising from how requirements are elicited, analyzed, specified, validated, and managed.

Key Concepts

Condition-Consequence Risk Statements

A well-formed risk statement uses the condition-consequence format:

IF [condition] THEN [consequence]

Bad: "Requirements might be incomplete." Good: "IF the EHS compliance officer is unavailable during elicitation, THEN regulatory disposal requirements will be missed, resulting in non-compliant system behavior."