One of the more popular methods to perform a risk analysis in the computer field is called Facilitated Risk Analysis Process (FRAP).
Facilitated Risk Analysis Process
FRAP analyzes one system, application or segment of business processes at time.
FRAP assumes that additional efforts to develop precisely quantified risks are not cost effective because:
- such estimates are time consuming
- risk documentation becomes too voluminous for practical use
- specific loss estimates are generally not needed to determine if controls are needed.
Three of the most important risks a software company faces are: unexpected changes in revenue, unexpected changes in costs from those budgeted and the amount of specialization of the software planned. Risks that affect revenues can be: unanticipated competition, privacy, intellectual property right problems, and unit sales that are less than forecast. Unexpected development costs also create risk that can be in the form of more rework than anticipated, security holes, and privacy invasions. [2]
Narrow specialization of software with a large amount of research and development expenditures can lead to both business and technological risks since specialization does not necessarily lead to lower unit costs of software.[3] Combined with the decrease in the potential customer base, specialization risk can be significant for a software firm. After probabilities of scenarios have been calculated with risk analysis, the process of risk management can be applied to help manage the risk.
Methods like Applied Information Economics add to and improve on risk analysis methods by introducing procedures to adjust subjective probabilities, compute the value of additional information and to use the results in part of a larger portfolio management problem.
