Identifying Software Project Risks: An International Delphi Study

Advocates of software risk management claim that by identifying and analyzing threats to success (i.e., risks) action can be taken to reduce the cbance of failure ofa project. The first step in theriskmanagement process is to identify tbe risk itself, so tbat appropriate countermeasures can be taken. One problem in this task, however, is that no validated lists are available to help the project manager understand the nature and types of risks typically faced in a software project. This paper represents a first step toward alleviating this problem by developing an authoritative list of common risk factors. We deploy a rigorous data collection metbod called a *'ranking-type" Delpbi survey to produce a rank-order list of risk factors. This data collection method is designed to elicit and organize opinions of a panel of experts through iterative, controlled feedback. Three simultaneous surveys were conducted in three different settings: Hong Kong, Finland, and tbe United Stales. This u'as done to broaden our view of the types of risks, rather than relying on tbe view of a single culture—an a.spect tbat has been ignored in past risk management research. In forming (he tbree panels, we recruiled experienced project managers in each country. The paper presents the obtained risk factor list, compares it with other published risk factor lists for completeness and variation, and analyzes common features and differences in risk factor rankings in tbe three countries. We conclude by discussing implications of our findings for both research and improving risk management practice.