Empirical assessment in the converging space of users and professionals

Implementing generic standardized systems in local practices often imply a process of change involving people from various domains and communities. In this paper we put particular emphasise on the new emerging community of people this implies. Based on experience from the Software Engineering and HCI domain we discuss a methodology supporting these new challenges. We use Communities of Practice as a possible conceptual framework, and action research as a methodological approach to better understand the ongoing situated activities and processes in practice. Empirically our discussion derives from lessons learnt in the EU IST-project CORAS. CORAS uses action research in their work on developing and improving methods for risk assessment of security critical systems. Lessons learned from this project show that involvement of the practitioner in the development of a methodology helps producing an end product fulfilling both the known and unknown requirements and expectations from end-users. Further, by actively involving researchers in the practitioner-context using an action research approach and storytelling-based assessment meetings helped them to better understand the problem at hand, and increase the communication between the stakeholders involved. The approach used was helpful in adapting the generic risk management standard AS/NZS 4360:1999 to the local context of use.