Risk Analysis as part of the Requirements Engineering Process

In software engineering, risk is usually considered and analyzed during, or even after, the system design. Countermeasures are elaborated and then accommodated as a refinement of the design, when a limited number of changes are still possible and they may introduce the problem of revisiting the initial requirements. In this paper, we propose a goal-oriented approach for modeling and reasoning about risk during the requirements analysis process. Risks are introduced and analyzed along the stakeholders' goals and countermeasures are introduced as part of the system's requirements. The approach extends the Tropos formal framework with new concepts and qualitative risk reasoning mechanisms. We use a case study on loan origination process to illustrate the proposal.