A Risk-Driven Decision Table for Software Process Selection

It is becoming increasingly clear that there is no one-size-fits all process for software projects. Requirements-first, top-down waterfall or V-models work well when the requirements can be determined in advance, but are stymied by emergent requirements or bottom-up considerations such as COTS- or legacy-driven projects. Agile methods work well for small projects with emergent requirements, but do not scale well or provide high assurance of critical attributes such as safety or security. Formal methods provide high assurance but are generally expensive in calendar time and effort and do not scale well.

We have developed the Incremental Commitment Model (ICM) to include a set of explicit risk-driven decision points that branch in different ways to cover numerous possible project situations. As with other models trying to address a wide variety of situations, its general form is rather complex. However, its risk-driven nature has enabled us to determine a set of twelve common risk patterns and organize them into a decision table that can help new projects converge on a process that fits well with their particular process drivers. For each of the twelve special cases, the decision table provides top-level guidelines for tailoring the key activities of the ICM, along with suggested lengths between each internal system build and each external system increment delivery. This presentation will provide a summary of the ICM, show how its process decision drivers can generally be determined in the initial ICM Exploration phase, summarize each of the twelve cases, and provide representative examples of their use.