Risk management analysis in Scrum software projects

• Date: 01 September 2019
• DOI: http://doi.org/10.1111/itor.12401
• Published date: 01 September 2019
• Author: Breno Gontijo Tavares,Carlos Eduardo Sanches da Silva,Adler Diniz de Souza

Intl. Trans. in Op. Res. 26 (2019) 1884–1905

DOI: 10.1111/itor.12401

INTERNATIONAL

TRANSACTIONS

IN OPERATIONAL

RESEARCH

Risk management analysis in Scrum software projects

Breno Gontijo Tavaresa, Carlos Eduardo Sanches da Silvaaand Adler Diniz de Souzab

aIEPG, Universidade Federalde Itajuba, Minas Gerais, Brazil

bIMC, Universidade Federalde Itajuba, Minas Gerais, Brazil

E-mail: breno.tavares@inatel.br[Tavares]; sanches@unifei.edu.br [da Silva]; adler@unifei.edu.br[de Souza]

Received 10 March 2016; receivedin revised form 6 January 2017; accepted 22 January 2017

Abstract

One of the reasons for the failure of software projects is the absence of risk management procedures or its

improper application. The adoption of Scrum in software projects is increasing. However, such approach

does not specify risk management activities. This paper presents the results of a survey conducted using a

qualitativeapproach to analyze how risk management is carried out in Scrum software projects.Consequently,

we present risk management practices that achieved greater and lesser agreement among respondents and

the literature, respectively. We found that risk management must be appliedcontinuously in a feedback loop.

Furthermore, Scrum projectsmust not have a high formal planning level, evenfor high-risk ones. The research

verified that risk managementin Scrum is performed differently from its application in traditional approaches.

The framework has native resources, but classic processes of risk management would be incorporated and

adapted.

Keywords:software engineering; Scrum; risk management

1. Introduction

Software projects are typicallycomplex and they are particularly susceptible to failure (Bannerman,

2008). Most of these projects run over budget, and are terminated prematurely or fall far from

meeting user expectations and business functionalities (Kaur and Sengupta, 2011). In this scenario,

software development industries have recently been using agile methodologies to manage projects

instead of traditional ones (Forrester Research, 2005; West and Grant, 2010), because they are

generally considered heavy, unlike agile ones, which aim to provide light approaches to projects

(Erickson et al., 2005). Furthermore, agile methodologies focus on managing and speeding up

development activities (Goodpasture, 2010).

The Scrum framework is the most widely used among agile methodologies in software project

management (Mahnic, 2010; Garz´

as and Paulk, 2013; Alharbi and Qureshi, 2014; VersionOne,

2016). It provides a set of good practices aimed at fast delivery value to the customers and can

C

2017 The Authors.

International Transactionsin Operational Research C

2017 International Federation ofOperational Research Societies

Published by John Wiley & Sons Ltd, 9600 Garsington Road, Oxford OX4 2DQ, UK and 350 Main St, Malden, MA02148,

USA.

B. G. Tavares et al. / Intl. Trans. in Op. Res.26 (2019) 1884–1905 1885

simplify the work process, reduce development time, and enhance organizational transparency

(Thamhain, 2013). However, risk management, which can reduce uncertainty and increase the

chances of success in software projects (Charette, 2005; SEI, 2010; Chowdhury and Arefeen, 2011;

Wetand Visser, 2013), is conducted mostly in an implicit way in projects thatuse agile methodologies

(Nelson et al., 2008; Nyfjord and Kajko-Mattsson,2008; Khatri et al., 2014; Moran, 2014). Nyfjord

and Kajko-Mattsson (2008) have performed a comparative analysis between traditional and agile

risk management approaches. The authors assert that agile approaches do not provide any risk

management taxonomy, and they suggest integrating traditional practicesto ensure an effective risk

management.

Furthermore, studies regarding risk management applied to software development projects that

implement agile methodologies are scarce (Hijazi et al., 2012; Tavares, 2015), and do not emphasize

the process of how a team establishes, ranks, and takes action regarding risks (Smith and Pichler,

2005). The aim of this study is to understand how risk management is performed in projects that

use the Scrum framework, with the following objectives:

ridentify applied risk management practices in software development;

rconduct a case study in software projects that use Scrum to analyze the respondent’s agreement

with the risk management practices identified in scientific literature;

ranalyze the agreement among the respondents and the standard respondent;

rrank the risk management practices according to the results.

This research is conducted for the following reasons:

rTheme relevance—There has been a growth in the number of software projects (Sethi et al., 2011;

Bazaz et al., 2012); project risk in this segment (Bazaz et al., 2012); and in the use of Scrum

(VersionOne, 2016), which is the most popular agile methodology (Azizyan et al., 2011; Meier

and Ivarsson, 2013; Mundra et al., 2013; VersionOne, 2016).

rUse of risk management in software projects—Generally, it is observed that there exists a lack

of risk management in software projects using Scrum (Hijazi et al., 2012; Tomanek and Juricek,

2015), and software projects in general (Bannerman, 2008; Junior et al., 2012; Singh et al., 2012).

rSoftware project success—Risk management can increase the chance of success in software

projects (SEI, 2010; Chowdhury and Arefeen, 2011; Bannerman, 2015) by reducing their uncer-

tainties and chances of failure (Wet and Visser, 2013). On the other hand, the absence of risk

management procedures is one of the reasons for the failure of these projects (Charette, 2005;

Dey et al., 2007; Lu et al., 2010).

rCharacteristics of risk management—Agile methodologies do not explicitly suggest risk man-

agement processes (Nelson et al., 2008; Nyfjord and Kajko-Mattsson, 2008; Khatri et al., 2014;

Moran, 2014).

The paper is organized as follows. Section 2 presents a literature review regarding the Scrum

framework and risk management; Section 3 presents the research classification, case study design,

and protocol; Section 4 presents the data collection and its results; and finally, Section 5 presents

the discussions, conclusions, and suggestions for further research.

C

2017 The Authors.

International Transactionsin Operational Research C

2017 International Federation of OperationalResearch Societies