Difficulties measuring software risk in an industrial environment

Software risk is intended to reflect loss due to software failure. This has traditionally been computed by taking the product of two things: a probability of occurrence and the cost associated with failures. Applying these definitions in practice, however, may be much harder than it at first appears. There are two types of problems that affect the applicability and usefulness of such a computation: that the user has to know detailed information that is not normally available, and that most risk definitions do not use relevant information that is available, including information derived from testing. A definition of risk is introduced that will be usable in industrial settings. We also explore ways of incorporating information about how the software has been tested, the degree to which the software has been tested, and the observed results.