Putting Risk into Context

Many aspects of risk exist within any organisation and these will differ dependent on point of view. Such a view is known as a context. Each context is complex in its own right but also presents complex interactions with the others; this can be viewed in a similar manner to the standard systems issue of dynamic complexity (the whole being greater than the sum of the parts). Many techniques exist to aid in the understanding of risk within each context, however it is difficult to relate these to each other either within one context or between differing contexts. One solution to these limitations would be to define a process which takes into account the different contexts and provides the ability to understand and provide relationships between tools. This paper discusses the application of the Unified Modelling Language (UML) to help identify and define a risk management process. It focuses on: 1) The identification and understanding of the viewpoint/context from which the assessment will be carried out and how this can be realised using multiple Use Case diagrams. 2) The understanding of the application to be assessed including the static and dynamic implications of the application in question. 3) The selection of a tool or tools and their amalgamation where basic tools do not fulfil the requirements of the assessment. 4) The assessment of risk in a qualitative or quantitative manner using parametric constraints provided in the SysML extension to the UML. A number of example applications of this approach will be presented showing the use of the notation. The paper concludes by highlighting the advantages provided through the use of UML and the ease of application of this straightforward approach to risk assessment.