CoChat
Sign Up
Cited by 0Software Engineering Techniques and PracticesConstruction Project Management and PerformanceSafety Systems Engineering in Autonomy

The DOI matches its Crossref record; 5 of the 5 references it cites were found in a registry or an index; none of the 37 sources its claims cite is checked for support yet.

Integrating Traditional Risk Management Practices with Agile Software Development: A Hybrid Framework for Improved Risk Handling

Open access
Nidheesh Sharma, Dr.Neha Gupta·2026·International Journal of Research & Technology
DOI 10.64882/ijrt.v14.i3.1874
Open this paper in CoChat — free accountOpen PDF

Abstract

Software projects continue to overrun schedule and budget for reasons that disciplined risk management was designed to prevent. Plan-driven risk management, as codified in PMBOK, PRINCE2 and ISO 31000, offers rigorous identification, quantification and traceability, but its heavyweight documentation cycles fit poorly with short iterations and emergent requirements. Agile methods handle volatility well through short feedback loops, yet they treat risk implicitly, rarely quantify exposure, and consistently underperform on slow-moving systemic risks such as architectural erosion, vendor dependency and regulatory compliance. This paper proposes HARM-F (Hybrid Agile Risk Management Framework), a two-tier framework that retains a lightweight strategic risk register and quantitative exposure model from traditional practice while embedding risk activities directly in agile ceremonies at the tactical tier. The framework introduces a composite Hybrid Risk Score that combines probability, impact, volatility and detectability with analytic-hierarchy-process weights, a risk-velocity measure that converts the static register into an iteration-level trend signal, and a benefit-ratio rule for selecting responses. HARM-F was developed through a design-science cycle informed by a practitioner survey and evaluated on six industrial projects against matched control projects. The treatment group showed a 37.9 percent gain in risk-detection effectiveness, a 60.8 percent reduction in escaped risks, and schedule and cost variance reduced to 7.4 and 6.8 percent respectively, at an additional process overhead of roughly four percent of iteration effort.

Overview

AI snapshot

Written from the paper’s full text.

TL;DR

The paper proposes HARM-F, a two-tier hybrid framework that combines a strategic traditional risk register with tactical risk activities embedded in agile ceremonies. Evaluation on six industrial projects against six matched controls reports improved risk detection, fewer escaped risks, and lower schedule/cost variance for modest process overhead.

Key findings

  • HARM-F uses a composite Hybrid Risk Score combining probability, impact, volatility, and detectability, with AHP weights \(w_1=0.31\), \(w_2=0.38\), \(w_3=0.17\), \(w_4=0.14\) and consistency ratio \(CR=0.043\).
  • Against matched controls, risk detection effectiveness rose from 61.4% to 84.7% (+37.9%), escaped risks fell by 60.8%, schedule variance fell to 7.4%, and cost variance fell to 6.8%; all six primary differences were significant at \(p<0.05\) with large effect sizes (e.g., RDE \(p=0.008\), Cliff’s \(\delta=0.72\)).
  • Residual-risk decay was faster for the hybrid group: fitted \(\lambda=0.152\) versus 0.041 for traditional and 0.038 for agile; the agile curve plateaued at \(R_\infty \approx 48\) versus \(\approx 17\) for hybrid.
  • Quantification changed mitigation ordering in 34% of observed iterations; excluding detectability moved 19% of items across the tier boundary; projects adopting scoring without promotion/decomposition achieved only about half the escaped-risk reduction. The abstract reports roughly four percent overhead, while Section 5.1 and the conclusion report about 1.5 percentage points of iteration effort.

Methods

  • Design-science study with five stages and two full design iterations; data included a survey of 84 practitioners, 19 semi-structured interviews, and historical data from 12 projects across four organisations—six treatment and six matched controls—covering 128 iterations and 1,046 risk items (mean team size 8.4; mean duration 7.9 months).
  • Framework development decomposed traditional risk activities into iteration-sized units assigned to agile ceremonies; AHP pairwise comparisons set score weights, accepted only with consistency ratio below 0.10.
  • Quantitative comparison used Mann-Whitney U tests at \(\alpha=0.05\) with Cliff’s delta, plus exponential decay fitting for residual risk; qualitative validation used nine senior practitioners rating completeness, clarity, feasibility, and usefulness on a five-point scale.

Limitations

  • The paper states the sample of 12 projects in four organisations is small and predominantly from regulated financial and healthcare domains, so unregulated product organisations may see smaller benefit; observation periods of 10–14 iterations may be too short to capture long-term register decay; and an attention effect cannot be excluded because the treatment group knew it was applying a new framework.
  • Evident in the text: the overhead estimate is inconsistent—the abstract says roughly four percent of iteration effort, while Section 5.1 and the conclusion say about 1.5 percentage points.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.64882/ijrt.v14.i3.1874

Cites

5 of 5 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Verification

Claims the paper makes

0 of 37 cited sources checked · 0 supported · 0 flagged

  • Findingown data

    The treatment group showed an additional process overhead of roughly four percent of iteration effort.

    “The treatment group showed a 37.9 percent gain in risk-detection effectiveness, a 60.8 percent reduction in escaped risks, and schedule and cost variance reduced to 7.4 and 6.8 percent respectively, at an additional process overhead of roughly four percent of iteration effort.”
    Quote in the paperSubstantial claim
  • Findingown data

    The treatment group showed cost variance reduced to 6.8 percent.

    “The treatment group showed a 37.9 percent gain in risk-detection effectiveness, a 60.8 percent reduction in escaped risks, and schedule and cost variance reduced to 7.4 and 6.8 percent respectively, at an additional process overhead of roughly four percent of iteration effort.”
    Quote in the paperSubstantial claim
  • Findingown data

    The treatment group showed schedule variance reduced to 7.4 percent.

    “The treatment group showed a 37.9 percent gain in risk-detection effectiveness, a 60.8 percent reduction in escaped risks, and schedule and cost variance reduced to 7.4 and 6.8 percent respectively, at an additional process overhead of roughly four percent of iteration effort.”
    Quote in the paperSubstantial claim
  • Findingown data

    The treatment group showed a 60.8 percent reduction in escaped risks.

    “The treatment group showed a 37.9 percent gain in risk-detection effectiveness, a 60.8 percent reduction in escaped risks, and schedule and cost variance reduced to 7.4 and 6.8 percent respectively, at an additional process overhead of roughly four percent of iteration effort.”
    Quote in the paperSubstantial claim
  • Findingown data

    The treatment group showed a 37.9 percent gain in risk-detection effectiveness.

    “The treatment group showed a 37.9 percent gain in risk-detection effectiveness, a 60.8 percent reduction in escaped risks, and schedule and cost variance reduced to 7.4 and 6.8 percent respectively, at an additional process overhead of roughly four percent of iteration effort.”
    Quote in the paperSubstantial claim
  • It may state two separate claims as one. 33
  • Probably not a substantial claim. 21

  • It may state two separate claims as one.

    Findingown data

    Risk detection effectiveness was 61.4% in control and 84.7% in hybrid, a +37.9% change (p=0.008, Cliff's δ=0.72).

    “| Risk detection | 61.4 | 84.7 | +37.9% | 0.008 | 0.72 |”
    • Also stated in: § 6. CONCLUSION AND FUTURE SCOPE · plain
      “risk detection effectiveness rose by 37.9 percent”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Findingown data

    All six primary differences between treatment and control groups were significant at the 0.05 level with large effect sizes.

    “All six primary differences are significant at the 0.05 level with large effect sizes.”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Findingown data

    The panel-derived AHP weights for the Hybrid Risk Score were w1 = 0.31, w2 = 0.38, w3 = 0.17 and w4 = 0.14, with consistency ratio CR = 0.043.

    “The panel-derived weights were w₁ = 0.31, w₂ = 0.38, w₃ = 0.17 and w₄ = 0.14, with CR = 0.043.”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Findingreasoning

    The design rule eliminated full Monte Carlo schedule simulation at team level, formal risk review meetings separate from existing ceremonies, and narrative risk reports, while preserving explicit enumeration, numerical prioritisation and documented closure.

    “This rule eliminated several practices that agile teams commonly resent -full Monte Carlo schedule simulation at team level, formal riskreview meetings separate from existing ceremonies, and narrative risk reports -while preserving the three that interviewees valued: explicit enumeration, numerical prioritisation and documented closure.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Findingown data

    A rotating risk steward prevented risk from becoming one person's concern, as reported by interviewees.

    “which interviewees reported prevented risk from becoming one person's concern.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Interpretationreasoning

    The framework provides an evaluated design artefact and a metric set that subsequent studies can replicate, addressing the recurring criticism that hybrid risk management is discussed anecdotally rather than measured.

    “For research, it provides an evaluated design artefact and a metric set that subsequent studies can replicate, addressing the recurring criticism that hybrid risk management is discussed anecdotally rather than measured.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Software projects continue to overrun schedule and budget for reasons that disciplined risk management was designed to prevent.
    • Rests on an assumption: Most organisations, particularly in regulated or contractually bound domains, already operate somewhere between plan-driven and agile, but they do so informally, with no defined interface between the corporate risk register and the sprint board.

  • It may state two separate claims as one.

    Premisecitation

    Agile methods handle volatility well through short feedback loops, yet they treat risk implicitly, rarely quantify exposure, and consistently underperform on slow-moving systemic risks such as architectural erosion, vendor dependency and regulatory compliance.

    “Agile methods handle volatility well through short feedback loops, yet they treat risk implicitly, rarely quantify exposure, and consistently underperform on slow-moving systemic risks such as architectural erosion, vendor dependency and regulatory compliance.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [16]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [17]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Rests on an assumption: Software projects continue to overrun schedule and budget for reasons that disciplined risk management was designed to prevent.

  • It may state two separate claims as one.

    Interpretationreasoning

    Traditional and agile risk management approaches are not opposed on principle but complementary in coverage: each is strong precisely where the other is weak.

    “The comparison shows that the approaches are not opposed on principle but complementary in coverage: each is strong precisely where the other is weak”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Traditional risk management produces an explicit, auditable artefact.
    • Rests on an assumption: Traditional risk management forces early consideration of low-probability high-impact events.
    • Rests on an assumption: Traditional risk management supports contractual and insurance decisions that require numbers rather than opinions.
    • Rests on an assumption: Register maintenance in traditional risk management is effort-intensive and tends to decay after the planning phase.
    • Rests on an assumption: Probability estimates in traditional risk management are elicited once and rarely revised.
    • Rests on an assumption: The review cadence in traditional risk management is tied to management reporting rather than to the rate at which the project actually changes.
    • Rests on an assumption: Agile literature treats risk largely as an emergent property of the process rather than as an object of explicit management.
    • Rests on an assumption: Iteration planning limits work in progress and therefore exposure.
    • Rests on an assumption: The definition of done constrains quality risk.
    • Rests on an assumption: Retrospectives surface process risk.
    • Rests on an assumption: Continuous integration and automated testing compress the feedback loop within which defects can be detected.
    • Rests on an assumption: Because risks are represented as backlog items, spikes or impediments, they inherit the lifespan of a sprint.
    • Rests on an assumption: An impediment that cannot be resolved within the iteration is often re-raised, deprioritised and eventually normalised.
    • Rests on an assumption: There is no exposure value in agile risk management.
    • Rests on an assumption: There is no trend data in agile risk management.

  • Probably not a substantial claim.

    Study design and conductown data

    Matching of the treatment and control groups was performed on team size, domain, contract type and nominal duration.

    “Matching was performed on team size, domain, contract type and nominal duration.”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Interpretationnone given

    The framework supplies a composite risk score and a risk-velocity indicator that make risk trend visible on the same timescale as the burndown chart, converting risk from a periodic report into a continuously observable project variable.

    “For measurement, it supplies a composite risk score and a risk-velocity indicator that make risk trend visible on the same timescale as the burndown chart, converting risk from a periodic report into a continuously observable project variable.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Software projects continue to overrun schedule and budget for reasons that disciplined risk management was designed to prevent.
    • Rests on an assumption: Most organisations, particularly in regulated or contractually bound domains, already operate somewhere between plan-driven and agile, but they do so informally, with no defined interface between the corporate risk register and the sprint board.

  • Probably not a substantial claim. The paper may give no reason why it holds.

    Interpretationnone given

    The framework offers a deployable two-tier structure with defined artefacts, roles and cadences that can be adopted incrementally by a Scrum team without abandoning existing governance instruments.

    “For practice, the framework offers a deployable two-tier structure with defined artefacts, roles and cadences that can be adopted incrementally by a Scrum team without abandoning existing governance instruments.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Software projects continue to overrun schedule and budget for reasons that disciplined risk management was designed to prevent.
    • Rests on an assumption: Most organisations, particularly in regulated or contractually bound domains, already operate somewhere between plan-driven and agile, but they do so informally, with no defined interface between the corporate risk register and the sprint board.

  • It may state two separate claims as one.

    Premisenone given

    Traditional plan-driven approaches share three assumptions: that the scope of the project is largely knowable in advance, that risks can be enumerated up front in a register, and that the register is reviewed on a fixed managerial cadence, typically monthly or at phase gates.

    “These approaches share three assumptions: that the scope of the project is largely knowable in advance, that risks can be enumerated up front in a register, and that the register is reviewed on a fixed managerial cadence, typically monthly or at phase gates.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Software projects continue to overrun schedule and budget for reasons that disciplined risk management was designed to prevent.

  • It may state two separate claims as one.

    Interpretationreasoning

    Plan-driven governance sees the slow risks and misses the fast ones; agile practice sees the fast risks and misses the slow ones.

    “Plan-driven governance sees the slow risks and misses the fast ones; agile practice sees the fast risks and misses the slow ones.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Software projects continue to overrun schedule and budget for reasons that disciplined risk management was designed to prevent.
    • Rests on an assumption: Most organisations, particularly in regulated or contractually bound domains, already operate somewhere between plan-driven and agile, but they do so informally, with no defined interface between the corporate risk register and the sprint board.

  • It may state two separate claims as one.

    Interpretationreasoning

    Across the reviewed work, integration is proposed at the level of principle rather than mechanism: papers advocate combining rigour with agility but do not specify which artefact is produced by whom, at which ceremony, and with what update rule.

    “First, integration is proposed at the level of principle rather than mechanism: papers advocate combining rigour with agility but do not specify which artefact is produced by whom, at which ceremony, and with what update rule.”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Premisecitation

    Risk-driven backlog prioritisation weights user stories by associated risk exposure so that high-risk items are pulled forward, but it addresses ordering only and leaves identification informal.

    “Risk-driven backlog prioritisation weights user stories by associated risk exposure so that high-risk items are pulled forward [7], [8], but it addresses ordering only and leaves identification informal.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [7]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [8]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • It may state two separate claims as one.

    Premisecitation

    The argument that agility is a risk-control strategy holds empirically for requirement volatility and for certain classes of technical uncertainty.

    “Empirically, this argument holds for requirement volatility and for certain classes of technical uncertainty [2], [6].”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [2]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [6]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Rests on an assumption: Software projects continue to overrun schedule and budget for reasons that disciplined risk management was designed to prevent.

  • It may state two separate claims as one.

    Premisecitation

    Scaled frameworks partially address agile risk persistence through program-level risk boards and PI-planning ROAM classification, but these are coarse and operate at a cadence of two to three months, which reintroduces the latency problem that agility was meant to remove.

    “Scaled frameworks partially address this through program-level risk boards and PI-planning ROAM classification [9], but these are coarse and operate at a cadence of two to three months, which reintroduces the latency problem that agility was meant to remove.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [9]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • It may state two separate claims as one.

    Premisenone given

    Plan-driven risk management, as codified in PMBOK, PRINCE2 and ISO 31000, offers rigorous identification, quantification and traceability, but its heavyweight documentation cycles fit poorly with short iterations and emergent requirements.

    “Plan-driven risk management, as codified in PMBOK, PRINCE2 and ISO 31000, offers rigorous identification, quantification and traceability, but its heavyweight documentation cycles fit poorly with short iterations and emergent requirements.”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites PMBOK

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites PRINCE2

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites ISO 31000

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Rests on an assumption: Software projects continue to overrun schedule and budget for reasons that disciplined risk management was designed to prevent.

  • It may state two separate claims as one.

    Premisecitation

    Risk burndown charting plots aggregate exposure across iterations, but in most reported uses the underlying values are re-estimated subjectively and the chart is decorative rather than decision-driving.

    “Risk burndown charting plots aggregate exposure across iterations and is widely cited [15], yet in most reported uses the underlying values are re-estimated subjectively and the chart is decorative rather than decision-driving.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [15]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim.

    Study design and conductown data

    The design cycle included evaluation against defined metrics with comparison to matched controls.

    “The design cycle comprised five stages: problem identification from literature and practitioner input; definition of solution objectives derived from the gaps in Section 2.5; design and development of the framework; demonstration on live projects; and evaluation against defined metrics with comparison to matched controls.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. It may state two separate claims as one.

    Premisecitation

    Agility is itself a risk-control strategy: short iterations limit the amount of work exposed to a change in requirements, continuous integration bounds the cost of defect discovery, and frequent demonstrations reduce the probability of building the wrong product.

    “Their designers argued that agility is itself a risk-control strategy: short iterations limit the amount of work exposed to a change in requirements, continuous integration bounds the cost of defect discovery, and frequent demonstrations reduce the probability of building the wrong product.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [2]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [6]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Rests on an assumption: Software projects continue to overrun schedule and budget for reasons that disciplined risk management was designed to prevent.

  • Probably not a substantial claim.

    Interpretationnone given

    The framework introduces a benefit-ratio rule for selecting responses.

    “The framework introduces a composite Hybrid Risk Score that combines probability, impact, volatility and detectability with analytic-hierarchy-process weights, a risk-velocity measure that converts the static register into an iteration-level trend signal, and a benefit-ratio rule for selecting responses.”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Interpretationcitation

    Across the reviewed work, evaluation is overwhelmingly anecdotal, using single case descriptions without control comparison or defined metrics, so the cost of the added process is never weighed against its benefit.

    “Third, evaluation is overwhelmingly anecdotal, using single case descriptions without control comparison or defined metrics [2], [10], so the cost of the added process is never weighed against its benefit.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [2]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [10]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim.

    Premisecitation

    Traditional risk management models risk as the product of the probability of an undesirable event and its impact, an exposure value used to rank a register of enumerated threats.

    “The traditional canon models risk as the product of the probability of an undesirable event and its impact, an exposure value used to rank a register of enumerated threats [3], [4].”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [3]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [4]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim. It may state two separate claims as one.

    Premisereasoning

    The study follows a design-science research methodology, which is appropriate because the primary output is a designed artefact rather than a descriptive theory.

    “The study follows a design-science research methodology [12], [13], which is appropriate because the primary output is a designed artefact rather than a descriptive theory.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [12]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [13]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • It may state two separate claims as one.

    Premisecitation

    Lightweight adaptations of ISO 31000 for agile contexts preserve the process skeleton while reducing documentation, but they do not specify how the reduced artefacts connect to sprint ceremonies.

    “Lightweight adaptations of ISO 31000 for agile contexts preserve the process skeleton while reducing documentation [4], [10], but they do not specify how the reduced artefacts connect to sprint ceremonies.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [4]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [10]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • It may state two separate claims as one.

    Study design and conductown data

    Qualitative validation of the framework used expert review by nine senior practitioners not involved in its development, who rated completeness, clarity, feasibility and perceived usefulness on a five-point scale, and whose free-text comments were coded thematically.

    “Qualitative validation used expert review: the framework was presented to nine senior practitioners not involved in its development, who rated completeness, clarity, feasibility and perceived usefulness on a five-point scale, and whose free-text comments were coded thematically.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. It may state two separate claims as one.

    Premisecitation

    Several authors describe agile risk management as implicit risk management and argue it is sufficient for the majority of project uncertainty.

    “Several authors describe this as implicit risk management [6] and argue that it is sufficient for the majority of project uncertainty.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [6]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Study design and conductcitation

    The composite score weights were elicited through pairwise comparison using the analytic hierarchy process with the interview panel, and the resulting weight vector was accepted only after its consistency ratio fell below 0.10.

    “Weighting of the composite score was elicited through pairwise comparison using the analytic hierarchy process [11] with the interview panel, and the resulting weight vector was accepted only after its consistency ratio fell below the conventional threshold of 0.10.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [11]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Study design and conductown data

    Two full design iterations were executed, with the framework revised after the first evaluation round in response to observed overhead concentrated in the mid-iteration reassessment step.

    “Two full design iterations were executed, with the framework revised after the first evaluation round in response to observed overhead concentrated in the mid-iteration reassessment step.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Premisecitation

    Classical treatments framed risk as a quantity to be identified, analysed, prioritised and controlled through an explicit, repeatable process, and this view was institutionalised in process standards: PMBOK's risk knowledge area, PRINCE2's risk theme, ISO 31000 and CMMI.

    “Classical treatments framed risk as a quantity to be identified, analysed, prioritised and controlled through an explicit, repeatable process, and this view was institutionalised in the process standards that still dominate governance practice: PMBOK's risk knowledge area [3], PRINCE2's risk theme, ISO 31000 [4] and the risk process areas of CMMI.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [3]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [4]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Rests on an assumption: Software projects continue to overrun schedule and budget for reasons that disciplined risk management was designed to prevent.

  • It may state two separate claims as one.

    Interpretationcitation

    Across the reviewed work, quantification is either abandoned or retained unchanged; no reviewed approach adapts the exposure model itself to an iterative setting by incorporating detectability or volatility, both of which vary sharply between iterations.

    “Second, quantification is either abandoned or retained unchanged; no reviewed approach adapts the exposure model itself to an iterative setting by incorporating detectability [14] or volatility, both of which vary sharply between iterations.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [14]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • It may state two separate claims as one.

    Interpretationown data

    Quantification is the component that agile teams resist most and benefit from most.

    “quantification is the component that agile teams resist most and benefit from most”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Study design and conductnone given

    Six metrics were defined before the evaluation began.

    “Six metrics were defined before the evaluation began.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. It may state two separate claims as one.

    Interpretationnone given

    Governance pressure is high in regulated financial and healthcare domains, and the value of the traditional tier is correspondingly greater there.

    “where governance pressure is high and the value of the traditional tier is correspondingly greater”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. It may state two separate claims as one.

    Study design and conductreasoning

    Because sample sizes are small and distributions non-normal, group differences were tested with the Mann-Whitney U test at a significance level of 0.05, with Cliff's delta reported as an effect size.

    “Because sample sizes are small and distributions non-normal, group differences were tested with the Mann-Whitney U test at a significance level of 0.05, with Cliff's delta reported as an effect size.”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Interpretationreasoning

    The classical static exposure formula RE_i = P_i × I_i is inadequate in an iterative setting because it ignores how quickly the estimate itself is changing and whether the project has any mechanism capable of detecting the risk before it materialises.

    “This static form is inadequate in an iterative setting for two reasons: it ignores how quickly the estimate itself is changing, and it ignores whether the project has any mechanism capable of detecting the risk before it materialises.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.

    Study design and conductnone given

    The principal residual threat to validity is the attention effect associated with any newly introduced process.

    “the principal residual threat, discussed in Section 5.4, is the attention effect associated with any newly introduced process.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Interpretationown data

    The evidence suggests a specific adoption order: taxonomy prompts first, then the scoring model, then the synchronisation interface, and only then the automated dashboard.

    “the evidence suggests a specific adoption order: taxonomy prompts first, since they cost the least and immediately improve identification; then the scoring model; then the synchronisation interface; and only then the automated dashboard.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper may give no reason why it holds. It may state two separate claims as one.

    Interpretationreasoning

    Prompted identification during backlog refinement using a seven-category taxonomy preserves the coverage advantage of checklist-based identification while costing only a few minutes of an existing meeting.

    “This preserves the coverage advantage of checklist-based identification while costing only a few minutes of an existing meeting.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Checklist-based risk identification has a coverage advantage over spontaneous identification.

  • Probably not a substantial claim.

    Interpretationnone given

    Integration rests on a single design rule: any traditional activity is retained only if it can either be decomposed to fit inside one iteration or justified as a strategic-tier activity that produces an artefact an external stakeholder consumes.

    “Integration rests on a single design rule: any traditional activity is retained only if it can either be decomposed to fit inside one iteration or justified as a strategic-tier activity that produces an artefact an external stakeholder consumes.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. The paper may give no reason why it holds.

    Interpretationreasoning

    Every registered risk can be traced to the iterations in which it was worked.

    “every registered risk can be traced to the iterations in which it was worked.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.

    Study design and conductnone given

    Observation periods of ten to fourteen iterations may be too short to capture the register decay that afflicts traditional practice over multi-year programmes.

    “Observation periods of ten to fourteen iterations may be too short to capture the register decay that afflicts traditional practice over multi-year programmes.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Register decay afflicts traditional practice over multi-year programmes.

  • It may state two separate claims as one.

    Study design and conductown data

    The sample of twelve projects in four organisations is small and drawn predominantly from regulated financial and healthcare domains, making the evidence base small and domain-concentrated.

    “The sample of twelve projects in four organisations is small and drawn predominantly from regulated financial and healthcare domains”
    • Also stated in: § 6. CONCLUSION AND FUTURE SCOPE · plain
      “with the qualification that the evidence base is small and domain-concentrated.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim.

    Study design and conductnone given

    The treatment group knew it was applying a new framework.

    “the treatment group knew it was applying a new framework”
    Quote in the paperSubstantial claim
45 of 45

  • The paper relies on this without support.

    Software projects continue to overrun schedule and budget for reasons that disciplined risk management was designed to prevent.

    “Software projects continue to overrun schedule and budget for reasons that disciplined risk management was designed to prevent.”

  • The paper relies on this without support.

    Most organisations, particularly in regulated or contractually bound domains, already operate somewhere between plan-driven and agile, but they do so informally, with no defined interface between the corporate risk register and the sprint board.

    “Most organisations, particularly in regulated or contractually bound domains, already operate somewhere between the two, but they do so informally, with no defined interface between the corporate risk register and the sprint board.”

  • The paper relies on this without support.

    Traditional risk management produces an explicit, auditable artefact.

    “it produces an explicit, auditable artefact”

  • The paper relies on this without support.

    Traditional risk management forces early consideration of low-probability high-impact events.

    “it forces early consideration of low-probability highimpact events”

  • The paper relies on this without support.

    Traditional risk management supports contractual and insurance decisions that require numbers rather than opinions.

    “it supports contractual and insurance decisions that require numbers rather than opinions”

  • The paper relies on this without support.

    Register maintenance in traditional risk management is effort-intensive and tends to decay after the planning phase.

    “Register maintenance is effort-intensive and tends to decay after the planning phase”

  • The paper relies on this without support.

    Probability estimates in traditional risk management are elicited once and rarely revised.

    “probability estimates are elicited once and rarely revised”

  • The paper relies on this without support.

    The review cadence in traditional risk management is tied to management reporting rather than to the rate at which the project actually changes.

    “the review cadence is tied to management reporting rather than to the rate at which the project actually changes”

  • The paper relies on this without support.

    Agile literature treats risk largely as an emergent property of the process rather than as an object of explicit management.

    “Agile literature treats risk largely as an emergent property of the process rather than as an object of explicit management.”

  • The paper relies on this without support.

    Iteration planning limits work in progress and therefore exposure.

    “Iteration planning limits work in progress and therefore exposure”

  • The paper relies on this without support.

    The definition of done constrains quality risk.

    “the definition of done constrains quality risk”

  • The paper relies on this without support.

    Retrospectives surface process risk.

    “retrospectives surface process risk”

  • The paper relies on this without support.

    Continuous integration and automated testing compress the feedback loop within which defects can be detected.

    “continuous integration and automated testing compress the feedback loop within which defects can be detected”

  • The paper relies on this without support.

    Because risks are represented as backlog items, spikes or impediments, they inherit the lifespan of a sprint.

    “Because risks are represented as backlog items, spikes or impediments, they inherit the lifespan of a sprint”

  • The paper relies on this without support.

    An impediment that cannot be resolved within the iteration is often re-raised, deprioritised and eventually normalised.

    “an impediment that cannot be resolved within the iteration is often re-raised, deprioritised and eventually normalised”

  • The paper relies on this without support.

    There is no exposure value in agile risk management.

    “There is no exposure value”

  • The paper relies on this without support.

    There is no trend data in agile risk management.

    “there is no trend data”

  • The paper relies on this without support.

    The daily stand-up provides sufficient risk-status information to discharge the traditional risk-status function.

    “the daily stand-up, for instance, is a sufficient risk-status mechanism and was not replaced by a separate status update.”

  • The paper relies on this without support.

    Checklist-based risk identification has a coverage advantage over spontaneous identification.

    “This preserves the coverage advantage of checklist-based identification while costing only a few minutes of an existing meeting.”

  • The paper relies on this without support.

    The most visible risk, rather than the most cost-effectively reducible risk, commonly absorbs mitigation effort.

    “This rule replaces the common failure mode in which the most visible risk rather than the most costeffectively reducible risk absorbs mitigation effort.”

  • The paper relies on this without support.

    A risk whose estimate is unstable is, in practice, a risk that is not yet understood.

    “Volatility earns a place in the score because a risk whose estimate is unstable is, in practice, a risk that is not yet understood.”

  • The paper relies on this without support.

    Risk velocity provides an iteration-level signal that traditional risk registers lack.

    “provides the iteration-level signal that traditional registers lack”

  • The paper relies on this without support.

    Displaying risk velocity beside the sprint burndown makes the risk position visible to the whole team daily at no additional reporting cost.

    “Displaying RV beside the sprint burndown makes the risk position visible to the whole team daily, at no additional reporting cost.”

  • The paper relies on this without support.

    Register decay afflicts traditional practice over multi-year programmes.

    “the register decay that afflicts traditional practice over multi-year programmes.”
24 of 24

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Conflicting estimates of additional process overhead

    Major

    The abstract describes the additional overhead as roughly 4% of iteration effort, while the conclusion describes the additional cost as about 1.5 percentage points of iteration effort. Both are presented as the added process effort, but they give different amounts.

  • Decay equation does not start at the stated initial exposure

    Minor

    At s = 0, Equation (6) gives R(0) = R0 + R∞, not R0. Because the paper describes a nonzero residual floor, R0 cannot also be the initial aggregate exposure as stated.

2 of 2

Citations

Cites

Flagged first, then by citations

Research works printed but not linked: 11

  1. R. Sharma and A. Kaur, “Revisiting risk exposure models for iterative software delivery,” Journal of Systems and Software, vol. 201, pp. 111–128, 2023.
  2. P. Rodrigues and L. Fernandes, “Implicit versus explicit risk handling in Scrum teams: an empirical comparison,” Empirical Software Engineering, vol. 28, no. 4, pp. 1–34, 2023.
  3. A. Nurdiani, J. Börstler and S. Fricker, “Risk-driven requirements prioritisation in agile projects,” Requirements Engineering, vol. 26, no. 2, pp. 205–224, 2021.
  4. H. Alahyari, T. Gorschek and R. Berntsson-Svensson, “Value and risk trade-offs in agile portfolio decisions,” Journal of Software: Evolution and Process, vol. 34, no. 9, e2470, 2022.
  5. S. Islam and A. Rehman, “Hybrid project management approaches: a multi-case study of governance and agility,” International Journal of Project Management, vol. 41, no. 3, pp. 102–118, 2023.
  6. J. Chen, Y. Wang and L. Zhao, “Quantifying detectability in software risk assessment using pipeline telemetry,” IEEE Transactions on Software Engineering, vol. 50, no. 2, pp. 412–429, 2024.
  7. M. Ali and F. Khan, “Risk burndown as a control instrument in iterative projects: evidence from twelve cases,” IEEE Access, vol. 11, pp. 84210–84225, 2023.
  8. G. Kumar and P. Bhatia, “Comparative analysis of plan-driven and agile risk practices in regulated domains,” Software Quality Journal, vol. 32, no. 1, pp. 57–84, 2024.
  9. L. Marques and R. Oliveira, “Architectural risk and technical debt accumulation in long-running agile programmes,” Journal of Systems Architecture, vol. 138, 102856, 2023.
  10. S. Verma, N. Gupta and R. Iyer, “Machine learning for early risk prediction in software projects: a replication study,” Expert Systems with Applications, vol. 244, 122913, 2024.
  11. C. Andersson and B. Lindqvist, “Process overhead tolerance in agile teams: an interview study,” Journal of Software: Evolution and Process, vol. 37, e2712, 2025.

Cited by

Still being checked.

Related

Metadata

Authors
Nidheesh Sharma, D. N. G.
Venue
International Journal of Research & Technology
Publisher
International Journal of Research and Technology
Published
2026-09-04
Volume
14
Issue
3
Pages
1279-1294
ISSN
  • 2321-7510 (ISSN-L)
  • 2321-7529
DOI
10.64882/ijrt.v14.i3.1874
OpenAlex
W7214160897
Cited by
0
References
4
FWCI
0.00
Type
journal article
Language
en
Open access
Licence
Locations
International Journal of Research & Technology (publishedVersion, cc-by-nc)
Topics
  • Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
  • Social Sciences › Decision Sciences › Management Science and Operations Research › Construction Project Management and Performance
  • Physical Sciences › Engineering › Safety, Risk, Reliability and Quality › Safety Systems Engineering in Autonomy
Keywords
software project risk, risk register, analytic hierarchy process, benefit ratio, regulatory compliance risk, architectural erosion

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

A language model drew the claims from the paper on 2026-11-07, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).

A second model labelled each claim on 2026-11-07 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review