Statistically dependent risk events are said to have correlated impacts with positive or negative correlations. The impact of a risk event has direct consequences on the impacts of those risk events that are statistically dependent, whereas the impacts of statistically independent risk events have no correlation with each other.
Therefore, based on the statistical properties of the impacts of risk events, the scheme classifies risk events as statistically dependent or statistically independent. Figure 3.10 shows that the impacts of the risk events A and B have positive correlation, therefore, a large impact on risk event A causes a large impact on risk event B, and vice versa. The impacts of risk events C and D show no correlation; hence, risk events C and D are statistically independent and have uncorrelated impacts.
Risk A Impact Risk B Impact 1.0 0.1 0.5 0.1 0.5 1.0 1.0 0.1 0.5 0.1 1.0 0.5 Risk C Impact Risk D Impact
Chapter -3 Software Cost and Risk 87 The correlation could be positive or negative: a positive correlation means that the risk impact moves in the same direction, while a negative correlation means that the risk impacts moves in the opposite direction, i.e. one increases while other decreases. The impacts of statistically dependent risk events are influenced by the impacts of risk events with which they have correlations.
The statistically dependent risk events measure the same underlying risk of a software project, depending upon their correlation. Therefore, considering these risk events together could cause double counting or under counting of the impact of risk events. Therefore, the impacts of such risk events should be considered according to their correlation with each other. The statistically independent risk events measure different attributes of the overall software project risk.
The overall impact of statistically dependent risk events should be estimated according to their correlation. For example, consider two risk events with risk impacts modelled as random variables and , having probability distributions and , respectively. Assume that risk impacts and have a certain degree of correlation in their impacts, as shown by shaded area in Figure 3.11(a), which represents the influence of impacts of risk events over each other. Therefore, to estimate the overall impact of and their correlation must be considered. This can be achieved by defining the conditional probability distribution of random variables. For example, the conditional probability distribution of , , will allow the selection of samples given the value of that preserves the correlation between and .
If the samples of are selected without considering the conditional distribution, it can cause an uncorrelated sample selection, which leads to under counting or double counting of the impact of risk. The multiple or insufficient counting depends upon the sampled value of . For example, a random value of is sampled from the
(a) (b) (c)
Chapter -3 Software Cost and Risk 88 distribution , instead of sampling it from the conditional distribution, , which may change the correlation with . If the actual correlation is low, and a sample of is selected that has high correlation with , it produces a situation where falsely appears to have more influence over , as shown with the shaded area in Figure 3.11(b), which would mean that the values of change in a perfectly linear fashion with the values of . A reverse situation is shown on Figure 3.11(c), where the actual correlation is high but the sampled value of produces a low correlation with , as shown in the shaded area, which would mean that the values of will not change according to the values of due to the selected value that has low correlation. These situations cause an under counting or over counting of the risk impact, depending upon the sampled value of .
Conditional probability distributions help to avoid selection of uncorrelated samples where random variables have correlations. Consider risk impacts of and shown in Table 3.7 with their respective marginal distributions and on the side; also shown in the middle is their joint probability distribution, .
Table 3.7: Marginal and Joint Distributions of and
0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1
Table 3.8 shows the conditional distribution , in the middle, estimated from the marginal and joint distributions , , and , respectively, such that:
(3.11)
Chapter -3 Software Cost and Risk 89 conditional distribution when is sampled when 0.1, i.e., . Therefore, the only samples of that are correlated with will be selected.
Table 3.8: Conditional distribution
1 0.1 1 0.1 1 0.1 1 0.1 1 0.1 1 0.1 1 0.1 1 0.1 1 0.1 1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1 0.1
Consider that the random impacts of risk events modelled with random variable , having known probability distributions, , where is the index of the risk events and are the single realizations of the random variable, , at some time instance. Similarly, the overall random impact of all the risk events is a random variable , having probability distribution .
When all the risk events have probabilistic independence, the probability distribution of the overall random risk impact, , is the product of the marginal probability distributions, , of all the risk events [PO91][MO07], as follows:
(3.12)
Whereas, when all the risk events have probabilistic dependence, the probability distribution, , of the overall risk impact is the joint probability distribution of the marginal distributions, , of all the risk events as follows:
Chapter -3 Software Cost and Risk 90 When the joint probability distribution, , of the impact of statistically dependent random risk events is fully specified, then equation (3.13) can be expanded as follows, where ’s can be generated independently [PO91]:
… (3.14) From equation (3.11) it follows:
(3.15)
The overall random risk impact, , having distribution of all the risk events each having random impacts, , is the product of their impacts sampled from their respective marginal distributions, , such that:
, (3.16)
When the risk impacts are in terms of single values and they have correlated impacts, researchers have proposed different techniques to combine the single point correlated values [VA03][LY88].