What kind of software risk / threat analysis tools or books are available?

Question

The situation: I work for a manufacturing company which uses several pieces of in-house software to mass customize our product. The system uses a home grown .NET 1.1 KBE (knowledge based engineering) backend, a .NET 2.0 web interface for quoting and ordering, and a DOS based tool from the late 80s/early 90s for creating AutoCAD drawings.

We are currently trying to justify a project costing around 1.1 million dollars to replace this system. The KBE backend needs some serious improvement (not all rules get processed when they are supposed to), the interface works fairly well on the web thanks to a lot of recent upgrades (and will not be replaced in this project), but the drawing tool is the real problem. It crashes at least once a day, needs constant tweeks, cannot handle multiple simultaneous request (and doesn't have any queuing system), is limited to 8 character file names (we have ~7000 files), 255 character rules, etc.

The question: Our management team isn't sure that it will be cost effective to replace this solution ... EVER. They talked today about continuing to support our currently implementation indefinitly (at least for another 4-6 years) and so I am looking for some risk analysis tools or books to help explain why this would not be a good choice. The basic analysis with increased sales and reduced cost already shows a 3-5 year ROI but they don't consider that acceptable "in the current economic climate" especially since it would involve putting other lower priority projects on hold.

Edit, in response to some answers:

Actually, we have a well defined business case that shows an ROI of approximatly 1.5 years; however, the sales manager in a meeting with our Executive Staff said that the increased sales numbers are probably BS and his department is the one who was providing those numbers. Since this system was put in place they have increased sales by 1,600% and the system just wasn't designed to handle that level of business.

They have actually said they will be willing to upgrade the product, they just want to know how urgent it is considering that the drawing software hasn't failed them in the 15 years they've owned it (their defenition of not failing being: it hasn't been down for more than 3 or 4 hours at a time. Last year its up time was probably around 90%.)

Answer 1

As you describe things, this is being viewed as simply a cost and risk issue. In other words spending the 1.1 million would not result in any synificant business benefits like sales would double or something like that.

With no business benefits, any system is hard to justify.

With respect to risks, two come to mind immediately. Since you are using obsolete technology:

1) Do you have the people on staff who understand that technology and or can you hire replacements who understand it should someone quit.

2) Are the compilers and tools used for that solution still supported by their vendors?

These are synificant risks, particulary if you are in a situation where you are using a critical tool whose vendor has gone out of business.

RESPONSE TO ADDITIONAL INFORMATION IN QUESTION.

Based upon the amended question, I don't think you have made your business case for risk.

As you present it, the document module has always met the requirements of the business (never down for more than 3-4 hours), and will most likely continue to perform as before.

Now when one of the two knowledgeable programmers actually leavs the company, you may have a better case.

Try to put yourself in the position of the sales manager, he probably realises he can't have everything he wants. He may be thinking that if you do this particular project then there is some other project (call it Y) theat he wants more that will not get done.

Or he may just be thinking that if the firm were to spend the million on hiring sales people instead of this project sales would increase faster.

You need to attempt to ascertain just where he is coming from.

Answer 2

I have used this template I found some time ago to do project risk analysis.Generic Software Project Risk Factors. I am sure you can fill in the risk factors and customize it to your needs. It is simple enough to use and easy enough for PHB's to understand. Then its in their hands to make the decisions.

It may be helpful to know the Micorosoft product Lifecycles as the dev tools will certainly be a factor in an long term project.

Answer 3

Managers understand money and risk. You are suggesting spending a lot of money on something that, on the face of it, will not save a single dollar. That simply isn't going to happen.

You need to show one of two things: that the rewrite will have a significant return on investment, or that the risks of not doing it are great.

You say the software isn't working well. Can you quantify that in terms of money? Do you have any examples of business rules not firing off the right rules, and losing money? Can you come up with good reasons why the drawing engine is costing money, through lost productivity or giving a bad impression to customers or frustrating employees so they quit?

Are there significant risks involved in continuing to use the software? Are you likely to get into regulatory trouble (I don't know what your business is)? Are you likely to wind up with something that has to be tweaked when it will be really expensive to get somebody to fix it right?

You're asking them to devote over a million dollars of resources to the project, when they could fire everybody and save the money, or have everybody working on something else that will have more positive impact. That requires a business case, not complaints about software quality or ease of use.