A framework for risk analysis in software engineering. - Geoffrey G. Roy; Terence L. Woodings (APSEC, 2000)