To take maximum advantage of open source software (OSS), the understanding, management and mitigation of OSS adoption risks is crucial. The objective is to avoid the impact of potentially significant adverse events on the business. Bayesian networks allow the integration of open source community data and expert judgement in order to determine the value of risk indicators. The approach taken here is to ask domain experts to evaluate specific scenarios of OSS community data (or risk drivers) in terms of values of risk indicators. In this paper, we describe the structure of tactical workshops with the purpose of obtaining the domain expert evaluation. The results of this evaluation are used in the RISCOSS methodology to construct Bayesian networks that map data from community risk drivers into statistical distributions that are feeding a platform management dashboard. We describe the empirical application of the tactical workshops and the lessons learned from the workshops conducted so far.

Peer Reviewed