Modelo de gestão de riscos para projetos de software no setor bancário

Abstract

The management of operational risk, credit risk, image risk and liquidity risk are very developed areas in the banking sector; however, the risk management of projects in this area needs constant investment in research and training to provide its evolution. The tools and risk management techniques have been developed to improve the success of projects; though, many software projects in the banking sector are still executed without the use of methodologies, and this may cause financial losses greater than the project budget. In 2013 the Brazilian banking sector invested US$ 7.9 billion on technology projects, even so, it is observed that the country still has lack of historical databases about the risks that affect this type of projects. This research aims to propose a risk management model applicable to software projects in the Brazilian banking sector, allowing to identify and prioritize the main risks of the portfolio. It can be classified as exploratory, descriptive and qualitative, using the unique case study method in one of the largest private bank in Brazil. It used the analysis of theoretical propositions technique and data were collected through interviews, internal documents and databases. As a result, using the organization historical database of project risks, it was possible to group them into a Risk Breakdown Structure as suggested by the taxonomy of the Software Engineering Institute, and identify that the main risks of the software projects in the organization are the same existing in the literature: unstable scope, unrealistic cost; and lack of appropriate management techniques. In conclusion we propose a risk management model for the portfolio of software projects in the banking sector. The STOp model guide the management of risks between the various hierarchical levels: strategic - executives assess the main risks of the portfolio and authorize enterprise solutions; tactical - governance teams prepare policies and processes to ensure the implementation of the solutions; and operational - development teams work on individual risks that may impact the project or product objectives. Based on the proposed model and data analysis, as opposed to the theoretical framework, it was possible to contribute with the evolution of the project risk management process existing in the company, highlighting its strengths, weaknesses, opportunities and threats.