A risk is an undesirable event that can result in mishaps if not identified early on during requirements engineering adequately.However, identifying risks can be challenging, and requirements engineers may not always be aware if risks are ignored.In this paper, we present Murphy -a framework for performing risk analysis.Murphy adopts the Reference Model, in which requirements are supposed to be met not by the projected software system behavior alone but through collaboration between the system and events occurring in its environment, hence the term Collaborative System.Murphy provides risk analysis facilities that include an activity-oriented ontology for carrying out risk analysis by systematically identifying risky activities in the system and in the environment, thereby obtaining a Risk Analysis Graph (RAG) and towards devising risk mitigation strategies later.In order to see both the strengths and weaknesses of Murphy, we experimented on developing a smartphone app involving a group of Ph.D. and senior-level graduate students -one group using Murphy and the other not using Murphy.Our observation, we feel, shows that the risks identified by the group using Murphy were able to identify more critical risks and those risks were comprehensive and relevant as.well.The results also showed that incorporating risk mitigation strategies for the risks identified can indeed help avoid them to some extent.

Risk, a potential occurrence of some undesirable event, can be dangerous if not adequately identified and dealt with early on during software development.However, identifying risks can be difficult, hence oftentimes resulting in a particular software system that is unable to address risks, especially critical ones adequately.This paper proposes an ontology-based framework for performing risk analysis with the Augmented Reference Model -The Reference Model augmented with risk analysis.The Reference Model emphasizes that the user requirements are met through the collaboration between the system and the events occurring in its environment -i.e., not by the system alone, hence the term "collaborative system."We also offer an activity-oriented ontology to carry out risk analysis by identifying risks from negating the events in the environment and system. Such negations of the requirements, specifications, and domain events generate a graph-like representation, called Risk Analysis Graph (RAG), to help perform risk analysis.To validate our framework, we have performed two experiments using questionnaires to identify risks and use the risk analysis tool to generate RAG for performing risk analysis.We feel that at least these experiments show that RAG helps identify risks -especially the critical and uncommon ones that we would not have thought of.