ENTERPRISE PROJECT OVERSIGHT SYSTEM Vishnupriya Subburaj B.E., Anna University, India 2006 PROJECT Submitted in partial satisfaction of the requirements for the degree of MASTER OF SCIENCE in COMPUTER SCIENCE at CALIFORNIA STATE UNIVERSITY, SACRAMENTO FALL 2011 © 2011 Vishnupriya Subburaj ALL RIGHTS RESERVED ii ENTERPRISE PROJECT OVERSIGHT SYSTEM A Project by Vishnupriya Subburaj Approved by: __________________________________, Committee Chair Dr. Ahmed Salem, Ph.D __________________________________, Second Reader Dr. Meiliu Lu, Ph.D ___________________________ Date iii Student: Vishnupriya Subburaj I certify that this student has met the requirements for format contained in the University format manual, and that this project is suitable for shelving in the Library and credit to be awarded for the project. __________________________, Graduate Coordinator Dr. Nikrouz Faroughi, Ph.D Department of Computer Science iv ___________________ Date Abstract of ENTERPRISE PROJECT OVERSIGHT SYSTEM by Vishnupriya Subburaj The enterprise Project Oversight System (ePROS) is a web based system that will facilitate the oversight portfolio of IT projects for project oversight professionals. Every new product being developed should undergo rigorous stages of the software development life cycle [SDLC]. The ePROS system will provide managers and quality assurance personal with a central repository from which they can manage the portfolio of IT projects in accordance with project oversight processes, software verification and validation standard and industry best practices relating to independent project oversight (IPO). This project would focus more on the risk management of the ePROS system. The project would provide the functionality to manage project oversight risks, issues, action items and decisions. These items are connected in a methodological way which will enable the project professionals to identify the risks. Based on the probability and timeframe, the impact and severity of the risk is determined by prioritizing the risk and it is assigned to the appropriate staff to manage these issues. Apart from managing risks, this project will also handle the vendor management and oversight reporting modules. Vendor contract component will capture all the project information like vendor contracts, v contract amendments and deliverables. The report generation component will provide the functionality to generate critical project oversight reports at the portfolio and project level. _____________________, Committee Chair Dr. Ahmed Salem, Ph.D ______________________ Date vi ACKNOWLEDGMENTS I would like to thank Dr. Ahmed Salem, my project advisor for the valuable guidance that he has provided throughout this project. I am thankful to my second reader Dr. Meiliu Lu who helped me in reviewing my project. I would also like to thank my husband, Loganathan, who stood by me and helped me in completion of the project. Also I would like thank all my professors, who taught me. Without their assistance and guidance, my Master’s degree would not have been completed successfully. vii TABLE OF CONTENTS Page Acknowledgments............................................................................................................. vii List of Tables ...................................................................................................................... x List of Figures .................................................................................................................... xi Chapter 1. INTRODUCTION .......................................................................................................... 1 2. BACKGROUND ............................................................................................................ 2 2.1 Overview ........................................................................................................... 4 3. TECHNOLOGY ............................................................................................................. 5 3.1 ASP.NET .......................................................................................................... 5 3.2 MS SQL Server 2008 R2 .................................................................................. 5 3.3 System Requirements........................................................................................ 5 3.3.1 User Interface ........................................................................................... 5 3.3.2 Software Interface .................................................................................... 6 3.3.3 Hardware Interface and Operating System .............................................. 6 3.3.4 System Perspective .................................................................................. 6 3.4 Functional Requirements .................................................................................. 7 4. SYSTEM ARCHITECTURE AND DESIGN ................................................................ 9 4.1 Methodology Used ............................................................................................ 9 4.2 Database Design.............................................................................................. 10 4.2.1 tblRisk .................................................................................................... 12 4.2.2 tblIssue ................................................................................................... 13 4.2.3 tblProject ................................................................................................ 14 4.2.4 tblVendor ............................................................................................... 14 4.2.5 tblDecision ............................................................................................. 15 4.2.6 tblReport ................................................................................................ 16 viii 4.2.7 tblActionItem ......................................................................................... 17 4.3 Use Case Diagram........................................................................................... 18 4.3.1 Risk Management .................................................................................. 18 4.3.2 Vendor Management .............................................................................. 20 4.3.3 Report Generation .................................................................................. 22 4.4 User Interface .................................................................................................. 24 4.4.1 Add New Risk Screen ............................................................................ 24 4.4.2 View Risk List Screen ........................................................................... 25 4.4.3 Add New Issue Screen ........................................................................... 28 4.4.4 Add New Action Item Screen ................................................................ 29 4.4.5 Contract Deliverable Updates Screen .................................................... 30 4.4.6 Vendor List Screen ................................................................................ 31 4.4.7 Report Generation Screen ...................................................................... 32 5. CONCLUSION AND FUTURE WORK ..................................................................... 34 Bibliography ..................................................................................................................... 37 ix LIST OF TABLES Page Table 1 tblRisk .................................................................................................................. 12 Table 2 tblIssue ................................................................................................................. 13 Table 3 tblProject .............................................................................................................. 14 Table 4 tblVendor ............................................................................................................. 15 Table 5 tblDecision ........................................................................................................... 16 Table 6 tblReport .............................................................................................................. 16 Table 7 tblActionItem ....................................................................................................... 17 x LIST OF FIGURES Page Figure 1 Overview of System ............................................................................................. 7 Figure 2 Architecture Diagram ........................................................................................... 9 Figure 3 Database Design ................................................................................................. 11 Figure 4 Risk Management ............................................................................................... 19 Figure 5 Vendor Management .......................................................................................... 21 Figure 6 Report Generation .............................................................................................. 23 Figure 7 Add New Risk .................................................................................................... 25 Figure 8 View Risk List .................................................................................................... 26 Figure 9 View Risk List - 2............................................................................................... 27 Figure 10 View Risk List - 3............................................................................................. 28 Figure 11 Add New Issue ................................................................................................. 29 Figure 12 Add New Action Item ...................................................................................... 30 Figure 13 Contract Deliverable Updates........................................................................... 31 Figure 14 Vendor List ....................................................................................................... 32 Figure 15 Report Generation ............................................................................................ 33 Figure 16 IPO Report ........................................................................................................ 35 Figure 17 Portfolio Briefing Report .................................................................................. 36 xi 1 Chapter 1 INTRODUCTION Project Oversight system is proved to be the best method for improving project delivery. The system provides an independent review and analysis of the project focused on risk management and performance monitoring. The emphasis and stress is on the very early identification and quantification of risks and issues that can affect the project or the project components in later stages [5]. In every project, the complete plan outlining how the software is developed and its functions are tested is done using Software Development Life Cycle [SDLC]. The enterprise Project Oversight System (ePROS) is a web based system that will facilitate the oversight of IT projects. The ePROS system will provide managers and quality assurance personal with a central repository from which they can manage the portfolio of IT projects in accordance with project oversight processes, software verification and validation standard and industry best practices relating to independent project oversight (IPO) [4]. The need and the scope of the project is explained in chapter 3. Also the system requirements and the functional requirements are exaplained in this chapter. The details about the technology, the programming concepts used, database design diagrams and the user interface screens are explained in chapter 4. Chapter 5 concludes the learning experience and future implementation plan. 2 Chapter 2 BACKGROUND For a project to be successful, there are few factors which are most important. To have a clear goal, a plan that shows an overall path, constant and effective communication between the team, controlled scope and management support to supply people and remove organizational obstacles to keep the project moving [3]. Project Oversight by definition is simply an auditing function where a set of processes are implemented to monitor, evaluate and report status. While these activities are certainly an important part of an oversight methodology, the real benefit they provide is the dissemination of the project status to stake holders. They do help to improve the projects probability of success [9]. Project Oversight is designed to be a non-intrusive approach that doesn’t concentrate on finding fault, but rather project oversight is designed to work in the background and monitor overall dependencies of any large project. The key components to projects success are to reduce project risks and ensure that the intended business result be completed on time and on budget planned. Risk Management is developed to provide a risk assessment based on the identification, analysis, quantification, and prioritization of key project risks [2]. There are few applications like Prolog [1] to provide project oversight management. But it is a collection of preconfigured tools and reports which helps to respond oversight requirements [1]. Other such tools for risk management available in the market are Master Control, Risk Matrix, Operational Risk Management. 3 Operational Risk Management is a cyclic process which includes risk decision making and implementation of risk controls which results in avoidance of risk. The strength of this tool is that it is an oversight of the operational risk, including the risk of loss resulting from inadequate or failed internal processes or systems, or external events [11]. On the other hand, this tool handles the risk management part but doesn’t talk about the issue management part which this project handles. Master Control generates a report based on the input given. It establishes risk analysis as a separate process. The output is a risk score based on a consistent process, which enables quality departments to reduce the oftentimes subjective nature of quality making. The main feature in this tool is that handles is incorporating Risk Analysis Performance and Risk Analysis Approval [10]. But it doesn’t capture few challenges such as inconsistent risk assessment, disconnected risk analysis processes and no support for risk analysis decisions. . Risk Matrix is a software application that helps to identify, prioritize, and manage key risks in the system. It is used during risk assessment to define various level of risk based on the severity. The risks can then be calculated by weighing up the risk of an event against the cost to implement safety and the benefit gained from it [12]. Risk Matrix has its own drawbacks such as poor resolution, ambiguous inputs and outputs. Also there are some tools like Eventrac and Quantitative for managing vendor details. Both these tools do not capture the contract deliverable detail which is one of the key features of project oversight system. 4 2.1 Overview The enterprise project oversight system [ePROS] is a new custom developed solution for managing a project. This project would focus more on the risk management part of the ePROS and provides the functionality to capture risks, issues, action items and decisions [4]. These items are connected in a methodological way which will enable the project professionals to identify risks. Based on the probability and timeframe, the impact and severity of the risk is determined by prioritizing the risk and it is assigned to appropriate staff to manage these issues. Apart from managing issues and risks, this project will handle the vendor management and oversight reporting modules. Vendor management component will capture the all the project information like vendor contracts, contract amendments and deliverables. The report generation component will provide the functionality to generate critical project reports at the project and the portfolio level. So the key components of ePROS are: Risk Management Vendor Management Oversight Report Generation Chapter 3 details the requirements of the project, which would help to clearly understand the objective of this application. 5 Chapter 3 TECHNOLOGY 3.1 ASP.NET ASP.NET is a web programming technology pioneered by Microsoft that allows developers to create dynamic web pages. Dynamic web pages are pages whose content is dynamically regenerated each time the web page is requested. It is successor to Active Server Pages (ASP), which was Microsoft’s earlier dynamic web-page creation technology [7]. It is one of the most powerful and easiest technologies of the bunch available. Telerik Rad Controls for the ASP.NET AJAX set the bar for comprehensiveness, versatility, performance, reliability in the user interface component industry. Telerik’s support helps to build a high quality application in a easier and faster way [6]. 3.2 MS SQL Server 2008 R2 Microsoft SQL Server 2008 R2 is a powerful and reliable data management system that delivers a rich set of features, data protection, and performance for embedded applications, lightweight Web sites and applications, and local data stores [8]. It is designed for easy development. 3.3 System Requirements 3.3.1 User Interface EPROS is a web based project with simple user interface views. The web pages displayed to the user will have simple forms using which the users can add, edit, update 6 and delete the values. The updated values would be saved in the database. The value/record being deleted would be inserted in a separate database table for future reference. The web pages will be easy for the user to navigate from one page to another. 3.3.2 Software Interface This project uses ASP.NET for the front end related design and Microsoft SQL Server 2008 R2 for the back end design. 3.3.3 Hardware Interface and Operating System The ePROS will run on Windows platform and will be accessible on MS Internet Explorer version 6 and above. This application would not need to interface with any external systems to provide its full functionality. 3.3.4 System Perspective The figure 1 drawn below shows the general overview of ePROS system. The different modules connect with this application to establish the flow of data. When the user creates or updates data values through the user interface, the values are saved in the MS SQL Server database. 7 Figure 1 Overview of System 3.4 Functional Requirements Functional requirements talk about the main functionality of the system. The application would enable the user to do the following tasks. Create new risks by entering the related project information. The criticality of an item to be a risk/issue would be calculated based on the probability the item would occur. View risk list option would allow the user to view all the risks or categorize them based on particular search criteria. The risks will be grouped according the projects once the project name is clicked in the list 8 Adding new issue is similar to risk except to the fact that it gets redirected to the issue page from risk when the probability of a risk to occur is more than certain percentage. View issue list acts in the same way as the risk list. Adding a new action item will be a separate page. If the user thinks that a particular issue/risk can have more than one action item, there is this option to add more action items corresponding to that particular risk/issue. Contract deliverable updates module captures all the vendor details along with the contract related details. View vendor list will list all the vendor contact and deliverable details. Report management module will generate reports based on the search criteria of project related fields in customized format. 9 Chapter 4 SYSTEM ARCHITECTURE AND DESIGN 4.1 Methodology Used The design phase of the project involves the database design in the first place. Once the database is set up with the tables needed, the front end part can be connected to the backend. The detailed explanation of the overall architecture diagram and the database design phase of the ePROS application is shown in the figures below. Figure 2 Architecture Diagram 10 4.2 Database Design This section shows the database design of the ePROS system. The diagram in figure 2 shows the tables in the application. The risk table is the parent table with risk id and project id as the primary keys. It is linked to the tblIssue, tblDecision, and tblActionItem with risk id as the foreign key. The table tblReport is linked to the tblProject through project id as the reports are generated using the project related details. The table details are explained in the diagram shown below. 11 Figure 3 Database Design 12 Given below is the detailed description for each of the database tables. 4.2.1 tblRisk The tblRisk stores information about the details related to risk. Risk id is the unique number generated automatically for the each new risk being created. The field name gives the name of the column in the table like riskId, riskStatus, riskStatement, criticalityLevel, timeframe, probability,dueDate, projectType, projectName, decisionId, issueId, actionId, actionItem, projected and, fileUpload. The constraint column shows whether the particular column is a primary key or foreign key for the table. Table 1 tblRisk Field Name Description Data Type Constraints riskId Gives a unique id for each new risk being created. Int Primary key riskStatus riskStatement criticalityLevel Gives the status of the risk. Explains about the risk. Gives if the risk is at low, medium or high level. Approximate time to fix the risk. Chance a risk can occur. Date the risk will be fixed. Type of the project. Name of the project. Maps to the decision id in the decision table. Varchar Varchar Varchar Varchar Int Date Varchar Varchar Int Foreign Key Maps to the issue id in the issue table. Maps to the action item table. Action item taken to solve a risk. Gives a id for every new project. Int Foreign Key Int Varchar Int Foreign Key Timeframe Probability dueDate projectType projectName decisionId issueId actionId actionItem projectId Primary key 13 4.2.2 tblIssue The tblIssue stores information related to issue. Issue Id is the unique number generated for each issue. The field name gives the name of the column in the table like issueId, issueStatus, issueStatement, criticalityLevel, probability,dueDate, projectType, projectName, actionItem timeframe, and, projectId. The constraint column shows whether the particular column is a primary key or foreign key for the table. Table 2 tblIssue Field Name Description issueId Gives a unique id for each new issue being created. issueStatement Probability Explains about the issue. Chance of occurance will be always 100% for a issue. Gives the status of the issue. Gives a unique id for each new risk being created. Gives if the issue is at low, medium or high level. Approximate time to fix the issue. Date the issue will be fixed. Type of the project. Name of the project. Action item taken to solve a issue. Gives a id for every new project. issueStatus riskId criticalityLevel Timeframe dueDate projectType projectName actionItem projectId Data Type Int Constraints Primary key Varchar Int Varchar Int Foreign Key Varchar Int Date Varchar Varchar Varchar Int Foreign Key 14 4.2.3 tblProject The tblProject stores information related to project. Project Id is the unique number generated for each project. The field name gives the name of the column in the table like proejctId, dueDate, projectType, projectName, dollarAmount, description, contractdelId, acceptedDate and, comments. The constraint column shows whether the particular column is a primary key or foreign key for the table. Table 3 tblProject Field Name Description projectId Gives a unique id for each new project. Name of the project. Type of the project. Estimated cost of the project. projectName projectType dollarAmount Description dueDate contractDelId acceptedDate Comments Description about the project. Date the risk will be fixed. Contract deliverable id for a contract. Date when the contract was accepted. Comments about the project. Data Type Int Constraints Primary key Varchar Varchar Int Varchar Date Int Date Varchar 4.2.4 tblVendor The tblVendor stores information related to contract deliverables. Project Id and vendor id is the unique number generated for a project. The field name gives the name of the column in the table like proejctId, vendorId, projectName, contractDeliverable, 15 contractAcceptedDate, fileUpload, deliverableExpectedDocument, Submitteddeliverable, vendorInvoice, comments, deliverableAccepted, description, contractDeliverableId, accceptedDate and, dollarAmount. The constraint column shows whether the particular column is a primary key or foreign key for the table. Table 4 tblVendor Field Name Description projectId Gives a unique id for each new project. Gives a unique id for each new project. Name of the project Number of deliverables Date contract is accepted. Files related to the contract. Document related to a deliverable. Documents submitted. Vendor invoice related documents. Comments for a contract Yes/No Value for a deliverable acceptance. Description about the contract. Unique Id for a contract. Delivarable accepted date. Estimated dollar amount for the deliverable. vendorId projectName contractDeliverable contractAcceptedDate fileUpload deliverableExpectedD ocument SubmittedDeliverable vendorInvoice Comments deliverableAccepted description contractDeliverableId acceptedDate dollarAmount Data Type Int Constraints Int Primary key Foreign key Varchar Int Date Varchar Varchar Varchar Varchar Varchar Int Varchar Int Date Int 4.2.5 tblDecision The tblDecision stores information related to project. Project Id is the unique number generated for each project. The field name gives the name of the column in the 16 table like decisionId, description, justification, date, authorizingParty, riskId and, projectId. The constraint column shows whether the particular column is a primary key or foreign key for the table. Table 5 tblDecision Field Name Description decisionId Description Justification Unique id for a decision. Description of a decision. Commenting why such a decision Date decision taken Person who authorizes decision. Unique id for a risk Unique id for a project Date authorizingParty riskId projectId Data Type Int Varchar Varchar Constraints Primary Key Date Varchar Int Int Foreign Key Foreign Key 4.2.6 tblReport The tblReport stores information related to project. ReportId is the unique number generated for each report. The field name gives the name of the column in the table like projectId, reportId, projectName, criticality, email, phonenumber, department, startDate, endDate, oversightOrganization, resourcesAvailable and, qualityCE. The constraint column shows whether the particular column is a primary key or foreign key for the table. Table 6 tblReport Field Name projectId reportId projectName Criticality Description Unique project id Unique report Id Name of the project High, Medium, Low level Data Type Int Int Varchar Varchar Constraints Foreign Key Primary Key 17 Email Phonenumber Department startDate endDate oversightOrganisation resourcesAvailable qualityCE Email Id to contact Phone number to contact Department the report is generated for. Start date for the project End date for the project Name of the organization Resources available for the organization Varchar Int Quality control Varchar Varchar Date Date Varchar Varchar 4.2.7 tblActionItem The tblActionItem stores information related to project. ActionId is the unique number generated for each report. The field name gives the name of the column in the table like actionId, actionItem, owner, startDate, dueDate, riskId and projectId. The constraint column shows whether the particular column is a primary key or foreign key for the table. Table 7 tblActionItem Field Name Description actionId Unique id for a actionItem. Description of a action item Person who creates the actionItem Date the risk is identified Date the risk can be fixed Unique id for a risk actionItem Owner startDate dueDate riskId Data Type Int Constraints Primary Key Varchar Varchar Date Date Int Foreign Key 18 projectId Unique id for a project Int Foreign Key 4.3 Use Case Diagram 4.3.1 Risk Management The risk management use case diagram shown below explains all the functionalities developed in risk management module. The administrator or oversight professional will be able to add/edit/update or delete a new risk. He can also add a risk statement stating why the risk might happen. Then the risk will be assigned to an owner/developer - person who is going to solve it. Owner will be then creating the appropriate action item for a risk to get solved with the timeframe for a risk. 19 Figure 4 Risk Management 20 4.3.2 Vendor Management The vendor management diagram explains the functionalities how the vendor management can be handled. Add, Edit, View and Deleting vendor details is possible for the user with the authorized permission. 21 Figure 5 Vendor Management 22 4.3.3 Report Generation The report generation use case diagram explains about the report generation module. When the user enters all the details or any one of them or none of them and then on submission, the corresponding report is generated with all the details requested. 23 Figure 6 Report Generation 24 4.4 User Interface This section displays the user interface screens of ePROS. 4.4.1 Add New Risk Screen This is the screenshot for adding a new risk. Once the user clicks on the ‘Risk Management’ tab a drop down list appears with an option to add a new risk. The project name field in this page would contain all the projects created already and it would be automatically loaded when the page opens up. When the project name is selected the project type would change to the respective value. The ‘Probability’ field decides whether the entered item is a risk or a issue. If the probability is more than 70%, the page will be redirected to the ‘Add Issue’ page. If the risk owner thinks that there is more than one action item for a particular risk, he/she can click on the ‘Yes’ button at the end, which will transfer to the action item page. On ‘Submit’ the data gets stored in the back end. 25 Figure 7 Add New Risk 4.4.2 View Risk List Screen This screen displays list of all the risks in the database. I have used a tool called Telerik to make the UI better by incorporating it with the Microsoft Visual Studio. So when the left most icon in a list is clicked, it displays the details with editable option. The next one deletes the entire row on confirmation from the user. The display of number of items on a page can be modified with the small tab at the bottom. 26 Figure 8 View Risk List The project names in this page are hyperlinked so that by clicking on that actually groups the risk ids for a particular project. 27 Figure 9 View Risk List - 2 28 Figure 10 View Risk List - 3 4.4.3 Add New Issue Screen This page is similar to the adding a new risk except to the fact that the probability that an issue would occur will be 100%. On submit the data gets saved to the backend. 29 Figure 11 Add New Issue 4.4.4 Add New Action Item Screen This page helps to add action item for a risk. A risk is associated by clicking on the corresponding risk ids and then by entering all other details. On submit the data is saved in the database tables. 30 Figure 12 Add New Action Item 4.4.5 Contract Deliverable Updates Screen This screen collects all the contract deliverable related information. It also has options to upload documents related to a particular deliverable. If the deliverable accepted data has to be changed from ‘No’ to ‘Yes’, by just clicking on the button would display a grid data with the data being changed. On Submit the data is saved to the backend. 31 Figure 13 Contract Deliverable Updates 4.4.6 Vendor List Screen This page displays all the list of non-accepted deliverables and its details. It also has the option to edit, update and delete a particular deliverable detail. The bottom most part shows the page navigation and a display to control how many rows a page should display. 32 Figure 14 Vendor List 4.4.7 Report Generation Screen This page shows how a report can be generated. The report generation is triggered either by entering value to all the fields, few of them or to none of them. By clicking on view report would display the generated report. 33 Figure 15 Report Generation 34 Chapter 5 CONCLUSION AND FUTURE WORK The ePROS project with three modules will be the first step in creating a web based application for the oversight professionals to manage IT projects. All the pages with the details listed, can be exported to Excel file format. The ePROS system breaks down each item on the project oversight into more granular points that the analyst can verify individually to support their decision. Furthermore ePROS will provide the analyst with industry best practices and rules of thumb that they can apply to each of these granular items when making their assessment and collecting evidence. Also the ePROS system will facilitate the management of vendor contract for each IT project in the department portfolio including but not limited to contracts for software vendors. This component of the system will allow project oversight professional to manage contract details such as contract amount, scope of work contract timeframe and submitted deliverables. There are many tools available in the market to do the risk management, vendor management, but the above listed features make the ePROS system unique in its behavior. Future work can be done on the report generation module. Two more items called Independent project oversight (IPO) report and portfolio briefing report can be developed. The report being generated now is a monthly report with all the projects. Making IPO reports will be making the project more flexible with generating more 35 suitable reports. The two diagrams in the figures 15 and 16 below show the sample screens for the IPO report and portfolio briefing report. Figure 16 IPO Report 36 Figure 17 Portfolio Briefing Report 37 BIBLIOGRAPHY [1] Prolog Oversight Pack, [Online]. Available: http://www.meridiansystems.com/landing/prolog-oversight-pack.asp#form [2] Risk Management Plan, [07-12-2011]: http://www.sos.ca.gov/elections/votecal/bidders-library/pdf/risk-management-plan-final072309.pdf [3] Project Oversight Introduction, [10-24-2011]: http://users.monash.edu.au/russel/proj1.html [4] ePROS Software Requirements Documentation [5] Independent Project Oversight, [10-12-2011]: http://www.tiebridge.com/solutions/independent-project-oversight.html [6] Telerik RadControls for ASP.NET AJAX, [Online]. Available: http://www.telerik.com/products/aspnet-ajax.aspx [7] Bill Evjen, Scott Hanselman, David Rader, “Professional ASP.NET 3.5 in C# and VB.” [8] Microsoft SQL Server 2008 R2 Express, [Online]. Available: http://www.microsoft.com/download/en/details.aspx?id=23650 [9] Project Oversight Introduction, [10-10-2011]: http://www.chaitassociates.com/Project_Oversight/project_oversight.html [10] Master Control Risk Analysis, [10-15-2011]: http://www.mastercontrol.com/solutions/risk_analysis_software.html 38 [11] Operational Risk Management, [10-24-2011]: http://www.metricstream.com/solutions/operational_risk_management.htm [12] Risk Matrix Tool, [10-26-2011]: http://www.mitre.org/work/sepo/toolkits/risk/ToolsTechniques/RiskMatrix.html