You may want to look at our CSES portfolio. It can be applied to your question with respect to risk management. One of our papers reference Barry Boehm's work in this area. http://academic.research.microsoft.com/Paper/4813650.aspx
Professor Chris Verhoef has done a lot of research in this area. You can view his papers on this and related subjects on http://www.cs.vu.nl/~x/qipm.html.
Hello! Does this question have been solved? It looks like interesting such hypothesis, a priori I guess that software cost estimation is impossible without requirements, how can you define a cost if you don´t know what are you going to do?