A Framework for Identifying and Understanding Risks in Information Technology Projects

INTRODUCTION Although information technology (IT) is becoming faster, more reliable, and less expensive, the costs, complexity, and risks of managing IT projects continues to be a challenge for many organizations. For example, a survey conducted by the Standish Group (1995) of 365 IT managers in 1994 drew attention to what many called the software crisis. The study was called CHAOS and reported that only 16 percent of the application development projects were successful in terms of being completed on time and within budget. Moreover, about 31 percent of the projects were canceled before completion, while 53 percent were completed but over budget, over schedule, and not meeting original specifications. The average cost overrun for a medium-size company surveyed was about 182 percent of the original estimate, while the average schedule overrun was about 202 percent. That is, the results of the survey suggest that a medium-size project estimated to cost about $1 million and take a year to develop actually cost about $1.8 million, took just over two years to complete, and only included about 65 percent of the envisioned features and functions. Many took this to mean that IT project management was in a state of crisis, especially since 48 percent of the IT managers surveyed believed that there were more failures at the time than five or ten years earlier. However, the original CHAOS study published in 1994 was the first of several studies conducted every two years by the Standish Group. Figure 1 provides a summary of the CHAOS studies conducted from 1994 through 2006. Although, in general, it appears that the percentage of successful projects is increasing, a large percentage of challenged and unsuccessful projects suggests that there is ample opportunity for improving project performance. Therefore, having a well-defined, proactive risk management approach may contribute to the likelihood of project success. In addition, a more recent study of 800 senior IT managers from the U.K., United States, France, Germany, India, Japan and Singapore conducted by Tata Consultancy Services (2007) reports dire results similar to the CHAOS studies: * sixty-two percent of the IT projects failed to meet their schedules; * forty-nine percent experienced budget overruns; * forty-seven percent experienced higher than expected maintenance costs; and * forty-one percent failed to deliver the expected business value and return on investment (ROI). The purpose of this paper is to present an IT project risk identification framework that can be used to identify and understand various project risks before impending failure. The proposed risk identification framework should be of interest to IT practitioners during the creation of the project plan and over the course of a project so that appropriate and corrective actions can be taken as needed. Moreover, this risk identification framework should also be of interest to IT academics in terms of teaching project risk management or as a theoretical basis for guiding future research. Taken together, this may help increase the likelihood of IT project success. IT PROJECT RISK MANAGEMENT Project Risk and Project Risk Management The Project Management Body of Knowledge (PMBOK[R]) Guide (2004) defines project risk as: An uncertain event or condition that, if it occurs, has a positive or negative effect on the project objectives (238). The PMBOK[R] Guide provides an important starting point for understanding risk. First, project risk arises from uncertainty. This uncertainty comes from an attempt to predict the future based on estimates, assumptions, and limited information. Although project risk has a downside resulting from unexpected problems or threats, project risk management must also focus on positive events or opportunities. Therefore, it is important that project stakeholders understand what those events are and how they may impact the project beyond its objectives. …