Summarize the following 4. Results 4.1. Introduction This section presents all p

Question

Summarize the following

4. Results

4.1. Introduction

This section presents all publications in scope of the meta-analysis of the empirical evidence for the influence of risk management on IT project success. The section is structured as follows. First, we describe how empirical evidence was collected in the various publications. Next, we give an outline of how the authors of these studies look upon risk management and project success. Then, a more detailed view is taken on the management approach

and the evaluation approach to risk management. To conclude this section, the various assumptions underpin- ning risk management and the empirical evidence

supporting or undermining these assumptions are dealt with in detail.

4.2. How empirical evidence was collected in the papers

Ropponen and Lyytinen (1997) state that many of the papers published on risk management in IT projects in the period until 1997 are often not based on empirical data. The publications published between 1997 and 2009 which we found, present a different situation. We found only three publications that contained no empirical data out of a total of 32 papers. The remaining selection of 29 papers includes some studies containing a limited amount of empirical data (Dey et al., 2007; Procaccino et al., 2002; Tesch et al., 2007; Zafiropoulos et al., 2005). In gen- eral however, empirically collected information forms the basis for the conclusions drawn in the publications. The evaluation approach to risk management mainly includes surveys, whereas the management approach prefers case studies to surveys and other instruments.

4.3. How risk management is approached in the papers

The set of publications presented between 1997 and 2009 that consider risk management from an evaluation perspec- tive (12 publications) almost equals the one that views it from a management perspective (14 publications). This is in contrast with the 1997 findings of Ropponen and Lyyti- nen (1997). They claim that most papers that were published until 1997 approach risk management from the evaluation perspective, in that they focus on the overall fac- tors or causes of risk. Further study of the publications presented between 1997 and 2009 revealed a relatively small third group of publications in which risk manage-ment, project success, and their relationship, was discussed from a contingency perspective (Barki et al., 2001; Jiang and Klein, 1999; Sauer et al., 2007). The contingency approach considers project success to be dependent on how well the project as a whole is able to deal with uncer- tainties in the project environment. Better fits between pro- ject and environment as well as between risk exposure and the project management profile (Barki et al., 2001) increase project performance. Risk management is not considered to be a separate management process in these publications; it is embedded in the various processes and procedures of the project. Because the contingency approach does not consider risk management as a separate process, these three publications were not further investigated.

4.4. How project success is defined in the papers

In the 26 publications on the relation between risk man- agement and project success that were investigated, the tra- ditional manner of defining and determining project success (The Standish Group International, 1999; Royal Academy of Engineering, 2004) is still very common. About two third of the publications dealt with in this paper refer to project success in terms of compliance with time limits, cost limits and meeting requirements (see Fig. 5).

A clear definition of project success, however, often remains rather implicit, as illustrated by e.g. Conrow and Shishido (1997) in the introduction to their paper: ‘‘rising costs, falling performance and slipping schedules are common problems . . .”, followed by a reference to a 1994 Standish report on the success and failure of IT projects, and a discussion about risk and risk management. In the remainder of their study, project success is neither men- tioned nor defined. Also Kutsch and Hall (2005) and Dey

et al. (2007) merely refer to time, costs and requirements in their introductions. Two other publications that remain implicit about what is meant by project success are Akker- mans and van Helden (2002) and Gemmer (1997), who both use the term ‘‘performance” without further defining it. Wallace and Keil (2004) and Wallace et al. (2004a,b) use product performance and process performance, but these terms also refer to time and budget (process perfor- mance), as well as requirements (product performance). Further, non-traditional project success definitions par- tially include features of traditional project success, e.g. McGrew and Bilotta (2000), who investigate the influence of risk management on project planning. Han and Huang (2007) use the concepts of product and process perfor- mance (see e.g. Wallace et al., 2004a), but add the impact of risks on team performance as described by Jiang et al. (2000), thereby broadening the definition of project success.

4.5. Papers addressing the evaluation approach to risk management

Building on earlier research by e.g. Barki et al. (1993), the evaluation approach to risk management has increased the lists of risk factors. Publications claim that these new lists of risk factors are better because more so than the old ones, they are based on extensive empirical research, whereas the old lists were mainly based on anecdotal information. This more solid, empirically based investigation into risk factors also enables one to rank the risk factors in order of importance. If ranking is applied, the following risk fac- tors score the highest: top management commitment, user participation, and user commitment (Akkermans and van Helden, 2002; Keil et al., 1998), along with incorrect, incom- plete, or changing requirements (Han and Huang, 2007; Keil et al., 1998). In their study of ERP implementations, Ehie and Madsen (2005) found that top management sup- port is the most important risk factor. Further, in relation to project failure, organizational issues seem to be more important than technical ones, a claim that is supported by Scott and Vessey (2002), as well as by e.g. Sarker and Lee (2003).

4.6. Papers addressing the management approach to risk management

Publications that advocate the management approach to risk management often build on practitioner handbooks on project management (Association for Project Management, 2006; Project Management Institute, 2004) or on project risk management (Association for Project Management, 2004). Among other options, rational decision making is promoted, i.e. it is assumed that all risks and uncertainties can be man- aged. Research has shown that this assumption is not always correct. Uncertainties, risks for which there is no classical or statistical probability distribution available (Holt, 2004), cannot be managed by means of the risk management pro-

cess (March and Shapira, 1987; Pender, 2001; Pich et al., 2002). Nevertheless, the empirical research on risk manage- ment is often based on the assumption that a proper execu- tion of the practices prescribed by the risk management approach will fully mitigate the risk factors (e.g. Conrow and Shishido, 1997; Dey et al., 2007; Lassudrie and Gulla- Menez, 2004; Zafiropoulos et al., 2005). And although a rela- tion between risk management and project success is implied in these publications, they do not provide empirical evidence for the relation between project risk management and pro- ject success.

Ropponen and Lyytinen (1997) as well as McGrew and Bilotta (2000) consider the risk management process in more detail, arguing that risk management activities have a positive impact on a timely project delivery. In addition, risk management activities lead to a better estimation of the resources needed to perform a task (Ropponen and Lyytinen, 1997), and decrease the number of task failures (McGrew and Bilotta, 2000). Ropponen and Lyytinen (1997) have also found indications that experience counts, meaning that a frequent and continuous use of risk man- agement measures by project managers in various projects over time contributes positively to the effectiveness of risk management in their own projects.

Further, several other authors have mentioned that the characteristics and behaviour of individual project stake- holders is important in relation to risk management and project success. Gemmer (1997) states that effective risk management requires functional behaviour of the stake- holders, which means that they may not necessarily comply with the risk management procedure. Dey et al. (2007) state that generally stakeholders must be involved in the risk management process, whereas others are more specific by arguing that the involvement of users and top management in particular are crucial for the project’s success, e.g. Jiang and Klein (1999), or Jiang et al. (2000). They conclude that building consensus among stakeholders and stimulating communication with external stakeholders adds positively to team performance.

4.7. Assumptions underpinning the approaches to risk management

Empirical findings indicate that the assumptions under- pinning risk management are in certain cases not correct. These findings contradict the potential effects of risk man- agement on project success. Kutsch and Hall (2005) show that project managers in IT projects show a tendency to deny the possibility or actual presence of risk and uncer- tainty; they avoid them, ignore them, or delay their actions until the circumstances have improved. These are the char- acteristics of behaviour that is not in line with the view pre- sented by the risk management approach that actors behave rationally. Flyvbjerg et al. (2003) have shown that at the start of a project, people deliberately both overesti- mate the benefits of the project and underestimate its risks and uncertainties. As a result, the stakeholders become

biased; right from the start of the project, their expecta- tions are too high. Project success will, therefore, become much harder to achieve in terms of time and budget requirements.

Besner and Hobbs (2006) as well as others, e.g. Banner- man (2008), Raz et al. (2002) and Voetsch et al. (2004) have investigated the various activities carried out within the risk management process of several types of projects. They have come to the conclusion that the sequence of identifica- tion, analysis, responses, and monitoring is often not fol- lowed. Risk identification is often included in the process; Voetsch et al. (2004) state that it is done in almost all of the projects. Risk analysis, however, is rarely done. Besner and Hobbs (2006) have observed that project managers do not regard risk analysis as potentially valuable, especially quantitative risk analysis. Therefore, the performance of quantitative risk analyses within IT projects is not expected to increase in the near future. Bannerman (2008) in his research finds that none of the 17 IT projects he investi- gated used quantitative risk analysis. A reason why quan- titative risk analysis is not considered useful may be that many of the risks in IT projects are not aleatoric in nature (they are not based on probability), but epistemic, which means that there is not enough information available to take a decision. In project situations, this often leads to the postponement of the decision (Kutsch and Hall, 2005), or to a request for more information.

Explanation / Answer

The given study includes the different sections involved in result stage of risk management in IT project publications where all the publications that use the empirical evidence for influence of risk management on IT project management success are analyzed. The first stage is to describe how the empirical evidence was collected in the publication. The publications started using empirical data to describe the risk management in IT processes only after 1997 and the data became the basis for conclusion. The next section describes how risk management is approached in the papers and the studies revealed that when almost equal amount of publications used evaluation perspective and management perspective a small amount of publications used contingency perspective which considers project success as the ability to deal with uncertainties. Risk management is considered as a part of various processes and procedures in the project and not as a separate process. Next section explains how project success is defined in publications and two third of the publications refer project success as compliance with time limits, cost limits and meeting requirements. Some publications used the term performance to define project success and later it was broadened by adding concepts of product and process performance and impact of risk on the tem performance at different stages. Papers addressing evaluation approach to risk management claim that empirical research helps in identifying more risk factors and can be ranked according to the order of importance. The top risk factor is the top management commitment and organizational issues are considered more important to technical issues to avoid project failure. Papers addressing the management approach to risk management are often built on practitioner handbook and often promote rational decision making. But research has shown that the assumption to manage all uncertainties is not valid and cannot be managed without statistical probability distribution. These publications do not provide empirical evidence for the relation between project risk management and project success. Later studies argue that risk management process affect timely project delivery, better estimation of resources for a task, and decrease the number of task failures. The behavior of individual stakeholders is also considered to be important for project success particularly the involvement of top management and users. Last section describes about the assumptions underpinning the approaches to risk management. The assumptions on certain case are not correct. The project managers deny the possibility of risk and uncertainty due to overestimation of project success and underestimation of risk and uncertainties. The stakeholders also become biased and the project success becomes more difficult to achieve in terms of time and budget requirements. Another reason is that sequence of steps in risk management process from identification to monitoring is often not followed and quantitative risk analysis is not done in most of the projects and decision making becomes difficult due to lack of complete information.

Related Questions

Navigate

• Browse (All)
• Browse S
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.