Risk Management in Information Systems Projects: It Can Be Risky Not To Do It

Background

All IS projects are risky since they are unique undertakings with varying degrees of complexity that aim to deliver benefits (PMI, 2017). In discussing risk management, it is necessary to consider two main aspects. The first is about understanding and defining the notions of uncertainty and risk. Knight and Frank (2012) make a distinction between measurable uncertainty (which can be considered risk) and non-measurable uncertainty. One can assume that risks are related to events that are either perceived or perceptible and the likelihood of which can be estimated (Hofman and Grela, 2018).

A general dictionary definition states that risk is “the possibility of loss or injury.” This definition highlights the negativity (“loss or injury”) often associated with risk and points out that uncertainty (“possibility”) is involved (Schwalbe, 2018). On the one hand, following PMI (2017) definition, a risk is “an uncertain event or condition that, if it occurs, has a significant positive or negative effect on at least one objective.” This means that, in a project, we can have negative risks, but also positive risks (thus having a positive effect on meeting project objectives). IPMA (2015) distinguishes risks (negative effects) from opportunities (positive effects), stating that they should always be viewed considering their relation to and consequences for realizing the objectives of the project.