The (non-)adoption of risk management processes in projects

Managing risk in information systems (IS) projects remains one of the major challenges for managers. Many IS failures may result from the inadequate application of risk management tools and techniques. Little is known, though, about individual beliefs and consequently intentions to apply risk management. As such, the Theory of Planned Behaviour is used as a basis for understanding the use of different approaches to risk management in IS projects. A laddering technique was employed to investigate project managers’ understandings of risk management, based on interviews with IS project managers involved in different projects within a large IS companies. We found that project managers face behavioural and control beliefs that constrain their intention to actually execute risk response actions. The results indicate the magnitude of these beliefs and the potential outcome of risk management being an ‘administrative’ exercise with little or no impact on project performance. If project risk management and its underlying processes are not to be discredited, the behaviour of project managers when confronted by uncertainty should be considered and action taken to discourage project managers’ irrational intentions to merely assess, but not to actively manage risk.