3.1 Introduction

Risk in computer-based projects are surprisingly under-managed.

Willcocks and Griffiths ^[1]

We've minimized risk because we are sharing the risk (between the client and the vendor)

Assistant Executive Officer, California Franchise Tax Board

What we tend to find with IT projects is that they may not produce a positive NPV. And what I'm trying to get people to do more and more is recognize that some projects are enablers and not every project you do is going to pay back. So just recognize that some of it is invested in the infrastructure of the business.

Financial Controller, Major Retail Company

Focus has been less on only cost and more and more emphasis on what should we be doing to move our business ahead managers of the larger projects begin to speak about the IT investment now more in terms of return versus simple cost minimization.

Information Technology Manager,

Hewlett Packard Test and Measurement Organization

In this chapter, we will identify approaches for justifying and planning IT projects. Remenyi has capably and effectively covered risk assessment in his book Stop IT Project Failures Through Risk Assessment (in this same Butterworth-Heinemann series), but a brief discussion of risk from a complementary perspective is relevant at this juncture. Despite their importance to all phases of an IT/e-business project, and especially in the initial assessment, risk assessment and management are often overlooked throughout those phases because:

1. the client/users care less about development productivity than about the ultimate product's...