3.10 Key learning points

• The examination of failed projects presented in this chapter demonstrates the critical need to assess and manage risk. Chapter 4 details how measurement can assist in the process of keeping IT investments on track across the development, implementation and on-going phases of the system lifecycle.

• Risk assessment should take place on all projects/technology investments, as all will have some degree of associated risk. Risk assessment should ultimately provide part of the foundation for project management and measurement.

• Risk assessment requires the identification of risks, the estimation of impact of the risk and the on-going management of the risk.

• Risk identification, the process of proactively seeking out risks and their sources, and risk estimation must be the prelude to risk management. Risk identification can only diagnose and highlight risks, but this activity must lead to a risk management system which ensures that action is taken to mitigate those risks across the system's lifecycle.

• Risk management plans require resources. Resourcing will depend upon decisions about the trade-offs between how much risk aversion is required and how much risk can be accepted. Responsibility for risk aversion actions and the authority to take action are also determined in the resourcing phase.

• Models of risk assessment and diagnosis reveal a number of significant project variables to be managed from the perspective of risk mitigation, including:

  1. the need for user involvement;

  2. the level of commitment from management and key staff;

  3. a need for flexibility;

  4. on-going assessment of IT project alignment with strategy;