Does risk matter? Disengagement from risk management practices in information systems projects

Risk management and ‘routine-based reliability’ is considered fundamental to
project performance. Existing theories of project risk management do not fully
explain why project managers stop practicing risk management information
systems (IS); however, constructs drawn from organisation theory offer insights
into how and why such disengagement occurs. The study examines risk
management practices in 21 IS projects within 10 organisations. By focusing on
risks that resulted in significant events and mapping backwards over time the
practices associated with those risks, we identify that in all but five projects the
manager had disengaged from prescribed risk management before executing
risk responses. In most projects, the majority of formally identified and assessed
risks remained unallocated and untreated. A laddering technique was used to
help explain why this transpired. We found five key underlying beliefs that
governed project managers’ risk management attitudes and actions.