Effects of Risk Management Practice
Effects of Risk Management Practice
Corresponding author:
Daranee Pimchangthong
Rajamangala University of Technology Thanyaburi
Faculty of Business Administration
Klong 6, Thanyaburi, Pathum Thani, 12110, Thailand
phone: (+66) 89 062 1321
e-mail: Daranee p@rmutt.ac.th
30
Management and Production Engineering Review
manager can use to increase the likelihood of project ing the role and effects of applying risk management
success. in successful IT projects. Reference [12] elaborates
Although there was high importance of risk man- that every project had some risk, for example, re-
agement to IT project success, the adoption of these sources left the organisation, leadership changed, and
risk management methods in practice is inconsistent budgets got cut, etc. There are many factors beyond
[6, 7]. In addition, many project managers decide control. However, many risks to projects can be mit-
not to apply any risk management due to financial igated or even eliminated with some forethought and
reasons. This research aims to explore the influence ongoing management.
of risk management practices on IT project success.
The results from this study can provide guidance Project success
on the practical implementation of risk management The success of IT projects is an area of con-
concerns for IT project success. cern for many organisations around the world. At
the beginning, papers on project success were focus-
Literature review ing on the classical project triangle, i.e. time, cost,
and quality. Later, it was enhanced by considering
Project risk management stakeholder satisfaction and the strategic aspect of
Project risk management is the art and science the client. This development required the considera-
of identifying, analysing, and responding to risk tion of the interrelationships among the components
throughout the life of a project and in the best in- of the project success: the success criteria and the
terests of meeting project objectives [8]. Project risk critical success factors [13]. Besides this triple crite-
management involves understanding potential prob- rion system, reference [14] discusses the alternative
lems that might occur on the project and how they evaluation models such as the key performance indi-
might impede project success. Several research re- cator (KPI)-based or financial indicator-based, e.g.,
sults indicate that poor risk management is a likely NPV or IRR evaluation models. These models could
cause of project problems and failures. “Risk man- be very effective in certain projects, but they may
agement is an essential process for the successful de- face serious shortcomings when they have to evalu-
livery of IT projects” [9, 10]. The body of research ex- ate projects which are hard to quantify. A variety of
amining risk in IT projects spans over 30 years. Risk approaches and models exists on the measurement
management researchers have focused on the exam- of project success. One of the most popular models
ination of process models that provide prescriptions was developed in 1992 [15]. This model expresses six
for risk management, typically including variations measures for information system’s project success as
on the four processes of risk identification, assess- follows: system quality, user satisfaction, information
ment, response planning, and monitoring [11]. Ref- quality, information use, organisational impact, and
erence [8] expresses six processes that involved risk individual impact. In 2003, reference [16] proposed
management as follows: planning risk management, the updated IS success model. The updated model
risk identification, qualitative risk analysis, quanti- consisted of six interrelated dimensions of IS success:
tative risk analysis, risk response planning, and risk information, system and service quality, (intention
monitoring & control. to) use, user satisfaction, and net benefits [16–18].
Reference [5] develops a model to investigate However, such studies did not touch upon whether
the relationship between risk management and IT and how the delivery project of the IT system had
project success, and the model consists of risk man- succeeded [19].
agement in four categories: risk identification, risk In the project perspective, references [20, 21] ex-
analysis, risk response planning, and risk monitor- emplify on success criteria that were measured at
ing & control. The research results found that risk the end of the project to judge on its success. Refer-
identification and risk planning did not influence the ence [20] is concerned with a broadening of the nar-
subjective performance of the project in terms of re- row concept of time, cost, and delivery in accordance
liability, easiness, flexibility, satisfaction and quality. with specifications, while reference [21] suggests tak-
There was no method of risk management that in- ing time at the beginning of an IT project to develop
fluenced the objective performance of the IT project and agree on a set of success criteria for each project.
in terms of cost, schedule, and effort. Therefore, the Many researchers suggest that projects should be
conclusions couldn’t be generalized to all IT com- rated as successful when they are completed within
panies due to the reduced sample size to an unac- or near the estimated schedule and budget, and pro-
ceptable error margin. Further research in this field duce an acceptable level of performance [22, 23]. Ref-
is mandatory to formulate a solid conclusion regard- erence [24] carried out a study using a project com-
pleted on time and within the budget that worked Several research outputs presented interesting ef-
as the measures to evaluate project success. Some fects of organisational culture on IT project success.
studies were aware of the benefits, which were used Reference [36] expresses that projects required a high
as criteria to justify project success [25–27]. Ref- degree of organisation and planning to progress
erences [28–30] use organisational impact and user smoothly and profitably. The companies must create
satisfaction as the criteria to measure the ERP sys- a collaborative and friendly culture and be willing
tem success. According to reference [31], project suc- to change the culture by retaining younger staff and
cess involves two components, e.g., project manage- having them to commit to training and development.
ment success and product success. Project perfor- Organisation size was one of the important crite-
mance is the degree, to which the software project ria for the success of an IT project in an organisa-
achieves success in the perspectives of process and tion. SMEs (Small to Medium Enterprise) found that
product [32]. Process performance referred to time managing successful IT projects was difficult due to
and budget, and product performance referred to re- the lack of optimum financial resources and a high
quirements as shown in Table 1. initial set-up cost [37], while larger firms had an ade-
quate financial and technical capability, and the flex-
Table 1 ibility to support IT project success. Reference [38]
Dimensions of project performance [5]. identifies that the major obstacles to IT adoption in
Dimension Reference [32] References [33, 34] small companies are a financial deficiency and insuf-
of performance ficient levels of technical capability.
• Learning The project was In terms of types, organisations are public and
Process completed within
• Process control private. A significant difference can be observed be-
performance • budget
• Quality tween the working environment and organisational
of interactions • schedule culture of a public and private organisation. The dif-
• Operational The application ferences definitely have a direct impact on the success
efficiency developed is of the IT project development in an organisation.
• Responsiveness • reliable The research framework is developed to explore
• Flexibility • easy to use the effect of organisational factors and risk manage-
• good flexibility ment practices on the success of IT projects as shown
Product in Fig. 1. The framework consists of two indepen-
performance • meets user’s
• intended
dent variables and one dependent variable. The in-
dependent variables are organisational factors and
• functional
risk management practices. The dependent variable
• requirements
is IT project success that includes all dimensions of
• satisfied users performance as shown in Table 1. Risk management
• overall high practices include risk identification, risk analysis, risk
quality response planning, and risk monitoring & control.
Organisational factors
Organisational factors deal with how far the or-
ganisation supported the success of IT project. Sev-
eral organisational factors affect the success of IT
project, e.g. organisational culture, working environ-
ment, organisational types, and sizes.
Each organisation has distinctive ways of solving
problems, treating employees, passing on the tradi-
tions, etc., which are called organisational culture.
The organisational culture gives identity to an or- Fig. 1. Research framework.
ganisation. Working environment also has a direct
impact on the successful IT project. According to Research methodology
reference [35], working environment factors affect the
performance of project managers, team relationships, This research is a quantitative study of the effects
time availability, materials and supplies of projects, of risk management on IT project success. The ob-
and their performance has a direct impact on the jectives of this research are to explore organisational
success of an IT project. factors affecting IT project success and risk manage-
ment practices influencing IT project success. Risk were public (72%) and medium size with 100–500
management practices include risk identification, risk employees (51%). Measures of central tendency and
analysis, risk response planning, and risk monitoring measures of dispersion were computed to summarize
and control. The IT project success was measured by the data and to understand the variability of scores
process performance and product performance. for the organisational type and organisational size
The research involves a literature review, ques- variables. The following are the results of this analy-
tionnaires, and statistical analysis, both descriptive sis: N = 200; X = 1.27, 2.02; S.D. = 0.448, 0.701.
and inferential statistics, to answer the research ques- Table 2 shows that risk management practices
tions: in the aspects of risk identification, risk analysis,
Do organisational factors including organisation- and total aspects have a high level of importance
al types and organisational sizes affect IT project (X = 3.96, 3.55, 3.69; S.D. = 0.644, 0.807, 0.562).
success? Do risk management practices including risk The aspects of risk response planning and risk mon-
identification, risk analysis, risk response planning, itoring and control have a moderate level of im-
and risk monitoring & control influence IT project portance (X = 3.49, 3.32; S.D. = 0.680, 0.671).
success? IT project success in the aspects of process perfor-
The research hypotheses are: mance, product performance, and total aspects has
1. There is a significant difference in organisational a high level of importance (X = 4.05, 3.91, 4.17;
factors including organisational types and organi- S.D. = 0.788, 0.684, 0.686).
sational sizes that affect IT project success.
2. Risk management practices including risk identi- Table 2
Measure of central tendency and dispersion for risk
fication, risk analysis, risk response planning, and management practices and IT project success.
risk monitoring & control influence IT project suc-
X S.D.
cess.
Risk management practices 3.69 0.562
The questionnaire was adopted as a means of col-
1. Risk identification 3.96 0.644
lecting reliable and quantifiable data at a reasonable
2. Risk analysis 3.55 0.807
cost. The target population consisted of project man-
3. Risk response planning 3.49 0.680
agers, IT managers, and IT analysts from IT com-
panies in Thailand and the samples were derived 4. Risk monitoring and control 3.32 0.671
from the convenience sampling method. Question- IT project Success 4.17 0.686
naires were distributed to 200 research samples. The 1. Process performance 4.05 0.788
questionnaires were categorized into three parts. The 2. Product performance 3.91 0.686
first part had two questions about the organisation-
al types and sizes, and they are checklist questions. Table 3 shows the differences in organisational
The second part had 12 questions about the following factors (organisational types and sizes) that affect IT
risk management practices: risk identification, risk project success in the aspects of process performance,
analysis, risk response planning, and risk monitor- product performance, and total aspects of IT project
ing and control. The third part had ten questions success. An independent sample t-test is conducted
about process performance, which involves budget to compare the effect of process performance, prod-
and time, and product performance, which involves uct performance and IT project success in a private
project requirements. The second and third parts of and public organisation. There are significant differ-
the questionnaire used interval rating scale measure- ences in a public (X = 3.99, 4.21, 4.29; S.D. = 0.661,
ment with five-point Likert-Scale. The Cronbach’s 0.725, 0.655) and private organisation (X = 3.67,
alpha value for reliability test of the questionnaires 3.62, 3.84, S.D. = 0.695, 0757, 0.660; t(198) = 2.948,
was 0.928. Descriptive statistics for analysing data 5.062, 4.359; p = 0.004, 0.000, 0.000). These results
included frequencies, percentages, means, and stan- suggest that organisational type does affect process
dard deviations. Inferential statistics for analysing performance, product performance, and IT project
data included independent samples t-test, one-way success.
ANOVA, and multiple linear regression at the statis- One-way ANOVA (F-test) is conducted to com-
tical significance level of 0.05. pare the effect of organisational size on process per-
formance, product performance and IT project suc-
Results cess in a small, medium, and large organisation.
There is a significant effect of organisational size on
The descriptive statistics results show that most product performance at p < 0.05 level for the three
of the organisations that participated in the survey conditions [F (2, 197) = 4.940; p = 0.008]. Post hoc
Table 3
Differences in organisational factors affecting IT project success.
Information technology project success
Process Product IT project
performance performance success
Organisational t (198) = 2.948 t (198) = 5.062 t(198) = 4.359
types p = 0.004∗ p = 0.000∗ p = 0.000∗
Organisational F (2, 197) = 4.940 F (2, 197) = 4.616
–
sizes p = 0.008∗ p = 0.011∗
∗ Statistical significance level of 0.05.
comparisons using Fisher’s Least Significant Differ- and total aspects of IT project success, have R values
ence (LSD) test indicate that the mean score for of 0.560, 0.610, and 0.597, respectively, which are in-
the small organisation condition (X = 3.91, S.D. = terpreted so that the correlations between predictors
0.830) is significantly different from the large organi- and dependent variables are rather high in the same
sation condition (X = 4.33, S.D. = 0.792). However, direction. The percentages of forecasting equations
the medium size organisation condition (X = 3.96, for process performance, product performance, and
S.D. = 0.716) does not significantly differ from the total aspects of IT project success are 30.60, 36.20,
small and large organisation conditions. Taken to- and 35.00, respectively.
gether, these results suggest that a large organisation Predictor constants: risk identification, risk
affects product performance. analysis, risk response planning, and risk monitor-
There is a significant effect of organisational size ing & control
on IT project success at p < 0.05 level for the three The multiple linear regression analysis results
conditions [F (2, 197) = 4.616; p = 0.110)]. Post hoc show that risk identification (X1 ) and risk response
comparisons using LSD test indicate that the mean planning (X3 ) influence process performance at the
score for the small and medium organisation condi- statistical significance level of 0.05 as shown in Ta-
tion (X = 4.06, 4.09; S.D. = 0.704, 0.638) is signifi- ble 5.
cantly different from the large organisation condition The highest beta coefficient is 0.398, which means
(X = 4.41, S.D. = 0.686). However, the medium that risk response planning has the greatest influence
size organisation condition (X = 4.09, S.D. = 0.638) on predicting process performance, followed closely
does not significantly differ from the small organisa- by risk identification with a beta coefficient of 0.244.
tion conditions. Taken together, these results suggest Results of the multiple linear regression analysis
that a large organisation affects IT project success. show that risk identification (X1 ), risk analysis (X2 ),
As shown in Table 4, the multiple correlation re- and risk response planning (X3 ) influence product
sults demonstrate that dependent variables, which performance at the statistical significance level of
include process performance, product performance, 0.05 as shown in Table 6.
Table 4
Multiple correlation between predictors and dependent variables.
Model R R Square Adjusted R Square Std. Error of Estimation
Process Performance .560 .313 .306 .57216
Product Performance .610 .372 .362 .62955
IT Project Success .596 .356 .350 .55967
Table 5
Multiple regression between predictors and process performance.
Unstandar-dized Coeff. Standar-dized Coeff.
Predictors t Sig.
B Std. Error Beta
(Constant) 1.456 0.277 5.257 0.000∗
Risk Response Planning (X3 ) 0.405 0.070 0.398 5.814 0.000∗
Risk Identification (X1 ) 0.262 0.073 0.244 3.565 0.000∗
∗ Statistical significance level of 0.05.
Table 6
Multiple regression between predictors and product performance.
Unstandar-dized Coeff. Standar-dized Coeff.
Predictors t Sig.
B Std. Error Beta
(Constant) 1.145 0.320 3.577 0.000∗
Risk Identification (X1 ) 0.471 0.082 0.383 5.767 0.000∗
Risk Response Planning (X3 ) 0.428 0.079 0.367 5.419 0.000∗
Risk Analysis (X2 ) −0.131 0.060 −0.135 −2.189 0.030∗
∗ Statistical significance level of 0.05.
Table 7
Multiple regression between predictors and IT project success.
Unstandar-dized Coeff. Standar-dized Coeff.
Predictors t Sig.
B Std. Error Beta
(Constant) 1.430 0.271 5.278 0.000∗
Risk Identification (X1 ) 0.388 0.072 0.359 5.412 0.000∗
Risk Response Planning (X3 ) 0.342 0.068 0.333 5.018 0.000∗
∗ Statistical significance level of 0.05.
The highest beta coefficient is 0.383, which means mance. The project manager needs to be sure that
that risk identification has the greatest influence on all project requirements are well understood by all
predicting product performance, followed closely by stakeholders from the early state, which will sig-
risk response planning and risk analysis with the be- nificantly improve the IT project success rate.
ta coefficient of 0.367 and -0.135, respectively. 2. A large organisation affects both product perfor-
The multiple linear regression analysis results mance and IT project success, due to the advan-
show that risk identification (X1 ) and risk response tage of having well-organised procedures to per-
planning (X3 ) influence IT project success at the sta- form projects, staff experience, budget, and flex-
tistical significance level of 0.05 as shown in Table 7. ible staff allocation. However, large organisations
The highest beta coefficient is 0.359, which means may still have some drawbacks such as poor agili-
risk identification has the greatest influence on pre- ty that may cause some defects in product perfor-
dicting IT project success, followed by risk response mance requiring software updates or patches.
planning with the beta coefficient of 0.333. 3. Process performance is concerned about the com-
pletion of the project on time and within the bud-
Conclusions get, and the results show that the differences in
organisational sizes have no effect on process per-
formance. This implies that the finishing of IT
The purpose of this article is to explore organi- projects on time and within the budget was de-
sational factors and risk management practices that sired by organisations of all sizes.
affect IT project success. To achieve this purpose, 4. Risk identification practice has the highest influ-
the survey research from the sample group provides ence on product performance and IT project suc-
results that contribute to the development of IT cess. The results indicate the importance of risk
project success. The results demonstrate that the identification; therefore, it needs to be completed
differences in organisational types affect IT project first. The project managers should be aware of this
success in all aspects. However, the differences in or- practice to improve IT project success rate.
ganisational sizes do not affect IT project success in 5. Product performance is positively influenced by
the aspect of process performance. Risk identification risk identification and risk response planning but
and risk response planning influence the process per- is negatively influenced by risk analysis. This
formance and the success of IT projects. Risk identi- means that the less risk analysis is performed,
fication has the highest positive influence on product the more product performance is expected, or that
performance, followed closely by risk response, while overanalysing is counterproductive. Organisations
risk analysis negatively influences on product perfor- need to carefully consider performing risk analysis
mance. The results lead to the following implications practices due to time and financial reasons sup-
for the practices: ported by reference [5] that, from the practical
1. Organisational project types and sizes affect IT point of view, a lot of project managers decide
project success in the aspect of product perfor-
not to apply any risk management due to finan- [7] Taylor H., Artman E., Woelfer J.P., Information
cial reasons. Technology Project Risk Management: Bridging the
6. The results indicate the high influences of risk Gap between Research and Practice, Journal of In-
identification and risk response planning practices form Technology, 27, 17–34, 2012.
to IT project success. The results can be helpful [8] Schwalbe K., Information Technology Project Man-
to project managers to allocate proper time and agement 7th, Course Technology, Cengage Learning
resources to perform risk management practices. 440–446, 2014.
In conclusion, all risk management practices in-
cluding risk identification, risk analysis, risk re- [9] Baccarini D., Salm G., Love P.E.D., Management
of risks in information technology projects, Industri-
sponse planning, and risk monitoring and control
al Management & Data Systems, 104, 4, 286–295,
are required for process performance, product perfor- 2004.
mance, and IT project success. However, risk analy-
sis practices should be limited to avoid a negative [10] Alhawari S., Karadech L., Talet N.A., Mansour E.,
impact on scheduled time and budget. Knowledge-based risk management framework for
Although interesting results have been found, the information technology project, International Jour-
relatively small sample groups were limited to IT nal of Information Management, 32, 1, 50–65, 2012.
projects at IT companies in Thailand. Further re- [11] Taylor H., Artman E., Woelfer J.P., Information
search could be conducted internationally on larger technology project risk management: bridging the
sample groups in a variety of industries to obtain gap between research and practice, Journal of Infor-
more general results. mation Technology, 27, 17–34, 2012.
to accept other success criteria, International Jour- [30] Ward J., Daniel E.M., The role of project manage-
nal of Project Management, 17, 4, 337–343, 1999. ment offices (PMOs) in IS project success and man-
agement satisfaction, Journal of Enterprise Informa-
[21] Wateridge J., How can IS/IT projects be measured tion Management, 26, 3, 316–336, 2013.
for success?, International Journal of Project Man-
agement, 16, 1, 59–63, 1998. [31] Baccarini D., The logical Framework Method for
Defining Project Success, Project Management
[22] Project Management Institute A Guide to the
Journal, 30, 4, 25–32, 1999.
Project Management Body of Knowledge, 3rd ed.,
Newtown Square, Pennsylvania, 2003. [32] Nidumolu S., Standardization, Requirements Uncer-
tainty and Software Project Performance, Informa-
[23] Martin N.L., Pearson J.M., Furumo K., IS Project
tion and Management, 31, 3, 135–150, 1996.
management: Size, Practices and Project Manage-
ment Office, Journal of Computer Information Sys- [33] Jun L., Qiuzhen W., Qingguo M., The effects of
tems, 47, 4, 52–60, 2007. project uncertainty and risk management on IS de-
[24] Mahaney R.C., Lederer A.L., An Agency Theo- velopment project performance: A vendor perspec-
ry Explanation of Project Success, The Journal of tive, International Journal of Project Management,
Computer Information Systems, 51, 4, 102–113, 29, 923–933, 2011.
2011. [34] Wallace L., Keil M., Arun R., How software project
[25] Iacovou C.L., Benbasat I., Dexter A.S., Electronic risk affects project performance: an investigation of
data interchange and small organizations: adoption the dimensions of risk and an exploratory model,
and impact of technology, MIS Quarterly, 19, 4, 465– Decision Sciences, 35, 2, 289–321, 2004.
485, 1995. [35] Pheng L.S., Chuan Q.T., Environmental factors
[26] Nelson R., Project retrospectives: evaluating project andwork performance of project managers in the
success, failure and everything in between, MIS construction industry, International Journal of
Quarterly Executive, 4, 3, 361–372, 2005. Project Managemant, 24, 24–37, 2006.
[27] Peppard J., Ward J.M., Daniel E.M., Managing the [36] Allen M., Alleyne D., Farmer C., McRae A., Turner
realization of business benefits from IT investments, C., A Framework for Project Success, Journal of In-
MIS Quarterly Executive, 6, 1, 1–11 2007. formation Technology and Economic Development,
5, 2, 1–17, 2014.
[28] Gable G.G., Sedera D., Chan T., Re-conceptualizing
information system success: the IS impact measure- [37] Dixon T., Pottinger G., Jordan A., Lessons from the
ment model, Journal of the Association for Informa- private finance initiative projects in the UK: Bene-
tion System, 9, 7, 377–408, 2008. fits, problems and critical success factors, Journal of
Property Invest. Finance, 23, 5, 412–423, 2005.
[29] Jones M.C., Zmud R.W., Clark T.D., ERP in prac-
tice: a snapshot of post installation perception and [38] Cragg P., King M., Small-firm computing: motiva-
behaviors, Communications of the Association for tors and inhibitors, MIS Quarterly, 17, 1, 47–53,
Information Systems, 23, 437–462, 2008. 1993.