Managing risks in IT projects: an options perspective

https://doi.org/10.1016/S0378-7206(01)00133-1Get rights and content

Abstract

Organizations are making large investments in information technology (IT) projects. However, many are risky and are often considered runaway, because they do not meet original expectations of cost, time, or benefits. Effective management of risks in IT projects is therefore extremely important. This paper emphasizes the need to differentiate between risks that can be resolved by action and risks that require hedging. It presents a framework for understanding and hedging risks in IT projects based on the finance literature on real options. This framework can be used to understand and justify project management decisions. The insight provided by this framework is consistent with practical managerial decisions in IT project management.

Introduction

Organizations are making large investments in information technology (IT) and there is growing realization that IT investments can be a significant source of competitive advantage [11]. Accounting legislation in the US has recognized the importance of IT investments and requires that after 15 December 1998, costs associated with a software system developed for internal use must be added together and accounted as an asset on balance sheets [12]. This legislation has both advantages and disadvantages from the viewpoint of IT managers. On the one hand, it might increase the awareness of the importance of IT projects. On the other hand, competition for capital expenditure dollars is often more intense than for annual budget dollars; companies examine their priorities carefully. Effective management of IT projects is therefore extremely important.

IT projects are often difficult to estimate and manage and some projects are canceled or reduced in scope because of overruns in cost and/or time or failure to produce anticipated benefits [25], [32]. Hence, effective management of IT project risks is a challenging task in many organizations. Also, it is becoming increasingly common for large IT projects to be managed by multifunctional teams. Hence, it is also important for the project management team members to communicate well with each other and with project sponsors using business-oriented concepts (as opposed to IT-oriented ones) and to present risk management in IT projects using business terms that senior finance executives can understand.

The purpose of this article is to propose a framework for managing risks in IT projects. This framework is based on research in finance on real options theory [1], [42], [26], [43]. The proposed framework represents a systematic approach to risk management in IT projects. There is empirical evidence to support the fact that managers who are aware of some options-like ideas do a better job of managing risky research and development (R&D) projects [24]. Also, senior finance executives are becoming increasingly aware of the need to view major risky capital investments as options [1], [8], [33]. Researchers in computer science [40] suggest that the real options framework can be useful for understanding key software design decisions. The literature on strategic management [29] and justification of IT investments [10], [22], [30] has also recognized the value of conceptualizing decisions in terms of options. Earlier research [16], [20] has shown that traditional financial evaluation techniques such as net present value (NPV) tend to undervalue IT investments and has proposed the use of real options techniques for evaluating IT investments. In the MIS literature, Benaroch and Kauffman [2] illustrate the use of real options techniques in the context of a decision to expand a banking ATM network. Taudes [41] explains that software procurement decisions can be considered real options. To the best of our knowledge, risk management in IT projects has not been systematically studied in the context of real options. In particular, this paper suggests that many IT project management decisions can be conceptualized as real options and illustrates how some common options can be valued.

Section snippets

Managing risks in IT projects

Risk has been studied from many perspectives. These include a detailed theoretical analysis of the anatomy of risk [38], and risk and uncertainty in the context of the value of information [13]. Research has examined uncertainty in the context of managing IT projects [4], [15], [37]; these risks include specification uncertainty (due to uncertain business conditions or lack of knowledge), incorrect understanding of specifications, overlooked specifications, unrealistic schedules and budgets,

Real options

An option can be described as a right (not an obligation) to do something (such as buy or sell an asset). Financial options are options on financial assets (e.g. an option to buy 100 shares of AOL at US$ 120.00 per share on 1 January 2002). These are usually traded and one can buy the type of option in the example above for a price (say, US$ 500). The option in this example is one of many types and is called a ‘European-type call option’ [14]. This will be exercised if the price of AOL shares

IT projects as real options

Fig. 2 shows how a project that might contain some parallel and some interrelated activities can be considered to be a sequence of investment decisions on the part of the project manager.

Each arc (arrow) in Fig. 2(a) denotes a project activity (1, 2, 3, 4). Activities 1 and 3 precede activities 2 and 4, respectively. Fig. 2(b) denotes the time required for each activity. Fig. 2(c) shows that Fig. 2(a) can be thought of as a set of sequential managerial decisions at different points in time: at

Hedging risk in IT projects

Managers can hedge risks by holding an appropriate portfolio of real options. Managing IT projects can be viewed as the process of updating this portfolio by adding new options, deleting existing ones, or altering the values of existing options by altering parameters that affect their value.

Managerial implications

IT project managers typically manage risk by identifying risks and formulating risk management strategies. These risk management strategies may include strategies to reduce risk (reduction strategies) as well as strategies to manage the impact of risk (risk hedging strategies). Managers may often use the term ‘risk mitigation strategies’ to include risk reduction as well as risk hedging strategies.

In practice, managers often use checklists of risks, with associated probabilities to evaluate the

Conclusions

This paper has emphasized the importance of categorizing risk management in IT projects into risk reduction and risk hedging strategies, since some risk in IT projects cannot be eliminated. Traditional techniques such as checklists of risks, with associated probabilities, used in IT project management do not emphasize risk hedging, which is well-accepted in financial risk and has strong theoretical underpinnings. However, a similar understanding and theory base for hedging risks in IT projects

Acknowledgements

This research was funded by in-part by a grant from Childress Klein Inc., and UNC-Charlotte.

Ram L. Kumar is Associate Professor in the Business Information Systems and Operations Management Department at the Belk College of Business Administration, UNC-Charlotte. He received his PhD from the University of Maryland in 1993, where he was the recipient of the Frank T. Paine Award for Academic Merit. He worked for 5 years in information systems development and management, with major multinational corporations such as FUJITSU before entering academics. His research in the areas of

References (43)

  • J. Jiang et al.

    Risks to different aspects of system success

    Information and Management

    (1999)
  • R.L. Kumar

    An options view of investments in expansion-flexible manufacturing systems

    The International Journal of Production Economics

    (1995)
  • S. Majd et al.

    Time to build, option value and investment decisions

    Journal of Financial Economics

    (1987)
  • M. Amram, N. Kulatilaka, Real Options: Managing Strategic Investment in an Uncertain World, Harvard Business School...
  • M. Benaroch et al.

    A case for using real options analysis to evaluate information technology investments

    Information Systems Research

    (1999)
  • B. Boehm, A Spiral Model of Software Development and Enhancement, IEEE Computer, 1988, pp....
  • B. Boehm, Software Risk Management: Principles and Practices, IEEE Software, 1991, pp....
  • R.A. Brealey, S.C. Myers, Principles of Corporate Finance, McGraw-Hill, New York,...
  • R.N. Burns, A.R. Dennis, Selecting an Appropriate Application Development Methodology, DATABASE, 1985, pp....
  • G. Davis

    Strategies for information requirements determination

    IBM Systems Journal

    (1982)
  • A. Dixit, R. Pindyck, The Options Approach to Capital Investment, Harvard Business Review, 1995, pp....
  • A. Dixit, R. Pindyck, Investment Under Uncertainty, Princeton University Press, Princeton, NJ,...
  • B.L. Dos Santos

    Justifying investments in new information technologies

    Journal of Management Information Systems

    (1991)
  • R. Gardner, CEOs to IT: Teach Us, Computerworld, October 19,...
  • J. Hibbard, Software gains capital treatment, Information Week 12...
  • R.W. Hilton

    The determinants of information value: synthesizing some general results

    Management Science

    (1981)
  • J.C. Hull, Options, Futures, and Other Derivative Securities, 2nd Edition, Prentice Hall, Englewood Cliffs, NJ,...
  • A. Kambil, C.J. Henderson, H. Mohsenzadeh, Strategic management of information technology: an options perspective, in:...
  • B. Kamrad, R. Ernst, Multiproduct manufacturing with stochastic input prices and output yield uncertainty, in: L....
  • M. Keil

    Pulling the plug: software project management and the problem of project escalation

    MIS Quarterly

    (1995)
  • A. Kemna

    Case studies on real options

    Financial Management

    (1993)
  • Cited by (127)

    • Evaluating large-scale IT investment decisions

      2018, Technology in Society
      Citation Excerpt :

      Jiang and Klein [59] suggest risks are typically associated with the feasibility of an IT project. Similarly [60], argues many IT projects are risky because they do not meet original expectations of cost, time, or benefits. One of the first risks that a company will have to deal with is the initial expense to create an IT infrastructure and then the cost of maintaining it.

    • Navigating Rumsfeld's quadrants: A performative perspective on IT risk management

      2018, Technology in Society
      Citation Excerpt :

      The levels of analysis range from the project (e.g. [51]) to the organization (e.g. Ref. [12]) and includes the inter-organizational, especially in terms of research on outsourcing risks (e.g. Refs. [3,5,4,52]). Other areas of concern in IS risk research are ERP risks [16,53–56], and security risks [21,38,39,57,58]. As is evident in this rich stream of research, there are a multitude of variations on risk definitions, but at its core risk is a matter of an “effect of uncertainty on objectives” (ISO 31000).

    • A quantum derivation of a reputational risk premium

      2016, International Review of Financial Analysis
      Citation Excerpt :

      Further developments have resulted in an generalization of this methodology so that it can be used to value a wide set of financial derivatives (Hull 2006; Poitras 2002; Wilmott 2007), capital structure (Bensoussan, Crouhy, Galai, Wilkie, & Dempster 1994), financial responsibilities (Longstaff & Schwartz 1995; Merton & Samuelson 1990), corporate securities (Black & Cox 1976), corporate liabilities (Brealey, Myers, & Allen 2006; Merton 1974), investment opportunities (Abel, Dixit, Eberly, & Pindyck 1996; Amram & Kulatilaka 1999; Brennan & Schwartz 1985; Copeland & Antikarov 2001; Dixit 1994; McDonald & Siegel 1985; Smit & Trigeorgis 2012; Trigeorgis 1993; Trigeorgis 1996), and even a whole company (Bowman & Hurry 1993; Copeland Thomas, Koller, & Murrin 1994; Koller, Goedhart, & Wessels 2010; McDonald & Siegel 1985; Sanchez 1995) or the issue of business failure (McGrath 1999). At a more general level, the same approach has been successfully applied in construction and technology projects (Benaroch 2002; Ford, Lander, & Voyer 2002; Kumar 2002; McGrath 1997; Schwartz & Zozaya-Gorostiza 2003; Zou & Zhang 2009), research and development (Eckhause, Hughes, & Gabriel 2009; Huchzermeier & Loch 2001; Paxson 2001; Schneider et al. 2008), production (Gamba & Fusari 2009; Xu, Lu, & Li 2012), manufacturing (Kogut & Kulatilaka 1994), supply chains (Cucchiella & Gastaldi 2006; Tang & Nurmaya Musa 2011; Wong, Potter, & Naim 2011), joint ventures (Chi 2000; Kogut 1991), budgeting (Costa & Paixão 2010; Meier, Christofides, & Salkin 2001), corporate social responsibility (Husted 2005) and risk management (Cruz 2002). These models are developed under the assumption that a certain financial magnitude can be represented as a stochastic process.

    • Modeling business risk: The effect of regulatory revision on renewable energy investment - The Iberian case

      2016, Renewable Energy
      Citation Excerpt :

      A vast literature is available on the use of Real Options in several fields. Examples of such fields being researched include development [13] [14], information technology [15] [16], and renewable energy [17] [18] projects. Since 1970, the worldwide energy market has gone through extensive changes in terms of regulation, technology, distribution, etc. [19].

    View all citing articles on Scopus

    Ram L. Kumar is Associate Professor in the Business Information Systems and Operations Management Department at the Belk College of Business Administration, UNC-Charlotte. He received his PhD from the University of Maryland in 1993, where he was the recipient of the Frank T. Paine Award for Academic Merit. He worked for 5 years in information systems development and management, with major multinational corporations such as FUJITSU before entering academics. His research in the areas of management of information systems, electronic business and management support systems has been funded by organizations such as the US Department of Commerce and Maryland Industrial Partnerships Scheme and other Organizations. His research has been published in Communications of the ACM, Computers & Operations Research, DATABASE, Information & Management, International Journal of Production Economics, International Journal of Production Research, Journal of MIS, OMEGA, chapters in edited books, and several conference proceedings.

    View full text