The management approach to risk management has as yet not led to conclusive evidence either. Based on what is presented in publications from 1997 to 2009, we conclude that the empirical knowledge is still anecdotal and largely based on how risk management is assumed to work instead of how it is actually used in project practice. Considering the assumptions on which risk management is based, it is remarkable that except for Kutsch and Hall (2005), none of the authors comes to the conclusion that risk management may not work as assumed. The literature should at least have recognised that risk management is not being conducted as it should be in order to be effective, according to its basic criteria. This leads to the conclusion that risk management can only be effective in specific project situations. Following the work by Loch et al. (2006), an interesting direction for further research would be to determine these specific conditions in the context of IT projects.