4.2. How empirical evidence was collected in the papers
Ropponen and Lyytinen (1997) state that many of the papers published on risk management in IT projects in the period until 1997 are often not based on empirical data. The publications published between 1997 and 2009 which we found, present a different situation. We found only three publications that contained no empirical data out of a total of 32 papers. The remaining selection of 29 papers includes some studies containing a limited amount of empirical data (Dey et al., 2007; Procaccino et al., 2002; Tesch et al., 2007; Zafiropoulos et al., 2005). In general however, empirically collected information forms the basis for the conclusions drawn in the publications. The evaluation approach to risk management mainly includes surveys, whereas the management approach prefers case studies to surveys and other instruments.