Besner and Hobbs (2006) as well as others, e.g. Bannerman (2008), Raz et al. (2002) and Voetsch et al. (2004) have investigated the various activities carried out within the risk management process of several types of projects. They have come to the conclusion that the sequence of identification,
analysis, responses, and monitoring is often not followed. Risk identification is often included in the process; Voetsch et al. (2004) state that it is done in almost all of the projects. Risk analysis, however, is rarely done. Besner and Hobbs (2006) have observed that project managers do
not regard risk analysis as potentially valuable, especially quantitative risk analysis. Therefore, the performance of quantitative risk analyses within IT projects is not expected to increase in the near future. Bannerman (2008) in his research finds that none of the 17 IT projects he investigated used quantitative risk analysis. A reason why quantitative risk analysis is not considered useful may be that many of the risks in IT projects are not aleatoric in nature (they are not based on probability), but epistemic, which means that there is not enough information available to take a decision. In project situations, this often leads to the postponement of the decision (Kutsch and Hall, 2005), or to a request for more information.