Literature (e.g. Kutsch and Hall, 2005) indicates that knowledge of the risks does not automatically imply that this knowledge is used for managing those risks. Over the last decade, there appears to have been a growing interest in the development of new methodologies for the management of IT projects, such as e.g. Agile (see e.g. Schwaber and Beedle, 2002) and RUP (see e.g. Kruchten, 2004). These methodologies address issues such as user participation, management buy-in, and user buy-in in a more extensive manner than the traditional project management methodologies. The knowledge obtained by adopting the evaluation approach to risk management may have influenced, or may even have facilitated the development of these new methodologies. Furthermore, the knowledge of the risks generated by the evaluation approach to risk management may have found its way into new or updated questionnaires that are used during risk identification sessions.
The management approach generally considers risk management as a process consisting of well defined steps of identification, analysis, response, monitoring, and control. Only two papers report some positive impact of risk management activities on issues such as a timely project
delivery, the estimations of the resources required to perform a task, and the number of task failures. All other papers remain implicit about the contribution to project success, assuming that the well defined steps are taken, and that they contribute to project success in one or another way. Less is known, however, about what happens inside the risk management process; what risk management
practices are used within a project, which stakeholders are participating in these practices, how these risk management practices influence stakeholders, and how do these practices influence project success? These are relevant questions, to which the risk management approach so far has not provided satisfactory answers, and neither does it give a truthful representation of how stakeholders actually behave.