The analysis leads to remarkable conclusions, which are
presented in the last section of the paper. Over the last 10
years, much has become known from extensive empirical
research about what causes IT projects to fail. However,
there is still little empirical evidence that this knowledge
is actually used and that the risks in IT projects are really
manageable. An analysis of the assumptions underpinning
risk management indicates that the risk management
instrument may only work under very strict conditions.
Therefore, more in-depth empirical work which looks
inside the risk management process is necessary.