However, as Alter and Ginzberg’s (1978) use of the word ‘‘suggest” indicates, the effects of risk management are hard to establish. The debate during the time of the millennium change, in IT circles known as the Y2K problem, is an example of the general problem that it is difficult to establish the influence of something that is meant to prevent something else from happening. During the late 90’s, large sums of money were invested to identify and repair computer software that was assumed to be unable to handle the transition from the year 1999 to 2000. When the transition actually took place, however, there were no major computer failures. The question was then asked whether it had been worth the investment (BBC News Talking Point, 2000). The debate took the form of a controversy between believers and non-believers, because it is impossible to determine what would have happened if this risk management had not been applied. With respect to the use of risk management in projects, professionals therefore state that risk management must be done because the project management handbooks say so, and it should be done in the way the handbooks prescribe it (Association for Project Management, 2006; Project Management Institute, 2004). This normative approach is often found in relation to literature that focuses on project management in general (Turner, 1999), and on risk management in IT projects in particular (Ropponen and Lyytinen, 1997).