Organizational risk – looking at how equipped the organization is to implement the project in terms of personnel, skills and experience.
IS infrastructure risk – assessing how far the entire IS organization needs, and is prepared to support, the project.
Definitional uncertainty – assessing the degree to which the requirements and/or the specifications of the project are known. Incidentally, research into more than 130 organizations shows this to be a primary barrier to the
effective delivery of IT (Willcocks, 1993). Also assessed are the complexity of the area and the probability of non-routine changes.