Systemic risk might jeopardize your IT project portfolio: A qualitative evaluation of risk measures

Abstract

IT project portfolios consist of various projects which depend on each other. Including additional IT projects, which are interdependent with existing ones, affects the IT portfolio’s systemic risk, which arises from these interdependencies. To handle this risk, organizations must quantitatively analyze the systemic risk of their IT portfolio. However, an overview and evaluation of risk measures for quantitatively analyzing systemic risk in IT portfolios has been missing. In our study, we first conducted a structured literature review to identify risk measures. We then determined evaluation criteria based on mathematical considerations on how risk measures can be modeled and insights from our literature review. Subsequently, we performed a qualitative, criteria-based evaluation to clarify which risk measure fits specific use cases. Finally, we delineated our findings as three recommendations. Our research supports organizations in better analyzing systemic risk in their IT portfolios by selecting the most appropriate risk measure according to their data or use case, contributing to a more successful IT portfolio management.