Variations in risk exposure: A longitudinal analysis of enterprise software projects

Effective allocation of resources to risk mitigation still is a pivotal challenge to project managers. Thus, researchers and practitioners compile commonly important risks and present them as checklists, risk rankings, and other methods to help project managers in justifying allocating resources for mitigation. In this paper, we challenge the static nature of such compilations by exploring longitudinal variations in project managers' risk exposure estimations. Our analysis of risk reports from 111 enterprise software projects shows that (1) risk exposure estimations vary along project phases and that (2) the estimations' volatility differs across risks. This highlights the necessity of a dynamic lens for advancing the understanding of project risks. From a practical perspective, our findings substantiate the need for continuous risk assessments throughout projects.