IT Evaluation Methods for Risks

Back to IT Risks

1. Real Option (RO): DCF and NPV methods can lead to erroneous conclusions in the face of uncertainty even when the apparent range of interest or the existence of certain types of risks are possible. The method can also lead to the possibility of unexpected outcomes. This is because NPV analysis ignores the time series interactions among contingent investments, and the possible consequences of the delayed effects from the expected benefits and costs. In this sense, real option recognizes incremental value arising from flexibility. The fact that the flexibility gives rise to additional value is the recognition of the altered probability distribution of potential outcomes and its impact on risk exposures. When a significant degree of uncertainty in outcomes for IT investments, the waiting game might produce substantial benefits. The value of waiting is a reflection of the costs associated with an irreversible investment. That is, if there is an element of a sunk cost in an investment, then once the investment has been made the sunk cost is incurred. If an investor is making an investment decisions on the basis of NPV, then it is almost certain that miscalculations will be made if embedded options are not recognized. In this context, the identification of real options helps to explain the value of flexibility by demonstrating the managers are not miscalculating investment outcomes and are acting rationally. The method uses three basic types of data # Current and possible future business strategies # The desired capabilities sought by the company # The relative risks and costs of other information technologies choice that can be used. The method can help assess the risks associated with IT investment decisions, taking into account the business strategies and system requirements may change. 2.  Portfolio Approach (PA): It focuses on three important dimensions that influence the risk inherent in IT investments. These include: # Sizes of projects and workload to be handled by the system. Larger the Rupee expense in the projects, the larger the workload, levels of staffing, the amount of time and the larger the number of departments affected by IT, the greater the risk. #Experience of management with the technology. Because of the greater likelihood of unexpected technical problems, IT risk increases as familiarity of the system team with the hardware, operating systems, database handler and project application language decrease. # Capability in handling complex highly structured project. The highly structured projects usually carry less risk than projects that are less structured, their outputs are more subject to the manager’s judgment and hence are vulnerable to change. This approach suggests that a company not only assesses relative risk for the single IT project, but also develop an aggregate risk profile of IT investment. In an industry where computers are an important part of the product structure, managers should be concerned when there are no high-risk projects. In such a case, the company may be leaving a product or service gap, which may present an opportunity for the competition to step in. On the other hand, a portfolio loaded with high risks projects suggests that the company may be vulnerable to operational disruptions when projects are not completed as planned. 3.  Delphi Approach: It is a technique in which several experts provide estimates of the likelihood of the future events associated with the decision situation. The estimates are collected and distributed to all experts. All experts are then asked if they wish to modify their initial ratings based on the inputs from other experts. After all inputs are collected, final individual values are evaluated and summarized. If the results are sufficiently consistent, final overall values are assessed for all. If any inconsistency is recorded, the experts will be asked to discuss the instances of inconsistencies and attempt to reach a compromise on the final value. This and other final values will be adopted and used to compute the risks associated with the investment. This approach is particularly useful for the risk analysis of a new IT investment where the risks involved in the investment may be primarily unknown or unfamiliar to the managers.

Back to IT Risks