Journal of the Association for Information Systems


The information technology (IT) project risk management literature comprises two dominant but diverging bodies of knowledge: the normative and the experiential. We conducted a three-step dialectical review of this literature with the aim of creating a bridging body of knowledge. In the first step, delineation, we synthesize the overarching variance and process explanations in each body of knowledge and motivate the examination of their divergences. In the second step, contrastation, we perform a dialectical interrogation of these bodies to articulate their key assumption-level tensions. We elaborate on the most prominent tension between the two bodies, namely, the relative performance of intuition and deliberate analysis for project risk assessment. In the third step, sublation, we propose a theoretical model that resolves this tension. Anchored in both bodies of knowledge and drawing from managerial decision-making research, the model proposes that the relative performance of intuition depends on characteristics of the IT project manager (project-specific expertise), the project (risks’ temporal complexity and risks’ structural complexity), and the project’s organizational environment (e.g., stakeholders’ involvement in risk management, methods-using pressures). Moreover, the model posits that project-specific expertise moderates all the other effects. Building on the bridging knowledge insights from this model, we discuss how researchers can design interventions to increase project managers’ use of deliberate analysis when it is expected to outperform intuition or to encourage reliance on intuition when it is likely to outperform deliberate analysis.