Abstract
Projects are important to society, and yet they often fail. This is despite the application
of widely accepted project management standards, training, and processes. In this
context, there is growing awareness that projects are often highly complex and therefore
cannot be managed effectively solely by using process-based project management
techniques. An alternative approach is now emerging, and that is recognising and
dealing with the dynamic complexity, feedback and uncertainty inherent in most large
projects today.
When a project does fail, it follows that there has also been a failure in the management
of risks to the project. Given this, it is possible to obtain insight into failures in complex
projects by investigating how risk is managed. During this research, the management of
internally generated risks in projects was of particular interest. These are the risks that
projects create for themselves by the way they are set up or operate. If it is established
that such risks are common, important and not well managed, it could provide valuable
insight into why projects fail.
Nine complex projects were investigated to identify, document and analyse internally
generated risks to their success. Using data gathered from workshops and confidential
interviews, five hypotheses were tested to understand the role played by internally
generated risks in projects. A key part of the research method was the use of risk maps,
an adapted form of cause-and-effect diagrams, as the basis for the dialogue necessary to
create a shared understanding of each risk.
Statistically significant results were obtained to support the conclusion that internally
generated risks are common in complex projects, have the potential to significantly
impact upon project success, and yet are generally poorly managed. It was also
concluded that internally generated risks are important as a class of project risk, with
potentially large impacts upon the success or otherwise of complex projects. Given this,
further research to better understand how such risks arise and how they can be
recognised and managed is appropriate.