Developing risk breakdown structure for information technology organizations

Any risk management method begins with a preliminary phase of risk identification intended to detect and classify potential risk items. This paper presents a methodological process for developing a Risk Breakdown Structure (RBS) constructed by analyzing records from previous projects and past organizational occurrences. An implementation of the method is presented for an Information Technology (IT) organization. The RBS visually portrays the hierarchical structure of the overall organizational risk pattern, thus facilitating the detection of risk areas that require special attention from management. The results of an analysis of this IT organization reveals a risk pattern that focuses on customer involvement and communication issues on the one hand and product description and production requirements on the other hand. The method of analysis described here utilizes various types of information already existing in an organization and thus should enable managers to structure an appropriate RBS for their projects.