Benaroch, Michel

Goldstein, James

English

AIS Electronic Library (AISeL)

Association for Information SystemsAIS Electronic Library (AISeL)AMCIS 2006 Proceedings Americas Conference on Information Systems(AMCIS)December 2006An Integrative Economic Optimization Model toIS Development Risk ManagementMichel BenarochSyracuse UniversityJames GoldsteinSyracuse UniversityFollow this and additional works at: http://aisel.aisnet.org/amcis2006This material is brought to you by the Americas Conference on Information Systems (AMCIS) at AIS Electronic Library (AISeL). It has been acceptedfor inclusion in AMCIS 2006 Proceedings by an authorized administrator of AIS Electronic Library (AISeL). For more information, please contactelibrary@aisnet.org.Recommended CitationBenaroch, Michel and Goldstein, James, "An Integrative Economic Optimization Model to IS Development Risk Management"(2006). AMCIS 2006 Proceedings. 68.http://aisel.aisnet.org/amcis2006/68Benaroch and Goldstein  Integrative Economic Optimization Model - IS Development Risk ManagementProceedings of the Twelfth Americas Conference on Information Systems, Acapulco, Mexico August 04th-06th 2006An Integrative Economic Optimization Modelto IS Development Risk ManagementMichel BenarochMartin J. Whitman School of ManagementSyracuse Universitymbenaroc@syr.eduJames GoldsteinMartin J. Whitman School of ManagementSyracuse Universityjcgoldst@syr.eduABSTRACTThis research develops an integrative model to managing IT investment risk from an economic optimization perspective byconsolidating  and  building  on  the  strengths  of  two  research  streams.   The  traditional  stream  is  concerned  with  softwaredevelopment risk management and its focus on the “building” stage in the IT investment lifecycle enables addressinggranular risks using well-established project management practices, but precludes managing risk from a comprehensiveeconomic perspective.  By contrast, the more recent stream uses real options theory (ROT) to study the economicimplications of risk in relation to the flexibility one can build into IT investments to enable deployment of contingent riskcountermeasures.  However, this stream’s macro level perspective is not geared towards granular risk management practicesat the execution level.  The economic optimization orientation of our model follows from the use of ROT as an economicbasis for unifying micro- and macro-level risk management practices studied by both streams.KeywordsInformation Systems Risk, Real Options Theory, Project Management.INTRODUCTIONRecently there is much renewed interest in the management of information systems (IS) development risk (e.g., Barki, Rivardand Talbot, 2001; Benaroch, 2002; Jiang, Klein and Discenza, 2002; Keil, Lyytinen and Schmidt, 1998; Lyytinen,Mathiassen and Ropponen, 1998; Ropponen, 1999; Schmidt, Lyytinen, Keil and Cule, 2001).  This work falls into twodistinct streams.  One stream largely follows in the footsteps of early work on software development risk management. It issubject to three known weaknesses.  First, although software development is a value-creation activity (Boehm and Sullivan,2000), this research looks to control only the cost side of software development, ignoring business managers’ concerns overhow risk affects the payoffs that every IS development project is expected to generate.  Second, by limiting its scope tosoftware development risks arising in the investment “building” stage, this research fails to see that risk managementdecisions pertaining to the building stage affect and can be affected by decisions pertaining to earlier and/or later stages in theinvestment lifecycle (Benaroch, 2002).  However, a strength that follows from its limited scope is a richness of details thatpermits integrating risks into “micro” level project management decisions.  Finally, although the notions of risk and riskcountermeasures have clear consequences on investment costs and payoffs, this research offers no adequate ways to quantifythese notions and link them to the net value of an IS development project.  As a result, this work precludes managing IS riskfrom an economic optimization perspective – it is impossible to know whether any specific combination of riskcountermeasures pursued for a target IS investment is optimal or even adds value.A more recent research stream on IS risk management looks to address some of the above drawbacks within the context ofreal options theory.  This work looks at ways to use real options to build flexibility into an investment so as to enablemanagement to favorably alter the variation in expected outcomes and bring risk under control (Amran and Kulatilaka, 1999;Kumar, 2002; Kim and Saunders, 2002).  For example, a recently developed option-based risk management framework offersa comprehensive way to use different types of real options to manage various specific forms of IS investment risks(Benaroch, 2002).  However, this research stream has its own weaknesses.  First, its primary focus is on the construction andevaluation of a business case for a target IS development investment opportunity.  As such, it takes a somewhat static view ofthe risk management endeavor, unlike the way more traditional work views IS risk management as an ongoing iterativeendeavor.  Second, while it looks at risk management in the context of the entire IS development investment lifecycle, it isconcerned with “macro” level business decisions (invest or not, investment timing, investment scope, etc.).  Consequently, itis not geared towards capturing granular details that allow for integration with “micro” level project management practices. 536Benaroch and Goldstein  Integrative Economic Optimization Model - IS Development Risk ManagementProceedings of the Twelfth Americas Conference on Information Systems, Acapulco, Mexico August 04th-06th 2006This research develops an integrative model for managing IS development risk from an economic optimization perspective.The model is integrative in the sense that it builds on the strengths of the two research streams reviewed above, while fittingthe richness of details of the micro technical view within the holistic approach of the macro business level view.  Theeconomic optimization orientation of the model follows from the use of real options theory as a unifying economicfoundation for integrating risk management practices at both the micro (stage) and macro (lifecycle) levels as well as fortreating risk management as a dynamic iterative problem-solving process.  We show how the dynamic ongoing micro leveltechnical decisions affect and are affected by the flexibility afforded by embedded options created by macro level decisions,demonstrating that real options theory is a viable vehicle for effectively linking both levels into a single economic model foroptimal IS risk management.  Such a model will bridge the gap between both research streams, allowing managers tounderstand how the technical decisions made during the building stage impact the overall net investment value.MODELING APPROACHBased on well-established practices in the domain of financial investment and financial risk management, the modelconsiders IS risk management to be a problem-solving process that aims at favorably changing the distribution of theexpected net investment value (see Figure 1).  This process involves four activities: (1) identify and quantify relevant risks,(2) map the risks to plausible risk countermeasures, (3) plan which of these countermeasures to apply over time based ontheir expected cost and their expected impact on investment payoffs, and (4) monitor risk in light of new information andreiterate.  Thus, at its core, this process is about planning managerial interventions that provide a desired (or optimal) level ofbalance between the likelihood of acceptable and unacceptable investment outcomes.  Applying proper interventionsmodifies various risky traits of the investment and its contextual environment, thereby favorably skewing the distribution ofnet investment value (see Figure 1).RiskyInvestmentReconfigured,Less Risky Investmentdistribution of the investmentvalue without risk managementVPLNet InvestmentValueidentify &operationalizeVPL –threshold under which the investment value isunattractive (e.g., investment looses money)PPL –probability of investment loosingwith no risk managementP’PL –probability of investment loosingwith risk actively managed1Risk ResolutionInterventionsRiskFactors 23generate & evaluateinvestmentconfigurations4mapmonitor risk& reiterateRiskAssessment(develop theinvestment riskprofile)RiskControl(modify theinvestmentrisk profile)modified distributionof the investment valuewith risk managementNet InvestmentValueVPLFigure 1A prerequisite to managing IS development investment risk is having the flexibility to deviate from a predetermined courseof action in response to the materialization of risks affecting an investment and its contextual environment.  It has beenshown empirically that ‘flexibility’ is one of five cultural variables of an organization having a significantly positivecorrelation with successful IS development (Harper and Utley, 2001).The ability to apply risk countermeasures at a reasonable cost is missing unless the requisite flexibility exists from the outset.When management does not have the flexibility to apply risk interventions, the investment value is usually measured by thepassive NPV, NPVP.  When management has the flexibility to take (economically) rational corrective actions in response torisk, the value of the investment is measured by the active NPV, NPVA: 537Benaroch and Goldstein  Integrative Economic Optimization Model - IS Development Risk ManagementProceedings of the Twelfth Americas Conference on Information Systems, Acapulco, Mexico August 04th-06th 2006NPVA = NPVP + value of managerial flexibility permitting to deploy risk interventions (1)However, flexibility is not inherent in any IS investment – it must be proactively planned and built in a target investment,based the specific risks one seeks to control using specific risk interventions.  The flexibility built into an IS investment iseconomically counterproductive if: (1) there are no risks present, and (2) it is not linked to specific interventions that areadequate for the risks present.  Moreover, recognizing that flexibility and risk interventions have a cost associated with them,the question in need of an answer is:How much, and what forms of, flexibility should risk management build into an IS developmentinvestment in order to optimize the expected net investment value?This question frames risk management as being about creating the right amount of flexibility needed for a carefully plannedset of interventions, whose expected cumulative cost is optimally balanced against the value that they are expected to add tothe investment.A useful way to refine the above question is using the notion of real options.  Real options are surrogates of the forms offlexibility needed to deploy beneficial countermeasures when relevant risks materialize (Benaroch and Kauffman, 2001).Real options can be viewed as high-level strategies for managing risk.  In fact, some of the risk countermeasures mostcommonly identified in the IS risk literature have clear parallels with, or even map directly to, real options.  Some options arein themselves risk countermeasures; e.g., prototyping, staging (incremental development), fee-based outsourcing contracts,resource leasing contracts, and abandonment (Boehm, 1991; Fairley, 1994).  Other options simply create the flexibilityneeded to deploy more granular risk countermeasures; e.g., deferral provides time to cross-train personnel to counter risk dueto an unstable emerging technology.  Moreover, another appealing reason to build on the notion of real options has emergedfrom a recent empirical study showing that IS managers follow the logic of real options theory (ROT) in managing ITinvestment risk, although purely based on intuition (Benaroch, Lichtenstein and Robinson, 2006).Figure 2 depicts the interactions between flexibility that the macro-level business decisions build into an IT investment andrisk resolution interventions that micro-level decisions employ to mitigate the impact of IS development risk factors.Through outlining these relationships, we can see that micro-level technical decisions made in response to risk factors enableor constrain macro-level business decisions.  For example, the organization could make the technical decision to go with amodular design in response to the risk factor that functionality requirements may change.  The flexibility created by thedesign would then enable management to build the additional functionality at a lower cost if the risk factor did indeedmanifest.  Without that flexibility, building additional functionality could turn out to be cost prohibitive.  A high-level sketchof the economic optimization model we fully develop is as follows:[ ])plannedsurescountermeariskoptions,embeddedrisk,(presentrisksthegcontrollinforRRIsplausiblefNPVNPV PA +=MAX (2)Our model examines the way the probability density function of investment returns can be affected by the addition of specificforms of flexibility and the risk countermeasures that they enable.  The model builds on two important measures developedby research on software development risk management – risk exposure (RE) and risk resolution intervention (RRI) (Boehm,1991).  RE is a measure of risk defined as:RE = Probability of a risk event * Loss expected if risk event occurs (3)RRI is a cost-benefit measure of a risk intervention, defined as:oninterventiofcostafterbefore RERERRI -= (4)We reframe these two measures in terms that can be naturally fitted into formal real option valuation models.  Overall, ourmodel is expected to enable organizations to determine the effect of IT investment risk on the net investment value, and tomanage that risk in an economically optimal manner. 538Benaroch and Goldstein  Integrative Economic Optimization Model - IS Development Risk ManagementProceedings of the Twelfth Americas Conference on Information Systems, Acapulco, Mexico August 04th-06th 2006(with risk management) the “reconfigured”investment defines the active NPVAflexibility(option 1)flexibility(option i)flexibility(option m)RRI1 RRI2 RRI3 RRI4Risk factors aremapped toalternative riskresolutioninterventions(RRI) facilitatedby the flexibilitythat  embeddedreal options offerRRI8 RRI1 RRI6 RRI3 RRI5 RRI7 RRI2… …r1 r2 r3 … rm(without risk management) the “base case”investment defines the passive NPVPRRI9Risk factorscontribute tothe varianceof the netexpectedinvestmentvalue.(compound)options 1… mcould havesynergetic orsubstitutiverelationsNPVP-RRIs’expectedcost+options’expectedvalue=NPVAOROR ORFigure 2CONCLUSIONRecognizing that software development is a value-creation activity, this research seeks to provide organizations a means tomanage IS development risk in an economically optimal manner.  The approach involves explicitly modeling the value-creation perspective within a real options framework, which is suitable for establishing the economic link between technicaldecisions made at the micro level and strategic business decisions made at the macro level.  The ongoing effort toconceptualize and formalize the risk management model using this approach is to be followed by two other steps. One is theidentification and adaptation of a suitable option valuation algorithm for solving the resulting model. The other is thedevelopment of realistic illustrations to demonstrate the economic link and its practical implication on real-world softwaredevelopment decision-making.ACKNOWLEDGEMENTSThis research was supported by a grant from the IBM Fund and the Brethen Institute for Operations Research, WhitmanSchool of Management, Syracuse University.REFERENCES1. Alter, S. and Sherer, S.A. (2004) A general but readily adaptable model of information risk, Communications of theAssociation for Information Systems, 14, 1-28.2. Amran, M. and Kulatilaka, N. (1999) Disciplined decisions: Aligning strategy with the financial markets, HarvardBusiness Review, 77, 1, 95-104.3. Barki, H., Rivard, S. and Talbot, J. (2001) An integrative contingency model of software project risk management,Journal of Management Information Systems, 17, 4, 37-69.4. Benaroch, M. (2002) Managing investments in information technology based on real options theory, Journal of MIS, 19,2, 43-84.5. Benaroch, M., Lichtenstein, Y. and Robinson, K. (Forthcoming, 2006) Real options use in IT investment riskmanagement: An empirical investigation, MIS Quarterly.6. Benaroch, M. and Kauffman, R.J. (1999) A case for using real options pricing analysis to evaluate informationtechnology project investment,  Information Systems Research, 10, 1, 70-86.7. Boehm, B. W. (1991) Software risk management: Principles and practices, IEEE Software, 32-41.8. Boehm, B. and Sullivan, K. (1994) Software economics: A roadmap, Proceedings of ICSE’2000, June 8, 2000, 321-343.9. Fairley, R.E. (1994) Risk management for software projects, IEEE Software, 1, 3. 539Benaroch and Goldstein  Integrative Economic Optimization Model - IS Development Risk ManagementProceedings of the Twelfth Americas Conference on Information Systems, Acapulco, Mexico August 04th-06th 200610. Harper, G. and Utley, D. (2001) Organizational culture and successful information technology implementation,Engineering Management Journal, 13, 2.11. Jiang, J.J., Klein, G., and Discenza, R. (2001) Information system success as impacted by risks and developmentstrategies, IEEE Transactions of Engineering Management, 48, 1, 46-55.12. Keil, M., Cule, P.E., Lyytinen, K. and Schmidt, R.C. (1998) A framework for identifying software project risks,Communications of the ACM, 41, 11, 76-83.13. Kim, Y.J., and Sanders, L.G. (2002) Strategic actions in information technology investment based on real option theory,Decision Support Systems, 33, 1– 11.14. Kumar, R.L. (2002) Managing risks in IT projects: An options perspective, Information and Management, 40, 63-74.15. Lyytinen, K., Mathiassen, L. and Ropponen, J. (1998) Attention shaping and software risk – a categorical analysis offour classical risk management approaches, Information Systems Research, 9, 3, 233-255.16. McFarlan, W. (1982) Portfolio approach to information systems, Journal of Systems Management, 33, 1, 12-19.17. Ropponen, J. (1999) Software risk management: Foundation, principles and empirical findings, Jyväskylä UniversityPrinting House, Jyväskylä.18. Schmidt, R., Lyytinen, K., Keil, M. and Cule, P. (2001) Identifying software project risks: An international delphi study,Journal of Management Information Systems, 17, 4, 5-36. 540

An Integrative Economic Optimization Model to IS Development Risk Management

https://aisel.aisnet.org/cgi/viewcontent.cgi?article=1616&amp;context=amcis2006

An Integrative Economic Optimization Model to IS Development Risk Management

Abstract

Similar works

Full text

Available Versions

AIS Electronic Library (AISeL)