Overview of risk management methodologies and standards in IT projects, programmes, and portfolios

Abstract

The study aimed to systematise existing risk management methodologies and identify theoretical provisions regarding their potential suitability for IT projects. To achieve this goal, a comparative analysis and theoretical assessment of the high-level characteristics of risk management methodologies in IT projects were used. The comparative analysis revealed the features of the most commonly used risk management methodologies: ISO 31000:2018 was characterised by a high level of versatility; Project Management Body of Knowledge (PMBoK) and Risk Management in Portfolios, Programs, and Projects: A Practice Guide had a high degree of detail; Projects IN Controlled Environments (PRINCE2) was formal in nature, while Enterprise Risk Management (COSO ERM) was conceptual; Factor Analysis of Information Risk (FAIR) and Factor Analysis of Information Risk Artificial Intelligence Risk (FAIR AIR) focused heavily on the use of quantitative risk assessment tools; and “NIST Special Publication 800-37. Revision 2. Risk Management Framework for Information Systems and Organisations: A System Life Cycle Approach for Security and Privacy”, “NIST AI 100-1. Artificial Intelligence Risk Management Framework (AI RMF 1.0)” and “NIST AI 600-1. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile” ensured risk management in projects based on the use of artificial intelligence. The results of comparative analysis and research into the practical application of individual methodologies can be used to select the optimal methodology in a specific context.