How user risk and requirements risk moderate the effects of formal and informal control on the process performance of IT projects

Improving the management of information technology (IT) projects is of prime concern to both IS researchers and practitioners, as IT projects are notorious for poor process performance, frequently running over budget and behind schedule. Over the years, at least two separate streams of research have emerged with the aim of contributing to our understanding of IT project management. One of these focuses on the exercise of formal and informal controls, while another focuses on identifying and managing key risks such as those associated with requirements and users. Proponents of the control stream would argue that the exercise of formal and informal controls can improve process performance and there is some evidence that this is so. An obvious question that emerges, however, is how effective these controls are in the presence of particular risks. In this study, we seek to answer this question by developing and testing a research model that integrates these two streams of research. On the basis of data collected from 63 completed IT projects in China, we examine the moderating effects of requirements risk and user risk on the relationship between control (both formal and informal) and the process performance of IT projects. We contribute to the current state of knowledge by clearly demonstrating that both types of risk moderate the effects of formal and informal controls on performance. Specifically, both requirements risk and user risk were found to reduce the positive influence of controls on process performance, implying that implementing solid controls is a necessary, but not sufficient, condition to ensure good process performance.