The implementation of enterprise resource planning (ERP) is an intrinsically high-risk endeavor. Many critical business processes spanning several areas within an organization are drastically changed, requiring new capabilities, multiple data migrations, and complex interfaces with enterprise legacy systems. Surprisingly, ERP risk management literature is rare, and does not correspond to the ubiquitous presence of ERP transformation projects in the last 20 years in major corporations around the world. Therefore, a paper covering risk management in information technology (IT) projects, such as this one by three authors from the University of Pisa, is always welcome.

The main focus of the paper is on proposing a systemic approach for ERP project risk classification based on a matrix relating two orthogonal dimensions: risk dependence and risk driving power. Each risk factor affecting an ERP project is plotted in one of the four quadrants of this matrix, and therefore is classified in one of the four risk groups: independent (high driving power/low dependence), autonomous (low driving power/low dependence), linkage (high driving power/high dependence), and dependent (low driving power/high dependence). From a case study, the authors defined 19 ERP project risk factors; after deploying each of them in the matrix, the paper ultimately presents a cause-effect relationship graph.

The risk classification matrix represents an interesting perspective for practical ERP project risk management. It shows that independent and autonomous risks, such as low top management involvement and ineffective consulting service experiences, are the root cause of all other risk factors and therefore should receive greater focus within the risk management process.

Having worked the last 23 years on ERP projects, I was very pleased with the list of risks derived from the case study. It is very complete, very well described, and could be used by the reader as a reference checklist for effective risk assessment in real ERP project implementations. However, the risk matrix classification should not mislead the reader to prioritize independent or autonomous risks over linkage or dependent risks. In fact, all produce equally high risk exposure, and the way to properly manage them is to make sure the mitigation actions envisioned for the former will not only address their intrinsic risks, but will also positively and directly contribute to mitigating the latter risks (that is, linkage and dependent risks). This risk cause-effect relationship is a great contribution made by this paper, since it provides specific guidelines for shaping risk mitigation actions, especially for broad-spectrum risk factors. For example, the independent risk of low top management involvement should be shaped to promote enterprise conformance to ERP processes (or minimum functional gap, in ERP project jargon) in a way that mitigates the dependent risk of inadequate business process reengineering.