Discuss the following:
Q1. Have we established suitable criteria and procedures for evaluating the risk of IT projects? Are these criteria and procedures effective in communicating this risk to management?
Q2. Do we have project planning, tracking, and control processes that accommodate different degrees of project risk?
Q3. Are we using adaptive approaches appropriately for project that entail high requirements volatility or other sources of uncertainty? Do we have processes in place that will allow us to learn and adjust during the duration of a project?
Q4. Is the overall risk of our project portfolio a good fit with our business objectives and strategies?