Understanding The Relationship Between Risks And Controls In Erp Implementations: You Can Choose Your Friends But Not Your Relatives

Enterprise Resource Planning (ERP) systems have been in existence for over 2 decades yet businesses are still losing billions of dollars annually due to the implementation of software designed to reduce costs and increase profitability. Risk Management is an area that contributes to these losses, specifically due to uncertain outcomes when dealing with an interconnected construct such as risk, and a research gap at the tactical and operational levels between risks and controls. A comparative case study approach, encompassing 13 different ERP implementations, was adopted to explore emerging patterns at the project implementation level, and from this two contributions emerged. After observing risks behaving in a hierarchical fashion with predictable results, an exploratory Hierarchy of Risks model was constructed. Although this model is still in its formative stage, it may prove useful in furthering our understanding of the close inter-relationship of risks in ERP implementations and the implications of managerial choice when determining risk prioritisation. A second finding is that no direct linear relationship appears to exist between risks and controls. Rather, this counterintuitive finding suggests that it is impacts as a consequence of risk, rather than the risks which cause the impacts, which allows these constructs to be bridged.