The impact of cultural practices on the outcome of IT risk management implementation

Purpose The objectives of this research are two-fold. The first is to explore, describe and explain the relevance of the concept of Information Technology risk management (ITRM) implementation processes. In this regard, we were required to understand the interaction between contextual issues, the ITRM framework itself, IT individual interpretations toward them and their effect on implementation. The second objective is to develop a theoretical model for use in guiding the design and analysis of the proposed empirical work. The study introduces a fresh perspective to an established research area. It is argued that without more emphasis on the dynamic nature of the implementation process, an incomplete understanding of the problem will result. Design/methodology/approach The study adopts an interpretive methodology to a multiple case study design gathering and analysing qualitative evidence. A series of three case studies was designed around 22 semi-structured in-depth interviews conducted to investigate IT individuals’ role in facilitating a successful ITRM implementation. Findings The findings provide new insights in relation to ITRM implementation by considering IT individual culture. The research develops a substantive theory involving a schematic model involving a set of theoretical propositions. These findings suggest a dynamic approach to implementing IT risk management framework — one that considers the interaction over time of intentions, context, process and action around risk management frameworks. Research limitations/implications This study makes important theoretical contributions to the understanding of organizational implementations by taking a dynamic view of implementation, identifying different individual IT culture archetypes, emphasizing the role of social aspects and developing a set of key factors and contextual conditions. Practical implications This model offers managers an understanding of how IT individual culture and the factors and contextual conditional work together over time to ensure a successful ITRM implementation. Meanwhile, it sheds some light on how managers treat IT individuals with different levels of experience differently. Originality/value We theorize IT individual culture and the factors and contextual conditional and show their effects on ITRM implementation success, thus making an essential contribution to the information systems and implementation research and practice. Moreover, we provide a novel methodology to conceptualize ITRM implementation as a cultural process through which IT people socially construct the meanings and purposes of their work activities. This research answers scholars’ call to construct more accurate explanations of innovation outcomes in an increasingly IS implementation world.