Stop Guessing, Start Governing: A Guide to De-Risking IT Capital Allocation 

Written By Nicolas Landry

Over the years, IT has evolved from a back-office utility into a core driver of corporate strategy and operations. The same systems that enable business processes, efficiencies, and competitive advantage also introduce severe financial and operational risk. Despite decades of project management maturity, IT projects continue to experience chronic cost and schedule overruns.

Enterprise technology investments are among the most capital-intensive undertakings in the modern business environment. Empirical research confirms that IT project risk is structurally unique, characterized by extreme outliers. This volatility exposes organizations to "fat-tail" risks, where runaway projects may exceed budgets by over 200% and delay schedules by nearly 70%, significantly impacting return on invested capital (ROIC).

A core driver of these poor outcomes is the reliance on "bottom-up" estimation, which often ignores cognitive biases and overconfidence. To mitigate this systemic exposure, we recommend the implementation of Reference Class Forecasting (RCF). RCF de-biases decision-making by positioning prospective projects within a distribution of comparable, completed initiatives to derive risk-adjusted budgets and schedules.

The Uniqueness of IT Cost Risk

A 2025 study in the Project Management Journal by Flyvbjerg et al. analyzed 11,011 projects, demonstrating that IT initiatives carry higher cost risks than any other category analyzed, including nuclear power and nuclear waste disposal. Leaders must address three primary risk factors when prioritizing IT capital:

  1. Infinite Structural Risk: IT cost overruns follow a Pareto 1 distribution, meaning potential losses are structurally infinite and cannot be mitigated by simple average contingency funds.

  2. Expected Regression to the Tail: Catastrophic cost overruns are statistically inevitable over a sufficiently large portfolio of projects.

  3. The Statistical Gap: While half of the IT projects in the sample did not experience a cost overrun, the mean cost overrun was 73% over budget. About 20% of the projects had a cost overrun greater than 50%, and the mean overrun of that group was 453%. 

So why is IT so different from other disciplines? Research identifies four variables that drive this unique IT risk profile:

  1. Technical Immaturity: Rapidly evolving methods and capabilities often lack the stability of established engineering disciplines.

  2. Intangibility: Software and digital work are harder to see, measure, and validate than other types of physical work, such as construction, engineering, or manufacturing projects.

  3. Goal Ambiguity: Requirements are frequently subject to shifting organizational priorities and politics.

  4. Stakeholder Resistance: IT changes how people work, so adoption risk needs to be built into the project. 

One more interesting finding of the study is how project duration acts as a compounding risk factor for IT projects. Every additional year of project duration increases the average cost risk by 4.2 percentage points (for public sector environments) or by 15% (for large corporate enterprise environments). Projects scheduled to last longer than 24 to 30 months face extreme variability because a longer schedule opens a wider window for cascading failures, shifting stakeholder requirements, and team turnover.

Cognitive Bias and the Planning Fallacy

The "planning fallacy," documented by Kahneman and Tversky, describes the systemic tendency to underestimate time and costs while overestimating benefits. This bias persists even among highly skilled planners due to optimistic internal narratives and political pressure to present attractive business cases.

So what does the planning fallacy look like in reality? 

“Here is our team.”

“Here is our plan.”

“Here is what we are going to do.”

“This should take nine months.”

“Our team is strong and experienced.”

“We learned from the last project.”

“It will be different this time.”

Sound familiar? 

Applying RCF to the Organization

Applying RCF to the organization is a project in itself. After getting alignment between IT and operational leaders, the general project milestones should be:

  1. Establish a steering committee and build governance around general decision-making, ownership, and the organization’s risk appetite.

  2. Extract cost, schedule, and other relevant data on completed projects from the organization’s PPM system, and build out the reference class categories that are relevant to the organization.   

  3. Train and upskill project planners, capital allocators, project managers, and finance on RCF methodologies.

  4. Pilot RCF to 10 projects. 

  5. Scale out RCF to the rest of the organization.  

Applying RCF at the Project Level

There are three actionable steps to put RCF into practice. They are:

Find the Right Historical Benchmarks

Identify past projects that are structurally similar to your proposed project. Do not just stop with general attributes like software or infrastructure. Look at projects with the same level of system dependencies or integration points. Other things to consider are the experience and skill of the project team (including the project sponsor), the level of change, and how “changeable” the organization or business unit is that received the change.

Measure the Real Risk 

You must look beyond your team’s bottom-up estimate and analyze the historical cost overruns of your reference projects. Since IT projects carry unique risk, simply using an average overrun percentage is insufficient. To measure the real risk, you must:

  1. Collect All Data: Gather the actual cost overrun/underrun percentage for every single structurally similar project you have completed. It is crucial to include all projects that came in under budget, on budget, and those that went catastrophically over budget.

  2. Order the Outcomes: Sort this entire data set from the smallest cost underrun (best performance) to the largest cost overrun (worst performance).

  3. Find the P80 Point: The P80 value is the specific cost overrun percentage where 80% of all past projects (the entire list) finished at or below that percentage. This is your required financial multiplier to apply to the team’s bottom-up estimate.

Set a Safety Buffer   

The P80 percentage derived from your historical data is the mandatory financial adjustment you must apply to account for planner bias and fat-tail risk.

  1. Define Risk Appetite: Leadership must formally commit to a risk appetite (e.g., P80). This means they accept a 20% statistical chance that the final project cost will exceed the budget.

  2. Apply the Multiplier: Apply the P80 percentage as a non-negotiable uplift factor to the project team’s original project estimate.

  3. Determine Project Viability: The resulting risk-adjusted budget is the project's true estimated cost. This figure, and not the original bottom-up estimate, dictates whether the project is financially viable and where it sits in the funding pipeline.

Example: Applying the P80 Uplift

Original Project Estimate: $100 Million

Reference Class P80 Uplift: 32% Overrun (80% of all similar projects cost 32% or less above the original estimate)

Risk-Adjusted Budget (P80): $100M × (1 + 0.32) = $132 Million

If the organization's available capital for this project is only $105 million, the project is not funded at P80 risk level and must be redesigned, broken down, or deprioritized. Projects requiring excessive uplifts (P90 or P95) to meet the risk standard must be flagged as high-risk and moved lower in the funding pipeline.

RCF fundamentally transforms capital allocation from an optimistic hope into an empirical discipline. Through bias mitigation, RCF provides capital allocators with an objective financial risk appetite that is grounded in historical reality rather than internal optimism. This immediately clarifies two critical elements: (1) the true cost required to mitigate the systemic, fat-tail risk inherent in IT projects; and (2) the actual value of a proposed initiative. Any project that fails to yield a sufficient return over the risk uplift is an inferior allocation of capital. For business decision-makers, RCF serves as a powerful mechanism to ensure that resources are prioritized based on the value delivered. Adopting RCF is not just a forecasting exercise, but a strategic governance that shields the enterprise from chronic variance and ensures every dollar invested in technology is a fiscally responsible decision.

References

Nicolas Landry https://www.northridgeadvisorygroup.com/
Next

From Project Management to Predictive Leadership: How AI will Change the Way Work Gets Done