A FRAMEWORK FOR CLASSIFYING RISKS IN ERP

MAINTENANCE PROJECTS

Cristina Lopez and Jose L. Salmeron

School of Engineering, University Pablo of Olavide, Ctra. Utrera, Km. 1, 41013, Seville, Spain

Keywords: ERP system, Software maintenance, Risk factors, Framework.

Abstract: Enterprise resource planning (ERP) is one the most common applications implemented by firms around the

world. These systems cannot remain static after their implementation, they need maintenance. This process

is required by the rapidly-changing business environment and the usual software maintenance needs.

However, these projects are highly complex and risky. So, the risks management associated with ERP

maintenance projects is crucial to attain a satisfactory performance. Unfortunately, ERP maintenance risks

have not been studied in depth. For this reason, this paper presents a framework, which gathers together the

risks affecting the performance of ERP maintenance.

1 INTRODUCTION

ERP systems are defined as a single software system

allowing the complete integration of information

flow from all functional areas in companies by

means of a single database and accessible through a

unified interface and channel of communication

(Davenport, 1998; Jacobs and Whybarck, 2000; Ng

et al., 2003).

Companies have spent billions of dollars in ERP

implementation. However, ERP projects are never

finished: after the implementation process, the

maintenance starts. Firms must manage

organizational performance with ERP, fixing bugs,

adapting ERP to unstable environments, supporting

new user requirements, and so on. To achieve the

ERP maintenance’s expected results, the ERP and

the business process have to be completely aligned.

If this fails, it will have more damaging

consequences.

An ERP maintenance project is considered

successful when it is completed within time and

budget and meets ERP users’ expectations (Aloini et

al., 2007) without damage ERP performance. Poor

risk management of ERP maintenance projects often

leads to failure, which can affect the system and the

project outcome (Wallace et al., 2004). However,

ERP maintenance failures can be prevented if the

maintenance team manages risks projects properly.

In contrast, ERP maintenance risks research is

scarce in the literature. In fact, the literature only

brings together three risks in the maintenance phase

and these derive from insufficient and inappropriate

personnel. Specifically, these three risks are:

“insuficient training and reskilling of the IT

workforce in new technology”, “insuficient

‘internal’ expertise” and “failure to mix internal and

external expertise effectively” (Sumner, 2000).But,

there are more risk factors that affect successful ERP

maintenance projects.

To support the professionals’ work, we have

realized a formal study about risks which threaten

the ERP maintenance process. Specifically, we have

identified the risk that threatens the maintenance

process of any ERP system. Subsequently, we have

stated which ERP maintenance phase is threatened

by each risk. The results indicate where the

maintenance team must focus on treating and

mitigating the risks and threats.

2 CREATING THE FRAMEWORK

OF ERP MAINTENANCE RISKS

Different risks could affect the whole ERP

maintenance project. The risks lists for IS/IT,

software development and maintenance projects are

not completely fit to ERP maintenance because the

above frameworks are very general and do not take

into account the features of ERP systems. Therefore,

it is necessary to create an ERP maintenance risks

201

Lopez C. and Salmeron J..

A FRAMEWORK FOR CLASSIFYING RISKS IN ERP MAINTENANCE PROJECTS.

DOI: 10.5220/0003407802010204

In Proceedings of the International Conference on e-Business (ICE-B-2011), pages 201-204

ISBN: 978-989-8425-70-6

 2011 SCITEPRESS (Science and Technology Publications, Lda.)

classification. With this in mind, we followed the

steps indicated in Figure 1.

Figure 1: Steps followed in the creation of ERP

maintenance risks framework.

Similar studies have used a variety of

methodologies to identify risks. A critical literature

review is a widely-used methodology in the

literature. Steps 1, 2 and 3 are based on a broader

literature review of software risk management. In

step 1, we find papers about software development,

software maintenance, IS/IT projects and the ERP

projects which identify and/or classify risk factors.

To do so, we consulted through databases such as

IEEE-Xplore, ScienceDirect, Emerald Management

Xtra., SpringerLink databases, among others. The

criteria followed to select papers were:

1. The studies have to contain the term "Risk

Management" in the title, abstract or keywords.

2. The studies have to contain one of the following

expressions in the title, abstract or Keyword:

"Project IT/IS", "Software Development",

"Software Maintenance" or "ERP".

3. The studies have to identify the risks clearly.

4. The time horizon was not limited. Thus, all

target studies were collected and reviewed.

Altogether 20 papers (Aloini et al., 2007; Batista

et al., 2005; Boehm, 1991; Chen and Huang, 2009;

Cule et al., 2000; Dekleva, 1992; Han and Huang,

2007; Huang et al., 2004; Houston et al., 2001; Keil

et al., 1998; Lientz and Swanson, 1981; Lu and Ma,

2004; Mursu et al., 2003; Peng and Nunes, 2009;

Scott and Vessey, 2002; Sherer, 1995; Sumner,

2000; Wallace et al., 2004a; Wallace et al., 2004b;

Zhou et al., 2008) were found in the search. The sum

of all risks identified in these studies added up to

681 risks. However, many risks are identified by

several papers. So, in step 2, the risks factors were

checked removing duplicates. The result was a list

made up of 313 risks. In step 3, we eliminated those

risks which do not affect ERP maintenance. For this

purpose, we carefully analyzed the activities address

to perform the changes required in the ERP system

and the risks included in the list together. The

preliminary list was made up of 25 risks. These were

renamed and adapted to the study’s scope.

Given the absence of studies on ERP

maintenance risks, it was possible that the

preliminary list of risks did not bring together all

ERP maintenance risks. Moreover, the list had not

been validated. So, we consulted 9 ERP maintenance

experts. The optimal number of experts depends on

the characteristics of the study itself. We can,

however, say that the greater the heterogeneity of the

group, the fewer is the number of experts

recommended, 9 being a good size (Okoli and

Pawlowski, 2004). The main selection criterion

considered was recognized knowledge in the

research topic and an absence of conflicts of interest.

Figure 2 shows the profile of consulted experts.

Figure 2: Experts profile.

In step 4, the experts checked the preliminary list

and added 5 further risks. Thus, we obtained the list

of ERP maintenance risks. In steps 5 and 6, the risks

brought together in the list were categorized. This

consists of grouping the risks identified according to

their characteristics. The dimensions have been often

fixed depending on the factor that causes the risks.

Notwithstanding, it is also important to know what

the risks affect.

The aim of this stage is to identify the risks that

threaten the process of the ERP maintenance.

Therefore, it is useful to classify them according to

the process stage that is most likely to affect the

risks identified. In other words, each risk was

classified in the maintenance stage whose

performance is threatened by it. To do so, in step 5

we classified the risks, according to the IEEE std.

1219 (IEEE, 1998). The result was a preliminary

framework of ERP maintenance risks. Finally, in

step 6, ERP maintenance experts reviewed and

corrected the abovementioned preliminary

framework. When all experts accepted it, we

obtained the ERP maintenance risks framework.

ICE-B 2011 - International Conference on e-Business

202

3 FRAMEWORK OF ERP

MAINTENANCE RISKS

Table 1 presents the framework created of ERP

maintenance risks. No previous research have

established a framework in which ERP maintenance

risks are classified depending on the process phase

whose performance can be affected. This result

allows professionals to understand the situation

better and to take action on every risk group.

4 CONCLUSIONS

In recent decades, companies across the world have

implemented ERP systems. Proper ERP

implementation has been a much explored issue.

Specifically, numerous papers have presented the

critical success factors in these projects. But even

when the implementation finished satisfactorily,

success in ERP adoption is not guaranteed. It also

depends on the effectiveness process in the post-

implementation ERP systems.

The maintenance of the ERP is necessary to

correct and prevent systems failures as well as to

enhance its performance and adapt continuously to

the system. Nevertheless, this is often managed

intuitively and without taking into account the

existing risks. In contrast, risks management in IT

projects is a common practice because it decreases

failure probability. In this sense, the managers need

to know what risks threaten their maintenance

projects. In spite of this, the risks that affect the

maintenance of ERPs have not been studied

previously.

Given this gap existing in the literature and the

professional needs, the aim of this research was to

identify the risk factors that threaten ERP

maintenance performance. With this in mind, we

devised a framework. It contains 30 risks factors

classified according to the maintenance phase that

they influence.

The findings of this study can also help the

professional to achieve effective risk management in

the whole ERP maintenance. But they should obtain

more information about the risk in this purpose.

Specifically, the professionals need to know which

risks are critical, medium or marginal. To do this,

we think that, in future studies, aspects of critical,

medium and marginal risks of ERP maintenance

should be identified. On the other hand, the

professionals also need to know how the risks arise.

In this sense, we believe that studies about the ERP

maintenance risks dimensions are also necessary.

Table 1: Framework of ERP maintenance risks.

PHASE RISK

Problem/

modification

identification,

classification

and

prioritization

Unstable organizational environment

Conflicting ERP requests

Continuing stream of requirement changes

Inadequate requirements prioritization

Wrong management/selection/control

external parties (consultants, ERP vendors,

subcontractors)

ERP system users are reluctant/reticent to

the changes

Analysis Evaluation of performance requirements

Inadequate ERP maintenance manager

Wrong ERP project resources/size

estimates

Wrongly-fit ERP system with pre-existing

applications

Design Miscommunications or misunderstanding

of the requirements

Conflict and non-cooperation between

ERP maintenance team members

Team members lack skills/

knowledge/experience required by ERP

maintenance

Short/null/poor/documentation

Incorrect choice of the ERP modules

Specific competence of ERP consultants

Implementation Changing structure/processes/ tasks ERP-

adopting organization

High turnover within ERP maintenance

team

ERP maintenance team members are

unmotivated/ not committed

Inadequately-trained ERP maintenance

team members

Quality of original programming

Poor establishment of standard process/

procedures /methodology

ERP project milestones not clearly defined

Excessively-complex procedures

Regression

system testing

Inadequate measurements/

tools/technology for test/

simulation/evaluation

Lack of proper tests

Acceptance

testing

Managers and/or employees do not

cooperate the maintenance project

Poor establishment of ERP quality

standards

Delivery Lack of training of ERP users

Poor documentation for support of ERP

users

A FRAMEWORK FOR CLASSIFYING RISKS IN ERP MAINTENANCE PROJECTS

203

ACKNOWLEDGEMENTS

The authors wish to thank the Spanish Ministry of

Science and Technology (MICINN-ECO2009.

12853) and the Andalusian Regional Government

(CICE-P07-SEJ-03080) for their financial support.

REFERENCES

Aloini, D., Dulmin, R., Mininno, V. (2007). Risk

management in ERP project introduction: Review of

the literature. Information & Management, 44(6), 547-

567.

Batista, K.P. de Olivera, K. M., Anquetil, N. (2005). A

risk taxonomy proposal for software maintenance. In:

21st IEEE International Conference on Software

Maintenance, Budapest, pp. 453-461.

Boehm, B. W. (1991). Software risk management:

principles and practices. IEEE Software, 8(1), 32-41.

Chen, J.-C., Huang, S.-J. (2009). An empirical analysis of

the impact of software development problem factors

on software maintainability. The Journal of Systems

and Software, 82(6), 981–992.

Cule, P., Schmidt, R., Lyytinen, K., Keil, M. (2000).

Strategies for Heading Off is Project Failure.

Information Systems Management, 17(2) 1-9.

Davenport, T. H. (1998). Putting the enterprise into the

enterprise system. Harvard Business Review, 76(4),

121-133.

Dekleva, S. (1992). Delphi study of software maintenance

problems. In: Conference on the Software

Maintenance, pp. 10-17.

Han, W.-M., Huang, S.-J. (2007). An empirical analysis of

risk components and performance on software

projects. The Journal of Systems and Software, 80(1),

42-50.

Houston, D. X., Mackulak, G. T., Collofello, J.S. (2001).

Stochastic simulation of risk factor potential effects

for software development risk management. The

journal of Systems and Software, 59(3), 247-257.

Huang, S-M., Hang, I.-C., Li, S-H., Lin, M-T. (2004).

Assessing in ERP projects: identify and prioritize the

factors. Industrial management & data systems, 8(8),

681-688.

IEEE, 1998. IEEE Standard 1219 for Software

Maintenance. Institute of Electrical and Electronic

Engineers, New York.

Jacobs, F. R., Whybarck, D. C. (2000). Why ERP? A

primer on SAP implementation. McGraw-Hill, New

York.

Keil, M., Cule, P., Lyytimen, K., Schmidt, R. (1998). A

framework for identifying software project risk.

Communications of the ACM, 41(11), 76-83.

Lientz, B. P., Swanson, E.B. (1981). Problems in

application software maintenance. Communications of

the ACM, 24 (1) 763-769.

Lu, X. N., Ma, Q. C. (2004). Risk analysis in software

development project with owners and contractors. In:

Engineering Management Conference, pp. 789-793.

Mursu, A., Lyytinen, K., Soriyan, H. A., Korpela, M.

(2003). Identifying software project risks in Nigeria:

an International Comparative Study. European

Journal of Information Systems, 12(3), 182–194.

Ng, C. S. P., Gable, G. G., Chan, T. (2003). An ERP

maintenance model. In: 36th Annual Hawaii

International Conference on System Science, Hawaii,

pp. 1-10.

Okoli, C., Pawlowski, S. (2004). The Delphi method as a

research tool: an example, design considerations and

applications. Information & Management, 42(1), 15-

29.

Peng, G. C., Nunes, M. B. (2009). Identification and

assessment of risks associated with ERP post-

implementation in China. Journal of Enterprise

Information Management, 22(5), 587-614.

Scott, J. D., Vessey, I. (2002). Managing Risks in

Enterprise Systems Implementations. Communications

of the ACM, 45(4), 74-81.

Sherer, S. A. (1995). The three dimensions of software

risk: technical, organizational, and environmental. In:

Hawaii International Conference, Hawaii, pp.

369-378.

Sumner, M. (2000). Risk factors in enterprise-wide/ERP

projects. Journal of Information Technology, 15(4),

317-327.

Wallace, L., Keil, M., Arun, R. (2004a). How software

project risk affects project performance: an

investigation of the dimensions of risk and an

exploratory model. Decision Sciences, 35(2), 289-321.

Wallace, L., Keil, M., Rai, A. (2004b). Understanding

software project risk: a cluster analysis. Information &

Management, 42(1), 115-125.

Zafiropoulos, I., Metaxiotis, K., Askounis, D. (2005).

Dynamic risk management system for the modeling,

optimal adaptation and implementation of an ERP

system. Information management & Security, 13(3),

212-234.

Zhou, L., Vasconcelos, A., Nunes, M., 2008. Supporting

decision making in risk Management through an

evidence-based information Systems Project risk

checklist. Information Management & Computer

Security, 6 (2) 166-186.

ICE-B 2011 - International Conference on e-Business

204