Is Complexity Theory Right that Bigger Is Riskier? Evidence from Information Technology
Ajazi, Nickelsen, Schmidt, Flyvbjerg & Christodoulou

Overview

Conventional project management wisdom assumes that larger IT projects are inherently more risky because they involve greater complexity, more stakeholders, and stronger interdependencies. This study challenges that assumption using one of the world’s largest empirical datasets of completed IT projects.

The authors analyzed 5,094 IT projects (cost performance) and 831 projects (schedule performance) from 64 countries, covering software development, ERP, BI, cybersecurity, and other IT initiatives. Their conclusion is striking:

Project size is not a reliable predictor of project risk. In fact, the smallest IT projects exhibit the highest cost risk, while schedule risk shows no consistent increase with project size.

---

Research Objectives

The study tested two widely accepted hypotheses:

• H1: Larger IT projects experience greater cost overruns.
• H2: Larger IT projects experience greater schedule overruns.

Project size was measured by the approved project budget at the Final Investment Decision (FID), while project risk was measured by:

• Cost overrun (Actual Cost / Estimated Cost)
• Schedule overrun (Actual Duration / Planned Duration)

---

Key Findings

1. Smaller Projects Are Not Safer

Contrary to conventional belief, very small projects demonstrate the highest average cost overruns.

Project Size	Average Cost Overrun
Very Small	192%
Small	53%
Medium	42%
Large	42%
Very Large	57%

The statistical analysis found no evidence that increasing project size leads to higher cost risk. Instead, the smallest projects performed significantly worse than all other groups.

---

2. Schedule Overruns Do Not Increase with Project Size

The analysis of schedule performance also rejected the traditional assumption that larger projects are more likely to finish late.

Project Size	Average Schedule Overrun	Projects with >50% Delay
Very Small	37%	20.4%
Small	30%	21.7%
Medium	75%	43.4%
Large	67%	44.0%
Very Large	26%	33.1%

Although medium and large projects showed higher average delays, statistical testing found no consistent upward trend between project size and schedule risk. Very large projects actually demonstrated the lowest average schedule overrun.

---

3. IT Project Risk Has “Fat Tails”

A major contribution of the paper is confirming that IT project overruns follow fat-tailed (power-law) distributions.

This means that:

• extreme overruns are not rare exceptions;
• catastrophic outcomes occur much more frequently than predicted by traditional risk models;
• conventional approaches based on normal distributions systematically underestimate project risk.

Importantly, this characteristic applies to projects of every size, although it is strongest among the smallest projects.

---

Why Are Small Projects More Risky?

The authors suggest several explanations:

• Small projects often receive less executive attention and governance.
• Organizations frequently assign less experienced teams to smaller initiatives.
• Risk management processes are typically less rigorous for projects below predefined budget thresholds.
• Cognitive biases (such as the Dunning–Kruger Effect and Uniqueness Bias) contribute to underestimating project complexity and organizational capability.

---

Practical Implications

The findings challenge several common project management practices:

• Budget should not be used as the primary indicator of project risk.
• Small IT projects require the same level of governance and risk assessment as larger initiatives.
• Organizations should evaluate project risk based on team capability, organizational maturity, technical complexity, and uncertainty, rather than project size alone.
• Risk management frameworks should explicitly account for fat-tailed risks, recognizing that extreme overruns are an inherent characteristic of IT projects rather than statistical anomalies.

---

Conclusions

The study fundamentally challenges the long-standing assumption that “bigger means riskier” in IT project management. Instead, it demonstrates that all IT projects carry substantial risk, while small projects are often the most vulnerable to severe cost overruns.

For practitioners, the key lesson is clear: project governance should be driven by risk characteristics rather than budget size. Organizations that automatically devote greater oversight only to large projects may inadvertently overlook the projects most likely to fail.

Original article