“…The premise of the factor-based approach to IS risk management is that risks are entities that can be identified and defined prior to the commencement of a project; that they are time and context independent, and that the nature and attributes of such risks remain static throughout the lifetime of a project. Such a 'factor-based' approach to risk management, has been widely adopted (Barki et al, 1993, Dagher and Kuzic, 2011, Kappleman et al, 2006, Tiwana and Keil, 2004, nevertheless the approach overlooks the emergent nature of risks (Leonard, 2012, Wright andCapps, 2010).…”