Evaluation of the Effectiveness of Risk Management in the Process of Acquisition of Information Technology in Public Administrations

This research investigates the effectiveness of risk management in Information Technology (IT) acquisitions within public administrations. Despite existing regulations and the recognized importance of risk assessment in public procurement, the study highlights a persistent lack of maturity in risk management practices among public organizations. This deficiency, as evidenced by various federal accountability agencies, leads to increased costs, project delays, and the failure to achieve institutional objectives in IT projects. The literature review explores academic studies on risks in IT contracts, focusing on public procurement. It examines models and approaches to risk management, including supplier selection, contract continuity, and the development of systematic methodologies for managing risks in public sector IT acquisitions. The research emphasizes the critical need for effective risk management to ensure the success and efficiency of public IT procurements, given their complexity and financial relevance. The study evaluates whether normative frameworks developed over a decade in Brazil effectively influence managers’ decisions and foster the creation of robust risk treatment mechanisms. Specifically, it analyzes IT acquisition processes to determine if risk analysis genuinely impacts decision-making, leading to the implementation of controls such as contractual clauses or documented managerial actions. To achieve this, an evaluation instrument was developed, validated through focus groups with experts from oversight bodies, and applied to a sample of 100 ICT procurement processes from ten federal agencies. The data were analyzed using Self-Organizing Maps (SOM), enabling the calculation of a Quality Index and a Consistency Index. The results revealed low maturity in risk management practices, with evidence that risk analyses are often performed merely as formal compliance, without effectively influencing decision-making. The study contributes by providing an instrument for assessing the effectiveness of risk management in ICT procurement, supporting oversight bodies and managers in strengthening governance practices.