A culture of fatalism in IT projects? The curious case of the (lack of) risk management