Which risk is the risk that IT projects take longer than expected?

• A. Threat event
• B. Schedule risk
• C. Resource (IT)
• D. Vulnerability assessment/analysis

Answer: (B)

Schedule risk is the risk that IT projects will not finish within the planned timeline. In IT, timing is crucial because delays push out milestones, increase costs, and can delay the realization of benefits. This type of risk arises when estimates are optimistic, the actual work is more complex than expected, or there are delays in dependencies on other teams, vendors, or regulatory approvals. Managers mitigate it by understanding the critical path, adding buffers, and adjusting scope or resources as needed to keep the schedule on track. The other options refer to different concerns: threat events are security incidents that could harm operations; vulnerability assessment/analysis is about identifying weaknesses; and resource risk is about shortages of people, equipment, or funds. Therefore, the risk described as taking longer than expected specifically points to schedule risk.