Sam Thomas

Bhasi Marath

An Integrative Model Linking Risk, Risk Management and Project Performance: Support from Indian Software Projects

Keywords: Risk, Risk management, Project Outcome, Software project in India, Structural Equation Modeling

Software development organizations across the globe are concerned about the high rate of project failures. Two constructs which are hypothesized to have significant impact on project outcome are risk and risk management. Risk points to an aspect of a development task, process or environment which, if ignored, tends to adversely affect the project performance. Risk management is defined as the mechanism for identifying, addressing and eliminating software risk items before they become threats to project success. Based on the data collected from 527 software development projects in India, this research develops an integrated model linking these three constructs. Structural Equation Modeling was used to develop and validate the models. The models show how the impact of risk management on project outcome may be mediated by risk.

Introduction

Research on software project risk and project outcome has attracted attention among academicians and practitioners all over the world. One of the reasons why this topic remains relevant across time is that the failure rate continues to be very high among software projects. The latest "chaos" report (2011) from Standish Group research shows that 66% of projects are either "challenged" or downright failures, leaving 34% of projects to be considered successful. Jørgensen and Moløkken-Østvold (2006) suggest that failure rates for software development projects could be up to 85%. As software companies continue to invest time and resources into the development of software, how software development problems and failures can be minimized continues to be a focus area.

Most of the researchers on software project risk broadly agree on a two-step approach to managing risk: risk assessment and risk control. Risk assessment involves identifying, analyzing and prioritizing the risk factors that are likely to compromise a project's success, and risk control involves acting on each risk factor in order to eliminate or control it ( [START_REF] Boehm | Software risk management: Principles and practices[END_REF][START_REF] Charette | Software engineering risk analysis and management[END_REF]Lyytinen et.al, 1998;[START_REF] Wallace | Understanding Software Project Risk: A Cluster Analysis[END_REF], Keil et al., 2008, Wen-Ming Han, 2007). Literature review shows that the past research on software project risk has mainly focused on:

(a) Risk identification and assessment [START_REF] Mcfarlan | Portfolio approach to information systems[END_REF]Barki et al., 1993;[START_REF] Neumann | Computer related Risks[END_REF][START_REF] Keil | Framework for identifying software project risks[END_REF][START_REF] Lyytinen | Attention shaping and software risk -A categorical analysis of four classical risk management approaches[END_REF][START_REF] Ropponen | Components of software development risk: how to address them? A project manager survey[END_REF]Schmidt et al., 2001;[START_REF] Wallace | Understanding Software Project Risk: A Cluster Analysis[END_REF][START_REF] Tiwana | The One-Minute Risk Assessment Tool[END_REF][START_REF] Cuellar | A framework for ex ante project risk assessment based on absorptive capacity[END_REF][START_REF] Costa | Evaluating software project portfolio risks[END_REF] (b) Risk management strategies for project performance improvement [START_REF] Alter | Managing Uncertainty in MIS Implementation[END_REF][START_REF] Boehm | Software risk management: Principles and practices[END_REF][START_REF] Fairley | Risk management for software projects[END_REF][START_REF] Powell | Risk Management for Information Systems Development[END_REF][START_REF] Keil | Framework for identifying software project risks[END_REF][START_REF] Barki | An integrative contingency model of software project risk management[END_REF]Barki & Rivard, 2003;[START_REF] Jiang | Information system success as impacted by risks and development strategies[END_REF][START_REF] Iversen | Managing risk in software process improvement: an action research approach[END_REF][START_REF] Taylor | Risk management and problem resolution strategies for IT projects: prescription and practice[END_REF]Camprieu et al., 2007;Keil et al., 2008) ( c) Relationship between risk and risk management (Kirsch,1996;[START_REF] Ropponen | Components of software development risk: how to address them? A project manager survey[END_REF]Jiang et al,2000;Barki et al,2001;Addision and Vallabh,2002) (d) Link between risk and project performance [START_REF] Nidumolu | The Effect of Coordination and Uncertainty on Software Project Performance: Residual Performance Risk as an Intervening Variable[END_REF]Jiang & Klein, 1999;[START_REF] Na | Uncertainty profile and software project performance: A cross-national comparison[END_REF][START_REF] Wallace | Understanding Software Project Risk: A Cluster Analysis[END_REF]Han & Huang, 2007;Na et al., 2007) Most of the previous research takes an isolated view of software project risk and risk management strategies. Empirical evidence on the relationship between risk, risk management and project outcome is rare. Arguments are largely based on theory or case studies. Yet, this is an important step for advancing our knowledge on software project risk. Most of the projects will have risk management strategies adopted from the beginning of the project. But risk factors continue to exist in the project. What defines the project success will be the combined impact of the risk factors present and the effectiveness of the risk control strategies adopted. This can be analyzed only through an integrated study on the linkages among risk, risk management and project outcome. This can help project managers to select the needed implementation strategies to achieve their desired project outcomes.

The past research on software project risk is predominantly reported from the western world. This has been acknowledged as a major limitation of the research in this domain [START_REF] Ropponen | Can software risk management improve system development: An exploratory study[END_REF]Schmidt et al., 2001;Shan Liu et al., 2009). Whenever research was conducted in emerging economies, particularly where crosscultural research indicates likely differences in behavior or practices, differences were observed in software development risk factors - [START_REF] Schmidt | Identifying software project risks: an international delphi study[END_REF] in USA, Finland and Hong Kong, Na et.al (2006) in Korea, Mursu (2000) in Nigeria, Mann et.al (2002) in Thailand, Shan Liu et al (2009) in China and Thomas et.al ( 2011) in India. Cultural differences can impact work related values and play a significant role in the success or failure of projects [START_REF] Hofstede | Cultures and organizations: Software of the mind: Intercultural cooperation and its importance for survival[END_REF]. There is a need for more risk related studies across varying socio-economic contexts to validate the models. Also, previous studies have looked at software projects in all types of companies without focusing on software development with only IT companies. This research is undertaken with an objective of developing insights into the linkages among risk, risk management and project outcome. Based on the data collected from 527 projects executed within the leading software development companies in India, this paper validates an integrated model linking these constructs using Structural Equation Modeling (SEM). Reliable and validated instruments were used for measuring risk, risk management and project outcome. We begin this article with a brief review of the relevant literature. Next the methodology for collecting and analyzing the data is discussed. Finally, the results of the model testing are reported and the implications of the study are discussed.

Background

The research focus on three constructs namely risk, risk management and project out come with respect to software development projects. Previous work related to these studies is briefly reviewed here.

Software project risk

A software project risk points to an aspect of a development task, process or environment, which if ignored tends to increase the likelihood of software project failure (Lyyttinen et al., 1993). Such incidents pose danger to the development of a successful project leading to inadequate software operations, software re-work, implementation difficulty, delay or uncertainty [START_REF] Boehm | Software risk management: Principles and practices[END_REF]. Barki et al. (1993) define software development project risk as the product of the uncertainty surrounding a software development project and the magnitude of potential loss associated with project failure.

The most common method for identifying the presence of risk factors has been the use of checklists. These checklists present a list of all potential risks that might be applicable in a software development project. One of the pioneering studies in this regard is the top 10 risk list of [START_REF] Boehm | Software risk management: Principles and practices[END_REF]. Barki et al (1993) tried to produce a more comprehensive list of risk factors based on the data collected from 120 ongoing projects in 75 organizations. [START_REF] Jiang | The importance of building a foundation for user-involvement in information system projects[END_REF] supplemented this study through a survey among project managers asking them to rank these risk categories in order of importance. One of the most quoted international studies on software project risk factors was conducted by [START_REF] Schmidt | Identifying software project risks: an international delphi study[END_REF] Their research developed an extensive list of risk factors through three simultaneous Delphi surveys in three different settings: Hong Kong, Finland and the United States. [START_REF] Keil | Framework for identifying software project risks[END_REF] improved upon their international Delphi study exploring the issue of IT project risk from the user perspective and compared it with risk perceptions of project managers. The study was repeated in China (Shan Liu et al., 2009) and Nigeria ( Anja Mursu ,1999) .The Software Engineering Institute (SEI)'s Taxonomy-Based Risk Identification Instrument, which contains 194 questions, is probably one of the largest checklists of software development risk factors. [START_REF] Moynihan | How experienced Project Managers access risk[END_REF] through his survey on project managers produced a huge collection (113) of risk related constructs and showed that many of the real world issues are not captured in the Barki list and the SEI list. The work by [START_REF] Ropponen | Can software risk management improve system development: An exploratory study[END_REF] contributes to the empirical studies on software development risks. [START_REF] Wallace | The development of an instrument to measure software project risk[END_REF] developed a valid and reliable measure of software project risk to study risk from a common perspective and to compare findings across studies in a more meaningful manner. [START_REF] Addison | E-commerce project development risks: Evidence from a Delphi survey[END_REF] through a Delphi study among expert practitioners identified the most important risks in the development of e-commerce projects. IT implementation risk and its impact on the organization have been stressed by many researchers [START_REF] Alter | Implementation risk analysis[END_REF]Chatzoglou et.al, 2009, Malhotra et.al, 2009).

Software project risk management

Once the risk factors are successfully identified and assessed, the next logical step is to manage the risk [START_REF] Boehm | Software risk management: Principles and practices[END_REF]. Software project risk management is one mechanism for minimizing project failure [START_REF] Mcfarlan | Portfolio approach to information systems[END_REF][START_REF] Boehm | Software risk management: Principles and practices[END_REF]Barki et. al., 1993). Risk management is concerned with a phased and systematic approach to analyse and control the risks occurring in a specific context [START_REF] Charette | Software engineering risk analysis and management[END_REF]. Project risk management encompasses both hard skills such as estimating and scheduling tasks, and soft skills, which include motivating and managing team members [START_REF] Kirsch | The management of complex tasks in organizations: controlling the systems development process[END_REF].

Research on software risk management has primarily focused on crafting guidelines for specific tasks. Risk management strategies use observations from the past; they learn from analogical situations, and they use deductive reasoning to detect risky incidents. [START_REF] Alter | Managing Uncertainty in MIS Implementation[END_REF] focused on problems associated with the organizational acceptance and implementation of the information system. Davis' model (1982) is concerned with selecting procedures that lead to complete and correct information requirements. McFarlan (1982) classified risk resolution techniques into four types, namely External integration, Internal integration, Formal planning and Formal control mechanisms. Boehm's model (1991) suggests a comprehensive set of steps and guidelines to manage software development risks. Drawing from contingency research in Organizational theory and IS literature, [START_REF] Barki | An integrative contingency model of software project risk management[END_REF] developed an integrative contingency model of software project risk management. [START_REF] Ropponen | Components of software development risk: how to address them? A project manager survey[END_REF] researched on how risk management practices and environmental contingencies help in addressing the risk components in software projects. [START_REF] Kirsch | The management of complex tasks in organizations: controlling the systems development process[END_REF] proposed to build an integrated contingency model of software project management linking project management practices to the characteristics of the project and attributes of the individuals involved. [START_REF] Jiang | Software development risks to project effectiveness[END_REF] studied the relationship between the major risk factors and the risk mitigation strategies. A similar analysis was performed by Addision and Vallabh (2002) to determine whether there were significant relationships between risks and risk controls in software projects.

Project outcome and its linkages with risk and risk management

A project is usually deemed as successful if it meets the desired requirements, is completed on time and is delivered within budget [START_REF] Powell | Risk Management for Information Systems Development[END_REF]. A number of success criteria have been developed and empirically tested for IS projects. The triple criteria of project successmeeting cost, schedule and performance targets -have been widely used by researchers to analyze project success [START_REF] Barki | An integrative contingency model of software project risk management[END_REF][START_REF] Nidumolu | The Effect of Coordination and Uncertainty on Software Project Performance: Residual Performance Risk as an Intervening Variable[END_REF][START_REF] Deephouse | Software Processes and Project Performance[END_REF][START_REF] Wallace | Software project risks and their effect on outcomes[END_REF]Ravichandran, 1996). Performance measures like meeting the original specifications, reliability, easy to use, portability etc. are subjective measure whereas time and cost overruns are objective measures. Studies are reported based on both subjective and objective measures (Nidumolu, 1996;Wallace et al., 2004b;[START_REF] Rai | effects of development process modeling and task uncertainty on development quality performance[END_REF].

Linda [START_REF] Wallace | The development of an instrument to measure software project risk[END_REF] validated the second order factor model of risk through the establishment of co-alignment, a structural model of the relationship between risk and project outcome. [START_REF] Jiang | Software development risks to project effectiveness[END_REF] has independently done a study similar to the one described above and arrived at similar conclusions. But both these studies failed to include the risk management in the model which is stated as a major limitation by the authors. [START_REF] Barki | An integrative contingency model of software project risk management[END_REF] showed how the outcome of the software project is influenced by the fit between the project risk and the project management. [START_REF] Deephouse | Software Processes and Project Performance[END_REF], through an exploratory study, developed a conceptual model linking effectiveness of software processes such as project planning, training, user contact, design reviews, prototyping and cross functional teams on project outcome. But there is no reference to the risk items. [START_REF] Nidumolu | The Effect of Coordination and Uncertainty on Software Project Performance: Residual Performance Risk as an Intervening Variable[END_REF] model introduced residual performance risk as an intervening variable clarifying the relationship between risk, coordination mechanisms and performance. [START_REF] Na | Software development risk and project performance measurement: Evidence in Korea[END_REF] replicated this study in Korea revealing that both functional and system development risks are important predictors of software project performance. [START_REF] Jiang | Software development risks to project effectiveness[END_REF] related software development risks to project effectiveness and Deephouse et al (2005 linked effectiveness of software processes to the project outcome.

Building on the limitations of the past research to include comprehensive measures of risk, risk management and project outcome into a single framework, we have undertaken this study. We are attempting to empirically validate the linkages among risk, risk management and project outcome in a single integrated model.

Research Methodology

The current research was designed as a survey. Operationally, risk is defined as the presence of the factors that will adversely affect the software development project. Risk management is defined as the presence of practices which are crafted to reduce the impact of risk in software projects. Project outcome is defined in terms of time overrun, cost overrun and quality of the software developed. The level of risk, risk management and project outcome were measured by collecting data from software projects through validated instruments.

Instrument Development

An exhaustive survey of literature was performed to identify the major risk and risk management items from the previous studies. This list was edited by five senior software professionals working with leading companies in the IT industry as well as five senior professors in software engineering. The project outcome was measured with the validated tool used by [START_REF] Wallace | The development of an instrument to measure software project risk[END_REF] with nine questions on the product quality and one question each on time and cost overrun. The draft questionnaire was pretested to a convenient sample of 100 software professionals with at least one year of software development project experience. The final instrument was developed incorporating the modifications based on the pretest data. It had 68 items representing the risk construct and 42 items representing the risk management construct. The [START_REF] Wallace | The development of an instrument to measure software project risk[END_REF] instrument on project outcome was retained without any change.

The population for the study was defined as completed software development projects undertaken by software development organizations based in India. The data had to be provided by a project representative who had been part of the project from the beginning to the completion. The respondent was asked to read each statement and indicate the extent to which the risk / risk management item was present his/her project. The response format for each item was a five-point Likert-type scale ranging from "strongly disagree" to "strongly agree". Product quality was measured through a five point rating scale where the respondent rated the software developed on nine dimensions of software quality. The time and cost overrun (or underrun) had to be indicated as a percentage of variation from the original estimate.

Data Collection

The survey was conducted in Chennai, Bangalore (tier I cities) Cochin and Trivandrum (tier II cities) in India. National Association of Software Companies (NASSCOM) is the most respected and recognized body of Indian software industry. NASSCOM listed companies account for over 90% of the revenue of the software industry in India. NASSCOM list of software companies in the selected cities was accepted as the sample frame for data collection. Letters were sent via email to the centre heads/HR managers of all the companies requesting them to allow their IT professionals to participate in the study. Reminder letters were sent after three weeks. 105 companies agreed to participate in the study. Data was collected from different types of projects and members in different roles but keeping the condition that only one response should be solicited from one project. The researchers distributed 1350 questionnaires via email to the 105 companies who agreed to participate. After two rounds of reminders, 574 filled questionnaires were collected back from 95 companies. Detailed examination of the data based on grossly missing or inappropriate values resulted in the deletion of 47 records. Thus the final data set had 527 usable records representing 527 projects from 95 companies. Table 1 shows how the sample projects are distributed across various categories.

Developing the Risk and Risk Management Measurement Models

The data was randomly divided into two groups: An estimation sample of 250 responses and validation (hold out) sample of 277 responses. Exploratory Factor Analysis (EFA) was performed on the estimation sample to identify the underlying dimension structure for the risk and risk management constructs. The identified factor structures were confirmed (validated) through a Confirmatory Factor Analysis (CFA) on the validation sample. This approach is recommended by many researchers [START_REF] Moore | Development of an instrument to measure the perceptions of adopting an information technology innovation[END_REF]Hair et. al., 2006, Thomson S.H. Teo et.al, 2006). Finally, the proposed model was tested on the validation sample using structural equation modeling.

Exploratory Factor Analysis (EFA)

The estimation sample data was subjected to an exploratory factor analysis using principal component analysis with varimax rotation. This has been the most popular and accepted procedure for similar data analysis [START_REF] Moore | Development of an instrument to measure the perceptions of adopting an information technology innovation[END_REF][START_REF] King | Key dimensions of facilitators and inhibitors for the strategic use of information technology[END_REF], Thomson S.H. Teo et.al, 2006). The number of factors was to be decided looking into (a) percentage of variance explained (b) eigen values (c) interpretability of the factor structure (Hair et.al, 2006).

The analyses led to the representation of risk construct as a five factor structure and risk management as a four factor structure. Kaiser-Meyer-Oaklin measure of sampling adequacy and Bartlett Test of Sphericity values were seen to be acceptable. Items that did not load on a factor or cross load on multiple factors were identified. They were deleted if they didn't affect the face validity of the instrument in which case they were retained under the factor where the loading was highest. The final instrument had 55 risk items under risk construct loading onto five risk dimensions [START_REF] Sam | Software Development Project Risk: A Second Order Factor Model Validated in the Indian Context[END_REF] and 36 items under the risk management construct loading onto 4 risk management dimensions ( Thomas et.al, 2011(2)).

Confirmatory Factor Analysis (CFA)

Confirmatory Factor Analysis (CFA) which is part of the structural equation modelling (SEM) is used to confirm a factor structure known beforehand or developed through EFA. The validation sample data was used to confirm the factor structures developed with EFA on the estimation sample. Software package AMOS 4.0 was used to do the analysis. The overall fit of a model was assessed using a number of fit indices like Goodness of Fit Index (GFI) (Joreskog and Sorbom, 1989), Comparative Fit Index (CFI) [START_REF] Bentler | Comparative fit indexes in structural models[END_REF], Non-normed Fit Index (NFI) (Bentler and Bonet`t, 1980) and Root Mean Squared Residual (RMSR). The reliability of each dimension as well as the total construct was tested by computing Cronbach alpha () value. The risk and risk management dimensions with the fit indices are presented in tables 2 and 3. Thomas et.al ( 2012) describes in details the procedure followed. (Nidumolu,1995;[START_REF] Na | Software development risk and project performance measurement: Evidence in Korea[END_REF]. Thus the impact of the risk management on project outcome may be mediated by risk in the project. The proposed research model shown in figure 1 model postulates that risk management will be related to project outcome, both directly and indirectly, being mediated by risk. The hypothesized direct and indirect relationship between the predictor variables (risk, risk management) and the dependent variable (project outcome) is explored. Separate models were tested for each of the project outcome measures. Figure 2 shows the proposed model for the project outcome "quality".

. Structural equation modeling (SEM) is often used for testing theory associated with latent variable models because it enables the inference of complex relationships among variables which cannot be directly observed. SEM is a multivariate statistical methodology, which takes a confirmatory approach to the analysis of a structural theory. SEM provides researchers with the ability to accommodate multiple interrelated dependence relationships in a single model. (Hair et al., 1998). As mentioned earlier, the overall fit of a model was assessed using a number of fit indices as well as the values of the loading coefficients.

Modeling the Outcome Variable -Quality

The posited model presented in figure 2 contains two models -( 1) the full direct model, which incorporates all identified paths and (2) the indirect model, in which the direct path (dotted) linking risk management to Quality will not be estimated. As both these models are nested (i.e., they are hierarchical models based on the same data set) and possess different degrees of freedom, their goodness-of-fit can be directly compared via multimodel analysis. In conducting a multimodel analysis using AMOS the procedure suggested by [START_REF] Ho | A Handbook of Univariate and Multivariate Data Analysis and Interpretation with SPSS[END_REF] is used. The step involves (1) defining the full direct model and ( 2) defining the indirect model in which the direct path linking risk management to Quality is constrained to zero. Constraining paths to zero is equivalent to those paths not being estimated.

Table 4

Fit measures for the quality models.

Limitations of the Study

Risk and risk management are complex constructs which many researchers constantly work on. Hence it is quite possible that this research may not have captured every aspect of these construct even though an extensive literature review was conducted and experts in the area were consulted for inputs.

The study was designed as a single-respondent survey. Although it is common to use a single respondent in academic research, it would be more desirable to have multiple respondents from each project and independently assess risk in order to validate the results. Future researchers can address this issue by administering the instrument in this study to different stakeholders involved with the same project and comparing their perceptions of risk. The data is confined to projects executed with IT companies in India. It doesn't account for software development happening with non IT companies.

This research looks at software projects at a generic level. This lays the foundation for future research for studying the possible variation in the models depending on the organizational and project characteristics. Future researchers can follow the procedures laid out in this study to develop models on projects which are at different stages in project life cycle rather than studying them at the completion of the project.

Discussion and conclusion

This study showed the integrated relationship among risk, risk management and project outcome. The implications of this research for researchers and practitioners are highlighted.

The study showed that the impact of the risk management on project outcome is mediated by the levels of risk present. This indirect impact is more visible in the case of time and cost outcome measures. The quality of the software developed had a positive relationship with risk management and negative relationship with risk. The direct impact of risk management was seen to be stronger than the indirect impact through risk. The other outcome variables namely time overrun and cost overrun had strong negative relationship with risk. Risk management did not have much direct effect on overrun variables. Risk was seen to be acting as an intervening variable between risk management and overrun variables.

The direct link between risk and project outcome measures is consistent with literature. [START_REF] Wallace | The development of an instrument to measure software project risk[END_REF] proved that the second order model of risk directly influenced all the three outcome measures. [START_REF] Jiang | Software development risks to project effectiveness[END_REF] also demonstrated the negative impact of risk items on a range of project effectiveness measures.

The findings on the direct as well as indirect impact of risk management on project outcome also find support from literature. Deephouse et.al (2005) found that effectiveness of the software processes had a stronger and direct linkage with project quality than with overrun measures. [START_REF] Nidumolu | The Effect of Coordination and Uncertainty on Software Project Performance: Residual Performance Risk as an Intervening Variable[END_REF] showed that the risk control measures such as coordination strategies may have a direct and/or indirect impact on project outcome measures.

The impact and the importance of different risk and risk management dimensions can be understood looking at their loading coefficients in the models. The complexity risk and team risk are seen to be the most important risk dimensions in all the three models. Similarly execution management and HR management are seen to be the most effective risk management components.

It is important for project managers to understand this relationship among these constructs in the integrated environment. A clear assessment of risk helps project managers to perform risk control better. They can develop appropriate strategies for mitigating the risk in order to reduce the chance of project failure. Thus it can be concluded that only an integrated model accounting for the direct and indirect impact of risk and risk management can explain the variation in project outcome measures satisfactorily.

Fig

  Fig. 1. Integrated model

Table 1

 1 Type of the project in the sample

	Sl. No.	Domain	Percent (%)
	1	Business Applications	48.3
	2	Engineering Applications	20.2
	3	System Software	10.5
	4	Web Application	17.5
	5	Others	3.5
	Total		100

Table 2

 2 Fit indices for the measurement models of risk

	Dimensions of risk	No. of	GFI	CFI	NFI	RMSR	Cron
		items					bach α
	Team Risk	26	0.894	0.953	0.913	0.048	0.9667
	Proj. Plan & Exec Risk	14	0.804	0.807	0.790	0.09	0.9196
	External Risk	5	0.914	0.837	0.831	0.08	0.8466
	User Risk	6	0.962	0.967	0.958	0.07	0.8309
	Proj. Complex Risk	4	0.990	0.986	0.982	0.03	0.7663
	Full Risk Model	55	0.908	0.895	0.896	0.04	0.813
			Table 3
	Fit indices for the measurement models of risk management
	Dimensions of Risk Management	No. of items	GFI	CFI	NFI	RMSR	Cron bachα
	Execution Management Strategies	13	0.937	0.953	0.937	0.038	0.9204
	Human Resource Management Strategies	11	0.930	0.913	0.895	0.050	0.8630
	User Coordination Strategies	6	0.983	0.975	0.965	0.030	0.7001
	Project Planning Strategies	6	0.994	0.999	0.989	0.034	0.8059
	Full Risk Management Model	36	0.921	0.914	0.907	0.037	0.8340

Risk Management-Risk-Project Outcome ModelThe objective of this research to empirically develop and validate an integrated model linking risk, risk management and project outcome. Risk management is designed to reduce risk in the project and reduction in risk is

Fit measures

Values for the direct model for quality As seen in table 4, both the models are fitting the data very well. But the direct model has better fit indices values. The reduction in chi square (from 134 to 72) is statistically significant for a corresponding reduction of 1 in the degree of freedom as we move from indirect model to direct model. Therefore, although both models fitted the data relatively well, the direct model represents a significantly better fit than the indirect model, and is to be preferred. This conclusion is further supported by the Akaike Criterion Information (AIC) comparison statistics which shows a lower value for direct model which indicates that the direct model is both better fitting and more parsimonious than the indirect model. Table 5 presents the standardized regression coefficients of the paths in the hypothesized direct model. The results indicated that all the paths highly significant at p = 0.01 level. The risk had a significant negative link with risk management. Quality had a significant negative link with risk and positive link with risk management. Risk management is related indirectly to quality being mediated by risk. Thus better risk management result in reduced risk (β = -0.498) and reduction in risk results in increased quality (β = -0.318). Also, the better risk management results in a direct improvement in quality ((β = -0.351) and indirect improvement through risk (-0.498*-0.318= 0.158) . The loadings of the first order factors onto risk and risk management constructs were strong and positive, thereby providing further support for the model [START_REF] Segars | Re-Examining Perceived Ease of Use and Usefulness: A Confirmatory Factor Analysis[END_REF].

Modeling the Outcome Variable -Time Overrun

A similar analysis was performed on the second project outcome variable "time overrun". Both the direct and indirect models were tested. The values of the fit measures are reported in table 6: As seen both models are fitting well. The direct model shows slightly better fit. The standardized path coefficients for the direct mode are shown in table 7. The path linking risk management to time overrun is not significant at p = 0.01 level but significant at 5% level. The magnitude of the coefficient is very weak ( β = -0.11). Thus it can be concluded that the impact of risk on time overrun is strong and significant( β =0.754). But the direct effect of risk management on the outcome variable is very weak ( -0.11) and the effect is mainly indirect(-0.467*0.754 =-0.352) mediated through risk.

Modeling the Outcome Variable -Cost Overrun

The final outcome variable cost overrun was also modeled and analyzed similar to the other two variables. The values of the fit measures for the two models are reported in table 8. The two models show equal fit and statistically there is no difference between the two. The reduction in chi square value is not significant for a one degree difference in the degrees of freedom. This supports the indirect model. The path coefficients (Table 9) shows that the path linking risk management to cost overrun is insignificant even at p=.05 level. Thus we conclude that the risk has direct impact on cost overrun where as the effect of risk management is indirect through the mediating variable risk.


Jyoti M Bhat
email: jyoti.bhat@iimb.ernet.in

Legitimation of E-government Initiatives: A study of India's Identity Project

Keywords: E-government, legitimation, Institutional theory

Legitimation is an important aspect of e-government initiatives due to the complex and diverse issues related to policy and technology implementation which create huge demands for resources. Legitimation is one of the core concepts of Institutional theory. Though institutional theory is gaining importance in IS and e-government research, there are very few studies on the strategies and process of legitimation in e-government implementations. In this paper we use institutional theory and examine the institutionalization of India's Unique Identification (UID) project. Given the novelty and uniqueness of the UID initiative, we find that the predominant strategy used is that of conformance and proactive manipulation of the environment. The main contribution of the paper is in identifying that differing strategies are used for supply side and demand side stakeholders of e-government projects.

1 Introduction E-government projects cover a variety of applications depending on the content, the stakeholders involved and the specific context of use. While typical e-government projects cater to specific categories of stakeholders [START_REF] Rowley | e-Government stakeholders-Who are they and what do they want[END_REF], National identity (NI) projects are relevant to a wider range of contexts and stakeholders. NI projects leverage the latest technologies like smart cards and biometrics to enable identity management and impact large numbers of people in various economic, social and political activities. While the primary driving forces behind identity projects in developing countries are efficient delivery of government welfare services and developmental goals, in some of the developed countries, especially in Europe [START_REF] Kubicek | Different countries-different paths extended comparison of the introduction of eIDs in eight European countries[END_REF], the current focus is national security, travel document management, e-commerce and e-services. The evolving expectations, diverse stakeholders, large scale of implementation, untested technologies and the huge demands for financial and human resources make NI projects complex and risk prone. Countries like the UK and Australia had to abandon their identity projects as the public debate and opposition raised issues which turned these projects into technical, financial and even political liabilities.

NI projects are similar to other infrastructure projects taken up by the state, as they provide a basic service (i.e. identity management) to citizens, which can then be used by other government, private, social and economic actors. NI project creates a new institutional field with its own set of norms, processes and practices through which government, commercial and other parties interact. The benefits of identity projects take a longer time to become visible as they depend on large scale usage across diverse applications and on network effects. Hence the success of NI project depends on it gaining legitimacy and achieving a taken-for-grantedness among the various stakeholders.

Legitimizing a novel idea is very critical, especially if it involves both technology and practice novelty [START_REF] Boxenbaum | The Process of Legitimation[END_REF]. The institutionalization of NI involves the acceptance of the new identity management processes in addition to the adoption and diffusion of the identity management technologies. The planned interventions and tactics adopted by the NI project managers to gain legitimacy are critical to creating the new institutional field. While gaining legitimacy is critical for e-government success, there exists a gap in literature related to the legitimation processes and strategies adopted by e-government projects. In this paper we examine the legitimation strategies adopted by NI projects and address a critical gap in egovernment literature. We study the institutionalization of India's Unique Identification (UID) project and examine the strategies being adopted to gain legitimacy.

The Indian government has taken up Aadhaar1 , an ambitious biometric based identity for its billion plus residents in order to provide a clear identity to its citizens that would be primarily used as the basis for efficient delivery of welfare services [START_REF] Uidai | Creating a Unique Identity Number for Every Resident in India[END_REF]. UID has many firsts to its credit as an e-government project with respect to technology, scale and application, even when compared to other public and private ICT implementations across the globe. The current discourse is slowing moving away from UID enrolments and technological debates related to data security, reliability of biometric technology and authentication to the UID based delivery of welfare services. Given the novelty of the UID initiative with its dependence on IT as a paradigm changer, we found the strategies for legitimation of the IT/IS process to be different from the legitimation of the identify management process in government departments [START_REF] Avgerou | IT and organizational change: an institutionalist perspective[END_REF]. Though a repertoire of tactics is employed, UID is focusing on gaining cognitive legitimacy. It uses acquiescence or conformance strategies for the IT/IS dimension and proactive environment manipulation strategies for institutionalization of the identity management process. The main contribution of the paper is in identifying that the legitimation strategies adopted for supply side stakeholders differ from those adopted for demand side stakeholders. While context is critical in studying IS innovation diffusion, our findings can be applied to other large e-government projects which involve the creation of institutions where IT can be seen as an active change agent.

In the next section we discuss the theoretical background for legitimation of egovernment projects. We then describe the research question and method used. We provide an overview of Aadhaar and its institutional field to help understand the context. The analysis section details out our findings related to the legitimation strategies being adopted by Aadhaar. We discuss our study with respect to existing studies on legitimation strategies and conclude by identifying the contributions made by this study and the future work.

Theoretical Background

Institutional theory "considers the processes by which structures, including schemas, rules, norms, and routines, become established as authoritative guidelines for social behavior" [START_REF] Scott | Institutional theory: contributing to a theoretical research program[END_REF]. Institutional theory recognizes that the environment places a variety of technical, economic, social and cultural demands on organizations. Institutionalization is the process by which social practices conform to environmental pressures and eventually become taken for granted [START_REF] Scott | Institutions and organizations: ideas and interests[END_REF]. Institutional theorists describe three kinds of institutional pressures the environment exerts on organizations and organizational actors: coercive -formal and informal pressures due to the legal environment, standards and norms; normative -due to professionalism resulting from education and professional networks; and mimetic -as a response to uncertainty when organizations mimic or model themselves on other organizations that are perceived to be more legitimate or successful [START_REF] Dimaggio | The Iron Cage Revisited: Institutional isomorphism and collective rationality[END_REF].

The concept of agency is also gaining importance in institutional theory where interested actors work to influence their institutional contexts. [START_REF] Jepperson | Institutions, institutional effects, and institutionalism[END_REF] considers agentic action and defines institutions as the product of specific purposive actions taken to reproduce, alter and destroy mechanisms of control. [START_REF] Lawrence | Institutions and Institutional Work[END_REF] through a review of empirical work in institutional entrepreneurship, identify ten distinct sets of practices through which actors engaged in actions that resulted in the creation of new institutions. These include advocacy, defining, vesting, constructing identities, changing normative associations, constructing normative networks, mimicry etc. Advocacy, defining and vesting are actions which have political tones and define access to material resources. Constructing identities, changing normative associations, focus on how actors' belief systems are reconfigured. Mimicry and educating are actions which focus on altering abstract categorizations. [START_REF] Oliver | Strategic responses to institutional processes[END_REF] suggests an active approach of organizational actors in managing legitimacy. She suggests that organizational actors and managers do not always conform or comply with institutional pressures, but adopt other strategic responses which vary in active resistance. The five types of strategic responses which are each exerted through tactics are: acquiescence, compromise, avoidance, defiance, and manipulation. [START_REF] Boxenbaum | The Process of Legitimation[END_REF] suggests that there are varying degrees between the two extremes of institutional pressures and managerial response in gaining legitimacy. [START_REF] Rao | The social construction of reputation: Certification contests, legitimation, and the survival of organizations in the American automobile industry[END_REF] classifies legitimacy into sociopolitical and cognitive.

Cognitive legitimacy is the acceptance of new ideas a desirable and appropriate within a widely shared system of norms and values, while endorsements by legal authorities, governmental bodies, and other powerful organizations provides sociopolitical legitimacy.

Suchmann (1995) synthesizes the strategic and institutional groups of legitimation studies and proposes an inclusive, broad-based definition of legitimacy: "Legitimacy is a generalized perception or assumption that the actions of an entity are desirable, proper, or appropriate within some socially constructed system of norms, values, beliefs, and definitions."

He proposes three primary forms of legitimacy: pragmatic, based on audience selfinterest; moral, based on normative approval: and cognitive, based on comprehensibility and taken-for-grantedness. While the three forms co-exist, there are some underlying distinctions: pragmatic legitimacy rests on audience self-interest, whereas moral and cognitive legitimation involves larger cultural rules; pragmatic and moral legitimacy rest on discursive evaluation and organizations can gain legitimation by participating in public discussions and dialogues. Suchmann proposes 30 legitimation strategies and classifies them under gaining, maintaining and repairing legitimation within the 'institutional field' which is the environment within which legitimacy must be gained. Further the mechanism for gaining legitimacy can be classified as conforming, selecting or manipulating the institutional field.

A cross-disciplinary literature review by [START_REF] Weerakkody | The Diffusion and Use of Institutional Theory: A Cross Disciplinary Longitudinal Literature Survey[END_REF] finds that the use of institutional theory is in its infancy within the IS discipline. [START_REF] King | Institutional Factors in Information Technology Innovation[END_REF] recognizing the institutional factors in the diffusion of IT innovations propose six types of interventions which can be employed by the government to facilitate IT innovations. The six types of institutional interventions are mobilization, knowledge building, knowledge deployment, innovation directive, subsidy, and standard setting. While these interventions were proposed for guiding government's support for IT innovation, [START_REF] Henriksen | Dawn of E-Government -An institutional analysis of seven initiatives and their impact[END_REF] adapt the interventions proposed by King et al. to study and classify the initiatives used to stimulate e-government diffusion in Denmark. They find that the demand-pull based approach has not been successful and the Danish government is changing its strategy to imperatives and regulations. An examination of IS research publications by [START_REF] Mignerat | Positioning the institutional perspective in information systems research[END_REF] found that though the Institutional theory is being used by IS researchers; there are very few papers which adopted institutional theory to study e-government. Another finding was that 'acquiescence' or conformance was the only legitimation strategy studied by most of the IS papers reviewed. IS innovations may be initially adopted and diffused for its technical merits [START_REF] Zucker | Organizations as Institutions[END_REF], and partly under the influence of powerful actors [START_REF] Granovetter | The making of an industry: electricity in the United States. The Law of Markets[END_REF]. [START_REF] Avgerou | IT and organizational change: an institutionalist perspective[END_REF] finds that IS development and organizational transformation are two different institutionalization processes, and ongoing sustenance of IS adoption is based on its legitimacy, irrespective of its contribution to the processes of organizational change.

According to [START_REF] Whitley | Global Identity Policies and Technology: Do we Understand the Question?[END_REF] most governments approach their NI projects as a technology implementation without considering the eventual social impact and economic opportunities possible through innovative applications of NI. [START_REF] Crosby | Challenges and Opportunities in Identity Assurance[END_REF], by studying various NI usages across countries and private sector players, highlights the opportunities for new services and markets based on the NI infrastructure. He also brings out the need to involve various stakeholders and sectors in designing and implementing the NI project. The role of stakeholders and the importance of their participation in the e-government initiative for its long-term success are well-recognized in the literature [START_REF] Flak | Stakeholder governance: Adapting stakeholder theory to the egovernment field[END_REF]. De ' (2005) provides an appropriate framework for stakeholder groups in e-government considering their role as demand-side or supply-side and the impact felt by them as first order, second order or higher-order effects. These stakeholder groups exert institutional pressures on the e-government project.

Studies on technology acceptance and user satisfaction focus on individual's adoptions of ICT based on their perceptions of the technology [START_REF] Venkatesh | User acceptance of Information technology: Toward a unified view[END_REF]. E-government projects differ as the acceptance involves a social and political process with different adoption motivations across stakeholders. Current egovernment approaches take a project management approach and do not address the facilitation process required across various stakeholders such as policymakers, public officials, and business persons [START_REF] Sarantis | A critical assessment of project management methods with respect to electronic government implementation challenges[END_REF]. Hence an institutional perspective considering the various institutional pressures, developmental goals, existing social norms and beliefs which forces e-government projects to seek legitimacy more than efficiency [START_REF] Dimaggio | The Iron Cage Revisited: Institutional isomorphism and collective rationality[END_REF]) is more appropriate to study the diffusion of NI initiatives.

The literature review identifies the need for the legitimation process in egovernment projects, especially NI projects, given the novelty, complexity and scale of the initiatives. There is need to gain a positive cognitive personal response from salient stakeholders to gain support and access to resources. Existing studies of legitimation of IT-enabled changes focus on organizations (private or public). There exists a gap in literature related to studies on legitimation strategies adopted in egovernment projects. We attempt to address this gap by examining the legitimation strategies adopted by India's UID project.

Research Question and Method

The research objective is to identify and analyze the interventions and legitimation strategies adopted by Aadhaar for success of the NI initiative. As NI initiatives involve creating a new institutional field with new actors, norms and procedures, the legitimation strategies are used to institutionalize NI. Legitimation of NI initiatives would involve two separate sets of strategies [START_REF] Avgerou | IT and organizational change: an institutionalist perspective[END_REF]; one for the legitimation of the identity technologies and infrastructure and the other for the identity management processes used in e-government projects (enrolments, authentication and related applications). Hence RQ1: Are there different sets of strategies for gaining IS/IT infrastructure legitimation and e-government process legitimation in NI initiatives?

The success of NI depends on large scale usage across diverse contexts and egovernment applications. While pragmatic and moral legitimation strategies will be adopted, gaining cognitive legitimacy is important for long term success of NI initiatives. But government departments and agencies using NI to reengineer their process would evaluate the NI processes against their pragmatic expectations and benefits. The large numbers of people impacted and the novelty of technology and processes may force NI project managers to adopt manipulation strategies like co-opt, influence, or control the institutional pressures.

RQ2: Are there specific clusters and legitimation strategies which are more suitable for gaining specific types of legitimacy in NI projects?

The above research questions have been framed specific to NI projects, but can be generalized to other large e-government or IS implementation projects which involve the creation of a new institutional field.

The research methodology adopted in this paper is a case study approach using document analysis. Before beginning our study, we had an informal discussion with one of the senior members of the UIDAI technical team, who provided us with details on the events, choices and decisions made which lead to the current design and process for UID enrolments. The discussion also helped us identify relevant documents on the UIDAI website. We studied all the documents and articles related to Aadhaar available at the website of UIDAI (http://uidai.gov.in/). These indicate the explicit legitimation strategies adopted. Several news articles related to UID which highlight the activities of UIDAI were accessed through popular search engines using the keywords "UID", "UIDAI" and "Aadhaar". Documents and reports related to UID available in the public domain like websites of various government departments and agencies (like Parliament debates, GoI circulars, welfare benefit department websites) and discussions on social media sites dedicated to UID discussions were also studied (like http://thinkuid.org/ and http://aadhararticles.blogspot.in/ ). The documents and news articles for the period of two years (2011 and 2012) examined. Each document and source was examined by the author and the legitimation strategy identified. Each strategy was then coded using the categorization proposed by Suchmann (1995) for gaining legitimation along two dimensions -pragmatic, moral and cognitive legitimacy; and conforming, selecting and manipulating the institutional field. The legitimation strategies were further classified as IT/IS oriented strategies and NI process strategies.

Aadhaar -India's UID

Aadhaar, India's Unique Identity project (UID), which aims to provide a unique identity to 1.2 billion is the largest ICT roll-out using IT, biometrics and mobile technologies. In the last decade various national identity options have been evaluated by the Indian government. The current national identity project, initially proposed in 2003, was called the Multipurpose National Identity card and was initiated to address the national security issues. The current government which came to power in 2004 carried the project forward but renamed it as UID in January 2009 indicating a shift to a development goal for the project. The context in which Aadhaar project has been taken up is for efficient delivery of the socio-economic benefit services of the government. According to the strategy overview document developed by UIDAI, the statutory body set up to handle the Aadhaar project (UIDAI, 2010) -"The purpose of UIDAI is to issue a unique identification number (UID) to all Indian residents that is (a) robust enough to eliminate duplicate and fake identities, and (b) can be verified and authenticated in an easy, cost effective way"

The current focus of UID is the poor and underprivileged communities who lack any form of identity documentation. Therefore, UID enrolments are not being mandated though it is envisaged as the de facto identity for most applications in the future (GoI, 2008). UIDAI issues a 12-digit randomly generated number as the Aadhaar number after collecting the demographic (Name, address, gender, date of birth) and biometric (Iris scans, fingerprints and photographs) details of individuals. These details are subsequently verified against a central repository to check for duplicates before the UID is issued. Unlike most other countries UIDAI issues only a number and not a card. The residents' enrolment is done by partnering with central and state departments (Registrars) who process the UID applications and connect to a central repository for the de-duplication check and issue of Aadhaar. The Registrars that the UIDAI has partnered with are the government departments involved in providing welfare services like employment guarantee, health insurance, food distribution; who will use the UID in providing subsidies and other benefits.

The usage of UID by the various government and private agencies has been planned as a federated set of databases with the central repository containing a minimal set of fields. Registrars can provide their own account number for each resident which is the derived ID, while the UID/Aadhaar number forms the base ID. The registrars' database will access individual resident's details using the UID or the derived ID. UIDAI offers online authentication services by checking the resident's data against that stored in the central repository, but provides only "Yes"/"No" responses in order to protect residents' privacy. The authentication services are implemented using service agencies that have the connectivity to the Aadhaar authentication module. User agencies that require Aadhaar authentication have to sign up with the authentication service agency.

While the technological and implementation challenge of enrolling and providing IDs to 1.2 billion is broadly acknowledged, the common opinion is that UID is otherwise a very simplistic problem of a unique 12-digit number. But the achievement of the development objective is dependent on a base infrastructure consisting of connectivity, financial inclusion and identity on which various government and private agencies would build their own applications and platforms. This requires Aadhaar to have a taken-for-grantedness for identity management. As the extensions of the Aadhaar infrastructure are context dependant, various stakeholders like government agencies (registrars), regulators, residents, etc. are involved. We provide two examples below to highlight the possible variations. The Madhya Pradesh state government has reengineered its food distribution processes based on Aadhaar and has built the MPePDS platform for its food distribution system (MPePDS, n.d.). Figure 1 shows the proposed MPePDS process where the identity verification is done offline.

Fig 1: A sample usage of Aadhaar in food distribution process

To ensure financial inclusion and electronic payments, the Indian Central Bank and the banking association are building a payment platform consisting of Aadhaar Payments Bridge System, Aadhaar enabled payment systems and microATMs. This platform forms the base on which benefits are transferred to residents and basic financial transactions can be carried out using microATMs. UIDAI has signed up several banks to open the "no-frills" account after the central bank made policy changes to allow such accounts. Banking correspondents (BC) (can be the local small retailers) using the microATMs are planned as providing this last mile banking services in remote villages. Figure 2 provides an illustration of cash withdrawal using online authentication and electronic payments.

While the above examples illustrates only the first order effects of Aadhaar, the higher-order effects such as the residents' ability to participate in economic activity due to access to banking services, reduction of transaction costs due to the last mile banking is not directly visible. The ability to provide identity and access to financial services may further increase the trustworthiness of the individual and increase his abilities to participate in market transactions by providing services and products. The UIDAI has identified the various welfare schemes and relevant stakeholders who would be involved in adopting Aadhaar enabled services. Various regulatory bodies are also involved in establishing standards for different aspects of Aadhaar and its usage for e.g. UIDAI for biometrics, the Central Bank for microATM devices, etc. These standards are used by the suppliers involved in the UID enrolments, authentication and usage, who form the higher order stakeholders.

The Institutional Field of Aadhaar

With upcoming elections in 2014, the current ruling political party has reinforced its support for the UID project and announced new welfare schemes which are Aadhaar-based for e.g., direct cash transfers. The Planning Commission provides the administrative support for UIDAI and is actively pushing for Aadhaar as a basic requirement for inclusive development. But Aadhaar faces opposition from many other institutional actors and organizations at other levels in the government. The UIDAI bill has not yet been presented in the parliament as it has openly met resistance from various political parties and Parliamentary Standing Committee on Finance. Resistance has been seen from other government departments like the National Population Registry (NPR) which is collecting details of citizens with the objective of national security and views Aadhaar as intruding on its territory. While Aadhaar has been initiated by the central government, the welfare programs are state level responsibilities and hence Aadhaar-based applications have to be developed and supported by state governments in most cases. The implementation of the Aadhaar based welfare initiatives also depends on the executive officers in the Indian Administrative system who are posted at various levels of district and local governments.

One of the initial objections raised against UID was that if such projects have failed in other developed countries, its success in India is highly improbable. There are many public debates by social activists speaking on behalf of the poor and marginalized raising questions on the importance and applications of Aadhaar based on the feasibility of technology and policy implementation. Differing perspectives of Aadhaar are available on social media sites where opinions and news items are posted related to Aadhaar. Some of the common discussions revolve around data privacy, data aggregation, reliability of the technology, legality of UID, errors and delays in UID allocation. We provide an illustrative institutional field using the stakeholder diagram in Figure 3 which highlights the numerous and diverse stakeholders of the Aadhaar project. Each consecutive square represents higher-order stakeholders on the supply and demand side of Aadhaar [START_REF] De | E-Government systems in developing countries: Stakeholders and conflict[END_REF].

Analysis of the Legitimation Strategies adopted by Aadhaar

Organizations taking up activities or initiatives which have few precedents in the social order face the overwhelming task of acquiring acceptance either for the propriety of the activity or their own validity as practitioners (Suchmann 1995). In the case of Aadhaar overcoming this "liability of newness" is extremely formidable as the technologies used are untested and the initiative still lacks legal support. The acceptance of Aadhaar as the national identity, when currently many other forms of identity documents exist, involves convincing existing entities to support Aadhaar and get involved in a risky and lengthy relationship for offering Aadhaar enabled services.

We analyze the legitimacy gaining activities adopted by Aadhaar using two dimensions. The first dimension is based on whether the tactics are used for legitimizing the IT/IS innovation or the NI processes and the second dimension is the stakeholders being addressed with these tactics -supply side or demand side. The 2x2 matrix in Table 1 summarizes the predominant legitimation strategies adopted by UID. For each legitimation tactic we also identify the mechanisms used (C-conform, S-select and M-manipulate environment) and the type of legitimation being sought (p-pragmatic, m-moral and c-cognitive).The letters in the brackets after each strategy indicates the mechanism and type of legitimation sought.

Legitimation of IS Innovation:

Conforming to the existing norms and standards is the dominant legitimation strategy for institutionalization of the IT/IS innovations used in UID. Most of the tactics adopted are towards gaining cognitive legitimacy with both the supply side and demand side stakeholders.

UIDAI relies on the strong reputation of the key people and partners from the Indian IT industry. UIDAI recruited Nandan Nilekeni, the ex-CEO of an Indian IT firm which is held in high regard for its business ethics, transparency and performance, as the Chairperson of UIDAI. Legitimacy of IT knowledge and execution capabilities is sought by recruiting people from the IT industry on a voluntary basis and forging partnerships with various IT industry players. UIDAI is partnering with Banking system for building Aadhaar enabled systems and platforms which will form the basis of cash transfers and transactions for the welfare schemes.

Being an e-government project conforming to existing standards or defining new standards is a mandatory requirement for UIDAI to gain cognitive legitimacy. UIDAI has adopted most of the e-government standards issued by the Department of electronics and IT. In some cases it had to define new standards like standards for biometrics and microATM. In response to the doubts and concerns raised by various institutional actors over the biometrics technology UID has invested in the creation of the Biometrics Centre of Competence. In some aspects of the technical architecture and choice of technologies, UIDAI has adopted externally accepted competencies like open source and a server farm architecture to avoid lock-in and be cost-efficient. Given the failure of several e-government initiatives which adopted a kiosk-based model [START_REF] De | E-Government systems in developing countries: Stakeholders and conflict[END_REF]; UIDAI is riding on the mobile penetration in India as a means to access the rural and remote regions.

Demonstration of success has been actively pursued by UIDAI as a means to gain moral legitimacy. Success is operationalized as the number of Aadhaar enrolments. Announcing the number of Aadhaar numbers issued and handing over of specific milestone numbers by prominent people like the Prime Minster or ruling party chairperson are some of the strategies adopted.

Legitimation of NI Processes:

The dominant strategy adopted for legitimization of the NI processes is to manipulate the environment. This is more applicable to ensure participation from demand side stakeholders during the UID enrolments as they are the salient stakeholders for this stage of UID. Once the UID gains legal status, the manipulation mechanism may be visible even on the supply-side stakeholders as government departments and agencies would have to adopt UID-based services.

Communicating the benefits of identity to the residents, and highlighting the goal of efficiency in distribution and monitoring of welfare schemes to government departments is a clear manipulation strategy. UIDAI is seeking cognitive legitimacy through the UIDAI bill which has yet to be enacted. In the meantime, it is using the support of salient and influential stakeholders like the Prime Minister and Finance minister to enable it to continue operating in its current set of welfare departments and locations and enter new application areas like direct cash transfers. The UIDAI uses task forces with members from relevant government departments as a means to offer them decision making access to the design on the technical solution and policy implications. UIDAI engages them as registrars allowing them to collect information in addition to the basic details required for Aadhaar. UIDAI has engaged with certain welfare departments like public distribution system and employment guarantee scheme in its search for friendly audiences for the initial Aadhaar based applications. Under these welfare schemes it has identified receptive state governments and district level administrative officers to partner for the initial pilots of these applications.

While UID enrolments are claimed to be voluntary, mandating it for availing welfare benefits and other services, send a very explicit message that without an Aadhaar number, welfare benefits cannot be availed. It has persisted in Aadhaar enrolments in spite of lack of legislative and regulatory support. In spite of many technical and process related setbacks which led to delays and temporary hold up of Aadhaar enrolments, UIDAI has continued to retain its enrolment partners like the state governments and other departments who are keen to resume the Aadhaar enrolments. Aadhaar is approaching a de facto standard for identity and people are enrolling for Aadhaar numbers to take advantage of the advertised welfare benefits or the fear of exclusion.

UIDAI communicates an image of transparency and openness in all its communications. In accordance with this image it has an Aadhaar portal with current status and a website where it makes available data of UID enrolments and authentication which can be used for various analyses and research by anyone.

Legitimation strategies for demand side and supply side:

The strategies adopted for gaining acceptance from the supply side and the demand side for the NI process are different. UIDAI attempts to gain pragmatic legitimacy with the supply side stakeholders like the government departments and agencies for the NI processes. UIDAI uses cognitive legitimation strategies to popularize the UID technology and processes among the demand side stakeholders.

Linkages between strategies:

UIDAI has adopted a repertoire of the legitimation strategies for gaining legitimacy and has accumulated a group of supporters across various kinds of stakeholders. Many of the specific actions taken for a strategy may be due to the existing context or situation at the time of decision-making by the organizational actors. We found during our analysis that some of the legitimation strategies lead to a new situation (or failure) where another legitimation strategy may need to be applied to gain or maintain legitimacy. For example, we found that UIDAI had initially planned to adopt the IT architecture as per the existing e-government project guidelines, but on obtaining a quote from the hardware vendors it was found that the cost effectiveness requirement of the initiative would be at risk. Hence it was decided to adopt a farm of servers similar to the cloud based architecture using low-end servers. This was a novelty in government projects, though it had been quite successfully adopted by commercial IT organizations. But this required gaining legitimacy for the new architecture by defining new standards, advertising the product and popularizing the new model. Another instance is related to the lack of confidence in the existing biometric standards due to which UIDAI had to invest in research and competence building biometrics. Hence many of the strategies have a linkage and an order which we have not described in our analysis.

Findings and Discussion

Our analysis of the strategies adopted by UIDAI for institutionalization of Aadhaar identified the following  IS innovation legitimation involves gaining cognitive legitimacy and conforming to existing environmental norms.  NI projects need to use manipulative mechanisms to gain legitimacy of the NI processes. This strategy is more dominant with the demand side stakeholders during the initial stages of the NI project.  Pragmatic legitimacy strategies are adopted for gaining acceptance of the NI processes with the supply side stakeholders. These stakeholders evaluate the NI project based on the benefits and norms of interactions to deliver NI based services, hence gaining pragmatic legitimacy is important.  Cognitive legitimation strategies are used to popularize both NI processes and technologies with the demand side stakeholders. With respect to our research questions we found that the legitimation of the IS innovation requires different sets of strategies as compared to the strategies adopted for NI processes (RQ1). The legitimation strategies for gaining acceptance with demand side and supply side stakeholders differ. The mechanisms for gaining legitimation are either conforming to the environment or manipulating the environment using cognitive and pragmatic legitimation strategies (RQ2). The strategies related to environment selection have only limited usage for e-government projects as the initiatives are constrained by their objectives and goals.

Our findings support the argument by [START_REF] Avgerou | IT and organizational change: an institutionalist perspective[END_REF] that IT and organizational change undergo two different institutionalization processes and the legitimation of IT does not automatically lead to organizational change. [START_REF] Mignerat | Positioning the institutional perspective in information systems research[END_REF] found that acquiesce or conformance to environment was the most dominant response studied in IS literature. IS initiatives within an organization usually conform to the institutional field of the organization as the sponsors of the project are usually the senior management. We found this to be true even in the case of e-government projects as IS legitimation strategies use mechanisms whereby the IS innovation conforms to standards and norms in the professional discipline, even if the technology is untested and new. Our study finds empirical support for [START_REF] Henriksen | Dawn of E-Government -An institutional analysis of seven initiatives and their impact[END_REF] conclusion that manipulative or regulations are needed to embed IS innovations in organizational processes. While the technology may be accepted, usage of the technology in processes needs manipulative strategies. We also found that the legitimation strategies needed to gain the support of the supply side stakeholders differs from that required to popularize the concept among the larger demand side stakeholders. Pragmatic legitimacy is sought by supply side partners while cognitive legitimacy is required to gain the demand side acceptance. [START_REF] Cousins | The social shaping of electronic metals exchanges: an institutional theory perspective[END_REF] found that the B2B metal exchanges which survived had established pragmatic legitimacy in their business relationship among their trading partners. As the UID initiative is still in the initial adoption phase, it is too early to decide whether these strategies would result in sustained success and legitimacy of UID. While there are not many studies which has studied the legitimation strategies adopted by egovernment projects, some of the existing IS innovation literature supports these findings.

Though we used Suchmann (1995) classification for analyzing the legitimation tactics, we could map them to the strategic responses and tactics in response to institutional pressures identified by [START_REF] Oliver | Strategic responses to institutional processes[END_REF]. But we did not find examples for some of the tactics proposed by Oliver. For example, the strategic response and tactics related to "Defy" like 'Assaulting the sources of institutional pressure' is not addressed as part of the legitimation strategies. Is it because such a tactic does not help in gaining legitimacy? We approached this study of legitimation of NI projects assuming planned actions by organizational actors to institutionalize the new idea. But if we assume legitimation as a socially constructed concept Structuration theory by Giddens can be used as another lens to study legitimation of e-government projects.

We have identified the legitimation strategies adopted by UIDAI for gaining legitimacy using document analysis. [START_REF] Boxenbaum | The Process of Legitimation[END_REF] argues that this approach does not help identify the process of legitimation which involves the choices available to organizational actors and the context and trade-offs made while taking decisions. While we recognize the limitation of our method, we argue that the process of legitimation can be inferred from document analysis in the case of e-government initiatives. Being an e-government initiative UIDAI publishes all information through their website. Some of the details can be reconstructed using news articles, blogposts and other social media postings. But we realize that the sequence and linkages among strategies may not always be identifiable through methods like document analysis.

Conclusions

Aadhaar -the national identity project of India is unique and novel in many aspects and gaining legitimacy in its institutional field is critical for its long term survival. We used the lens of institutional theory to study the legitimation strategies adopted by this e-government initiative in India. One of the contributions of the paper is in identifying that NI projects adopt different strategies for institutionalizing the IS innovation and the NI processes. While conformance to environment is the dominant strategic mechanism for legitimizing IS innovation, manipulation of the environment is the mechanism adopted for institutionalizing the NI processes. The main contribution of the paper is that IT-enabled changes seek cognitive legitimacy with demand side stakeholders and pragmatic legitimacy with their supply side stakeholders.

This paper contributes to the e-government research by filling the gap in studying legitimation strategies in e-government. It also contributes to the institutional theory literature by bringing in the e-government context to legitimation strategies. Some of the future research areas are identifying the linkages between legitimation strategies, and associating the strategies to specific stages of the innovation diffusion cycle.

Fig 2 :

 2 Fig 2: Aadhaar enabled Payments Platform

Fig 3 :

 3 Fig 3: Institutional field of Aadhaar (illustrative)



  Rely on reputation of key personnel (C,p)  Co-optation with the Banking System (C,p)  Adopt existing e-government standards (C,c)  Define new hardware/device standards (C,c)  Adopt open source (C,c)  Mimic hardware architecture of large cloud infrastructure providers (C,c)  Undertake research and competency development in biometrics (C, c)  Rely on reputation of IT industry, outsourcing partners (C,p)  Co-optation with the Banking System (C,p)  Adopt existing e-government standards (C,c)  Define new hardware/device standards (C,c)  Leverage the mobile penetration (C,c)  Demonstrate success through announcements of number of Aadhaar enrolment and specific milestones (M,m) NI Processes Institutionalization  Seek legislation of UID (M, c)  Co-opt salient and influential stakeholders (M, c)  Use task forces (C, p)  Engage with government departments and public agencies (C, p)  Identify receptive state governments and district level officers for pilots (S, p)  Communicate the 'efficiency' goal to registrars (M, p)  Seek legislation of UID (M, c)  Co-opt salient and influential stakeholders (M, c)  Communicate the benefits of Identity (M, p)  Advertise an image of transparency and openness through actions like sharing data (M, p)  Form coalition of initial adopters and highlight success (M, m)  Persist with UID enrolments in spite of lack of regulatory support (M, c)  Popularize usage of UID authentication by through advocates of UID in the state government and administrative department (M, c)  Established Aadhaar as a de facto standard by mandating it for welfare schemes, retirement benefits and payroll of government employees (M,c).

Aadhaar means "foundation" in many Indian languages. UID and Aadhaar have been used interchangeably in this document.

Acknowledgements. The author would like to thank Prof. Abhoy Ojha, Prof. Rahul De' and Pramod Varma for their guidance and comments on previous versions of this paper. The author is also grateful to the two anonymous reviews of the IFIP WG 8.6 conference for their constructive comments which helped improve this paper.