Reducing Risk in IT Decisions