How to identify risky IT projects and avoid them turning into black swans