Why your IT program is risker than you think