Managing risk during information technology change