![Risk network and Risk Structure Matrix (adapted from [24])](https://www.researchgate.net/profile/Franck-Marle/publication/236216771/figure/fig1/AS:299356172374026@1448383481605/Risk-network-and-Risk-Structure-Matrix-adapted-from-24_Q320.jpg)
Content uploaded by Franck Marle
Author content
All content in this area was uploaded by Franck Marle on Oct 03, 2014
Content may be subject to copyright.
- 1 -
An integrated framework for risk response planning under
resource constraints in large engineering projects
Abstract
Engineering project managers often face a challenge to allocate tight resources for
managing interdependent risks. In this paper a quantitative framework of analysis for
supporting decision-making in project risk response planning is developed and studied. The
design structure matrix representation is used to capture risk interactions and build a risk
propagation model for predicting the global mitigation effects of risk response actions. For
exemplification, a genetic algorithm is used as tool for choosing response actions and
allocating budget reserves. An application to a real transportation construction project is also
presented. Comparison with a Sequential Forward Selection greedy algorithm shows the
superiority of the genetic algorithm search for optimal solutions, and its flexibility for
balancing mitigation effects and required budget.
Keywords: risk response planning, project management, complexity, design structure matrix,
resource constraints, genetic algorithm
Managerial relevance statement
The aim of this paper is to provide managers of engineering projects with an integrated
five-step framework to guide the risk response planning process, which is to determine and
implement preventive and corrective actions to avoid, reduce or transfer project risks. A
- 2 -
series of quantitative methods have also been presented for practical use, e.g., for modeling
risks and risk interactions, predicting global mitigation effects of response actions, and
optimizing the allocation of constrained budget to candidate response actions. Thus, the
framework supports project managers’ decision-making process in coping with the
complexity of project risks and resource constraints. An example of application to a real
industrial project of implementing a tramway system in a medium-sized city in Europe is also
provided. The proposed approach is expected applicable to a wide set of engineering projects
for risk management.
1. Introduction
Engineering projects require the timely accomplishment of a number of tasks, which
are exposed to risks of delay, erroneous or low quality completion, incompletion, etc. The
Project Management Institute (PMI) defines a project as “a temporary endeavor undertaken to
create a unique product, service or result”, and a risk as “an uncertain event or condition
whose occurrence affects at least one of the project objectives, e.g., scope, schedule, cost, and
quality” [1]. The classical Project Risk Management (PRM) process includes risk
identification, risk analysis, risk response planning, risk monitoring & control and lessons
learned. In particular, project risk response planning aims at identifying actions that can
reduce the threats to the realization of the project objectives at minimum cost. It includes the
identification and assignment of one or more persons (the “risk response owner”) to take
responsibility for each agreed-to and funded risk response action. Risks are addressed by their
priorities in terms of their impact on the project. Resources are then assigned to the budget
and risk response actions are scheduled in the project plan.
- 3 -
Risks are generally identified using more or less structured methods involving a
combination of experience, expertise and information search [2], with classical methods, for
example, based on analogy [3], heuristics [4] or analysis [5]. They are generally assessed
with respect to their probability and impact [1, 6, 7]. For risk prioritization, a very common
tool in risk management practice for projects and other contexts is the ‘risk matrix’ or
‘probability-impact grid’ (PIG) or ‘probability-impact graph’ [8-10]. Top-ranked critical risks
are then subject to budget allocation and action planning for prevention or mitigation. The
other risks identified are not treated, because the risk is regarded acceptable (in terms of both
probability and impact) or the action is too expensive and there is no sufficient budget
remaining.
However, engineering projects are growing in complexity, of both structure and context
due to the involvement of numerous, diverse and strongly interrelated elements [11-13]. This
situation exposes projects to a number of diverse and interdependent risks, which implies that
identifying and analyzing their causes and effects is an important aspect. For instance, Failure
Modes and Effects Analysis (FMEA) consists in a qualitative analysis of dysfunction modes
and their effects [14]. Initially developed for product-related risks, it has been expanded to
process-related and project-related risks, where the focus changes, but the principle is the
same, consisting in identifying direct causes and effects of a potential failure. Fault Tree and
Cause Tree Analyses determine the conditions which lead to an event, and link them through
logical connectors in a tree-structure which clearly displays causes and effects of the
particular risk analyzed [15, 16]. Some methods have been considered for analyzing the
interrelationships among risks, such as Bayesian Belief Networks [17, 18], System Dynamics
[19-22], and Influence Diagrams [23].
- 4 -
In addition, risk analysis methods and risk response planning methods do not share the
same objectives. Risk analysis methods can help to identify actions (for instance, preventive
actions by inferring the causes of a risk from a bow-tie diagram), but they do not indicate
how to decide on which actions to undertake or not. Within the risk decision-making process,
these methods perform the step of searching alternatives, not the step of sorting / ranking the
alternatives. In the end, risk responses must be appropriate, cost effective, and realistic within
the project context. Selecting the best risk response from several options is often required. To
measure the effectiveness of an action or of a portfolio of actions is not easy, since it affects
an uncertain event with the additional uncertainty inherent to the planning and execution of
the action itself.
In our work here presented, the complexity underlying the web of interconnections
among project risks is modeled and represented in terms of a risk network [24]. Such network
representation captures the individual risks and the interactions which may trigger global
phenomena, like chain reactions or loops. For instance, a single source risk such as project
schedule delay, may impact on the risk of cost overrun, which influences a technical risk, and
propagates looping back to amplify the original delay. Then, the effects of response actions
designed for mitigating the exposure to one or several risks may impact other parts of the
network, so that the overall effects of risk response actions may be very different from the
expectation of project managers. The challenge of risk response planning is rendered more
difficult by the limitation of resource. As constraints become tighter, balancing risks is more
critical and less intuitive. For these situations, reliable analytical methods can help project
managers plan risk response actions that optimize resource allocation [25-27].
In this paper, a novel integrated five-step framework is introduced to guide the risk
response planning process, which is to determine and implement preventive and corrective
- 5 -
actions to avoid, reduce or transfer project risks. A matrix-based method is used to facilitate
identifying and assessing risk interactions, and build the representative project risk network.
This enables the risk propagation behavior in the network to be analyzed. It is then possible
to anticipate the global effects of response actions identified by the project management team.
Thus, the framework supports project managers’ decision-making process in coping with the
complexity of project risks and resource constraints. An example of application to a real
industrial engineering project, which consists in implementing a tramway system in a
medium-sized city in Europe, is considered.
For this case study, a genetic algorithm is developed to optimize the plan of response
actions under given budget constraints. Genetic algorithm (GA) is a probabilistic search
method introduced by Holland in 1970s [28]. It is based on Darwin’s principle of “survival of
the fittest”, and has rapidly become a popular evolutionary technique for solving complex
combinatorial optimization problems, in a wide range of applications [29]. For example, they
have been extensively used for the optimization of system reliability and maintenance [30-33],
index fund portfolio management [34, 35], project scheduling [36-38] and machine
scheduling problems [39, 40]. The GA results are compared with those obtained by using a
greedy algorithm, which is based on Sequential Forward Selection (SFS) [41], where the
search for the optimal solution proceeds by making the locally optimal choices at each step,
with the hope of finding the global optimum.
The remainder of the paper is organized as follows. Section 2 introduces the integrated
framework for risk response planning under resource constraints. Section 3 describes the
process of building the project risk network and a risk propagation model. In Section 4, the
remaining steps of the framework and the developed algorithms for optimizing the risk
- 6 -
response plan are presented in details. Section 5 illustrates the application of the proposed
approach to a real industrial project. Finally, we conclude the paper in Section 6.
2. An integrated framework for risk response planning
In this Section, a five-step framework for project risk response planning is presented
(Fig.1):
1) Building project risk network;
2) Defining objective function;
3) Identifying budget constraints;
4) Identifying potential response actions;
5) Optimizing risk response plan.
Building the project risk network allows us to follow risk propagation in the project.
Potential risk response actions can then be proposed, given the risk management objectives
and budget constraints. The effects of these response actions can be traced and anticipated in
the risk network model. Embedding these analyses within an optimization algorithm (like the
SFS greedy algorithm or the genetic algorithm used in this paper) allows searching for an
optimal project risk response plan.
The details of each step of the framework are discussed in the following Sections 3
(step 1, which consists of a few sub-steps) and 4 (steps 2 to 5). In practice, the
implementation of the proposed framework requires the involvement of the project
management team in each step, to provide the necessary project knowledge and expertise and
to take decisions.
- 7 -
Fig.1. Framework for risk response planning
3. Building project risk network (step 1)
The project risk list containing previously identified potential risks is provided by the
project management team (step 1.1). It serves as an input for studying risk interactions in
order to build the project risk network.
- 8 -
3.1. Identification of risk interactions (step 1.2)
The Design Structure Matrix (DSM) method introduced in [42] has proven to be a
practical tool for representing and analyzing relations and dependencies among system
components [43, 44]. For example, it has been extensively used in process modeling and
project scheduling problem for design and product development projects, such as in [45-49].
In this work, we use the DSM method to identify risk interactions, for determining the cause-
effect relationships among project risks. It provides a simple and concise way to represent the
inter-relationships in a complex system. This helps the project manager and the experts
focusing on one risk and its dependency with other risks (causes in row and effects in column)
during the identification and also the subsequent assessment process, while not getting
confused in the complex interrelationships among risks. In addition, the possible existing
DSMs representing the interrelations among project objects, such as tasks, actors and product
components, can be used to guide the identification of the interactions among the risks
associated to these objects. For example, an object-object relationship (whether functional,
structural or physical) means that risks, which may be related to product function, quality,
delay or cost, can be linked, since a problem on one object may have an influence on another.
For instance, the project schedule gives information about task-task sequence relationships;
this enables identifying relationships among risks of delay on these tasks.
Moreover, a number of DSM tools and algorithms have been developed to facilitate
systemic information acquisition and matrix-based analysis, e.g., in [50, 51]. Although
applying these DSM tools/algorithms is not in the scope of this paper, using the DSM
methods may provide possible solutions (e.g., in risk grouping and risk owner assignment)
for other managerial purposes.
- 9 -
Risk interaction consists of a precedence relationship between two linked risks. We can
represent this by the Risk Structure Matrix (RSM), which is a square matrix whose generic
element:
1 if there is an interaction between risk
s and
0 otherwise
ij i j
ij
RSM R R
RSM
=
=
(1)
Fig. 2 shows an example of a risk structure matrix capturing the relationships in the risk
network.
Fig. 2. Risk network and Risk Structure Matrix (adapted from [24])
In the process of building the risk network structure, a sanity check is performed.
Suppose we know that
R
j has
R
i as a cause: if
R
i does not have
R
j as a consequence, then there
is a mismatch. All identified mismatches are studied and solved, like in [52]. Multiple experts
are engaged for this task, after being made aware of the possible confusion between direct
and indirect interactions among risks, and being asked to concentrate on direct dependencies.
For solving mismatches, the two actors involved at each end of the edge are asked to confirm
or to deny their initial proposal by discussing together. Generally, people are more easily
aware of potential causes that may affect them, rather than potential effects of their own
- 10 -
failures. This is why these discussions are mandatory and useful, both for creating a reliable
input matrix and for creating links among people.
3.2. Assessment of risk interactions (step 1.3)
In the assessment task, we not only evaluate risk characteristics such as impact and
probability, but also assess the strength of risk interactions (interpreted as transition
probability between risks). Risk impact may be assessed on a qualitative scale (ordinal or
cardinal scale with 5 or 10 levels for instance) or on a quantitative scale (financial loss for
instance). Risk impact is assessed by classical methods, based upon a mix of previous
experience and expert judgment [1, 53].
For the probability assessment, we make a distinction between the probability of a risk
to be triggered by another risk inside the network, and its probability caused by external
events or risks which are outside the system. Spontaneous probability can be interpreted as
the likelihood of a risk which is not the effect from other activated risks inside the system. On
the other hand, transition probability measures the likelihood of direct cause-effect relation
between two risks. For the example in Fig. 2, Risk 5 occurs only by spontaneous probability;
and Risk 6 may arise from both its spontaneous probability and the transition probability
between Risk 5 and Risk 6.
Qualitative scales are often used to express risk probability with 5 to 10 levels (e.g.,
very rare, rare, unlikely, likely, etc.), which typically correspond to non-linear probability
values (e.g., 10
-4
, 10
-3
, 10
-2
, 10
-1
, etc.) [9, 54].
3.3. A risk propagation model (step 1.4)
Some DSM-based work has been done to model the propagation or transmission
behavior in the design process. For example, Clarkson and Hamilton proposed a
- 11 -
“signposting” model to identify the next design tasks based on the confidence in key design
parameters [55]; Smith and Eppinger introduced a work transformation matrix based on the
DSM method to model the engineering design iteration process [49]. In the domain of project
risk management, a matrix-based risk propagation model has been presented in [56]. This risk
network model can be used to predict the global effects of response actions on the entire risk
network.
Suppose there are N identified project risks in the network. Let vector s represent their
spontaneous probabilities, i.e. the initial vector of risk probabilities before propagation in the
network. Let the N-order square matrix T denote the matrix of transition probabilities. We
make the assumption that a risk may occur more than one time during the project (as
witnessed in practical situations). Risk probability is thus cumulative if arising during
propagation from different causes or several times from the same cause. After m steps of
propagation, the probability vector of risks is thus equal to
m
T s
⋅
and the cumulative risk
probability vector P is given by the following equation:
1 1 0
( ) ( )
m m m
i i i
i i i
P s T s I T s T s
= = =
= + ⋅ = + ⋅ = ⋅
∑ ∑ ∑
(2)
where I is the N-order identity matrix. In the limit of infinite propagation steps in the project
development,
0
lim( )
mi
mi
P T s
→∞ =
= ⋅
∑
(3)
Multiplying both sides of Eq. (3) by (I - T),
1
0
( ) ( ) ( ) ( )
mi m
i
I T P I T T s I T s
+
=
− ⋅ = − ⋅ ⋅ = − ⋅
∑
(4)
- 12 -
It is not guaranteed that the infinite product of the transition matrix T would converge
to 0, as shown in the following equation:
lim 0
m
m
T
→∞
=
(5)
Sufficient conditions for the convergence of an infinite product of matrices have been given,
e.g., in [57-59]. Since in our case T is the risk transition matrix, which is usually sparse and
composed of transition probability values less than 1, convergence is usually satisfied. Thus,
the cumulative risk probability vector can be re-evaluated as:
1
( )
P I T s
−
= − ⋅
(6)
Response actions performed on the risk network translate in changes in the values of
the parameters of the model, e.g., the spontaneous probabilities in vector s, the transition
probabilities in matrix T. The global effects of these actions in terms of the new values of the
risk probabilities in the vector P after actions implementation can then be obtained by
running the propagation model.
4. Formulating and solving the optimization problem
4.1. Defining objective function (step 2)
Generally, risk response actions with allocated budget are conducted to achieve two
different goals: the local mitigation of particular risks and the global risk exposure mitigation.
In this paper, we only consider minimizing the overall risk exposure or expected financial
loss in global sense. In this regard, the objective function OF can be defined as:
1
N
i i
i
OF P G
=
= ∗
∑
(7)
- 13 -
where P
i
and G
i
indicate the probability and impact (G for gravity scale or financial value) of
Risk i.
4.2. Identifying budget constraints (step 3)
Given the project scope, a budget for project risk management, called B
RM
, is initially
established by the project manager. This budget is dependent on the total budget of the
project, the evaluated overall level of risk exposure, and also the risk attitudes of the
stakeholders.
The budget B
RM
is normally comprised of three parts. Besides the expense for
performing risk analysis B
RA
(not significant compared with the other parts) and the reserve
for risk contingency B
RC
, the remaining amount B
RR
is for the execution of the risk response
plan:
RR RM RA RC
B B B B
= − − (8)
It should be noted that based on the results of the project risk analysis and of the
evaluation of the costs of actions in Step 4 (Fig. 1), the budget for performing the risk
response plan B
RR
can be updated according to the new knowledge acquired with regard to
the risk management tasks.
4.3. Identifying potential response actions (step 4)
The identified project risks can be analyzed and prioritized using classical methods or a
simulation model based on the risk network [24] (step 4.1). However, it is not the main
concern of this paper. Aiming at achieving the objectives defined for risk management, for
example, mitigating the global risk exposure as mathematically captured by the OF in Eq. (7),
potential response actions can be identified based on the project risk analysis results (step
4.2). The response action list may include different types of risk response actions on risks and
- 14 -
their interactions, in terms of risk sharing, risk avoidance, risk mitigation and risk acceptance,
etc. These actions are, for instance, adopting less complex processes, conducting more tests,
enhancing internal communication, choosing a more stable supplier, etc. From the point of
view of the framework of modeling and analysis, conducting the response actions has the
effects of changing the values of some of the parameters of the risk network model. For
example, a classical response action on a particular risk reduces its spontaneous probability or
impact; a complementary preventive action is to cut off the input links or reduce their
transition probabilities; blocking the output links can be regarded as the action of confining
the further propagation of such risk to subsequent risks.
Risk response actions always consume time, money and other resources. In order to
perform the optimization, the cost of each identified action is evaluated by the project
management team (step 4.3). Actions should be worthwhile, i.e., more valuable than the
expected value of the risk impact. Before the next step of optimization, the response action
list shall be examined by the project manager to exclude the unfeasible actions.
4.4. Optimizing risk response plan (step 5)
For each risk response action identified in Step 4, the project manager can decide
whether to implement it or not. Given a list of n candidate actions, there are 2
n
-1
combinations for the risk response plan aiming at mitigating the overall risk exposure (the
global objective function). An exhaustive test of all the combinations is impractical.
Considering the resource constraints, heuristic algorithms can be exploited to optimize the
portfolio of response actions: here, we provide two examples of such algorithms which are
then applied on a real case study in Section 5.
- 15 -
4.4.1. A SFS greedy algorithm
A greedy algorithm based on Sequential Forward Selection is developed for the
optimization of a risk response plan under constraints. At each step the action with the best
test performance is chosen until the budget is completely allocated. The risk propagation
model presented in Section 3.3 can be used to evaluate the mitigation performance of actions
in terms of the OF in Eq. (7).
The SFS greedy algorithm is sketched as follows:
Usually such greedy algorithm for optimization under constraints can achieve only a
locally optimal solution because it makes commitments to certain choices too early, which
Identify the budget constraint B
RR
;
Prepare the action list L;
Create the portfolio of actions
A
=∅
;
WHILE
L
≠ ∅
DO
BEGIN
FOR each
i
A L
∈
IF the cost of
Ai
exceeds the remaining budget
BRR:
(
( )
i RR
C A B
>)
Remove Ai from L : (
\
i
L L A
=);
ELSE
Test the global mitigation effects of
i
A A
U
in the risk network model;
END
END
Choose the best candidate Ai*;
Add Ai* into A : (
*
i
A A A
=U
);
Remove
A
i* from
L :
(
*
\
i
L L A
=);
Allocate the corresponding amount of budget (
*
( )
RR RR i
B B C A
= − );
END
RETURN
A as the optimal portfolio of actions.
- 16 -
prevent it from finding the best overall solution later. For example, choosing at an early stage
an action with positive effects but expensive reduces the budget remaining for future actions,
with the risk of sacrificing opportunities.
4.4.2. A genetic algorithm
In our work, a genetic algorithm is devised for the optimization of a project risk
response plan. The aim is to find an optimal portfolio of actions, whose performance is
measured by an objective function (fitness) which integrates the budget constraint. The
synergic effects (positive or negative) of the actions in the portfolio are taken into account,
because the entire portfolio is tested on the risk network model, while not just the single
actions separately.
The basic genetic algorithm-based optimization process is described as follows:
1) Basic Scheme
1) Representation
Generation GEN = 1;
Create initial population POP of individuals Ind (each one is a portfolio of actions);
WHILE GEN < GEN* AND (Not Terminate-Condition) DO
BEGIN
GEN = GEN + 1;
Apply each portfolio of actions (
Ind POP
∈
) to the risk network model and compute the
fitness values for each individual;
Select parents
PAs
from
POP
;
Produce children
CHs
from
PAs
by Crossover;
Mutation operation on children
Ind CHs
∈
;
POP POP CHs
=U
;
Reduce
POP
by fitness ranking;
END
- 17 -
A risk response plan of n actions A
i
(i = 1, …, n) is suitable to be encoded as a string of
bits
1 2 1
={ , ,... ,... , }
i n n
x x x x x x
−
forming a chromosome (individual) in the GA. Each bit
{0,1}
i
x∈indicates whether the corresponding action A
i
is chosen in the portfolio or not.
2) Fitness
We integrate the budget constraint into the objective function (fitness) of the
optimization problem, aiming at minimizing the value:
1
( )+(1 )( / )
N
i i RR
i
Fitness f P G C B
β
λ λ α
=
′ ′
= ∗ −
∑
(9)
Here C is the total cost of the action plan;
i
P
′
and
i
G
′
are the probability and impact of
Risk
i
after the implementation of the response plan. The penalty value
( / )
RR
C B
β
α
significantly increases if the allocated costs C exceed
RR
B
α
(
0 1
α
< ≤
), e.g.,
90% of the budget constraint. Thus, breaking constraints is penalized by the decrease of the
fitness. The parameter
1
β
>
reflects the project manager’s degree of aversion to budget
overruns. The project manager can adjust the parameter
[0,1]
λ
∈
to balance the trade-off
between budget constraints and mitigation effects.
The details of the GA process are introduced in the Appendix.
5. Application to a real industrial project
The framework proposed has been implemented to a real engineering project aimed at
building a tramway infrastructure and associated systems. The project includes the
construction and implementation of tramway, equipment, and civil work.
- 18 -
5.1. Build the project risk network (step 1)
An original project risk list has been provided by the project manager. It contains 56
identified risks at the main level, with their names, domains and qualitatively evaluated
characteristics, as shown in Table 1. The project risks identified with negative effects belong
to different categories such as Technical, Contractual, Financial,
Client/Partner/Subcontractor, and Project management on construction site.
Using the DSM-based method introduced in Section 3.1, the interactions among the 56
risks have been identified with the help of the project manager and the team of experts,
composed of the 11 risk owners. For each risk, experts were asked to provide information
about the potential causes and effects (to explore the row and the column corresponding to
the considered risk in the risk structure matrix). The aggregation of local cause-effect
relationship identifications enables to build the global risk network.
As anticipated in Section 3.2, the assessment of the identified risk interactions was then
performed on a 10-level Likert scale, due to the high expertise of interviewees. This requires
the participation of several experts involved in the project, since it necessitates a wide
overview of the project elements and stakes. In this case study, four risk owners, including
the project manager, were mostly contributing to the data gathering. The other owners and an
external risk manager were only solicited to give some specific and local information, and to
validate existing data. In the end, the binary risk structure matrix can be transformed into the
matrix of the transition probabilities between risks.
- 19 -
Table 1. Tramway project risk list and related characteristics
20
5.2. Define the mitigation objective and budget constraint (steps 2 and 3)
In this prototype application, the aim is to mitigate the global risk exposure, and for this,
the objective function in Eq. (7) is used as the function for which minimization is sought. The
impact of risks is assessed in terms of qualitative severity scale (from 1 to 10) for this case study,
as shown in Table 1.
We suppose in this case study that the budget reserve for implementing the risk response
plan is B
RR
= 300 k€.
5.3. Build the action list (step 4)
With the help of the project management team, a list of potential risk response actions is
proposed, as reported in Table 2. The 21 proposed actions are based on a refined analysis, taking
into account interactions between risks and eliminating some unfeasible ones. The actions are
intended to mitigate the risk nodes (reduce risk spontaneous probability or risk impact) or the
risk interaction edges (reduce transition probability between risks). The local effects of the
response actions are estimated (Table 2). The global effects of the actions can be predicted using
the risk propagation model described in Section 3.3. The cost for executing these actions is also
estimated by the project management team.
21
Table 2. List of risk response actions
22
5.4. Optimize the portfolio of actions (step 5)
Optimization results obtained using both the SFS greedy algorithm and the genetic
algorithm are illustrated and compared in this Section.
5.4.1. Greedy algorithm results
The SFS greedy algorithm devised in Section 4.4.1 has been used to obtain a portfolio of
actions, given the budget constraint B
RR
= 300 k€. The results are reported in Table 3, following
the successive iterations of optimal action addition to the portfolio.
The optimal portfolio A
*
contains 11 actions: A
*
= [A1, A2, A3, A4, A5, A6, A8, A9, A12,
A13, A16]. The total cost is 295 k€ and the value of the objective function, namely the overall
risk exposure, has been reduced from 63.128 to 43.599 thanks to the identified actions.
23
Table 3. Optimization results using the SFS greedy algorithm
Iteration Selected
Action ID Cost
(k€)
Objective
Function
Value
Added
Effects Current Portfolio Allocated
Budget (k€)
Initial
Status - 0 63.128 0.000 [Null] 0
1 A16 40 59.572 -3.556 [A16] 40
2 A5 20 56.521 -3.051 [A16,A5] 60
3 A9 5 54.367 -2.154 [A16,A5,A9] 65
4 A2 10 52.558 -1.808 [A16,A5,A9,A2] 75
5
A4
20
50.777
-
1.781
[A16,A5,A9,A2,A4]
95
6 A6 10 49.222 -1.555 [A16,A5,A9,A2,A4,A6] 105
7 A1 35 47.910 -1.313 [A16,A5,A9,A2,A4,A6,
A1] 140
8 A8 20 46.641 -1.269
[A16,A5,A9,A2,A4,A6,
A1,A8] 160
9 A13 60 45.434 -1.208 [A16,A5,A9,A2,A4,A6,
A1,A8,A13] 220
10 A12 20 44.424 -1.009 [A16,A5,A9,A2,A4,A6,
A1,A8,A13,A12] 240
11 A3 55 43.599 -0.825 [A16,A5,A9,A2,A4,A6,
A1,A8,A13,A12,A3] 295
5.4.2. Genetic algorithm results
In the genetic algorithm, the population size is set to M = 100 individuals. The Roulette
Wheel Method is used for selecting the parents for the next generation. The crossover fraction is
set to 0.8, and the mutation rate is set to 0.01 by testing. The termination condition is set as either
24
1) the maximum number of generations GEN* = 100; or 2) there is no improvement in the best
fitness value for 20 successive generations.
For the parameters of the fitness function f of Eq. (9), we set
=0.9
λ
,
=0.95
α
and
=20
β
by
experience and testing. We have run the GA for twenty times with different random seeds and
selected the best solution among them. In that run performed, the algorithm terminates at the 48
th
generation and the best individual is the chromosome x
*
= [1, 1, 0, 1, 1, 1, 1, 1, 1, 0, 1, 1, 1, 0, 0,
1, 0, 0, 0, 0, 1], corresponding to the decoded optimal portfolio A
*
= [A1, A2, A4, A5, A6, A7,
A8, A9, A11, A12, A13, A16, A21]. The best fitness value is equal to 39.052. The total cost of
implementing action plan A
*
is 295 k€. The objective function of global risk exposure in Eq. (7)
is reduced to the value of 43.169.
Comparison with the results of the SFS greedy algorithm (Table 4) shows that in the
optimal solution obtained by the genetic algorithm, the action A3 has been replaced by the
combination of A7, A11 and A21. In this case, the required budget for the portfolio is the same,
but the optimal risk response plan has better effects on the objective of mitigating the global risk
exposure.
Table 4. Comparison of the results obtained by the greedy and genetic algorithms
Method Optimal Portfolio Number of
Actions
Required
Budget (k€)
Objective
Function Value
SFS Greedy
Algorithm
[A1, A2, A3, A4, A5, A6, A8,
A9, A12, A13, A16
]
11 295 43.599
Genetic
Algorithm [A1, A2, A4, A5, A6, A7, A8,
A9, A11, A12, A13, A16, A21] 13 295 43.169
25
The parameters of the genetic algorithm can be modified to reflect the adjustment of
strategy by the risk management. For example, if we set
0.8
λ
=
to strengthen the control over the
budget, the optimal portfolio becomes A
*
= [A1, A2, A4, A5, A6, A7, A8, A9, A12, A13, A16,
A21]. We can see that A11 has been removed from the action plan so that the required budget
has decreased to 275 k€, with an objective function value of 43.443.
On the other hand, if we increase the balance factor
λ
to 0.95 for emphasizing the
mitigation effects, the optimal portfolio becomes A
*
= [A1, A2, A3, A4, A5, A6, A8, A9, A12,
A13, A16, A21]. In this case, A3 has replaced the actions A7 and A11. As a result, the objective
function has improved to 42.963. However, extra budget is required to achieve such result, for a
total cost of the risk response plan equal to 320 k€.
6. Discussion
This study has been motivated by questions and requests by practitioners, who are ready to
apply more sophisticated techniques to make decisions about their risk response plans. They
were confident in the results of the case study on the tramway construction project, since both
algorithms confirmed their priorities.
Apparently, the comparison of the results on the case study indicates that the genetic
algorithm provides a superior search for the optimum than the greedy algorithm. The deficiency
of the SFS greedy algorithm is that only the effect rather than the cost of actions is considered as
the basis for local searches, which may prevent it from finding the global optimal solution. On
the contrary, through testing the entire response plans while not individual actions in the risk
26
network model, the genetic algorithm takes into account the synergy or co-effects of different
actions for mitigating. Moreover, by adjusting the parameters of the fitness function, the project
manager is able to achieve a trade-off between improving risk management results and lowering
the budget.
However, the practitioners were attached to the sequence of inclusion of actions in the
portfolio by the SFS greedy algorithm, even if in a global optimization algorithm, like GA, this
could not have any importance. Specifically, they were confident on inclusion of actions A16,
A5 and A9, rather than A13, A12 and A3. On this last action A3, they were ready to include it in
their action plan, and both greedy algorithm (since this was the last action included in the
portfolio) and genetic algorithm (since it was not included in the optimal portfolio, but embraced
after relaxing the budget constraint) proved helpful in convincing them to change their plan in
such direction. In general, it is to be expected that the optimization should change only some
elements of an action plan, and not make a complete revolution, since decision-makers are
capable of identifying the most important and efficient response actions. The optimization work
can help in the decisions for actions which are close from inclusion or exclusion, and in the
identification of possible big surprises, although less frequent.
One may wonder when to perform this process of data gathering and related analysis. In
most cases, the earlier, the better. Indeed, it changes the risk response plan, with its associated
budget, resources and actions, so it is recommended to change decisions before they are applied.
However, information may be neither available nor reliable at the very beginning of the project,
which may result in irrelevant action plans. The decision about the schedule (one or several times
during the project) should thus be a balance between the necessities to do it early enough and to
27
have enough reliable information. The best moment depends on the degree of uncertainty on data.
If projects are recurrent and some historical data are available, both on risks, risk interactions and
risk response alternatives, then this process may be run at the earliest phases. But generally, if
the context is new (country, subcontractors), or if the objectives are significantly different, then it
is better to wait to have enough and more reliable data. In the case study presented here, the
project had already been launched before the beginning of the study. Eight risk review meetings
had been conducted before our intervention.
It should be admitted that there exist limitations of applying the proposed approach in
practice. For example, the difficulties and uncertainties are unavoidable in identifying and
quantifying the risk interactions using the DSM methods. First, the issue of a correct risk
identification and particularly risk formulation is relevant. In this regard, efforts should be made
by the project management team to determine the proper level of details and the way to
formulate risks in less ambiguous ways. Second, it is sometimes difficult to differentiate direct
and indirect interactions between risks, although the interviewees have been reminded to
concentrate on direct dependencies. Third, dealing with project risks, especially the probabilities
being used, includes subjective assessment and thus uncertainties. Subsequently, we have to be
very careful when manipulating uncertain / unreliable data using optimization algorithms, since
the output depends on the reliability of the inputs. One should not apply blindly the optimization
results, but should analyze carefully the gap between the proposed solution and its neighbors.
Also, we have to be careful when using quantitative data, since we cannot have all the data
which are quantitative, so the danger is to mix qualitative and quantitative data.
28
7. Conclusion and perspective
In this paper, we have presented an original framework for decision support in project risk
response planning, and showed how it is applied to a real case study of a tramway construction
project. Through modeling risk interactions, the framework makes it possible to analyze risk
propagation behavior and thus to anticipate the overall effects of response actions on the global
risk network. It can guide the project manager design some non-conventional actions on risk
interactions which mitigates risk propagation instead of risk occurrence. For optimally allocating
tight resources for risk mitigation, i.e., selecting the best risk response plan from an action list
with many options, a Sequential Forward Selection greedy algorithm and a genetic algorithm
have been investigated, taking into account budget constraints. The comparison of the results
obtained by these two optimization algorithms shows that the genetic algorithm has superior
performance. The proposed framework and quantitative methods are expected applicable to a
wide set of engineering projects for risk management.
In addition to the limitations of the approach discussed above, for potential improvements,
the stakeholders’ or the project manager’s preferences would be included into the risk response
planning process. For example, the mitigation of several particular risks is sometimes mandatory.
In addition, the portfolio of actions may be more complex. In practice, for instance, if more funds
are allocated on the reinforcement of a component or task, the probability of its failure risk will
decrease. In this regard, an action for mitigating risks, for example, A2 can be subdivided into
several alternatives (e.g., A2.1, A2.2, and A2.3) with different levels of cost, which will
undoubtedly generate different levels of mitigation effects. In this case, we need not only to
decide whether to choose an action or not, but also to optimize the level of investment on each
29
action and related risks. Furthermore, the developed DSM-based tools/techniques can be
considered for managerial purposes concerning risk management, e.g., in risk grouping and risk
owner organization. This work will also be considered for program management of multiple
related projects with regard to risk management.
Appendix. The process of Genetic Algorithm for this study
1) Initial population
An initial population of M individual solutions is created randomly. Each individual is a risk
response plan, namely a portfolio of actions. Population diversity (i.e., differences in the individuals) is
encouraged to investigate more broadly the search space [60].
2) Selection of the parents
During each successive generation, a proportion of the existing population is selected to breed a
new generation. Individual solutions are selected through a fitness-based process, where fitter solutions
(with lower values of the fitness function) are more likely to be selected. We employ the straightforward
Roulette Wheel Selection method [61, 62]: the chromosome
k
x
is selected if:
1
1 1
1 1
( ) ( )
( ) ( )
k k
j j
j j
M M
j j
j j
f x f x
r
f x f x
−
= =
= =
< ≤
∑ ∑
∑ ∑
(10)
where r is the generated random number with
(
]
0,1
r∈
.
3) Crossover and mutation
Crossover allows combining two parents to form a child. We employ a conventional scattered
crossover as sketched in Fig. 3 [63]. A random binary vector is created as bit mask. It selects the genes
30
from parent 1 where the mask bit is ‘1’, and the genes from parent 2 where the mask bit is ‘0’, and
combines the genes to form the child. It should be noted that in Fig.3 the symbols a~h and 1~8 are
replaced by binary bits in the work here presented. A crossover fraction of value in [0, 1] specifies the
portion of the individuals in the next generation that are produced by crossover, other than the elite
individuals (the number of individuals that are guaranteed to survive to the next generation). Elitism is the
process of selecting individuals with a bias towards the better ones, which is based on fitness ranking in
the developed GA. Indeed, elitism is important for allowing the solutions to get better over generations.
Fig. 3. Illustration of the crossover operation
Mutation inserts small random changes in the individuals of the population, which further favors
genetic diversity. It thus enables the GA to extend the search to a broader space. A mutation rate is
introduced as the probability that a bit in a chromosome will be reversed (0->1, 1->0). The mutation rate
for a single bit is usually taken very low for binary encoded genes [64].
4) Reduction of population for the next generation
We use the conventional GA with fixed population size in this work. In this regard, fitness ranking
is used to guide the reduction of the population for the next generation [30]: the individuals with lowest
fitness are removed from the enlarged population of parents and children, where the original size M is re-
established.
31
5) Termination condition
In this work, the search iterations of the GA are terminated simply when an a-priori fixed number
of generations GEN
*
is reached, or when the top ranked solution's fitness has stabilized, i.e., a fixed
number of successive iterations no longer improve it.
References
[1] PMI Standards Committee, "A Guide to the Project Management Body of Knowledge (PMBOK) (2008 ed.)," Project
Management Institute, 2008.
[2] E. Maytorena, G. M. Winch, J. Freeman, and T. Kiely, “The influence of experience and information search styles on
project risk identification performance,” IEEE Transactions on Engineering Management, vol. 54, no. 2, pp. 315-326,
2007.
[3] R. Riek, “From experience: Capturing hard-won NPD lessons in checklists,” Journal of Product Innovation
Management, vol. 18, no. 5, pp. 301-313, 2001.
[4] R. J. Chapman, “The controlling influences on effective risk identification and assessment for construction design
management,” International Journal of Project Management, vol. 19, no. 3, pp. 147-160, 2001.
[5] H. Shimizu, and H. Noguchi, “Reliability problem prevention method for automotive components-development of
GD'3' activity and DRBFM method for stimulating creativity and visualizing problems,” Transaction of Society of
Automotive Engineers of Japan, , vol. 36, no. 4, pp. 163-168, 2005.
[6] T. Raz, and E. Michael, “Use and benefits of tools for project risk management,” International Journal of Project
Management, vol. 19, no. 1, pp. 9-17, 2001.
[7] T. Williams, “A classified bibliography of recent research relating to project risk management,” European Journal of
Operational Research, vol. 85, no. 1, pp. 18-38, 1995.
[8] C. Chapman, and S. Ward, "How to manage project opportunity and risk: why uncertainty management can be a much
better approach than risk management," John Wiley & Sons Ltd., 2011.
[9] A. T. Cox Jr, “What's wrong with risk matrices?,” Risk Analysis, vol. 28, no. 2, pp. 497-512, 2008.
[10] A. Ahmed, B. Kayis, and S. Amornsawadwatana, “A review of techniques for risk management in projects,”
Benchmarking: An International Journal, vol. 14, no. 1, pp. 22-36, 2007.
[11] D. Baccarini, “The concept of project complexity – a review,” International Journal of Project Management, vol. 14,
no. 4, pp. 201-204, 1996.
[12] D. Chu, R. Strand, and R. Fjelland, “Theories of complexity – Common denominators of complex systems,”
Complexity, vol. 8, no. 3, pp. 19-30, 2003.
[13] A. Tiwana, and M. Keil, “Functionality risk in information systems development: an empirical investigation,” IEEE
Transactions on Engineering Management, vol. 53, no. 3, pp. 412-425, 2006.
[14] J. R. Bradley, and H. H. Guerrero, “An alternative FMEA method for simple and accurate ranking of failure modes,”
Decision Sciences, vol. 42, no. 3, pp. 743-771, 2011.
[15] J. A. B. Geymayr, and N. F. F. Ebecken, “Fault-tree analysis: a knowledge-engineering approach,” IEEE Transactions
on Reliability, vol. 44, no. 1, pp. 37-45, 1995.
[16] R. Ferdous, F. Khan, R. Sadiq, P. Amyotte, and B. Veitch, “Fault and event tree analyses for process systems risk
analysis: uncertainty handling formulations,” Risk Analysis, vol. 31, no. 1, pp. 86-107, 2011.
[17] E. Lee, Y. Park, and J. Shin, “Large engineering project risk management using a Bayesian Belief Network,” Expert
Systems with Applications, vol. 36, no. 3, pp. 5880-5887, 2008.
32
[18] C. Fan, and Y. Yu, “BBN-based software project risk management,” Journal of Systems and Software, vol. 73, no. 2,
pp. 193-203, 2004.
[19] J. M. Lyneis, and D. N. Ford, “System dynamics applied to project management: a survey, assessment, and directions
for future research,” System Dynamics Review, vol. 23, no. 2-3, pp. 157-189, 2007.
[20] J. Xu, X. Li, and D. D. Wu, “Optimizing circular economy planning and risk analysis using system dynamics,” Human
and Ecological Risk Assessment, vol. 15, no. 2, pp. 316-331, 2009.
[21] T. Williams, Modelling complex projects, Chichester: Wiley, 2002.
[22] T. Williams, F. Ackermann, C. Eden, and S. Howick, “Project risk: systemicity, cause mapping and a scenario
approach,” Managing Risks in Projects, pp. 343-352, 1997.
[23] I. Dikmen, M. T. Birgonul, and S. Han, “Using fuzzy risk assessment to rate cost overrun risk in international
construction projects,” International Journal of Project Management, vol. 25, no. 5, pp. 494-505, 2007.
[24] C. Fang, and F. Marle, “A simulation-based risk network model for decision support in project risk management,”
Decision Support Systems, vol. 52, no. 3, pp. 635-644, 2012.
[25] R. L. Dillon, M. E. Pate-Cornell, and S. D. Guikema, “Programmatic risk analysis for critical engineering systems
under tight resource constraints,” Operations Research, pp. 354-370, 2003.
[26] R. L. Dillon, M. E. Pate-Cornell, and S. D. Guikema, “Optimal use of budget reserves to minimize technical and
management failure risks during complex project development,” IEEE Transactions on Engineering Management, vol.
52, no. 3, pp. 382-395, 2005.
[27] E. Borgonovo, and C. Smith, “A study of interactions in the risk assessment of complex engineering systems: an
application to space PSA,” Operations Research, vol. 59, no. 6, pp. 1461-1476, 2011.
[28] J. H. Holland, Adaptation in natural and artificial systems: An introductory analysis with applications to biology,
control, and artificial intelligence: U Michigan Press, 1975.
[29] M. Mitchell, An introduction to genetic algorithms: The MIT press, 1998.
[30] M. Marseguerra, E. Zio, and S. Martorell, “Basics of genetic algorithms optimization for RAMS applications,”
Reliability Engineering & System Safety, vol. 91, no. 9, pp. 977-991, 2006.
[31] N. Wattanapongskorn, and D. W. Coit, “Fault-tolerant embedded system design and optimization considering
reliability estimation uncertainty,” Reliability Engineering & System Safety, vol. 92, no. 4, pp. 395-407, 2007.
[32] F. Cadini, E. Zio, and C. Petrescu, “Optimal expansion of an existing electrical power transmission network by multi-
objective genetic algorithms,” Reliability Engineering & System Safety, vol. 95, no. 3, pp. 173-181, 2010.
[33] Z. Ye, Z. Li, and M. Xie, “Some improvements on adaptive genetic algorithms for reliability-related applications,”
Reliability Engineering & System Safety, vol. 95, no. 2, pp. 120-126, 2010.
[34] K. J. Oh, T. Y. Kim, and S. Min, “Using genetic algorithm to support portfolio optimization for index fund
management,” Expert Systems with Applications, vol. 28, no. 2, pp. 371-379, 2005.
[35] M. Gilli, and E. Schumann, “Heuristic optimisation in financial modelling,” Annals of Operations Research, vol. 193,
no. 1, pp. 129-158, 2012.
[36] S. Hartmann, “A self-adapting genetic algorithm for project scheduling under resource constraints,” Naval Research
Logistics, vol. 49, no. 5, pp. 433-448, 2002.
[37] V. V. Peteghem, and M. Vanhoucke, “A genetic algorithm for the preemptive and non-preemptive multi-mode
resource-constrained project scheduling problem,” European Journal of Operational Research, vol. 201, no. 2, pp.
409-418, 2010.
[38] W. Huang, and L. Ding, “Project-scheduling problem with random time-dependent activity duration times,” IEEE
Transactions on Engineering Management, no. 99, pp. 1-11, 2011.
[39] P. C. Chang, S. H. Chen, C. Y. Fan, and V. Mani, “Generating artificial chromosomes with probability control in
genetic algorithm for machine scheduling problems,” Annals of Operations Research, vol. 180, no. 1, pp. 197-211,
2010.
[40] E. Vallada, and R. Ruiz, “A genetic algorithm for the unrelated parallel machine scheduling problem with sequence
dependent setup times,” European Journal of Operational Research, vol. 211, no. 3, pp. 612-622, 2011.
33
[41] A. W. Whitney, “A direct method of nonparametric measurement selection,” IEEE Transactions on Computers, vol.
100, no. 9, pp. 1100-1103, 1971.
[42] D. Steward, “The Design Structure Matrix: a method for managing the design of complex systems,” IEEE Transactions
on Engineering Management, vol. 28, no. 3, pp. 71-74, 1981.
[43] T. Browning, “Applying the design structure matrix to system decomposition and integration problems: a review and
new directions,” IEEE Transactions on Engineering Management, vol. 48, no. 3, pp. 292-306, 2001.
[44] M. Danilovic, and T. Browning, “Managing complex product development projects with design structure matrices and
domain mapping matrices,” International Journal of Project Management, vol. 25, no. 3, pp. 300-314, 2007.
[45] T. R. Browning, and S. D. Eppinger, “Modeling impacts of process architecture on cost and schedule risk in product
development,” IEEE Transactions on Engineering Management, vol. 49, no. 4, pp. 428-442, 2002.
[46] V. Lévárdy, and T. R. Browning, “An adaptive process model to support product development project management,”
IEEE Transactions on Engineering Management, vol. 56, no. 4, pp. 600-620, 2009.
[47] S. Cho, and S. Eppinger, “A simulation-based process model for managing complex design projects,” IEEE
Transactions on Engineering Management, vol. 52, no. 3, pp. 316-328, 2005.
[48] Y. Qian, J. Lin, T. Goh, and M. Xie, “A novel approach to DSM-based activity sequencing problem,” IEEE
Transactions on Engineering Management, no. 99, pp. 1-18, 2011.
[49] R. Smith, and S. Eppinger, “Identifying controlling features of engineering design iteration,” Management Science, vol.
43, no. 3, pp. 276-293, 1997.
[50] U. Lindemann, M. Maurer, and T. Braun, Structural complexity management: an approach for the field of product
design: Springer, 2008.
[51] S. D. Eppinger, and T. R. Browning, Design structure matrix methods and applications: MIT Press (MA), 2012.
[52] M. Sosa, S. Eppinger, and C. Rowles, “The misalignment of product architecture and organizational structure in
complex product development,” Management Science, vol. 50, no. 12, pp. 1674-1689, 2004.
[53] C. Chapman, and S. Ward, Project Risk Management – Processes, Techniques and Insights, Chichester: John Wiley &
Sons, 2003.
[54] D. Vose, Risk Analysis: a Quantitative Guide: John Wiley & Sons Inc, 2008.
[55] P. J. Clarkson, and J. R. Hamilton, “‘Signposting’, a parameter-driven task-based model of the design process,”
Research in Engineering Design, vol. 12, no. 1, pp. 18-38, 2000.
[56] C. Fang, F. Marle, and L. A. Vidal, “Modelling risk interactions to re-evaluate risks in project management,” in
Proceedings of the 12th International DSM Conference – Managing Complexity by Modelling Dependencies,
Cambridge, UK, 2010, pp. 31-44.
[57] O. Holtz, “On convergence of infinite matrix products,” Electron. J. Linear Alg, vol. 7, pp. 178–181, 2000.
[58] I. Daubechies, and J. C. Lagarias, “Sets of matrices all infinite products of which converge,” Linear algebra and its
applications, vol. 161, pp. 227-263, 1992.
[59] R. Bru, L. Elsner, and M. Neumann, “Convergence of infinite products of matrices and inner–outer iteration schemes,”
Electronic Transactions on Numerical Analysis, vol. 2, pp. 183-193, 1994.
[60] A. L. Nsakanda, W. L. Price, M. Diaby, and M. Gravel, “Ensuring population diversity in genetic algorithms: A
technical note with application to the cell formation problem,” European Journal of Operational Research, vol. 178, no.
2, pp. 634-638, 2007.
[61] D. B. Fogel, “An introduction to simulated evolutionary optimization,” IEEE Transactions on Neural Networks, vol. 5,
no. 1, pp. 3-14, 1994.
[62] R. Rajkumar, and P. Shahabudeen, “An improved genetic algorithm for the flowshop scheduling problem,”
International Journal of Production Research, vol. 47, no. 1, pp. 233-249, 2009.
[63] A. Popov, “Genetic algorithms for optimization,” User Manual, Hamburg, 2005.
[64] A. Senouci, and H. R. Al-Derham, “Genetic algorithm-based multi-objective model for scheduling of linear
construction projects,” Advances in Engineering Software, vol. 39, no. 12, pp. 1023-1028, 2008.
