Risk management in project portfolios

Developed by Simon Husum Fyhr

This article is an overview and summary of relevant body of knowledge concerning risk management in project portfolios. Project portfolio management is the set of managerial activities that are required to manage a collection of projects and programs needed to achieve stratetic business objectives. It has been widely accepted that Risk management is an important part of Project Management. Project risk management enables an organisation to limit the negative impact of uncertain events and/or to reduce the probability of these negative events materialising, while simultaneously aiming to capture opportunities . However, project risk management is only effective to a limited extent because it lacks a portfolio wide view. The information available regarding risk management at portfolio level is fairly scarce. Methods like Monte Carlo Simulation of Risk can be used to create efficient frontier charts in order to best as possible choose risk/return balance within the portfolio. Numerical methods are however often associated only with risks (known unkowns) and not uncertanties (unknown unknowns).

Project Portfolio Uncertainty Dimensions

The uncertainties at the portfolio level can be found within three dimensions: Uncertainty from organizational complexity, from environment, and from single projects.

The uncertainty from organizational complexity may stem from the system being used to manage the portfolio, the projects' relationships with the parent organization, interdependencies between projects, and other managerial features specific to the organization in question. The degree of the uncertainties based in complexity, is of course dependent on the degree to which autonomy is experienced and gained from the parent organization. External uncertainties include a more complex business context in the assessment of uncertainty. The mindset is that, if broader project and business networks have an effect on single projects and their management, they will eventually impact project portfolios too. It has been shown that market and technology turbulence, and external dynamics are relevant in mediating or moderating the relationship between certain project portfolio management dimensions and project portfolio success. The uncertainty derived from single projects are relevant for portfolios due to changes, deviations and unexpected events. The dependencies between projects mean that single projects might affect the entire portfolio of projects. In general it can be said that changes in single projects are reflected on changes in other projects and the portfolio as a whole.

Note that uncertainties are not negative by nature, they might as well have positive effects. Uncertainties therefor include both threats and opportunities.

The below table contain findings related to and examples of the three different dimensions of uncertainty.

Sources of uncertainties and their effect in previous empirical studies
Source	Uncertainty from organizational complexity	Uncertainty from environment	Uncertainty from single projects
Christiansen and Varnes, Blichfeldt and Eskerod, Loch	Politics and negotiation affect project portfolio decision making
Engwall and Jerbrant	Resourcing between projects (over-commitment and scheduling deficiencies)
Müller et al.	Governance type moderates some relationships between portfolio control and success	External dynamics moderate some relationships between portfolio control and success
Nobeoka and Cusumano			Design and technology transfer from ongoing projects may speed up development in parallel and forthcoming projects
Olsson	Projects may share similar risks	Uncertainties in project environments may be relevant for the entire portfolio	Single project-level risks may accumulate at the portfolio level
Perks	Inter-functional integration has an impact on project portfolio management through project control and evaluation criteria
Petit	Financial and resource uncertainties are unforeseen and affect the projects' ability to deliver results	Technical and market uncertainties, norms and regulations are foreseen uncertainties that have an impact on project portfolio scope and structure
Petit and Hobbs	Changes in processes, structures, budgets and strategy influence the portfolio	New customers and markets, and changes in supplier/third-party contracts incluence the portfolio	Uncertainty in project scope, problems with project performance, and needs for customization have effects on other projects
Teller et al.	Project portfolio complexity strengthens the relationship between project portfolio management formalization and PPM quality
Voss and Kock	Portfolio complexity strenghtens the relationship between relationship value for customer and portfolio success	Technology turbulence strenghens the relationship between relationship value for customer and portfolio success
Zika-Viktorsson et el.	Project personnel perceive project overload, due to lack of opportunities for recuperation, udadequate routines, scarce time resources and a large number of simultaneous projects

Project Portfolio Success

Project portfolio success is defined on six parameters: Average project success, average product success, strategic fit, portfolio balancing, preparing for the future and economic success. Combined these parameters give portfolio managers a way to assess the overall success of a specific project portfolio.

Parameters affecting the general project portfolio success

Average project success

Level of success regarding the iron triangle (cost, quality and time). Also includes the compliance with the fulfillment of the defined specifications of all projects in the portfolio

Average product success

Level of success of all projects in the portfolio. This includes both market and commercial success.

Strategic fit

To which extent the projects in the portfolio reflects the corporate business.

Portfolio balancing

The equilibrium between high-risk and low-risk projects, long-term and short-term projects, and technologies and markets.

Preparing for the future

The ability to quickly react to changes in the environment and seize opportunities in the long term.

Economic success

Adresses the overall market success and commercial success of an organization or business unit.

Correlations between Risk Management and Project Portfolio Success

With the above understanding of project portfolio success, it has been possible to examine correlations between the use of risk management and project portfolio success. Teller et al. concludes the following points through their investigation of project portfolios:

1. Formal project risk management is positively related to project portfolio success
2. The integration of risk information into project portfolio management is positively related to project portfolio success
3. The simultaneous use of a formal project risk management process and the integration of risk information into project portfolio management increase the positive effect on project portfolio success (positive interaction effect)
4. The relationship between formal project risk management and project portfolio success is stronger in portfolios with an R&D focus
5. The relationship between the integration of risk information into project portfolio management and project portfolio success becomes stronger as external turbulence increases
6. The relationship between formal project risk management and project portfolio success becomes stronger with increasing portfolio dynamics

In general it is found that the interaction between risk management practices on different management levels is highly relevant for project portfolio success. It is important to note that without risk management at the project level, the information needed at the portfolio level is not available. If formal processes for risk management at the project level are in place, it is neccesary to ensure that risk information is integrated at the portfolio level, in order for the risk mangement to develop to its full potential. However, it is also important to realize that it is insufficient to consider only project risks in the context of project portfolios. Project dependencies, project synergies, and similar can create uncertainties which only resides within the portfolio. The relationship between the project portfolio success and risk management is found to be very dependent on the characteristics of portfolio and environment. High level of external turbulence, high level of portfolio dynamics (measurement of how often projects within the portfolio change), high technological uncertainty, high number of R&D projects in portfolio, etc. are all drivers for increased risk management at the portfolio level. In contrast however, these characteristics also call for a high degree of freedom and flexibility, in order to quickly and easily mitigate any threats or take advantage of opportunities. Any increase in formal risk management will lower the flexibility of projects and portfolio, but the advantages of risk management will most often justify the lowered flexibility that comes with formal processes. It should be noted that project portfolios with low external turbulence and portfolio dynamics may not profit as much from integrating risk information at the portfolio level, and the results may not be beneficial from a cost/benefit perspective.

A Project Portfolio Risk-Opportunity Identification Framework

In order to address the uncertanties present within a specific portfolio, Sanchez et al. propose a framework for project portfolio risk-opportunity identification. The output is a register, which highlights the potential events that could impact the achievement of the goals. Using this framework, the links between an organization's strategic objectives and project portfolio processes are maintained and the uncertainty of achieving these strategic goals is decreased.

Steps of the Framework

The framework is build up of 7 distinct steps:

Flow of Framework Steps and Respective Outputs

Definition step

This step establishes and clarifies the main concepts used. It is important that all people involved in this stage have the same interpretation of the issues at hand, in order to have the same objectives during the next steps. Since strategic goals and expected project benefits are predetermined, it is important to have both senior management and project sponsors involved.

Modeling step

Here the interdependence model and the system-environment model are elaborated. The models are used to identify how a project contributes and its dependence towards strategic goals and elements influencing whether or not goals are achieved.

Identification based on interdependences

The aim of this step is to summarize the different consequences on the achievement of goals and to establish their degree of severity. It also includes an identification of the financial consequences to complete the severity assessment.

Identification based on system-environment search

This step searches the system and environment for potential circumstances or events that could force a manager to make the selected decisions.

Iterations

Iterations of respectively risks and opportunities are carried out. These iterations (time spent on each iteration and number of iterations) define the search depth, and should be carried out until a satisfactory level is achieved. Note that it is important to do the iterations seperately, as doing so permits focusing the search, fostering creative participation, and achieving better outcomes.

Portfolio risk-opportunity register output

All information obtained is grouped by event in order to show the risks and/or opportunities related to each event. Note that it can be of value to be (technically) able to sort events on different parameters (such as economic impact or severity), in order to facilitate the elaboration of early contingency and prevention plans.

Interdependence Model

Interdependence model showing how objectives and projects are linked

A range of dependencies between projects can be mapped with regards to different views on dependency. In this specific framework dependencies are looked at from three perspectives: Resource dependency, strategic dependency, and knowledge dependency. Resource dependency occurs when projects are linked due to shared resources. Strategic dependency occurs when projects work in collaboration to achieve the mission of an organization. Knowledge dependency exists when different projects share the same knowledge, whether generating it or using it as input to develop something else.

Note that the interdependence model does not consist of a hierachical structure of project interrelations, but rather a network where projects are interconnected in terms of their contribution to the benefits and final goals of the organization. I.e. Strategic resources such as specialists or special equipment are modeled as inputs to projects.
Sanchez et al. propose to use Checkland's methodology for soft systems (Soft systems methodology). It consists of seven steps aimed at solving complex problems in a holistic manner. Checkland's methodology facilitates the building of the interdependence model by showing how projects are interconnected by the benefits linked to the strategic objectives.

System-Environment Model

System-environment model adapted from Hayes (2000)

The system-environment model consists of five key elements (adapted from Hayes (2000)):

1. Input (Where is the organization at the present time?)
2. Output (Where does the organization want to be?)
3. Throughput (How does the organization go there?)
4. Feedback (How will the organization know when it is there?)
5. Environment (What may change in the organization's environment?)

The system as a whole is viewed as the project portfolio in question. The project portfolio can therefor be seen as the throughput whereby the organization implements the strategic plan to reach its vision. The risk-opportunity identification is oriented to increase the probability of the goal achievement, meaning that the search focuses on circumstances that may decrease or increase the chance of achievement. In this perspective risks are seen as circumstances threatening the achievement and opportunities as circumstances facilitating it.

The Risk-Opportunity Register

The risk-opportunity register

The final risk-opportunity register shows the events that may produce consequences. The register contains the following columns:

• Risk-Opportunity Identification: The reference number to identify the risk or opportunity
• Risk-Opportunity Title: The name of the risk or opportunity
• Risk-Opportunity Category: The category that the risk or opportunity belongs to
• Risk-Opportunity Owner: The name of the person accountable for managing the risk or opportunity
• Event Description: The primary event that may induce the identified risk or opportunity
• Associated Events: Events related to the primary event to be considered during the elaboration of potential responses
• Decision: The portfolio managers decision induced by the primary event
• Project: The name of the project hit by the decision
• Economic Impact: The economic consequence of the decision
• Impact on Benefits: The benefits hit by the decision
• Impact on Objectives: The objectives hit by the decision
• Secondary Consequences: The consequences related to primary consequences, which may cause domino effects or a change to risk appreciation; an initial risk may turn into an opportunity if secondary consequences are advantages
• Severity: The agreed severity helps to prioritize the risk or opportunity. The severity is calculated from a quantitative assessment of financial and strategic consequences. The process of assessment should be stricly described in order to get comparable ratings of severity.
• Potential Responses: Potential responses to treat the risk or opportunity; they are designed according to the following strategies:
  • Strategies to treat risks: avoid, transfer and mitigate;
  • Strategies to treat opportunities: exploit, share, and enhance; and
  • Strategies to treat both risk and opportunities: acceptance and contingent response strategies

Conclusion

Uncertainty in project portfolios stem from a variety of areas. The uncertainty at the portfolio level is produced by project uncertainties, but it is not enough for portfolio managers to only consider risk and opportunities which arise at the project level. The fact that synergies and project dependencies reside within the context of the project portfolio, means that portfolio managers must also identify joint uncertainties and their implications on the portfolio level.
It is also apparent that formal processes for project management and portfolio management must be integrated. Information transfer from project management to portfolio management is of great importance for project portfolio success. It is very difficult to perform risk analysis on the portfolio level if no information is available from the project level. This is especially relevant seen through a contingency perspective, since uncertainties can change character and chance of materializing over time. These changes in the project uncertainties should be spotted by the project manager and then be communicated to the portfolio manager.
The nature and environment of the portfolio closely relates to how stringent managers should set up formal processes for the risk management at the portfolio level. Portfolios which are highly dynamic, lots of R&D projects and great risk in general should be closely monitored and any uncertainties handled best and fast as possible. The same goes for portfolios acting in greatly complex and fast changing environments. The contradictory part is that these conditions also call for agile development and high flexibility of projects, while the formal processes in place to handle these conditions normally decrease flexibility. It is however noted that project portfolio risk management is more closely correlated with project portfolio success than project portfolio flexibility.

The project portfolio risk-opportunity framework is designed to help the portfolio manager to orient the decisions toward the achievement of the organization's objectives. The framework generates a tangible list of uncertainties, their expected severity and plans if a specific event occurs. The framework has its strength in the fact that it is iteratively driven, thus allowing managers to continously add to the depth of search within creation of the dependency model and the system-environment model. However, it should also be noted that the framework is an as-is situational analysis not directly allowing for a time scale perspective. Also the framework does not by itself create any knowledge regarding the uncertainties. It can therefor be beneficial to combine it with other methods or tools to assist the search of risks and opportunities - especially those tools that allow the evaluation on a time scale.