DB

Available online at www.sciencedirect.com

ScienceDirect

www.elsevier.com/locate/ijproman International Journal of Project Management 37 (2019) 731–749

Value creation through project risk management

Pelle Willumsen a,⁎, Josef Oehmen a, Verena Stingl a, Joana Geraldi b

a Engineering Systems Group, Department of Management Engineering, Technical University of Denmark (DTU), DTU Campus Lyngby, Denmark b Department of Organization, Copenhagen Business School, Frederiksberg, Denmark

Received 1 May 2018; received in revised form 10 January 2019; accepted 15 January 2019 Available online 13 February 2019

Abstract

Risk management is a common and widely adopted project practice. Practitioners use risk management based on a common assumption that risk management adds value to projects. Yet, in the complex and ambiguous environment of a project, value is often subjective. If this is the case, then how do stakeholders perceive project risk management to create value? This paper presents a literature review and an empirical study of project risk management as a means of creating value. The empirical study is based on interviews, analyzed through qualitative analysis, to unravel the subjective value of project risk management. Specifically, we addressed how practitioners perceived the connection between project risk management practices and value creation. We found that stakeholders' perceptions of value played an important role in how value was created through project risk management. What a stakeholder perceives to be important, such as the prospective outcomes of a project, influences the perceived value of a given project risk management practice. The empirical findings indicate the need for a contextualized understanding of the value of project risk management, and thereby provide a more nuanced view of the variety of forms through which project risk management can create value. The findings question the “universal ideal” of PRM value creation portrayed in the academic and practitioner literature. © 2019 Elsevier Ltd, APM and IPMA. All rights reserved.

1. Introduction

Risk management (RM) is a key task for project organizations, mandated by legislation, industry standards, and internal guide- lines. The first principle of RM according to ISO 31000 is that “RM creates and protects value” (ISO 31000, 2018). Yet, organizations often perceive that they fail to create value with their project risk management (PRM) practices, and a popular failure mode is to merely execute it as a tick-the-box exercise (Kutsch et al., 2014; Lehtiranta, 2014; Oehmen et al., 2014). Despite reported challenges in creating value through PRM practices, the implementation of such practices is high, which implies that stakeholders see some value in them. To address these contradictory observations, we investigate how PRM creates value.

Our starting point is Lepak et al.'s (2007) definition of value creation as the “process” (how value is created) and the “content” (what is of value). When we study PRM literature through the lens of value creation we find that the content is often assumed to be the project output, success, or benefits, while process is often

⁎ Corresponding author. E-mail address: [email protected] (P. Willumsen).

https://doi.org/10.1016/j.ijproman.2019.01.007 0263-7863/00 © 2019 Elsevier Ltd, APM and IPMA. All rights reserved.

described as the best practices of performing PRM (Oehmen et al., 2014; Rodrigues-da-Silva and Crispim, 2014). The literature on PRM is abundant with prescriptive guidelines (discussed in Section 2) without clearly articulated links to empirical evidence, as well as empirical studies that aim to provide evidence of an “objectively measurable” value of PRM - typically with respect to project success.

However, value creation has a subjective and contextual component, and a stakeholder cannot evaluate the appropriate- ness of a task without understanding the meaning of it in a specific context (Lepak et al., 2007). Stakeholder perceptions of how PRM practices create value are not well accounted for in the literature (Krane et al., 2012; Xia et al., 2018). The objective of this study is to develop a more nuanced understanding of these perceptions, and the significant variations between them and normative practice recommenda- tions. The research question guiding this paper is: How do stakeholders perceive PRM to create value?

Our study seeks to make two contributions to the literature. The first is to portray a more holistic picture of PRM in relation to value creation and the management of projects embracing both the subjective and objective facets of value creation. The

732 P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

second is to add to the understanding of the subjective facets of PRM's value creation through an empirical study. As such, in broader terms, the study contributes to the stream of work on the actuality of project management (PM), and more specifi- cally, of PRM (Ahlemann et al., 2013; Bannerman, 2008; Kutsch et al., 2014; Oehmen et al., 2014).

The primary empirical basis of our findings was qualitative interviews (Section 4), which were analyzed and collected through a multi-method study (Section 3). We interviewed experienced practitioners and compared their perceptions of the value created through PRM in their specific contexts. The focus of the empirical study was stakeholder perceptions of value creation regarding PRM in engineering projects. We did not attempt to quantify links between PRM and project success empirically.

The paper is structured as follows: Section 2 addresses the values of PRM as discussed within the literature, Section 3 describes our research methods and Section 4 presents our empirical study of a sample of PRM primary stakeholders in Denmark. We discuss the perceptions of value creation and compare these with general categories of acknowledged best practice principles. Finally, in section 5 we examine the implications of the results.

2. Literature review

The 2018 version of the ISO 31000 states that its current update offers several benefits, including “help[ing] the organization communicate the value of RM to the organization” (ISO 31000, 2018) – However, the standard remains silent concerning any definition or explanation of this “value”.

Our unit of analysis is the value-creating practices of PRM. Following Lepak et al. (2007), value creation is divided into content (what is value) and the process (how this value is created). First, we consider “What is value?” as a question of worth, and intimately linked with the divergent perception of project success (Kreiner, 2014; Laursen and Svejvig, 2016). Stakeholders within PRM can have different perceptions of which outcomes – project, strategic, or personal – are important (Krane et al., 2012). It is common to observe divergences in perceptions of outcome value, or project success criteria (Zwikael and Smyrk, 2012), and these are likely to have a direct effect on PRM practice (Lehtiranta, 2014).

Second, we consider the question “How is value created?”. On this level, value is the effectiveness of employing certain actions to achieve valued goals. As argued above, perceptions of value creation can be different, and correspondingly, the way in which various actions are perceived to be “effective” in terms

Fig. 1. Value creation of PR

of creating this value can be different for every stakeholder and context (den Ouden, 2012; Shenhar et al., 2001).

2.1. Content perspective of PRM value creation: What is value?

There is an assumption within the normative literature (e.g. ISO 31000, 2018; PMI, 2009) that PRM creates value for project outputs, outcomes, and other organizational processes (Fig. 1) thereby increasing the probability of project success and strategic benefits.

In the following, we discuss two major streams of literature that we identified during our review process regarding “what is the value” of PRM: Firstly, empirical studies in which the aim was to objectively define and measure types of value, and secondly, research into perceptions of types of value.

2.1.1. Studies aimed at objectively measuring PRM value and its contribution to project success

A number of empirical studies are premised on the basic assumption that PRM creates an objectively measurable value for project success (Table 1).

Mu et al. (2009), Pimchangthong and Boonjing (2017), Raz et al. (2002) and Zwikael and Ahn (2011) (Table 1) provided evidence that PRM creates value for project output or outcome. De Carvalho and Rabechini Junior (2015) found that the effect of traditional PRM was so small that it led them to question the way in which PRM is implemented in organizations today. Oehmen et al. (2014) did not find a direct effect. However, they did identify an indirect effect on project success through other organizational processes and outcomes. Bannerman (2008), on the other hand, found no effect. The findings are summarized in Fig. 2.

Even though these studies provide some insight into the value that PRM may create, they have limitations. Establishing and providing direct causal links between PRM and project success is problematic for several reasons:

a) There is an inherent problem of uncertainty in determining the effect of PRM (Besner and Hobbs, 2012) and uncertainty is inescapable in projects (Geraldi et al., 2010).

b) Given the complexity of project management, it is difficult to know whether PRM activities have influenced the manifestation of uncertainty, or if there are other compounding factors (Bannerman, 2008; Besner and Hobbs, 2012).

c) PRM adds value indirectly by enabling certain processes in the organization (Oehmen et al., 2014) that in turn can influence a

M: Basic assumptions.

Table 1 Empirical studies on the value creation of PRM practices related to project success.

Source Method Context Empirical findings

(Bannerman, 2008) 23 informants – 17 cases Qualitative and quantitative analysis

IT projects in the public sector

The study found no evidence of PRM's contribution to project success

(De Carvalho and Rabechini Junior, 2015)

Survey of 263 projects Interviews and documentation from projects Statistical analysis

Various projects in Brazil The soft side of PRM in projects (context, strategic approach to risk, risk communication, attitude, relationship with stakeholders and crisis management) contributes significantly to project success. The hard side of PRM in projects (risk planning, risk identification, risk analysis, risk monitoring and control, risk response) makes a small contribution to the project outcome dimension “time”. - The results lead the authors to question how PRM is currently implemented in organizations and projects

(Mu et al., 2009) In-depth field interview study with 14 participants and survey with 217 companies

NPD projects The NPD performance or project output is positively associated with risk management in the three dimensions of technological, organizational and market related risks

(Oehmen et al., 2014) Survey of 291 product development programs Statistical analysis

NPD projects No direct link between the application of PRM practices and product or project success. PRM creates value for organizational processes and outcomes such as improved decision making, program stability and improved problem solving. The results indicate that PRM contribute indirectly to project and product success.

(Pimchangthong and Boonjing, 2017)

Survey - 200 project managers, IT managers and analysts. Statistical analysis

IT projects Risk management processes are found to have a positive impact on project success

(Raz et al., 2002) Survey - 100 projects Statistical analysis

Various industrial projects in Israel

Projects using PRM met time and budget goals more easily but there was no correlation with achieving functional or technical specifications

(Voetsch et al., 2004) Survey - 175 risk special interest group members. 12 interviews Statistical analysis

Projects in multiple industries

Project success was found to occur more frequently with greater senior management support of risk management, actual practice of risk management practices, and regular risk monitoring.

(Zwikael and Ahn, 2011) Survey 701 project managers Statistical analysis

Multinational multi- industry study

Risk was found to negatively correlate with project success, and effective risk management planning could moderate the effect of those risks. The interaction between risk level and risk management planning was found to be significant for three project success measures: cost overrun, project performance, and customer satisfaction

733P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

project's outcome and output, and thus the probability of project success (Besner and Hobbs, 2012) (Fig. 2).

d) Repeatability is difficult because it is not possible to obtain a sample large enough to exclude chance, because each project has unique characteristics and is practically unrepeatable.

Beyond these challenges, there is also the larger question of how to define and measure project success. For example, several studies presented above do not agree on the definition of project success (De Bakker et al., 2012; De Bakker et al., 2011; De

Fig. 2. Value creation of PR

Carvalho and Rabechini Junior, 2015; Pimchangthong and Boonjing, 2017; Raz et al., 2002; Zwikael and Ahn, 2011). Furthermore, stakeholders have a relative perception of project outcomes and success (Laursen and Svejvig, 2016), making the aggregation of data from different projects and stakeholders problematic.

As a consequence, the assumption that PRM creates objectively measurable value is drawn into question, and research that attempts to prove otherwise faces validity challenges and limitations when trying to link the value creation of PRM directly to project success (Oehmen et al.,

M: Empirical findings.

734 P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

2014; Voetsch et al., 2004; Zwikael and Ahn, 2011). Therefore, even the most basic project output or outcome related value that PRM is supposed to create, is subject to debate. For this reason, there is a need to look beyond project outcomes when seeking to establish the value that PRM creates. In light of the previously discussed debate on defining and measuring project success, this challenge is not unique to PRM practices in projects (Laursen and Svejvig, 2016; Söderlund and Maylor, 2012). Measuring the value of PRM becomes problematic because different stakeholders have different perceptions of what is important (Krane et al., 2012), and thus what value PRM creates. The method of studying the value creation of PRM must be reconsidered accordingly.

One alternative approach, carried out in our empirical study (Section 4), is to extend the understanding of value from an objective one to a perceptual one – specifically the perceptions of stakeholders. This allows for a wider variety in terms of content (what is value) and process (how is value created) and it can illuminate the variation that exists in practice, without aggregating in the search for the “best practices”, nor diminishing forms of value creation as irrelevant because they do not link to “easily countable” measures of success.

2.1.2. Studies on perceptions of PRM value creation We identified few papers, discussed below, in which value

perception of the content perspective (“i.e. what is perceived as value?”) had already been investigated:

Besner and Hobbs (2012) studied the perceived value of PM practices, including PRM practices. They measured whether more or better use of PRM practices is perceived to improve performance. They conducted a survey that utilized a five point Likert scale with 1296 members of the Project Management Institute (PMI) as a sample. The results indicated that PRM was perceived to have a high potential to increase project performance, i.e. output and outcome. They did not, however, provide details about how this value was created.

Kutsch and Hall (2009) studied the application and perception of PRM practices in software projects through 18 interviews and a survey of 102 respondents from the PM community. In contrast to Besner and Hobbs's findings, Kutsch and Hall (2009) found that the main reason for not applying PRM was the perception that the application of a proactive PRM did not create enough value to justify its cost.

De Bakker et al. (2012) moved the study from a core focus on value in general to specifying what kind of value PRM created. They examined, through a qualitative multi-case study, the perceived value of PRM practices in IT/IS projects focusing on the communicative effects of PRM. The results demonstrated that stakeholders perceived that PRM created value by means of improving organizational communication in multiple ways, thereby furthering project success.

Krane et al. (2012) studied the different perspectives of stakeholders in PRM, and the objectives and risks the stakeholders perceived to be important. The study used

qualitative interviews and PRM documents from seven large projects within a combined qualitative-quantitative approach. The results indicated that different stakeholders have varying perceptions regarding what the important risks are. The authors found that project managers focus on project objectives whereas project owners place their attention on strategic objectives regarding the value that PRM should create/protect (Fig. 3). The stakeholders perceived that PRM could create value at both project and strategic level, influenced by their own perception of what is important and of risk (Fig. 3). Thamhain (2013) provided additional empirical evidence that stakeholders perceived risk and the purpose of PRM differently.

As demonstrated by our review of the empirical studies at the beginning of this section, the value that PRM creates may be to support project outputs, outcomes, strategic benefits, or personal outcomes, or to enable other processes within the organization (Fig. 3). The review of the studies about perception provides empirical evidence that stakeholders might have subjective perceptions of both the importance of a value dimension and the risks. Together, these aspects influence which value PRM should create or protect, according to a particular stakeholder as depicted in Fig. 3.

2.2. Process perspective of PRM value creation: How is value created?

In this section address three streams in the PRM literature on the question of “how value is created” are addressed. They are normative literature, empirical studies on objectively measur- able value creation, and empirical studies on perceptions of how value is created.

The normative guidelines suggest that PRM creates value through a series of steps similar to those described in the ISO 31000: establishing the context, risk identification, risk analysis, risk evaluation, risk treatment, monitor and control, and communication of risk. A central part of value creation in PRM is assumed to occur through formalizing a process that features the steps described above as well as through key “best practices” that enable the creation of value, such as supporting other processes, creating transparency regarding risk exposure, adding PRM results to decisions in project management and by using the best possible fact-based information in PRM (e.g. ISO, 2018; PMI, 2009). This review can only cover a limited number of the numerous recommended “best practices”. For additional details, see for examples ISO 31000 (2018), Olechowski et al. (2016), PMI (2009) or Purdy (2010).

A recurring theme in normative guides on PRM is facilitating open and honest communication about risk within the project team and with other stakeholders – i.e. creating transparency regarding risk exposure (e.g. ISO 31000, 2018; PMI, 2009). The creation of transparency is also recognized in the RM community as a value-adding practice (e.g. Aven, 2012, 2016). It seems “logical” that if one has transparency regarding risk exposure, then better decisions and fewer mistakes are likely to be made, and PRM can work as it should. We will revisit this idea in our empirical findings (Section 4).

Fig. 3. Value creation of PRM: First complication – what is value?

735P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

The normative standards recommend flexibility but at the same time promote aspects of standardization such as adhering to the ISO process steps. The standards generally advocate being proactive as a key best-practice and basic premise of PRM. The guidelines are built around formalizing a PRM process that includes documenting and reporting practices. Through such practices PRM creates value for other processes and for the PRM process (ISO, 2018; PMI, 2009).

Notably, the normative guidelines fail to include any evidence that supports the effectiveness of their prescriptions (Olechowski et al., 2016). This is also evident in the PMI guide to PRM, which “does not independently test, evaluate, or verify the accuracy or completeness of any information […] contained” (PMI, 2009). Rather, the PMI guideline is based on a group consensus process.

2.2.1. Empirical literature on objective measures of “how is value created”

In the second stream of literature, empirical studies have investigated various aspects of the process of value creation of PRM as proposed in the normative literature. The studies often looked for objectively measurable “best practices” (as depicted in Table 2) or what were perceived to be “universally” effective practices.

The empirical studies of “objectively measurable” value creation through specific processes presented above are subject to the same challenges and limitations that were discussed in Section 2.1 regarding the literature of “objectively measurable” categories of value.

Similarly, again a general lack of agreement exists on how value is created and what effective or “best practice” is with regard to PRM as demonstrated in Table 2. The empirical studies on value creating practices were conducted primarily in the form of surveys that were analyzed quantitatively and focused on project success. They covered different sets of tools, methods, or tasks, and sometimes at different levels of abstraction. The studies produced varying and sometimes contradictory findings – at times the process steps of the ISO created value, while at other times they did not, and sometimes other practices, such as creating transparency, were found to be the main sources of value creation.

The empirical studies do, however, converge on some aspects; for instance, Voetsch et al. (2004), Oehmen et al. (2014) and Teller and Kock (2013) found the practice of creating transparency regarding risk exposure to be a value creating practice. In addition, there are converging arguments that support proactive PRM (Thamhain, 2013; Zwikael and Ahn, 2011) and formalizing or “standardizing” PRM (Voetsch et al., 2004; Zwikael and Ahn, 2011). Multiple studies support the normative suggestion that PRM creates value by supporting and integrating with other project management practices.

2.2.2. Empirical literature on perceptions of “How is value created”

The third stream of literature addresses how stakeholders perceive PRM practices to create value. Besner and Hobbs (2006) surveyed the perceived effect of 70 PM practices, including PRM practices, in projects across different industries and with 753 respondents (project managers, upper manage- ment, team members and others). The results showed that PRM practices such as the ranking of risks and contingency planning were perceived to have high potential to create value, while quantitative techniques were perceived to have low potential (Besner and Hobbs, 2006).

Raz and Michael (2001) conducted a survey with 84 project managers. They studied which tools and practices were perceived to provide benefits. They studied both PRM activities associated with the five stages of the PRM cycle: risk planning, identification, assessment, control and tracking as well as “background” practices. Background practices were defined as practices “likely to affect the manner in which risk are managed without being specifically related to one of the five stages” (Raz and Michael, 2001, p. 10). These “background” practices such as simulation and prototyping were perceived to be both the most effective in contributing to project success and associated with PRM. Furthermore, formal PRM practices such as responsibility assignment, risk impact assessment, and the reporting of critical risks to senior management were perceived to be among the top 10 contributors to project success.

De Bakker (2011) and De Bakker et al. (2012) studied the perception of PRM's contribution to project success within the context of IS/IT projects. The study included a meta-analysis of

Table 2 Empirical studies on the process perspective i.e. how value is created – objectively measurable.

Source Method Context Empirical findings

(De Carvalho and Rabechini Junior, 2015)

Survey of 263 projects. Statistical analysis

Various projects in Brazil Soft side of PRM (context, strategic approach to risk, risk communication, attitude, relationship with stakeholders and crisis management) has a significant effect on multiple project success dimensions The hard side of PRM (Risk planning, risk identification, risk analysis, risk monitoring and control, risk response) has a small effect on project success dimension – time

(Oehmen et al., 2014)

Survey of 215 product development programs. Statistical analysis

NPD The results show that six categories of PRM practices are most effective: (1) Develop RM skills and resources; (2) Tailor RM to and integrate it with new product development; (3) Quantify impacts of risks on one's main objectives; (4) Support all critical decisions with RM results; (5) Monitor and review your risks, risk mitigation actions, and RM process; and (6) Create transparency regarding risks

(Raz et al., 2002) Survey of 100 projects. Statistical analysis

Broad range of industries PRM practices such as identification, risk analysis, planning for uncertainty, trade-off analysis. The effectiveness of PRM practices depends on the project. We need different PRM techniques for different projects and specific tools and practices to manage risk in different projects

(Teller and Kock, 2013)

Survey of 176 firms. 7-point Likert scale

Broad range of industries Risk transparency has a positive impact on project portfolio success. No link exist between risk coping capacity and risk transparency

(Thamhain, 2013) Exploratory action research. Surveys. 17 companies, 560 informants Multiple methods

PD The study found recognizing and dealing with risks early on to be critical. Cross-organizational collaboration is important for early risk detection and effective treatment. Aligning the strategic objectives of the project with the enterprise objectives is important for effective PRM

(Voetsch et al., 2004)

Survey of 175 project managers Statistical analysis

Project managers in public and private industries

A higher degree of implementation of formal RM practices leads to more rigorous risk monitoring. Project success was found to occur more frequently with greater senior management support of risk management, actual practice of RM practices, and regular risk monitoring

(Zwikael and Ahn, 2011)

Survey of 701 project managers. Statistical analysis

Various projects Multiple countries

Integrate PRM into project management processes. Functional managers should be charged with RM responsibilities. Project risk planning improves chance of success. Risks should be discussed with relevant stakeholders in an open form

736 P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

empirical evidence. The perceptions of PRM stakeholders were studied through case studies in enterprise resource planning implementation projects. The results revealed that PRM activities were perceived to create value for an organization in multiple ways and thus to contribute to project success. Risk management planning, for instance, was found to indicate the importance of actions and to communicate intended actions. Risk identification for instance, was found to initiate action; create awareness, a common view, and commitment; and clarify expectations.

Taylor (2005) studied the perceived effectiveness of PRM practices. He interviewed 22 project managers from 12 organizations in Hong Kong using an interview technique of cognitive probes to encourage respondents to reflect on their own PRM practices. The results demonstrated that the addition of contingency to a schedule and budget were perceived to create more value than the proactive PRM prescribed in the literature.

2.2.3. Summary: major research streams in the literature on value-creating PRM practices

Studies have generally focused on different aspects of PRM's value creation. Perceptions regarding how value is created, are aggregated in the studies in an attempt to identify universal tendencies of best practices and statistical significance; however, as a result, the variation and contextual nature of PRM are lost. In addition, the perception of what constitutes best-practice differs in the reported studies – as depicted in Fig. 4.

Yet there is consensus in much of the literature that best practices exist. Accordingly, there is a gap between theory

and practice in understanding which practices are perceived to create value (Bannerman, 2008; Kutsch et al., 2014; Kutsch and Hall, 2010; Oehmen et al., 2014) due to the prescriptive nature of PRM (Ahlemann et al., 2013). Studies covering the value-creating practices of PRM do not provide any detailed or contextual information of the conditions under which PRM creates value. However, the project and organizational context influence the need for and perception of those PRM practices and tools (Besner and Hobbs, 2012). Nonetheless, the studies of best practices are based on the (potentially incorrect) assumption that it is possible to aggregate and identify particular universal “best practices” and principles, separate from the context. The studies that do address the value creation of PRM cover different aspects and use different methods. Within these studies, most importantly two categories emerge – those that investigate objectively measurable value creation and those that study perception of value creation. The studies on perception cover only a few aspects of the value creation of PRM and none cover variations in perceptions. Consequently this study addresses this gap. Fig. 4 provides an overview of our conclusions from the literature.

2.3. Conclusions from the literature review

The PRM literature engages primarily in a posited view on PRM value that it is effective (or not) in generating the values that constitute project success. This literature does not reflect

Fig. 4. Value creation of PRM: Overview.

737P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

on the constructed, ambiguous, and negotiable nature of value in projects. Given the significance of this topic in the broader project literature, we can reflect that subjective perceptions of how value is created are likely to equally impact the practice of PRM. We may further deduce that the subjective perception of how value is created could provide an explanatory model for the regularly reported perceived “failure of PRM to create value”.

3. Methods

To answer the research question, we employed a reflective multi-method approach (Bryman and Bell, 2015) in two phases to increase validity, iterating between theory and empirical findings, and refining our findings and assumptions, as depicted in Fig. 5. The first phase consisted of an exploratory case study and focus groups interactions for validation. It develops our model to discuss PRM value creation, i.e. the differentiation of value creation into “content” related elements (what value is created?) and “process” related elements (how is the value created?) The second phase consisted of an interview

Fig. 5. Overview of th

study with 16 participants from 12 companies in different industries. This elicited the varied perceptions of value “content” and “process” from a range of project stakeholders.

The objectives of the first phase were to explore the value perceptions of PRM and to develop an empirically grounded sense-making framework (i.e. our distinction between content and process, as depicted in Fig. 4). The framework was developed through a grounded and abductive approach, as depicted in Fig. 6. The aggregate dimensions of content and process stem from iterating between the data and literature on PRM and value, through pattern matching. The framework is supported by the previous empirical studies covered Section 2. The objective of the second phase was to more deeply examine the perceptions of value-creating practices of PRM.

3.1. Phase 1: case study and focus groups to explore the constructs of value creation

3.1.1. Research design In the first phase we aimed to generate a preliminary

understanding of the value creation of PRM, that is, of

e research phases.

Fig. 6. Coding process phase 1.

738 P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

possible constructs and relationships between them. A case study is well suited to address this type of research. Theory- building research using cases typically answers research questions that address “how” and “why” (Eisenhardt and Graebner, 2007). Its purpose is to describe the current state and to address the initial phase of theory building; therefore, theoretical sampling is appropriate (Eisenhardt and Graebner, 2007). How stakeholders perceive PRM as value creating is not well understood as highlighted by our literature review (Section 2). Therefore, we chose an exploratory approach, which is suitable in the early stages of the theory building cycle (Cash, 2018).

We used interviews as the primary data source because interviewing is an appropriate method for studying value perceptions. The interviews were supplemented with observa- tions and PRM documents.

The case study was chosen for several reasons: the company is an industry leader and has successfully executed many different projects. It also provided an opportunity to collect information about PRM from multiple sources, namely from different stakeholders within the company and within a supplier, thereby enabling the researchers to examine different perspec- tives on PRM, which was crucial to the study. Furthermore, the company is heavily involved in multiple aspects of PRM and has both large (N1 billion DKK) and small-scale projects in its portfolio and attract experienced project managers. Its industry is highly competitive and profitable, with an emphasis on formalized processes around PRM and regulation. The company is involved in high and low risk projects, builds large-scale structures and develops products with high quality and scheduling demands – and because of this, the management of risk is important to the company. The company is project-based, and consider themselves especially reliant on compliance and PRM. All of these factors make it a suitable representative case

for studying PRM. Using a single case study is appropriate when studying a representative case (Yin, 2003).

3.1.2. Data collection The case study data was collected over the course of one

year (2017–2018). Semi-structured interviews served as the primary data source, accompanied by PRM documents, observations of PRM activities, and evaluation meetings to increase the richness of the data.

The interviews were conducted in different departments within the company, at different organizational levels, and with a critical supplier. The interviews typically lasted 60–90 min and were primarily individual, with occasional group, inter- views. Snowballing (Bryman and Bell, 2015) was used as the sampling strategy. We collected interview data from 15 participants within the company and from five participants within a critical supplier.

The interviews were conducted in multiple rounds. The first round was conducted with project management office employees, specifically those working in project controls, because they were responsible for practices regarding PRM and served as an internal support function for both project managers and upper management. We then progressed to interviewing project managers from different departments inside the company, as well as the CFO, CEO, project managers, and the head of the project management within the supplier company. The final round included project managers, a project team member, a VP, project controllers, a former department manager and an internal consultant on conducting project risk workshops, all of whom were involved in a subset and variant of the company's PRM. After each round of interviews, the relevant available documents were analyzed following the coding process described in the section below, to identify concepts and support the interview analysis. The

739P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

documents collected were: risk reporting between project management and the steering committee, project risk matrices and risk logs, and PRM internal guidance and workshop instructions.

3.1.3. Coding and analysis We used the recorded and transcribed material and notes as

the primary data sources. The interviews were coded in an iterative process, creating affinity diagrams through a grounded approach using open codes, concepts, and then themes and aggregate dimensions (Gioia et al., 2013) applying a reflexive mind-set (Alvesson and Skoldberg, 2009). Fig. 6 presents examples of the coding process.

We began by coding the first order constructs (Gioia et al., 2013). We performed multiple versions of first order coding constructs, staying close to the data. There were recurring patterns within the first order codes that matched concepts found in the literature. In the second stage of coding we iterated between ways of organizing into second order constructs among the four authors, iterating with the literature, as proposed by Gioia et al. (2013), within the fields of PRM, product development, and general RM, in order to identify relevant concepts for understanding the perceptions of the value creation of PRM (the literature is presented in Section 2).

Through iterating with the literature in an inductive- deductive, or abductive reasoning process (Alvesson and Skoldberg, 2009; Gioia et al., 2013), we found that the value perceptions could be interpreted to generally fall into categories of outcomes such as strategic value, project level value and more “process-oriented value”, which cover the effectiveness of activities or process attributes, rather than outcomes. From there, we identified value creation as aggregate dimensions for the top-level themes, categorized into the content and process of value creation, which formed the basis of the literature review and the model presented in Section 2 (Figs. 2, 3, and 4).

The insights described above emerged from iterating with the PRM literature (as listed in the references section) and value literature (Laursen and Svejvig, 2016; Lepak et al., 2007; den Ouden, 2012). The literature on value was used to discern several aspects, such as for whom value existed and what type of value it was. Value perceptions in the data were identified using a heterogeneous, multi-dimensional understanding of the concept of value creation as comparison coding (Laursen and Svejvig, 2016; Lepak et al., 2007; den Ouden, 2012).

The first author developed the initial coding scheme which an independent second researcher subsequently tested for consistency to reduce the likelihood of confirmation bias. The researcher's preliminary conclusions and emerging coding constructs were discussed and validated with the company in both informal and formal meetings throughout the process. This resulted in an amended coding scheme, which was discussed with two independent focus groups of N100 participants in total, consisting of risk managers, upper-level managers, and project managers, in order to explore the relevance of the findings beyond the case study.

3.2. Phase 2: in-depth interviews across industries on perceptions of value creating PRM practices

3.2.1. Motivations for moving into phase 2 of the research With regard to how and whether value was created, all the

interviewees agreed that PRM added value, but did not concur on how it did so. Disagreements and inconclusiveness concerning the value creation of PRM motivated us to perform a second, deeper study (Phase 2) of how stakeholders perceive PRM to create value.

We wanted to use a different interview technique in phase 2 because the direct questions about the value of PRM seemed to produce answers about the ideal PRM, rather than the actuality. In Phase 2, we therefore approached the investigation from multiple angles to circumvent the idealized descriptions of PRM, and to contextualize the value perception. We adjusted the interview guidance as proposed by Gioia et al. (2013) in order to ask about specific instances of PRM and interpret the answers subsequently. We also used the constructs of “process” and “content” identified in the case study and the literature review as inputs in the design of a new interview guide to probe deeper into the breadth and context regarding how PRM is perceived to create value.

3.2.2. Research design To examine our constructs within the categories – identified

in phase 1 – of process and content, we applied a different approach to data collection in terms of the interview technique, sampling to probe the conclusions from phase 1. We sampled across industries and companies to obtain a broad sample, as we were looking for possible variations in order to gain a deeper understanding. Based on the perceptions identified through the case study, we designed an interview guide. We interviewed stakeholders at various levels in several project- based companies from a broad range of engineering industries. We wanted to uncover perceptions regarding how value is created through interpretation, not by only asking direct questions. We strove for triangulation within the interviews by asking questions in multiple ways (Bryman and Bell, 2015). We used a technique of asking nondirective and directive questions to provide a stronger grounding of theoretical insights and to mitigate biases (Bingham et al., 2007).

3.2.3. Data collection The semi-structured interviews (Bryman and Bell, 2015)

were designed to investigate perceptions by questioning the participants in three ways. First, we asked specifically about what they perceived to be instances of “good” (i.e. value creating) and “bad” (i.e. non-value creating) PRM; participants were encouraged to provide as much detail as possible regarding their experiences. Second, we used a problem- centered interview technique (Witzel, 2000) asking about detailed experiences from practice. Finally, we asked why they engaged in PRM activities. During the interviews, the categories of best practice identified in phase one were used to cover how value was created. We utilized a list of topics (described in the previous section) along with the model of

Table 3 Phase 2 interviewees.

Role Industry Personal experience Company experience

Project manager Producer of medical equipment 5 years 20+ years Project manager Large producer of medical devices 1 12+ years 20+ years Project manager Large mechatronics supplier for defense, space and business-to-business (B2B) clients 6 years 20+ years Project manager Large producer of medical devices 1 6 years 20+ years Project manager Large producer of medical devices 2 5 years 20+ years Project team member Large producer of medical devices 1 15 years 20+ years Risk manager Large contractor within the construction industry 7 years 20+ years Risk manager Large engineering consultancy within multiple industries including

construction and RM consultancy 1 8 years 20+ years

Risk manager Large engineering consultancy within multiple industries including construction and RM consultancy 2

11 years 20+ years

Risk manager SME consultancy on RM 20+ years 20+ years Risk manager Large IT consultancy 1 year 11 years Portfolio manager IT developer of websites, digital infrastructure and custom solutions 5 years 16 years Project controller Large scale construction of infrastructure, operations and maintenance 12 years 20+ years Head of project controls Large producer of medical devices 1 7 years 20+ years Senior strategy manager Packaging, supplier of primary packaging for various industries 8 years 20+ years Executive VP Large producer of medical devices 1 8 years 20+ years

740 P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

value creation (described in Section 2), in the interview guide to probe areas that were not mentioned by the participants. “What if” questions were used as an additional method to draw out the participants' perceptions. The wrap-up question encouraged reflection on any conflicts experienced in relation to PRM.

3.2.4. Sample selection The sampling strategy was to acquire a wide range of

participants. In part, the sampling was driven by convenience, as the companies were selected in Denmark. Project stake- holders were contacted via email to ask for participation. The 12 project-based companies were selected for their experience with PRM and PM (Table 3). Four participants were from different entities within the same company. To gain a breadth of perspectives, we interviewed risk managers, project managers, and upper management.

3.2.5. Coding and analysis All of the interviews were recorded and transcribed and the

framework of “process” and “content” was used as a guide to

Fig. 7. Process of deriving the fin

code the interviews. The content constructs were: project outputs, project outcomes, organizational process and out- comes, and strategic outcomes. The process constructs were: qualitative techniques vs. quantitative techniques, stability vs. flexibility, adherence to risk information in decision making, proactive vs. reactive PRM, creating transparency regarding risk exposure and reporting vs. communicating (the constructs are described in the literature review, Section 2).

Not all the coding categories were included in the results as there are many “best practices” of PRM and the purpose was to deeply assess a few central concepts. We included the categories with the most heterogeneity, but excluded, for instance categories covering quantitative vs. qualitative methods due to a lack of data. Conversely, gut-feeling based PRM was added, which was not covered by literature as a best-practice of PRM. Figs. 7 and 8 depict examples of coding related to transparency regarding risk exposure.

The results were derived from reviewing the interview transcripts and identifying instances of value creation by comparing themwith the literature and codes identified in phase 1.

dings through phase 1 and 2.

Fig. 8. Examples of coding in phase 2.

741P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

4. Results: perceptions of PRM value creation

The following sections present the empirical results regarding the interviewees' perceptions of value-creating practices of PRM. This section first presents an overview of deviations from normative practice followed by the results in relation to each category of value creating practices.

The results reveal that the stakeholders' perceptions of how PRM creates value deviate from normative best practice and previous empirical findings. In some instances, the stakeholders perceived PRM created value by doing the opposite of what normative practice suggests: for instance, a risk manager hides risks to win a tender, thus avoiding transparency, in order to protect a strategic benefit. Table 4 summarizes our findings regarding deviations from normative practice.

The stakeholders perceived PRM to create value, but sometimes through a process that is completely contrary to what is considered best practice as shown in Table 4. The results are now presented in detail for each practice indicated in Table 4, showing the various content aspects of value creation and how they influence the perception of the effectiveness of value-creating practices.

4.1. Creating transparency regarding risk exposure

This subsection presents the stakeholders' varied perceptions of transparency in practice. They indicated that sometimes the best way to manage the risk was to avoid creating transparency regarding risk exposure. They perceived it to be contextual; whether it was value adding to be transparent depended on the outcome or output one was trying to protect.

Only part of the sample agreed with the normative “best practice”. There were examples of interviewees perceiving full transparency as value adding and essential, because it increased the ability to make quality decisions, particularly by upper management. Others were more selective, sharing information with only parts of a team, upper management, or internally in their company. On the extreme opposite end of the spectrum,

there were examples of transparency being perceived as posing a risk for the company, client, or manager in question.

4.1.1. Low transparency perceived as value adding Several reasons were given for preferring low transparency

regarding risk exposure. Low transparency was perceived to create value in multiple ways, for example: by changing risk estimates for negotiations; avoiding litigation by omitting information; and managing the risk that high transparency could represent for some stakeholders.

According to a risk manager, in multiple instances a client did not want to document certain aspects of the PRM process. “When dealing with large scale infrastructure projects it is not uncommon that fatalities occur. Risk mitigating so that fatalities cannot occur is extremely costly or even impossible” and “it is not completely safe to build infrastructure”. Bringing up topics like this can cause clients to be annoyed according to a risk manager (risk manager, engineering consultancy1).

Low transparency can help to protect strategic outcomes and create value as an artifact in negotiations; a risk manager described not documenting certain risks to keep the tender below a certain level: “The project was decided within 10 million so if we had put these extra risks on, we wouldn't have won the tender”. The risk manager described the company practice as sharing everything internally, but not externally and never with a client (interview risk manager, large contractor). This is driven by practices in the industry: “We are a bit protectionist in our line of business […] you are afraid that you let out something [information about risk] the others can use […] you can be in situations where you have acquired some information [about risk] that you don't want to share. […] If everything [regarding risk] is exposed, you don't have anything to bargain with” (risk manager, large contractor).

The risk estimate can be a determining factor in a project's approval or cancellation, and hiding information about the “real estimate” of risks can enable a project to continue as in the following example: a project manager was told that the project

Table 4 Perceptions of how value is created and deviations from normative practice.

Observed deviations from normative practice

Process category (Sub section)

Empirical results Illustrative quotes Normative standards (N) Previous studies (P)

Transparency – high or low (4.1)

Some interviewees perceived transparency to create value while others perceived it to do the opposite

“the project was decided within 10 million so if I had put these extra risks on, we wouldn't have won the tender”

“I would rather take the risk that we have to go back here [not pass a milestone] and be open [about risk exposure] than potentially delaying the whole […] plan”

Transparency is beneficial (N,P)

Reporting vs. ad hoc dialogue (4.2)

Some interviewees perceived that reporting takes away time from the project work, and others consider it essential

“Much reporting would take time away from engaging with engineers” - “and they are usually the ones who know where the major risks are”

“We are in the medical field so it is important to document so we can trace in case something goes wrong”

Reporting is beneficial (N, P)

Standardization vs. flexibility (4.3)

Some interviewees perceived standardization to be beneficial and others not

“when you put things into these standard templates, then the other project manager, the senior upper management and so on, knows what to look for. And that gives them a better opportunity be supportive “

“if the [PRM] setup had been too hierarchal where I'd have to go to my boss who had to go to another boss and so on, and the time would have been wasted”, [We would] maybe not even have had the time to make the original proposal”

Standardization is beneficial (N, P)

Gut feel vs. facts (4.4) Some described relying on gut- feeling as their practice, whereas others perceived factual approaches to be the only valid approach

“At the closing meeting it's the CEO who has final say in what we go with [in terms of risk reserves in the tender situation”

“Each estimate includes a description of how we got there, so you can see how they arrived at it […] and take that into account”

Utilizing facts is beneficial (N)

Proactive vs. reactive PRM (4.5)

Some perceived proactive PRM to be crucial, others saw it as non- value adding

“Even if you write it down things are happening different than you expected”

“Predictability is the key here”, “mandated from our owners”

Proactive PRM is beneficial (N, P)

(N) In particular, the following sources were considered: (ISO 31000, 2018; Oehmen et al., 2014; Olechowski et al., 2016; PMI, 2009) (P) Empirical evidence presented in studies discussed in the literature review (see e.g. Tables 1 and 2)

742 P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

would be cancelled if that was the risk estimate; the parties involved therefore changed their estimates to suit the project owner's risk tolerance level, because they wanted the project to go ahead (head of project controls, medical devices1). A similar sentiment was expressed by another risk manager in a different industry: with some clients, “if you add up the numbers […] and [the risk estimate] its 200% over, they say ‘but you can't show that’ [...], usually it is because it could hurt the business case”. (risk manager, engineering consultancy1).

Reduced transparency was also perceived as a risk mitigation strategy in a project: a project manager identified a company in the supply chain as a major risk and decided not to share the information with the engineers who oversaw negotiations with the supplier. “[The project team] was planning a trip to the old vendor and we didn't want to risk that they [the supplier] started re-planning or postponing things. So, we didn't tell the team” (project manager, medical equipment).

4.1.2. High transparency perceived as valuable The majority of the interviewees, at least in principle,

perceived high transparency to be beneficial. Risk managers in particular regarded transparency as a “personal value”. High degrees of transparency could reduce the risk of mistakes that could cause problems for organizational outcomes or the project itself. Transparency was perceived as central to decision-making for instance at the portfolio level: “I recall a

project manager who said project controls was extremely important, and then proceeded to not share any information [about risks] […] he ended up creating huge damage to the company […] if the project manager doesn't share the appropriate information, then risk-management at the portfolio level becomes very difficult.” (project controller, large scale construction).

Some interviewees perceived full transparency as the natural baseline: “I share everything! [...] but I may be a special case because I only do projects where the clients are internal to the company” (project manager, B2B mechatronics). High trans- parency served to protect the company from risk exposure: The experts do the evaluation and deliver them to the decision- maker and “it's very important that the person you deliver the information to understands the variation, restriction, risk, etc. […] [otherwise] the management may run with the wrong solution” (project manager, medical devices2).

High transparency was perceived to improve risk reduction and to serve as leverage in negotiations: “In one case the client asked to have risk logs delivered with the tender from all the bidders […] in that case they suddenly had four risk analyses', so they had a pretty good idea on how to proceed in the next rounds, and they could bring that as leverage” (risk manager, large contractor).

A high degree of transparency can reduce the risk for all stakeholders and influence contracting, project schedules and

743P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

the project outcome: “In one case we went through the whole risk log as it were with the client, […] and that resulted in changes in the contract, […] and reduced risk for the client and us”. (risk manager, large contractor).

One participant stated, “I would rather take the risk that we have to go back here [not pass a milestone] and be open [about risk exposure] than potentially delaying the […] plan” (project manager, B2B mechatronics). This perception was shared by a risk manager who described a project that was brought to a halt due to the project manager not escalating the risk information (risk manager, engineering consultancy2).

4.1.3. Balancing the need for transparency For some interviewees, the level of transparency was related

to the lifecycle of the project. “In general, I would say it's beneficial to be open towards the client, but when we are in a tender situation I wouldn't think you could have openness [regarding risk]” (risk manager, large contractor).

Balancing the level of information sharing was perceived as valuable to avoid burdening people with unnecessary information: “I don't share information with the developers because he is not going to do it faster if I tell him that we are over budget and have less time” (portfolio manager, IT developer). However, sharing information about risks also served completely different purposes: “Inexperienced project managers ‘overshare’ information to show themselves as “heroes”, as opposed to project managers who are very experienced and who “under-share”“(project controller, large scale construction).

In addition, too much transparency can create unwanted and unproductive management attention because flagging a risk draws attention. “If the project manager escalates or points out a problem too early, then he brings a lot of attention to it and then he's has committed himself to fixing it” (head of project controls, medical devices1).

In summary, the perception of the process of creating transparency regarding risk exposure is contextual and relates to different content. The interviewees described their own or others' non-transparent behavior as creating value for a personal, project, strategic, or organizational outcome. Trans- parency varied between companies, projects, and situations. Even for the same person, the value perception of transparency varied depending on the situation even if they valued transparency as a “best practice” in principle.

4.2. The value of reporting vs. ad hoc dialogue

4.2.1. Value perceptions of risk reporting In the examples in which reporting was not perceived as

value adding, creating reports was seen as time consuming, as an “administrative exercise”, as obtrusive, and even as taking time away from the actual management of risks: “As soon as you have to report stuff it means you have to create overview, and overview takes time. RM is great, but it shouldn't take too much time” (portfolio manager, IT developer). “Much reporting would take time away from engaging with engineers […] and they are usually the ones who know where the major risks are” (project manager, medical equipment).

In some instances, utilizing risk reports was not perceived as creating value due to the format of the reporting. Some interviewees indicated that certain formats did not provide useful support for project tasks, and others commented that the reports did not provide the right information, or the right amount, and were not in a format that fostered participation: “[The PRM report] is not something you can get people to look at […] it easily becomes a big ‘engineer’ excel sheet that people get tired of just opening it” (risk manager, large contractor).

When interviewees saw reporting as value adding, they perceived it to fulfil multiple functions. Risk reporting was used to evaluate the projects, served as a communication link between different levels of management and captured learning from projects, thus creating value for organizational, project, and strategic outcomes.

Reporting on risks creates traceability of errors, and is a compliance requirement in the medical and packaging industries: “Everything here is structured and we have formal processes and documentation, I perceive that as good RM. But it is also extremely necessary in our line of business” (senior strategy manager, packaging supplier). “We are in the medical field so it is important to document so we can trace in case something goes wrong […] It is in the company DNA to document, report and manage risk in a structured way” (executive, medical devices1). The value of reporting was perceived to be linked to risk ownership and organizational, strategic, and project outcome: “It is problematic that no reporting is done and that we don't have much structure because many risks fall between experts' knowledge and it's hard to figure out who to talk to.” (project team member, medical devices1). According to a risk consultant, the prime function of the reporting is to support decision-making (RM consultant).

4.2.2. The value of communicating through dialogue-based approaches

A dialogue-based, ad hoc approach to PRM was perceived to create value in multiple ways, sometimes adding to, or overriding, documentation processes.

A dialogue approach creates consensus on decisions and increases co-operation: “[During risk workshops] you get the teams to work much better together. When they do finally take a decision and commit it to it, it's a consensus (risk manager, RM consultancy).

Dialogue, as opposed to reporting, was viewed as enabling a deeper understanding: “An approach of and asking ‘how’ gets you a lot deeper”. “We have a thing where you have a mentor and you talk to them about what might go wrong in the future in your projects” (portfolio manager, IT developer).

Ad hoc, dialogue-based PRM during project meetings with upper and lower management was perceived as the main contributor to project success. Particularly for projects on a fast track, overriding the reporting procedures was perceived as value adding PRM (project manager, medical devices1). A dialogue-based approach in informal settings such as during lunch and at the coffee machines, was observed to improve risk identification: “Our project managers are very good at going around and asking each other ‘what if’ to identify risks” (head

744 P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

of project controls, medical devices1). By fashioning questions in a particular way, a dialogue-based PRM can be an exercise in reflexivity and awareness: “What if we have different weather conditions?” “If you make those questions to project managers […], at the beginning they will think that it's strange but then they will realize that they didn't mention it before, so […], they will realize that they didn't pay attention as they should have done”. (project controller, large scale construction).

The differences in perceptions of the value of reporting ranged from it being essential for the company to achieve its goals to it being a cumbersome, “administrative”, and non- value adding with regard to project outcomes. Reporting and communicating through ad hoc dialogue were perceived as both valuable and potentially problematic approaches to PRM. Multiple project managers gave examples of a dialogue approach being a central aspect of their PRM succeeding – but also voiced a need for more structured reporting.

4.3. The value of standardization vs flexibility

The interviewees perceived both standardization and flexi- bility in the PRM to be value adding.

4.3.1. Value perceptions of standardization The interviewees perceived standardization to increase the

manager's ability to support projects: “[…] when you put things into these standard templates, then the other project manager, the senior upper management and so on, knows what to look for. […] And that also gives them a better opportunity to [...] be supportive” (project manager, medical equipment). The project managers saw standardization as a way to facilitate communi- cation between project managers and enable them to exchange advice, creating value for project and organizational outcomes: “Having the company do it […] more streamlined would also make it easier for me to understand other project plans and other project management activities” (project manager, medical equipment). However, the interviewees also perceived pitfalls in standardizing: “When you formalize processes you have a better way of comparing risks across projects especially at the portfolio level, because everybody is communicating in the same way, - that's what you think at least! [...] but there is probably also a lot of stuff that falls outside which is dangerous when you have these kinds of processes” (portfolio manager, IT development).

4.3.2. Value perceptions of flexibility Multiple project managers perceived flexibility and the

ability to quickly reach out to senior management as crucial for agile, timely, and quick decision-making: “Sometimes deci- sions have a limited window of opportunity that requires flexibility […] if the [PRM] setup had been too hierarchal where I have to go to my boss who had to another boss and so on, and the time would have been wasted, […], we may not even have had the time to make the original proposal”. (project manager, medical equipment). By not having formalized procedures, each project manager is able to practice PRM as they see fit. This was perceived as a benefit, but only when a

strong PRM culture was in place. “[We have] a project where the PRM is informal or decentralized, without a risk manager, and no policy for how to do PRM, and it's a great project […] there is a lot of RM going on, but you have no idea what actually happened […] informal RM requires a very strong culture” (risk manager, large contractor).

In summary, the manner in which stable and non-stable PRM processes create value varies according to various contextual elements.

4.4. Deciding on gut-feeling vs. facts

4.4.1. Value perception of deciding on facts Using fact-based engineering was perceived to increase the

quality of the process: “We tried […] to avoid […] opinion engineering. [where] they just meet each other and say my idea is better than your idea. Your idea is– No, it isn't, my idea is the best, because they have an opinion, possibly based on experience. By actually going through the brainstorming, the pros and con evaluation, you force people to think”. (risk manager, RM consultancy).

Understanding the quality of estimates was perceived to support decision making: “Each estimate includes a description of how we got there, so you can see how they arrived at it […] and take that into account” (project manager, B2B mechatronics).

4.4.2. Value perception of deciding on gut feel In some instances, the CEO or upper management made

decisions on risk buffers based only on gut-feel. A process of structured risk analysis was followed by changing the results as the executives saw fit. The PRM results were used as an artifact in negotiations. “At the closing meeting it's the CEO who has final say on what we go with [in terms of risk reserves] in the tender situation”, “will it be 3%, 4% or 5%; it has to do with experience and competences. - Do you want to trust a [risk manager] person who has been in the company 3 years, or do you trust the project manager that has been there for 20 years and has followed the whole project?” (risk manager, large contractor).

A project manager stated that: “most of it [PRM] is based on gut-feel” (project manager, medical equipment) and explained that he perceived that PRM based on gut-feel enabled a high degree of flexibility because they did not have to run much analysis, and that enabled quick decisions.

Gut-feel can drive what is prioritized in the PRM, influencing the mitigation efforts and the estimates: “Some- times the CEO can fall in love with something very specific and ask ‘why is that one so big’, or they can say ‘I don't think that is right’ or ‘it's not going to work when we include all that’” (risk manager, large contractor). In summary, both fact-based and gut-feel based PRM were perceived as effective, but for different content.

4.5. Value of proactive vs. reactive PRM

Proactivity can be perceived to be non-value adding due to high degree of uncertainty, previous experiences, and because

Table 5 Perceptions of how PRM creates value (examples).

Process Content Illustrative quote

Creating low transparency in risk estimate

Strategic outcome: reduced risk of not being awarded a project

“if we had put the extra risk on, we wouldn't have won the tender” (risk manager)

Creating low transparency regarding supply risk

Project output: reduced risk of delay “we didn't want to risk that they started […] postponing things. So, we didn't tell it to the team” (project manager)

Creating high transparency of risk exposure

Project output and outcome: reduced risk of delay and improved planning

“[in the] decisions bodies risk is always highlighted. […] we create full transparency around [risks] and it reflects in much better planning” (executive)

Reporting serves as a communication link between departments

Improve other processes (org. outcomes)

“We are in the medical field so it is important to document in case something goes wrong” (executive)

No reporting and documenting Project output “reporting would take time away from engaging with engineers” (project manager) Standardized templates and

procedures Org. and strategic outcome: Comparing risks across projects

“you have a better way of comparing risks across projects [..] because everybody is communicating in the same way” (Portfolio manager)

Creating high flexibility in risk escalation process (Risk reporting)

Project outcome: Reduced risk of not meeting the deadline

“If the [risk management] had been too hierarchal [..] [we may] not have had the time to make original proposal” (project manager)

Gut-feel PRM Enables quick decisions (Org. outcomes)

“it is based on gut feel”, “I like in my work the flexibility we have”, “I like that decisions can be made fast” (project manager)

Fact based PRM Alignment between stakeholders and project output

“a serious conflict, which actually was threatening to delay the project”, “I did risk assessment”, “that was a shock for the contractor, that somebody would actually mediate and tell them that they were actually correct. Evidence based, not opinion based” (risk manager)

Proactive PRM Predictability (strategic outcome) “Predictability is key here”, “mandated from our owners” (project manager) Reactive PRM More time for the project (project

output) “Even if you write it down things are happening different than you expected” (Portfolio manager)

745P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

everything might change: “Even if you write it down things are happening different than you expected” and that it takes time away from the project work, potentially creating a risk of delay for the project: “Sometimes you can spend a lot of time telling people what the risks are instead of doing the project” (portfolio manager, it developer).

Proactivity was perceived as value adding, particularly for upper management because they base decisions on aggregation of uncertainty. “Predictability is the key here […] mandated from our owners” (project manager, B2B mechatronics), thus linking compliance to the ability to keep projects on schedule and within budget.

Proactive PRM was perceived to keep projects on schedule, cost and determine feasibility by identifying risky aspects of a project. A project manager explained that he had been assigned to projects to put them “back on track”: “No one ever took the time to map out the complexity [..] all the different solutions that were chosen were all highly complex and new fields, new areas, that weren't [within] the competence of the company” (project manager, medical devices).

There can be a conflict between viewing proactive RM and reactive RM as valuable. These perceptions can be linked to different outcomes as illustrated in what was described as a conflict between optimizing cost or safety: “We said they should shut it down. And they said they didn't shut it down. What they did was station a guy with a fire extinguisher. But you've got to understand that shutting down those things costs maybe a couple of million dollars […] They did what was necessary, but they didn't want to lose their production” (RM consultant). Both proactive and reactive PRM are perceived to create value for different content.

In summary, the perceptions of the process of creating value through PRM varied as well as which content was

considered important as illustrated by the previous section and by Table 5.

5. Discussion

The stakeholders' perceptions of how PRM creates value both contradict and align with the prescriptions of the normative literature and previous empirical studies. For instance, the perception of creating transparency as a value creating PRM practice changed depending on what content was perceived as important by a stakeholder – on occasion completely opposing the normative and empirical evidence that transparency regarding risk exposure is an effective best practice (Oehmen et al., 2014; Voetsch et al., 2004; Zwikael and Ahn, 2011). This variation might explain some of the controversy around the value creation of PRM and why stakeholders struggle to make explicit or “prove” an objective value of PRM, yet simultaneously have a multitude of perceptions of what the value of PRM is. It also draws into question the ability of normative standards to create a “one size fits all” type of PRM framework.

There were instances in which the stakeholders were justified in doing the opposite of suggested “best-practice” according to their perceptions of how PRM created value in their particular context. For instance, in the example where a project manager chose to reduce transparency to reduce the risk of losing a supplier, or the example of a risk manager reducing transparency in a risk estimate to win a tender. In both examples it could have created losses for the company to follow “best practice” advocated by empirical studies and normative literature.

The normative literature advocates for both standardization and flexibility, but not completely abandoning the PRM

746 P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

process and using only ad hoc PRM. Yet, some interviewees perceived this as a value creating practice, for instance when a project was on a “fast track”. The empirical findings of Voetsch et al. (2004), Oehmen et al. (2014) and Raz et al. (2002) provided evidence that formal or standardized PRM processes created value. However, whether or not it is perceived as such also influences the value creation of PRM, according to our results. For instance, if a project is put on an accelerated schedule, the stakeholders might perceive a benefit in abandoning the standardized and formal PRM process in favor of an ad hoc PRM due to time pressures, yet the project might be the type of project that would benefit from standardized and formalized PRM under different circum- stances. These considerations of context and the value perceptions of stakeholders are not accounted for in the studies that focus on objectively measuring the value creation of PRM. In fact, previous studies do not explicate the value creation aspect of PRM, even though it is fundamentally what they study.

In contrast to most studies, this study reported a variation in perceptions of how PRM creates value. One interpretation of this variation is that a risk management practice does not create value independently of objectives and circumstances. Rather, the value creation is affected by what content the stakeholder perceives as important and that influences the perception of the effectiveness of that particular PRM practice. Thus it might be problematic to generalize about the value creation of PRM without knowledge of the context and the stakeholders' perceptions.

Our findings demonstrate the possibility of a more detailed understanding of how PRM creates value, and show that stakeholder perceptions, the context and the complexity involved in studying value creation all play a major role. Thus our findings suggest that the value creation of PRM is contextual, and not “objectively” defined in terms of “count- able” project success metrics. Consequently, PRM activities such as risk identification might create value, yet their ability to do so depends on the perceptions of the stakeholders. Therefore knowledge about whether or not such practices were applied

Fig. 9. Value crea

and if project success, outcomes or output was achieved, may not tell us much about the actual value creation of PRM, without knowledge of the perceptions of the stakeholders and the context as well as possible compounding factors. A focus on PRM process steps or tools alone is therefore not sufficient to study the value creation of PRM.

Unlike most previous other studies, this one did not focus on specific types of content a priori, such as project output or success. This enabled us to identify greater variation. The results show that different types of content were identified as the target of value creation. Project personnel perceived PRM to create value for strategic, client, organizational, personal and project outcomes, and thus studies or practitioners linking PRM only to project success may miss the value creation of PRM that is occurring in relation to other outcomes. Interestingly, this in turn could indirectly influence project success according to evidence provided by Oehmen et al. (2014) and De Bakker (2011).

Despite reports about the failure of PRM to create value (Kutsch et al., 2014; Kutsch and Hall, 2010), the stakeholders in this study generally perceived PRM to create value. There was much variation in the perceptions of value creation of PRM in this study, but the current literature does not reflect its variety and interconnectedness beyond project outcomes (De Carvalho and Rabechini Junior, 2015) and its communicative effects (De Bakker et al., 2012).

The findings indicate that the perceived effectiveness of a PRM practice in terms of creating value is determined by what a stakeholder considers important and that the process, content and context are interlinked. Typically, the stakeholders perceived a specific way of doing PRM to be value adding for a particular content. The actions that stakeholders took were determined by what they were trying to protect, i.e. the value they were trying to create. The perception of which content is considered important can influence the perceived effectiveness of the process, as depicted in Fig. 9.

The findings complicate the design of PRM systems. Practically all PM, RM and PRM standards advise the tailoring of RM e.g., ISO 31000 (2018), PMI (2009) or Oehmen et al.

tion of PRM.

747P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

(2014). Yet it is not clear how to do this (Tegeltija et al., 2018) or which success criteria to take into account (Yaraghi and Langhe, 2011). The findings suggest new, previously missing aspects that merit consideration when designing a tailored PRM. Acknowledging the role of the subjective construction of value in PRM provides a new angle to approach its tailoring. The plurality of value perceptions regarding PRM value creation raises questions about the foundations of current normative guidance and empirical studies of PRM process quality.

6. Conclusion

6.1. Contribution

In this paper, we reviewed the literature to establish current streams of research on how PRM adds value to project management and organizations. We identified two dimensions that differentiate current work on the subject: Firstly, the researchers either attempt to objectively measure the value creation of PRM, or, less often, attempt to elicit value perceptions (or, in the case of most of the normative literature, often implicitly assume that PRM creates some type of value). Secondly, there are two aspects to value creation in PRM: a) What value is created, i.e. the content of value creation and b) How value is created, i.e. the process of doing so.

This paper makes a contribution to closing the significant gap on studying the perceived value creation of PRM in depth. We investigated the research question: How do stakeholders perceive PRM to create value? As an answer, we propose a holistic model of value creation in PRM and provide empirical findings regarding how stakeholders perceive PRM to create value.

The perceptions of how PRM creates value and what is considered effective practice varied between extreme opposites, and showed significant discrepancies with normative “best practice”. These extreme variations in perceptions could explain the controversy around PRM value creation and why conflicting results are often reached when trying to objectively measure the value creation of PRM. We argue that the perception of how PRM creates value is determined by: 1. The perception of content: the value that is perceived to be important, and, 2. The perception of the effectiveness of the process for that value – and most importantly, both are highly influenced by context.

The findings challenge current assumptions of studying the value of PRM, and present a new way to understand the limitations, complexities, and possibilities of its value creation. Rather than trying to establish causation and statistically “confirming” the effects of PRM on project success, we need to embrace the complexity, ubiquity, impreciseness and contextual nature of the value creation of PRM.

6.2. Practical implications

Practitioners may utilize the results in this paper to enhance their understanding of their own practice and the actuality of

PRM, and reflect on how PRM might create value in their context. This study also has implications for the use of normative guidance in PRM and the tailoring of PRM. The question is, what should be considered in tailoring PRM, in light of how much the actuality of PRM vary. Stakeholders in our sample generally perceive value in practicing PRM, but often did not do so in the way described in the normative literature, which is crucial knowledge for anyone trying to establish or improve a PRM system. In designing and tailoring their PRM systems, our findings suggest that practitioners must answer questions such as “What are the important stakeholder perceptions of how PRM creates value that may affect the particular PRM system?” and “Which practices apply in the particular context and which do not?”

6.3. Limitations

The findings presented in this paper were affected by a number of limitations. First, the interviews might have been inadvertently biased by us, e.g. through sample selection, formulation of questions, or nudging during the interview process. Even though we asked in different ways to avoid socially desired answers, the interviewees might have, as in any interview situation, given tainted answers for reasons unknown. The sampling was restricted to Denmark, and the value perceptions described may be affected by specific cultural or local aspects. The sample was relatively small and a bigger sample may have produced more nuanced or additional results. The data collected is subject to recollection bias. However, this is somewhat mitigated by our focus on studying perceptions.

Primarily PRM literature was investigated and thus there may be other aspects within more general RM to which the findings do not apply to or that cover these topics differently. The companies studied were primarily in the engineering sector and could be conducted in a broader context.

6.4. Implications for future studies

There is a need to understand the value creation of PRM in practice. We propose that future researchers should consider the concept of value creation holistically, as presented in this paper. The model provided in Fig. 9, can serve as guide to future studies on the value creation of PRM and as a means to evaluate them.

The findings suggest that future researchers should consider process, content and context in tandem. We must be vigilant regarding differences in perceptions when we evaluate and study PRM and embrace the potentially disturbing view that the value of PRM may not be easily measurable. Possibly, the classical view of stakeholders is not sufficient either. In contrast with Krane et al.'s (2012)‘s notion of stakeholder roles, we find significant variety in their behavior. Future studies should not take for granted that “either/or” is value adding, but rather engage and reflect on concrete situations and needs. Future researchers could investigate the perceptions of the value creation of PRM that exist across stakeholders and strive to

748 P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

uncover why they exist, and thus uncover the actuality of how PRM and RM create value in different segments and contexts.

Acknowledgements

The authors gratefully acknowledge: Funding support provided by the Brightline Initiative. One of the researchers (Verena Stingl) was partially funded by Asea Brown Boveri ltd.

References

Ahlemann, F., El Arbi, F., Kaiser, M.G., Heck, A., 2013. A process framework for theoretically grounded prescriptive research in the projectmanagement field. Int. J. Proj. Manag. 31, 43–56. https://doi.org/10.1016/j.ijproman.2012.03.008.

Alvesson, M., Skoldberg, K., 2009. Reflexive Methodology: New Vistas for Qualitative Research. SAGE https://doi.org/10.1080/13642531003746857.

Aven, T., 2012. Foundational issues in risk assessment and risk management. Risk Anal. 32, 1647–1656. https://doi.org/10.1111/j.1539-6924.2012.01798.x.

Aven, T., 2016. Risk assessment and risk management: review of recent advances on their foundation. Eur. J. Oper. Res. 253, 1–13. https://doi.org/ 10.1016/j.ejor.2015.12.023.

Bannerman, P.L., 2008. Risk and risk management in software projects: a reassessment. J. Syst. Softw. 81, 2118–2133. https://doi.org/10.1016/j. jss.2008.03.059.

Besner, C., Hobbs, B., 2006. The Perceived Value and Potential Contribution of Project Mangaement Practices to Project Success. pp. 37–48.

Besner, C., Hobbs, B., 2012. The paradox of risk management; a project management practice perspective. Int. J. Manag. Proj. Bus. 5, 230–247. https://doi.org/10.1108/17538371211214923.

Bingham, C.B., Eisenhardt, K.M., Furr, N.R., 2007. What makes a process a capability? Heuristics, strategy, and effective capture of opportunities. Strateg. Entrep. J. 1, 27–47. https://doi.org/10.1002/sej.1.

Bryman, A., Bell, E., 2015. Business Research Methods. Methods. 4th ed. . Cash, P.J., 2018. Developing theory-driven design research. Des. Stud. 56,

84–119. https://doi.org/10.1016/j.destud.2018.03.002. De Bakker, K., 2011. Dialogue on Risk - Effect of Project Risk Management on

Project Success. De Bakker, K., Boonstra, A., Wortmann, H., 2011. Risk management affecting

IS/IT Project success through communicative action. Proj. Manag. J. 42, 75–90. https://doi.org/10.1002/pmj.20242.

De Bakker, K., Boonstra, A., Wortmann, H., 2012. Risk managements' communicative effects influencing IT project success. Int. J. Proj. Manag. 30, 444–457. https://doi.org/10.1016/j.ijproman.2011.09.003.

De Carvalho, M.M., Rabechini Junior, R., 2015. Impact of risk management on project performance: the importance of soft skills. Int. J. Prod. Res. 53, 321–340. https://doi.org/10.1080/00207543.2014.919423.

den Ouden, E., 2012. Innovation Design: Creating Value for People, Organizations and Society. Springer https://doi.org/10.1007/978-1-4471-2268-5.

Eisenhardt, K.M., Graebner, M.E., 2007. Theory building from cases: oppurtinities and challanges. Acad. Manag. J. 50, 25–32. https://doi.org/ 10.2307/20159839.

Geraldi, J.G., Lee-Kelley, L., Kutsch, E., 2010. The Titanic sunk, so what? Project manager response to unexpected events. Int. J. Proj. Manag. https:// doi.org/10.1016/j.ijproman.2009.10.008.

Gioia, D.A., Corley, K.G., Hamilton, A.L., 2013. Seeking qualitative rigor in inductive research: notes on the Gioia Methodology. Organ. Res. Methods 16, 15–31. https://doi.org/10.1177/1094428112452151.

ISO 31000, 2018. ISO 31000:2018. Risk management - Principles and Guidelines, Risk Management. https://www.iso.org/standard/65694.html.

Krane, H.P., Olsson, N.O.E., Rolstadås, A., 2012. How project manager-project owner interaction can work within and influence project risk management. Proj. Manag. J. 43, 54–67. https://doi.org/10.1002/pmj.20284.

Kreiner, K., 2014. Advancing Research on Projects and Temporary Organiza- tions, Advancing Research on Projects and Temporary Organizations. Copenhagen Business School Press.

Kutsch, E., Hall, M., 2009. The rational choice of not applying project risk management in information technology projects. Proj. Manag. J. 40, 72–81. https://doi.org/10.1002/pmj.20112.

Kutsch, E., Hall, M., 2010. Deliberate ignorance in project risk management. Int. J. Proj. Manag. 28, 245–255. https://doi.org/10.1016/ j.ijproman.2009.05.003.

Kutsch, E., Browning, T.R., Hall, M., 2014. Bridging the risk gap: the failure of risk management in information systems projects. Res. Technol. Manag. 57, 26–32. https://doi.org/10.5437/08956308X5702133.

Laursen, M., Svejvig, P., 2016. Taking stock of project value creation: a structured literature review with future directions for research and practice. Int. J. Proj. Manag. 34, 736–747. https://doi.org/10.1016/j.ijproman.2015.06.007.

Lehtiranta, L., 2014. Risk perceptions and approaches in multi-organizations: a research review 2000–2012. Int. J. Proj. Manag. 32, 640–653. https://doi. org/10.1016/j.ijproman.2013.09.002.

Lepak, D.P., Smith, K.G., Taylor, M.S., 2007. Value creation and value capture: a multilevel perspective. Acad. Manag. Rev. 32, 180–194. https:// doi.org/10.5465/AMR.2007.23464011.

Mu, J., Peng, G., MacLachlan, D.L., 2009. Effect of risk management strategy on NPD performance. Technovation https://doi.org/10.1016/j.technovation. 2008.07.006.

Oehmen, J., Olechowski, A., Robert Kenley, C., Ben-Daya, M., 2014. Analysis of the effect of risk management practices on the performance of new product development programs. Technovation 34, 441–453. https://doi.org/ 10.1016/j.technovation.2013.12.005.

Olechowski, A., Oehmen, J., Seering, W., Ben-Daya, M., 2016. The professionalization of risk management: what role can the ISO 31000 risk management principles play? Int. J. Proj. Manag. 34, 1568–1578. https:// doi.org/10.1016/j.ijproman.2016.08.002.

Pimchangthong, D., Boonjing, V., 2017. Effects of risk management practices on IT project success. Manag. Prod. Eng. Rev. 8, 30–37. https://doi.org/ 10.1515/mper-2017-0004.

PMI, 2009. Practice Standard for Project Risk Management. Project Management Institute, Newton Square, PA.

Purdy, G., 2010. ISO 31000: 2009 — Setting a New Standard for Risk Management. vol. 30. https://doi.org/10.1111/j.1539-6924.2010.01442.x.

Raz, T., Michael, E., 2001. Use and benefits of tools for project risk management. Int. J. Proj. Manag. 19, 9–17. https://doi.org/10.1016/S0263- 7863(99)00036-8.

Raz, T., Shenhar, A.J., Dvir, D., 2002. Risk management, project success, and technological uncertainty. R&D Manag. 32, 101–109. https://doi.org/ 10.1111/1467-9310.00243.

Rodrigues-da-Silva, L.H., Crispim, J.A., 2014. The project risk management process, a preliminary study. Procedia Technol. 16, 943–949. https://doi. org/10.1016/j.protcy.2014.10.047.

Shenhar, A.J., Dvir, D., Levy, O., Maltz, A.C., 2001. Project success: a multidimensional strategic concept. Long Range Plan. 34, 699–725. https:// doi.org/10.1016/S0024-6301(01)00097-8.

Söderlund, J., Maylor, H., 2012. Project management scholarship: relevance, impact and five integrative challenges for business and management schools. Int. J. Proj. Manag. 30, 686–696. https://doi.org/10.1016/j. ijproman.2012.03.007.

Taylor, H., 2005. Congruence between risk management theory and practice in Hong Kong vendor-driven IT projects. Int. J. Proj. Manag. https://doi.org/ 10.1016/j.ijproman.2005.02.001.

Tegeltija, M., Oehmen, J., McMahon, C.A., Maier, A., Kozin, I., Škec, S., 2018. Tailoring Risk Management in Design 667–678. https://doi.org/ 10.21278/idc.2018.0385.

Teller, J., Kock, A., 2013. An empirical investigation on how portfolio risk management influences project portfolio success. Int. J. Proj. Manag. 31, 817–829. https://doi.org/10.1016/j.ijproman.2012.11.012.

Thamhain, H., 2013. Managing risks in complex projects. Proj. Manag. J. Proj. Manag. Inst. 44, 20–35.

Voetsch, R.J., Cioffi, D.F., Anbari, F.T., 2004. Project Risk Management Practices IRNOP VI Conference.

Witzel, A., 2000. The Problem-Centered Interview. Forum Qualitative Sozialforschung/Forum: Qualitative Social Research 1, Art. 22. https://doi. org/1438-5627.

749P. Willumsen et al. / International Journal of Project Management 37 (2019) 731–749

Xia, N., Zou, P.X.W., Griffin, M.A., Wang, X., Zhong, R., 2018. Towards integrating construction risk management and stakeholder management: a systematic literature review and future research agendas. Int. J. Proj. Manag. 36, 701–715. https://doi.org/10.1016/j.ijproman.2018. 03.006.

Yaraghi, N., Langhe, R.G., 2011. Critical success factors for risk management systems. J. Risk Res. 14, 551–581. https://doi.org/10.1080/13669877.2010.547253.

Yin, R.K., 2003. Case study methodology R.K. Yin (2003, 3rd edition). Case study research design and methods. Sage, Thousand Oaks (CA). pdf. Case Study Research: Design and Methods. 19–39, pp. 96–106.

Zwikael, O., Ahn, M., 2011. The effectiveness of risk management: an analysis of project risk planning across industries and countries. Risk Anal. 31, 25–37. https://doi.org/10.1111/j.1539-6924.2010.01470.x.

Zwikael, O., Smyrk, J., 2012. A general framework for gauging the performance of initiatives to enhance organizational value. Br. J. Manag. 23. https://doi.org/10.1111/j.1467-8551.2012.00823.x.