Attention Writing King: Apply a Qualitative Risk Analysis: Presentation and Exercise

P A

P E

R S

20 April 2013 ■ Project Management Journal ■ DOI: 10.1002/pmj

INTRODUCTION ■

U ncertainty is both a reality and great challenge for most projects

(Chapman & Ward, 2003; Hillson, 2010). The presence of risk creates

surprises throughout the project life cycle, affecting everything

from technical feasibility to cost, market timing, financial perform-

ance, and strategic objectives (Hillson, 1999; Loch, Solt, & Bailey, 2008;

Thieme, Song, & Shin, 2003). Yet, to succeed in today’s ultracompetitive envi-

ronment, management must deal with these risks effectively despite these

difficulties (Buchanan & O’Connell, 2006; Patil, Grantham, & Steele, 2012;

Shenhar, 2001; Shenhar, Milosevic, Dvir, & Thamhain, 2007; Srivannaboon &

Milosevic, 2006). This concerns executives, and it is not surprising that lead-

ers in virtually all organizations, from commerce to government, spend

much of their time and effort dealing with risk-related issues. Examples trace

back to ancient times that include huge infrastructure projects and military

campaigns. Writings by Sun Tzu articulated specific risks and suggested

mitigation methods 2,500 years ago (Hanzhang & Wilkinson, 1998). Risk

management is not a new idea. However, in today’s globally connected, fast-

changing business world with broad access to resources anywhere, and pres-

sures for quicker, cheaper, and smarter solutions, projects have become

highly complex and intricate. Many companies try to leverage their

resources and accelerate their schedules by forming alliances, consortia, and

partnerships with other firms, universities, and government agencies that

range from simple cooperative agreements to “open innovation,” a concept

of scouting for new product and service ideas anywhere in the world. In such

an increasingly complex and dynamic business environment, risks lurk in

many areas, not only associated with the technical part of the work, but also

including social, cultural, organizational, and technological dimensions. In

fact, research studies have suggested that much of the root cause of project-

related risks can be traced to the organizational dynamics and multidiscipli-

nary nature that characterizes today’s business environment, especially for

technology-based developments (R. Cooper, Edgett, & Kleinschmidt, 2001;

Torok, Nordman, & Lin, 2011). The involvement of many people, processes,

and technologies spanning different organizations, support groups, subcon-

tractors, vendors, government agencies, and customer communities com-

pounds the level of uncertainty and distributes risk over a wide area of the

enterprise and its partners (Thamhain, 2004; Thamhain & Wilemon, 1999),

often creating surprises with potentially devastating consequences. This

paradigm shift leads to changing criteria for risk management. To be effec-

tive in dealing with the broad spectrum of risk factors, project leaders must

go beyond the mechanics of analyzing the work and its contractual compo-

nents of the “triple constraint,” such as cost, schedules, and deliverables, and

also examine and understand the sources of uncertainty before attempting

to manage them. This requires a comprehensive approach with sophisticat-

ed leadership, integrating resources and a shared vision of risk management

across organizational borders, time, and space. Currently, we are good at

identifying and analyzing known risks but weak in dealing with the hidden,

less-obvious aspects of uncertainty, and in proactively dealing with risks in

Managing Risks in Complex Projects Hans Thamhain, Bentley University, Waltham, MA, USA

ABSTRACT ■

Dealing effectively with risks in complex projects

is difficult and requires management interven-

tions that go beyond simple analytical approach-

es. This is one finding of a major field study into

risk management practices and business process-

es of 35 major product developments in 17 high-

technology companies. Almost one-half of the

contingencies that occur are not being detected

before they impact project performance. Yet, the

risk-impact model presented in this article shows

that risk does not affect all projects equally but

depends on the effectiveness of collective mana-

gerial actions dealing with specific contingencies.

The results of this study discuss why some organ-

izations are more successful in detecting risks

early in the project life cycle, and in decoupling

risk factors from work processes before they

impact project performance. The field data sug-

gest that effective project risk management

involves an intricately linked set of variables,

related to work process, organizational environ-

ment, and people. Some of the best success sce-

narios point to the critical importance of recogniz-

ing and dealing with risks early in their develop-

ment. This requires broad involvement and collab-

oration across all segments of the project team

and its environment, and sophisticated methods

for assessing feasibilities and usability early and

frequently during the project life cycle. Specific

managerial actions, organizational conditions,

and work processes are suggested for fostering a

project environment most conducive to effective

cross-functional communication and collabora-

tion among all stakeholders, a condition impor-

tant to early risk detection and effective risk man-

agement in complex project situations.

KEYWORDS: project management prac-

tices; performance; maturity; risk manage-

ment; project management; complexity; high-

technology companies; new product develop-

ment; leadership; teamwork

Project Management Journal, Vol. 44, No. 2, 20–35

© 2013 by the Project Management Institute

Published online in Wiley Online Library

(wileyonlinelibrary.com). DOI: 10.1002/pmj.21325

April 2013 ■ Project Management Journal ■ DOI: 10.1002/pmj 21

their early stages (Smith & Merritt,

2002). Yet, some organizations seem to

be more successful than others in deal-

ing with the uncertainties and ambigu-

ities of our business environment, an

observation ( Thamhain & Skelton,

2007) that is being explored further in

this field study, resulting in actionable

lessons for effective risk management,

summarized at the end of this article.

What We Know About Risk Management

We Are Efficient in Identifying and

Analyzing Known Risk Factors

With the help of sophisticated comput-

ers and information technology, we have

become effective in dealing with risks

that can be identified and described ana-

lytically. Examples range from statistical

methods and simulations to business-

case scenarios and user-centered design

(UCD). Each category includes hundreds

of specialized applications that help in

dealing with project risk issues, often

focusing on schedule, budget, or techni-

cal areas (Barber, 2005; Bartlett, 2002;

Dey, 2002; Elliott, 2001). Risk manage-

ment tools and techniques have been

discussed extensively in the literature

(Bstieler, 2005; D. Cooper, Grey, Raymond, &

Walker, 2005; Hillson, 2000, 2003, 2010;

Jaofari, 2003; Kallman, 2006). Examples

include critical path analysis, budget

tracking, earned value analysis, configu-

ration control, risk-impact matrices, pri-

ority charts, brainstorming, focus

groups, online databases for categorizing

and sorting risks, and sophisticated

Monte Carlo analysis, all designed to

make project-based results more pre-

dictable. In addition, many companies

have developed their own policies, pro-

cedures, and management tools for deal-

ing with risks, focusing on their specific

needs and unique situations. Especially in

the area of new product development, con-

temporary tools such as phase-gate

processes, concurrent engineering, rapid

prototyping, early testing, design-build sim-

ulation, computer aided design/computer

aided engineering/computer aided man-

ufacturing (CAD/CAE/CAM), spiral

developments, voice of the customer

(VoC), UCD, agile concepts, and Scrum

have been credited for reducing project

uncertainties. Furthermore, industry-

specific guidelines (i.e., DOD Directive

5000.1, 2007), national and internation-

al standards (i.e., ANSI, CSA, the

International Organization for Standard-

ization [ISO], and National Institute of

Standards and Technology, 2000), and

guidelines developed by professional

organizations (the fifth edition of A

Guide to the Project Management Body

of Knowledge (PMBOK® Guide) [PMI,

2013]) all have contributed to the

knowledge base and broad spectrum of

risk management tools available today.

We Are Weak in Dealing With

Unknown Risks

These are uncertainties, ambiguities, and

arrays of risk factors that are often intri-

cately connected. They most likely follow

non-linear processes, which develop into

issues that ultimately affect project

performance (Apgar, 2006). A typical

example is the 2010 Deepwater Horizon

accident in the Gulf of Mexico. In hind-

sight, the catastrophe should have been

predictable and preventable. In reality,

the loss of 11 workers and an environ-

mental disaster of devastating propor-

tion came as a “surprise.” While the indi-

vidual pieces of this risk scenario

appeared to be manageable, the cumula-

tive effects leading to the explosion were

not. They involved multiple intercon-

nected processes of technical, organiza-

tional, and human factors, all associated

with some imperfection and risk. Even

afterward, tracing the causes and culprits

was difficult. Predicting and controlling

such risks appears impossible with the

existing organizational systems and

management processes in place.

We Are Getting Better Integrating

Experience and Judgment With

Analytical Models

With the increasing complexity of proj-

ects and business processes, managers

are more keenly aware of the intricate

connections of risk variables among

organizational systems and processes,

which limit the effectiveness of analytical

methods. Managers often argue that no

single person or group within the enter-

prise has the knowledge and insight for

assessing these multi-variable risks and

their cascading effects. Further, no ana-

lytical model seems sophisticated

enough to represent the complexities

and dynamics of all risk scenarios that

might affect a major project. These man-

agers realize that, while analytical meth-

ods provide a critically important toolset

for risk management, it also takes the

collective thinking and collaboration of

all stakeholders and key personnel of the

enterprise and its partners to identify

and deal with the complexity of risks in

today’s business environment. As a

result, an increasing number of organi-

zations are complementing their analyti-

cal methods with managerial judgment

and collective stakeholder experience,

moving beyond a narrow dependence on

just analytical models. In addition, many

companies have developed their own

“systems,” uniquely designed for dealing

with uncertainties in their specific proj-

ects and enterprise environment. These

systems emphasize the integration of

various tools, often combining quantita-

tive and qualitative methods to cast a

wider net for capturing and assessing

risk factors beyond the boundaries of

conventional methods. Examples are

well-known management tools, such as

review meetings, Delphi processes,

brainstorming, and focus groups, which

have been skillfully integrated with ana-

lytical methods to leverage their effec-

tiveness and improve their reliability. In

addition, a broad spectrum of new and

sophisticated tools and techniques, such

as UCD, VoC, and phase-gate processes,

have evolved, which rely mostly on orga-

nizational collaboration and collective

judgment processes to manage the

broad spectrum of risk variables that are

dynamically distributed throughout the

enterprise and its external environment.

The Missing Link

Despite extensive studies on project risk

and its management practices (Hillson,

22 April 2013 ■ Project Management Journal ■ DOI: 10.1002/pmj

Managing Risks in Complex Projects

P A

P E

R S

2000, 2010; Jaofari, 2003; Kallman, 2006;

Wideman, 1992), relatively little has been

published on the role of collaboration

across the total enterprise for managing

risk. That is, we know little about organi-

zational processes that involve the broad-

er project community in a collective

cross-functional way for dealing with risk

identification and mitigation. Moreover,

there is no framework currently available

for handling risks that are either

unknown or too dynamic to fit conven-

tional management models. The miss-

ing link is the people side as a trans-

functional, collective risk management

tool, an area that is being investigated in

this article with focus on two research

questions, which provide a framework

for this exploratory field study:

Research Question 1: How do contin-

gencies impact project performance,

and why does the impact vary across

different project organizations?

Research Question 2: What condi-

tions of the project environment are

most conducive to dealing effectively

with complex risk issues?

In addition, I state four important

observations made during discussions

with project leaders and senior managers

at an earlier exploratory phase of this

study. These observations provide a small

window into current managerial thought

and practice. They underscore the impor-

tance of investigating the two research

questions and providing ideas for future

research and hypothesis testing.

Observation 1: Contingencies in the

project environment do not impact

the performance of all projects equally.

Observation 2: Early detection of con-

tingencies is critically important for

managing and minimizing any neg-

ative impact on project performance.

Observation 3: Performance prob-

lems caused by contingencies (risks)

are likely to cascade, compound, and

become intricately linked.

Observation 4: Contingencies in the

project environment affect project

performance more severely with

increasing complexity and high-tech

content of the undertaking.

While specific hypothesis testing

appears premature at this early stage of

the research, the research questions

together with the field observations

provide focus for the current investiga-

tion, including designing question-

naires, conducting interviews, guiding

data collection, and discussing results.

Furthermore, the field observations

could provide the basis for the develop-

ment of formal propositions, hypothe-

sis testing, and future research.

Objective and Significance

Taken together, the objective of this

study is to investigate the dynamics and

cascading effects of risk scenarios in

complex projects, and the management

practices of handling these risks.

Specifically, the study aims to improve

the understanding of (1) the dynamics

of risk impacting project performance

and (2) the human side of dealing with

risks in complex project situations. Part

of the objective is to look beyond the

analytical aspects of risk management

to examine the interactions among

people and organizations and try to

identify the conditions most conducive

to detecting risk factors early in the

project life cycle and handle them

effectively. The significance of this

study is in the area of project manage-

ment performance and leadership

style. The findings provide team leaders

and senior managers with an insight

into the dynamic nature of risk and its

situational impact on project perform-

ance. The results also suggest specific

conditions that leaders can foster in the

team environment conducive to effec-

tive risk management, especially in

complex project scenarios.

Key Variables Affecting Risk Management By definition, risk is a condition that

occurs when uncertainties emerge with

the potential of adversely affecting one

or more of the project objectives and its

performance within the enterprise sys-

tem (ISO, 2009; PMI, 2013). Risk can

occur in many different forms, such as

known or unknown, quantitative or

qualitative, and even real or imaginary

(Shaw, Abrams, & Marteau, 1999). Risk

is derived from uncertainty. It is com-

posed of a complex array of variables,

parameters, and conditions that have

the potential of adversely impacting a

particular activity or event, such as a

project. At the minimum, three interre-

lated sets of variables affect the cost

and overall ability of dealing with risk,

as graphically shown in Figure 1:

1. Degree of uncertainty (variables, set #1)

2. Project complexity (variables, set #2)

3. Impact (variables, set #3)

Understanding these variables is

important for selecting an appropriate

method of risk management, and for

involving the right people and organi-

zations necessary for effectively dealing

with a specific risk situation.

1. Degree of Uncertainty ( Variable Set

#1). For discussion, we can divide the

degree of uncertainty into four cate-

gories (rank-ordered from low to

high) that may affect various seg-

ments of the project or the whole

business enterprise.

° Variations. These are variations of known variables, such as cost, tim-

ing, or technical requirements. The

degree of risk varies with the level

of uncertainty and magnitude of

the expected variation, and the

potential impact on the project.

However, by definition, the vari-

ables are well understood and the

model for project performance

impact is known. This is an area

where analytical methods and con-

ventional methods of project plan-

ning, execution, and control are

usually highly effective.

° Contingencies. These are known events that could occur and nega-

tively affect project performance.

However, the probability of occur-

rence and magnitude of impact are

not known. Or, the cost and effort of

determining probable occurrence

April 2013 ■ Project Management Journal ■ DOI: 10.1002/pmj 23

and impact are too great, or stake-

holders simply have chosen not to

deal with this contingency for the

time being. Examples are customer

changes, design failures, and con-

tractor issues that could have been

expected but catch project leaders

by surprise. This is an area where

better management discipline,

policies, and procedures can be

effective. In addition, certain ana-

lytical methods, such as PERT and

computer simulations, can help in

anticipating and dealing with these

risk factors.

° Accidents. These are events that can be identified in principle, but

the probability of occurrence and

its specific scope and impact on

project performance are difficult if

not impossible to predict. A some-

what simplified but graphic exam-

ple might be a motorist planning

for a car accident. One could make

an argument that a savvy driver is

proactive by carrying insurance, an

emergency medical kit, a flash-

light, a cell phone, and so on, and

drives carefully to avoid accidents.

However, the reality is that car acci-

dents happen even to the most

skilled and careful drivers. When

they happen, they were not “antici-

pated,” and a contingency plan

might be of little or no value.

Projecting this example to a com-

plex project venture, such as off-

shore oil drilling or outer space

exploration, provides the type of

scenario where the possibility

of accidents is certainly recognized

but its scope and impact are very

difficult to predict.

° Unknown-Unknowns. These are events that were not known to the

project team before they occurred,

or were seen as impossible to hap-

pen in a specific project situation.

Examples might be the failure of a

certified component with proven

liability in similar applications,

a sudden bankruptcy of a customer

organization, or a competitor’s break-

through invention/innovation that

undermines the value of your cur-

rent project or threatens a major

line of business. By definition,

unknown-unknowns are not fore-

seeable and therefore cannot be

dealt with proactively.

This classification was developed

during an earlier research study

(Thamhain & Skelton, 2007), where it

helped in characterizing various types

of uncertainties and in setting specific

boundaries for various levels of uncer-

tainty, hence establishing a conceptual

framework and basis for further discus-

sion. However, it should be pointed out

that the boundaries are rather fluid,

with a wide range of overlaps among

the categories. In fact, these four cate-

gories of uncertainty, previously

described, blend into a continuous

spectrum ranging from “predictable

and manageable” to “unforeseeable

and unpreventable.” The degree of

overlay among these classifications

depends on managerial skill sets, expe-

riences, and organizational environ-

ments, which is yet another set of

variables affecting uncertainty. That is,

events that seem to be manageable to

one team might appear as a complete

surprise (unknown-unknowns) to

another, an interesting reality that will

be discussed further in this article.

2. Project Complexity (Variable Set #2).

The scope and complexity of the proj-

ect undertaking is yet another dimen-

sion likely to influence the ability to

deal with risk issues (Geraldi &

Adlbrecht, 2007; Haas, 2009; Thomas &

Mengel, 2008). Formal studies of proj-

ect-related complexity have focused

on two aspects: “complexity in proj-

ects” and “complexity of projects”

(Cooke-Davies, Cicmil, Crawford, &

Richardson, 2007). The first focus aims

mostly at the complexities surround-

ing the project organization, such as

its socioeconomic and political envi-

ronment and its dynamics and

changes, both internal and external to

the enterprise (Cicmil & Marshall,

2005; Cooke-Davies et al., 2007;

Maylor, Vidgen, & Carver, 2008). The

second stream of research looks more

specifically at the project, trying to

Variations

Unknown-Unknowns (Unexplainable)

Pr oj

ec t

(lo w to

m ed

iu m

)

Pr og

ra m

(h ig

h)

Accidents (Unpredictable)

Contingencies (Predictable)

Set #2

Low----- Complexity ----- High

A rr

ay

(v er

y hi

gh )

S e t #

1

L o

w --

-- -

D e

g re

e o

f U

n c e

rt a in

ty -

-- --

H ig

h

S e t # 3

Lo w-

-- Im

pa ct

-- -H

ig h

C A

T -V

I: E n

te rp

rise Im

p a c t

C A

T -III: P

ro je

c t Im

p a c t

C A

T -II: L

im ite

d Im

p a c t

C a te

g o

ry -I: N

o Im

p a c t

Figure 1: Dimensions of risk management.

24 April 2013 ■ Project Management Journal ■ DOI: 10.1002/pmj

Managing Risks in Complex Projects

P A

P E

R S

characterize and classify its complexi-

ty (Geraldi & Adlbrecht, 2007; Jaofari,

2003; Shenhar & Dvir, 2007; Williams,

2005; Williams & Sumset, 2010).

Among the many streams of complex-

ity research, the classifications along

structural lines, such as task-project-

program-array shown in Figure 1,

seem to be most common. It is also

part of the popular Diamond Model

(Shenhar & Dvir, 2007), which suggests

a broader scope for characterizing

project complexity along four dimen-

sions: (1) structural complexity (low:

assembly, medium: system, high:

array), (2) novelty or innovation (deriv-

ative-platform-breakthrough), (3)

pace (regular-fast-blitz), and (4) tech-

nology (low-medium-high-super

high). All these models help in estab-

lishing some metric for classifying the

degree of “project difficulty,” providing

useful guidelines for discussing risk in

the context of project complexity.

3. Impact of Risk on Project and

Enterprise (Variable Set #3). Although

complex projects are likely to have a

larger impact on the enterprise,

smaller projects or risk issues

can also impact large segments of

the enterprise. An example is the

Toyota acceleration problem,

caused by a relatively small compo-

nent of the automobile. Yet, it

impacted the image and financial

performance of the whole enter-

prise. Four specific categories of risk

have been suggested in prior studies

( Thamhain & Skelton, 2007) as a

framework for discussing the situa-

tional nature of risk and its potential

impact on project and enterprise

performance:

° Category-I risks: Little or no impact on project performance. Category-I

risks are potentially harmful events

that can be identified and dealt

with before affecting project per-

formance.

° Category-II risks: Potential for limit- ed impact on project performance.

These risk issues can be dealt with

at a lower level of project activity,

such as a task or subsystem, before

they impact overall project per-

formance. Examples are technical

issues that can be solved “locally.”

The impact on cost, time, quality,

and other performance parameters

is limited to a subset of the project.

° Category-III risks: Potential for sig- nificant impact on project perform-

ance. The contingency is expected

to impact the project significantly,

affecting overall project perform-

ance, such as causing critical sched-

ule delays and budget overruns.

° Category-IV risks: Potential for signifi- cant irreversible impact on project and

overall enterprise performance. The

effects could be immediate or cascad-

ing, as we have seen in Toyota’s “acci-

dental acceleration issue,” which start-

ed out as an “unknown-unknown” risk

factor that appeared to be limited to

some technical issues but eventually

affected overall enterprise perform-

ance extensively.

The significance of establishing cat-

egories of risks with defined impact

boundaries is for describing and com-

paring the impact of a specific contin-

gency. These four categories are being

suggested as a measure for communi-

cating the degree of risk impact. As an

analogy, this is similar to the categories

established for storms or earthquakes

to describe the potential for damages

resulting from the events. Similarly, risk

categories identify the degree of poten-

tial problems caused in projects and

enterprise systems. In this context, the

article contributes a building block of

knowledge on project risk manage-

ment. Furthermore, the four risk cate-

gories will be used later in the Results

section of this article to build a model

explaining the dynamics and cascading

effects of risk events impacting projects

and their enterprise systems.

Method The work reported here is the continua-

tion of ongoing research into risk man-

agement practices and team leadership

in complex project situations (Skelton

& Thamhain, 2006, 2007; Thamhain,

2007, 2008, 2009, 2011; Thamhain &

Skelton, 2006, 2007). This article sum-

marizes four years (2008–2011) of this

investigation, focusing on the risk man-

agement practices of 35 major product

developments in 17 high-technology,

multinational enterprises.

The current research uses an

exploratory field study format with

focus on four interrelated sets of vari-

ables: (1) risk, (2) team, (3) team leader,

and (4) project environment. All these

variables, plus the components of risk

management, product development,

teamwork, technology, and project

management, are intricately connect-

ed, representing highly complex sets of

variables with multiple causalities.

Researchers have consistently pointed

at the nonlinear, often random nature

of these processes that involve many

facets of the organization, its members,

and environment (Bstieler, 2005;

Danneels & Kleinschmidt, 2001; Elliott,

2001; MacCormack, 2001; Thamhain,

2008, 2009; Verganti & Buganza, 2005).

Investigating these organizational

processes simultaneously is not an easy

task. Simple research models, such as

mail surveys, are unlikely to produce

significant results. Instead, one has to

use exploratory methods, casting a

wide net for data collection, to look

beyond the obvious aspects of estab-

lished theory and management prac-

tice. I used my ongoing work as a

consultant and trainer with 17 compa-

nies to conduct discussions, interviews,

and some surveys, together with exten-

sive observations, all helping to gain

insight into the work processes, manage-

ment systems, decision making, and

organizational dynamics associated with

project risk management. This method,

referred to as action research, includes

two qualitative methods: participant

observation and in-depth retrospective

interviewing. It also provided access to

some conventional questionnaire-based

surveys to about one-half of the

field study population characterized

in Table 1. This combined method is

April 2013 ■ Project Management Journal ■ DOI: 10.1002/pmj 25

particularly useful for exploratory

investigations, such as the study report-

ed here, which is considerably outside

the framework of established theories

and constructs (Eisenhardt, 1989;

Glaser & Strauss, 1967). However, the

method also has limitations and weak-

nesses, especially the dependence

upon the observer’s experience and the

observer’s biases, which are recognized.

The questionnaire was designed to

measure (1) risk factors, (2) frequency of

risk occurrences, (3) impact on project

performance, and (4) managerial actions

taken to deal with contingencies (risks).

To minimize potential misinterpretations

or biases from the use of social science

jargon, each of the 14 risk classes (sum-

marized in Figure 2) was defined specifi-

cally at the beginning of the question-

naire. For example, class #7 (changing

organizational priorities) was defined as

“changes of priorities in your organiza-

tion that affected resource allocations,

schedule, or support of your project.” For

each risk class, participants were asked to

indicate frequency, impact, and manage-

rial actions. Regarding frequency, partici-

pants indicated on a 3-point scale (never,

somewhat, definitely) whether the situa-

tion occurred during the project life cycle.

Regarding impact, participants indicated

on a 4-point scale (no impact, little impact,

considerable impact, and significant/

major impact on project and enterprise

performance) the impact of the contin-

gency on the project and its performance.

Regarding managerial actions, partici-

pants indicated the specific actions taken

by managers and project leaders in deal-

ing with the contingency, and the degree

of success achieved by the action.

Questionnaires were coded to track the

responses from team members, project

leaders, support personnel, or senior

management, respectively.

The 14 classes of risks used in the

questionnaire were identified during

interviews and discussions with more

than 100 managers during an explorato-

ry phase of an earlier field study, inves-

tigating risk management practices for

large projects ( Thamhain & Skelton,

2005, 2007). Managers were asked:

“What types of risks and contingencies

do you experience in managing your

projects, and where do these risks orig-

inate from? What are their causes?” The

discussions resulted in more than 600

situations and conditions related to

project risk, all seen with potential for

significant impact on project perform-

ance. Using content analysis of these

600 factors, 14 classes of risks were

developed for use in this study, as

shown in Figure 2.

The questionnaires were personally

introduced to 230 team members, 35

team leaders, and 36 senior managers,

yielding an overall return of 83% and

resulting in data describing risk cate-

gories, frequency, and impact such as

summarized in Figure 2 of the Results sec-

tion. The selection of the 230 team mem-

bers from the total of 489 followed the

project leads’ recommendation, judging

team members’ expertise (competence)

of answering the questionnaire properly.

The 35 team leaders and 36 senior man-

agers represent the total number identi-

fied in the sample, as shown in Table 1.

Data

The unit of analysis used in this study is

the project. The field study, conducted

from 2008 to 2011, yielded data from

35 project teams with a total sample

Project Environment Metrics

Total sample population 560

Companies 17

Product development 35 projects

Project managers 35

Team membersa 489

Product managers 9

R&D managers 6

Senior managers and 21 directors

Average project budget $4.6M

Average project life cycle 18 months

a 5 Total team sample – project managers – prod-

uct managers – R&D managers – senior managers.

Table 1: Summary of field sample statistics.

Performance Impact

Contingency caused little or no impact on project performance

Risk Classes:

Contingency caused major impact on project performance

– 5 0 %

– 4 0 %

– 3 0 %

– 2 0 %

– 1 0 %

1 0 %

Frequency

1. Changing project requirements

2. Changing market or customer needs

3. Communications issues

4. Technical difficulties

5. Technology changes

6. Lost or changing team members

7. Changing organizational priorities

8. Organizational conflict

9. Changing management commitment

10. Environmental quality problems

11. Changing regulatory requirements

12. Changing social/economic conditions

13. Changing contractor relations

14. Legal issues

2 0 %

3 0 %

4 0 %

5 0 %

6 0 %

7 0 %

8 0 %

Figure 2: Risk classes, frequency, and impact on project performance.

26 April 2013 ■ Project Management Journal ■ DOI: 10.1002/pmj

Managing Risks in Complex Projects

P A

P E

R S

population of 535 professionals such as

engineers, scientists, and technicians,

plus their managers, including 7 super-

visors, 35 project team leaders, 9 prod-

uct managers, 6 R&D directors, 5 mar-

keting directors, and 9 general manage-

ment executives at the vice presidential

level, as summarized in Table 1.

Together, the data covered more than

35 projects in 17 multinational compa-

nies in the Fortune 1000 category.

Project team members had, on average,

10 years of professional experience in

their field of specialty and four years of

tenure with their current employer. The

35 project leaders had an average of six

years of project management experi-

ence and five years of tenure with their

current employer. Approximately 25%

were Project Management Professional

(PMP®) (or equivalent) credential hold-

ers. Virtually all of the project leaders

completed some formal training in proj-

ect management, ranging from seminars

and workshops to certificate programs

and degree programs in project manage-

ment. However, none of the project lead-

ers had any formal training in project risk

management. Of the sample population,

90% had bachelor’s degrees, 50% held

master’s, and 15% had PhDs.

The projects observed in this study

involved mostly high-technology prod-

uct- and service-oriented developments

and roll-outs, such as information sys-

tem, financial services, automotive, air-

plane, computer, and pharmaceutical

products. Project budgets averaged

$1.4M and project life cycles of 18

months. All project teams saw them-

selves working in a high-technology,

multinational, and culturally diverse

environment. The data were obtained

from three sources (questionnaires, par-

ticipant observation, and in-depth retro-

spective interviewing), as discussed in the

previous section. The information

obtained during retrospective interview-

ing with the team leaders, line man-

agers, product managers, marketing

directors, and general management

executives was especially useful in

gleaning additional, deeper insight into

the processes, challenges, and best prac-

tices of risk management, and helped to

support the risk cause-effects model pre-

sented in Figure 3 of the Results section.

Data Analysis

The data collected via questionnaires

were evaluated and summarized via

standard statistical methods, while

content analysis was used to evaluate

the predominantly qualitative data col-

lected via work process observation,

participant observation, and in-depth

retrospective interviewing.

Results The findings of this field study are

organized into three sections. First, a

simple risk assessment model for track-

ing the effects of risk on project per-

formance is presented. Second, the

types of contingencies that typically

emerge during project execution are

identified and examined regarding their

impact on project performance. Third,

the managerial implications and lessons

learned from the broader context of the

quantitative and qualitative parts of this

study are summarized in two separate

sections of this article.

A Simple Model for Risk Assessment

“Risks do not impact all projects equally.”

This observation from earlier phases

of this research is strongly supported by

the formal results of this field study. The

managerial actions of dealing with

the event, such as eliminating or work-

ing around the contingency, greatly

influence the ability of minimizing the

magnitude of problems caused and

the cascading effects that propagate

through the organization. The dynam-

ics of these processes are being illustrat-

ed with the Risk Impact Model in Figure

3, showing the influences of the external

and internal business environment. The

model is a conceptual development

based on observations and interviews

conducted during this field study. Its

framework dates back to a 2007 study

(Thamhain & Skelton, 2007), which sug-

gests that contingencies affecting one

part of a project have the tendency to

cascade throughout the project organi-

zation, with increasingly unfavorable

impact on project performance, eventu-

ally affecting the whole enterprise.

Based on the performance impact,

the model identifies four distinct risk

categories:

Project Leadership Influences + Anticipation + Reaction + Management + Team interaction + Early warning system

Internal Influences (from within the enterprise) + Priority + Technology + Management + Leadership + Resources + Mergers + Strategy

External Influences & Contingencies (outside enterprise)

E n

t e

r p

r i s

e

S y

s t

e m

s P

ro je

c t/

O p

e ra

ti o

n s-

-- --

-- -M

a n

a g

e m

e n

t- --

S o

c /E

c o

CAT-II RISKSCAT-I RISKS

CAT-III RISKS

Actual impact on project performance

CAT-IV RISKS

Actual impact on project and enterprise performance

TIMING: t 0 t1 t2 t3 t4 ... t

5 t6 t7 t8 t9 ... t 10 t11 t12 t13 t14 ..... t

15 t16 t17

Project Performance Impact

Actual impact on project tasks and subsystems

No impact on project performance yet

Figure 3: Model of actual risk impact on project performance.

April 2013 ■ Project Management Journal ■ DOI: 10.1002/pmj 27

• Category-I risks: No impact on project

performance. Two types of risks fall

into this category. First are events that

might occur in the external or internal

project environment with potentially

harmful impact on project perform-

ance in the future. These contingencies,

such as a delayed contract delivery,

labor dispute, technical issue, or

priority change, are lurking in the

environment, whether they are antici-

pated or not. But they have not yet

occurred, and therefore have not yet

impacted project performance. By

anticipating these contingencies,

management can take preventive

actions to mitigate the resulting

impact if the event occurs. Second,

events that actually occurred were

identified and dealt with before they

affected project time, cost, or other

performance parameters.

• Category-II risks: Impact on task or

project subsystems only. The risk

events have occurred in the external

or internal project environment with

potentially harmful impact on project

performance. However, by definition,

these risk issues occurred at a lower

level of project activity, such as a task

or subsystem, and have not yet affect-

ed overall project performance.

Examples are delayed contract deliv-

eries, labor disputes, technical issues,

or priority changes that can be solved

“locally.” Although the resolution

might require extra time, it is not part

of a critical path, and therefore the

performance impact is limited to a

subset of the project. A similar situa-

tion exists for issues that affect cost,

quality, or other performance param-

eters at the local level only. Thus,

while these risks are expected to

impact the whole project, they have

not yet affected overall project per-

formance. Therefore, timely manage-

rial actions could minimize or even

avoid such performance impact.

• Category-III risks: Impact on project

performance. Events that occurred in

the external or internal project environ-

ment did impact project performance,

such as schedules, budgets, customer

relations, or technical issues. The impact

on project performance could have been

a direct result of a contingency, such as a

failure to obtain a permit, or resulting

from an issue at a lower level but prop-

agating to a point that affects total

project performance. Examples are test

failure on a critical activity path, or

problems caused at a lower level propa-

gating to a point where they affect total

project performance. However, by defi-

nition, the impact is still contained

“within the project,” without affecting

enterprise performance. Proper timely

management actions can lessen the

impact on overall project performance,

and possibly minimize or avoid any

harmful impacts on the enterprise.

• Category-IV risks: Impact on project

and enterprise performance. Events

have occurred and have already signif-

icantly impacted overall project per-

formance and the performance of the

entire enterprise. Similar to Category

III, the effects could be immediate or

cascading (i.e., Toyota’s “accidental

acceleration”). Proper management

actions can lessen the final impact on

both project and enterprise perform-

ance, but by definition, a certain degree

of irreversible harm has been done to

the project and the enterprise.

An Example Illustrating the

Dynamics and Cascading Effects of

Contingencies. Using the model shown

in Figure 3, we can follow the cascading

effects of a contingency through a time

cycle. Let us assume that an original

equipment manufacturer (OEM) runs

into shipping issues now (time t0) that

could affect the delivery of a critical

component to your system five months

from now. However, you learn about the

supply issue one month after it occurred

and decide on a remedial action at

month 2. That is, the contingency with

potentially undesirable consequences

(Category-I risk) occurs at time t0 and is

recognized at t1 5 month 1. Its actual

impact of the contingency on project per-

formance (occurring at t5 5 month 5) will

depend on the managerial actions of

dealing with the event at time t2. These

actions could range from (a) eliminating

the risk issue (e.g., switching to an alter-

nate supplier) to (b) project re-planning

or (c) innovative work-around. Hence,

depending on the effectiveness of

the project team and its leadership, the

contingency occurring at t0 may or may

not impact project performance at time

t5. However, if it does, the situation

is classified as a Category-III risk.

Assuming this situation is being recog-

nized at t6, the managerial actions

taken between t7 and t14 will determine

whether the risk is contained within the

project or escalates further, affecting

enterprise performance, such as cash

flow and future business between t15 through t17. If such impact on enterprise

performance occurs, the situation

would be classified as a Category-IV

risk. Depending on the type of contin-

gency, the complexity of the project

and the managerial interventions, the

cascading of impacts may continue fur-

ther. These cascading effects of contin-

gencies propagating through the work

process and compounding at higher

project breakdown levels have been

clearly identified and verified during

participant observation and interview-

ing as part of the field study. It also sup-

ports Observation 3, stated earlier in

this article, that performance problems

caused by contingencies are likely to

cascade, compound, and become intri-

cately linked.

Significance. The model under-

scores the importance of recognizing

risk factors and their potential perform-

ance impact early in the project life

cycle, consistent with the earlier

Observation 2. It also points to the people

side of risk management. That is, the atti-

tude and sensitivity of team members

toward early warning signs and first-

order effects is critically important. The

model further provides a framework for

integrated enterprise risk management

(ERM) by highlighting the importance of

collective cross-functional involvement

toward risk identification and impact

assessment, emphasizing the benefits

28 April 2013 ■ Project Management Journal ■ DOI: 10.1002/pmj

Managing Risks in Complex Projects

P A

P E

R S

of cross-organizational collaboration

for early risk detection and effective

treatment. The model also supports the

need for strategic alignment of the proj-

ect with the enterprise objectives. Only

with the help of senior management is it

possible to see the potential impact of

evolving risk on overall enterprise per-

formance and long-range mission

objectives. On the operational side, the

model provides a guideline for assessing

the project execution process regarding

its workflow, interfaces, transparency,

and effectiveness of providing useful

downstream results and upstream guid-

ance, consistent with well-established

models, such as VoC, quality function

deployment (QFD), and stage-gate

processes.

Robustness and Limitations. While

the risk-impact model is relatively sim-

ple in comparison to the complexities,

dynamics, and nonlinearity of today’s

project undertakings, it provides criti-

cal insight into the dynamics of risk

propagation and its effects on project

performance, as well as a framework for

tracking risk issues impacting project

performance and analyzing risk man-

agement effectiveness. Some of the pos-

itive features of the risk-impact model

are its simple construct, clarity, and

robustness, which should be helpful for

work process analysis and improve-

ment. However, further research is

needed to validate and fine-tune the

model for assessing enterprise risk

management performance and for

extending the model toward manageri-

al leadership-style development.

Contingencies Versus Project

Performance Impact

Using content analysis of the survey

data from interviews and question-

naires, managers in this study identified

more than 1,000 unique contingencies

or risk factors, which have the potential

of unfavorably impacting project per-

formance. These contingencies were

grouped into 14 sets, or classes of risks,

based on their root-cause similarities. A

graphical summary shows the 14 classes

in Figure 2, ranked by average frequency

as observed over a project life cycle.

Typical project performance impact

includes schedule slippage, cost over-

runs, and customer dissatisfaction. In

addition, risks also affected broader

enterprise performance, such as market

share, profitability, and long-range

growth. On average, project leaders

identified six to seven contingencies

that occurred at least once over the proj-

ect life cycle. However, it should be

noted that not every contingency or risk

event seems to impact project perform-

ance, as discussed in the previous sec-

tion. As a most striking example, project

managers reported “the loss or change

of team members” (cf. Figure 2, class #6)

to occur in 38% of their projects, an

event described as a major risk factor

with potentially “significant negative

implications to project performance.”

Yet, only 13% of these projects actually

faced “considerable” or “major” per-

formance issues, while 22% experienced

even less of an issue, described as “little”

or “no” impact on project performance.

Hence, 60% of projects with lost or

changed team members experienced

little or no impact on project perform-

ance. For most of the other 13 sets of

contingencies, the statistics are leaning

more toward a “negative performance

impact.” On average, 61% of the contin-

gencies observed in the sample of 35

projects caused considerable or major

impact on project performance. The most

frequently reported contingencies or

risks fall into three groups: (1) changing

project requirements (78%), (2) changing

markets or customer needs (76%), and (3)

communications issues (72%). These are

also risk areas that experience the highest

negative impact on project performance.

They include approximately 80% of all

projects with “considerable” or “major”

performance issues. The specific statis-

tics observed across all contingencies or

risks recognized by project leaders in all

35 projects, is as follows: (1) 9% of the

contingencies had no impact on project

performance (Category-I risks), (2) 16% of

the contingencies had some manageable

impact on project performance (mostly

Category-II risks plus some Category

III), (3) 14% of the contingencies had

substantial but still manageable impact

on project performance (Category-III

risks), (4) 49% of the contingencies had

a strong, irreversible impact on project

and enterprise performance (Category-

IV risks), and (5) 12% of the contingen-

cies resulted in project failure (mostly

Category-IV risks).

Mixed Performance Impact. Although

the number of risk occurrences (fre-

quency) was approximately equally

observed by all 35 project leaders, the

reported impact distribution was more

skewed, with 20% of the project leaders

reporting 71% of all considerable and

major performance problems. This

again provides strong support for

Observation 1, stated earlier, that con-

tingencies in the project environment

do not impact the performance of all

projects equally. It is interesting to note

that although all projects (and their

leaders) reported approximately the

same number of contingencies with

normal distribution across the 14 cate-

gories, some projects were hit much

harder on their performance (i.e., those

12% in the project that failed). This sug-

gests differences in organizational

environment, project leadership, sup-

port systems, and possibly other factors

that influence the ability to manage

risks.

Senior Management Perception.

When analyzing the survey responses

from senior managers separately,

we find that senior managers rate the

performance impact on average 30%

lower than project managers. That is,

senior management perceives less of a

correlation between contingencies and

project performance. Additional inter-

views with senior managers and root-

cause analysis of project failures strong-

ly confirms this finding. While senior

managers and project leaders exhibit

about the same statistics regarding

(1) the number of contingencies and risks

occurring in projects and (2) the distri-

bution of risks across the 14 categories

April 2013 ■ Project Management Journal ■ DOI: 10.1002/pmj 29

(as tested by the Kruskal-Wallis analy-

sis of variance by rank), senior man-

agers perceive fewer performance

issues directly associated with these

risks. That is, they are less likely to

blame poor performance on changes

or unforeseeable events (risks) but

more likely are holding project leaders

accountable for agreed-on results,

regardless of risks and contingencies.

The comment made by one of the mar-

keting directors might be typical for

this prevailing perspective: “Our cus-

tomer environment is quite dynamic.

No product was ever rolled out without

major changes. Our best project lead-

ers anticipate changing requirements.

They set up work processes that can

deal with the market dynamics. Budget

and schedule problems are usually

related to more conventional project

management issues but are often

blamed on external factors, such as

changing customer requirement.” This

has significance in three areas: (1) per-

ceived effectiveness of project man-

agement performance, (2) condition-

ing of the organizational environment,

and (3) enterprise leadership. First,

project leaders should realize that their

performance is being assessed largely

because of project outcome, not the

number and magnitude of contingen-

cies that they had to deal with.

Although overall complexity and chal-

lenges of the project are part of the per-

formance scorecard, they are also part

of the conditions accepted by the proj-

ect leader at the beginning of the proj-

ect, and therefore not a “retrospective”

performance measure. Second, less

management attention and fewer

resources might be directed toward

conditioning the organizational envi-

ronment to deal with risks that specifi-

cally affect projects, because senior

managers perceive less of a linkage

between risk and project performance.

This connects to the third area, the over-

all direction and leadership of the enter-

prise that affects policies, procedures,

organizational design, work processes,

and the overall organizational ambience

for project execution and control, an

area that probably receives less atten-

tion from the top but could potentially

influence project performance signifi-

cantly, and an area that should be

investigated further in future research

studies.

Discussion and Implications Seasoned project leaders understand

the importance of dealing with project

risks and take their responsibility very

seriously. However, foreseeing contin-

gencies and effectively managing the

associated risks is difficult and chal-

lenging. It is both an art and a science to

bring the effects of uncertainty under

control before they impact the project,

its deliverables, and objectives. Given

the time and budget pressures of

today’s business environment, it is not

surprising that the field observations

show project managers focusing most

of their efforts on fixing problems after

they have impacted performance. That

is, while most project leaders under-

stand the sources of risks well, they

focus their primary attention on moni-

toring and managing the domino

effects of the contingency rather than

dealing with its root causes. It is com-

mon for these managers to deal with

problems and contingencies only after

they have impacted project perform-

ance, noticed in schedules, budgets, or

deliverables, and therefore have

become Category-II or Category-III

risks. Only 25% of these managers felt

they could have foreseen or influenced

the events that eventually impacted

project performance adversely. It is fur-

ther interesting to note that many of the

organizational tools and techniques

that support early risk detection and

management—such as spiral process-

es, performance monitoring, early

warning systems, contingency plan-

ning, rapid prototyping, and CAD/

CAM-based simulations—readily exist

in many organizations as part of the

product development process or embed-

ded in the project planning, tracking, and

reporting system. It is interesting to note,

however, that project managers, while

actually using these project manage-

ment tools and techniques extensively

in their administrative processes, do not

give much credit to these operational

systems for helping to deal with risks.

Although this is an interesting observa-

tion, it is also counterintuitive and

needs further investigation.

Decoupling Risks From Projects:

Cause-Effect Dynamics

The field study provides an interesting

insight into the cause and effect of con-

tingencies on project performance,

including their dynamics and psychol-

ogy. Whether a risk factor actually

impacts project performance depends

on the reaction of the project team to

the event, as graphically shown in

Figure 3. It also seems to depend on the

judgment of the manager whether or

not a particular contingency is blamed

for subsequent performance problems.

Undesirable events (contingencies) are

often caused by a multitude of prob-

lems that were not predictable or could

not be dealt with earlier in the project

life cycle. During a typical project exe-

cution, these problems often cascade,

compound, and become intricately

linked. It is also noticeable that the

impact of risk on project performance

seems to increase with project com-

plexity, especially technology content

of the undertakings. From the inter-

views and field observations, clearly

even small and anticipated contingen-

cies, such as additional design rework

or the resignation of a key project team

member, can lead to issues with other

groups, confusion, organizational con-

flict, sinking team spirit, and fading

commitment. All these factors poten-

tially contribute to schedule delays,

budget issues, and system integration

problems that may cause time-to-mar-

ket delays and customer relation issues,

which ultimately affect project per-

formance. Realizing the cascading and

compounding effects of contingencies

on project performance, the research

emphasizes the importance of identifying

30 April 2013 ■ Project Management Journal ■ DOI: 10.1002/pmj

Managing Risks in Complex Projects

P A

P E

R S

and dealing with risk early in the proj-

ect life cycle to avoid problems at more

mature stages. The study also acknowl-

edges the enormous difficulties of actu-

ally predicting specific risk situations

and their timing, root-cause, and dys-

functional consequences, and to act

appropriately before they impact proj-

ect performance.

Differences in Assessing Performance

Issues Between Project and Senior

Managers

Project leaders and senior managers

differ in their “true cause” assessment

of performance problems, as was

shown in the statistical analysis of

Figure 2. Yet, there are additional impli-

cations to the perception of what caus-

es performance issues. These percep-

tions affect the managerial approaches

of dealing with risk. Specifically, we

learn from the discussions and field

interviews that project leaders blame

project performance problems and fail-

ures predominantly on contingencies

(risk situations) that originate outside

their sphere of control, such as scope

changes, market shifts, and project

support problems, while senior man-

agement points directly at project lead-

ers for not managing effectively. That is,

senior management blames project

managers for insufficient planning,

tracking and control, poor communica-

tions, and weak leadership. Additional

field investigations show an even more

subtle picture. Many of the project per-

formance problems and failures could

be root-caused to the broader issues

and difficulties of understanding and

communicating the complexities of the

project, its applications, and support

environment, including unrealistic

expectations for scope, schedule and

budget, underfunding, unclear require-

ments, and weak sponsor commitment.

The significance of these findings is

in several areas. First, the polarized per-

spective between project leaders and

senior managers creates a potential for

organizational tension and conflict. It

also provides an insight into the mutual

expectations. Senior management is

expected to provide effective project

support and a reasonably stable work

environment, while project leaders are

expected to “manage” their projects

toward agreed-on results. The reality is,

however, that project leaders are often

stretched too thin and placed in a tough

situation by challenging requirements,

weak project support, and changing

organizational conditions. Moreover,

many of the risk factors have their roots

outside the project organization and

are controlled by senior management.

Examples are contingencies that origi-

nate with the strategic planning

process. Management, by setting guide-

lines for target markets, timing, return

on investment, and product features,

often creates conflicting target parame-

ters that are also subject to change due

to the dynamic nature of the business

environment. In turn, these “external

changes” create contingencies and risks

at the project level. Existing business

models do not connect well between

the strategic and operational subsys-

tems of the firm, and tend to constrain

the degree to which risk can be foreseen

and managed proactively at the project

level (Hillson, 2003; Shenhar et al.,

2007). It is therefore important for man-

agement to recognize these variables

and their potential impact on the work

environment. Organizational stability,

availability of resources, management

involvement and support, personal

rewards, stability of organizational

goals, objectives, and priorities are all

derived from enterprise systems that

are controlled by general management.

It is further crucial for project leaders to

work with senior management, and

vice versa, to ensure an organizational

ambience conducive to cross-functional

collaboration.

Lessons for Effective Risk Management

Despite the challenges and the inevitable

uncertainties associated with complex

projects, success is not random. One of

the strong conclusions from this empir-

ical study is risks can be managed.

However, to be effective, especially in

complex project environments, risk

management must go beyond analyti-

cal methods. Although analytical meth-

ods provide the backbone for most risk

management approaches, and have the

benefit of producing an assessment of a

known risk situation relatively quickly,

including economic measures of gains

or losses, they also have many limita-

tions. The most obvious limitations are

in identifying potential, unknown risk

situations and reducing risk impact by

engaging people throughout the enter-

prise. Because of these limitations and

the mounting pressures on managers to

reduce risk, many companies have

shifted their focus from “investigating

the impact of known risk factors” to

“managing risk scenarios” with the

objective to eliminate potential risks

before they impact organizational

activities. As a result, these companies

have augmented conventional analyti-

cal methods with more adaptive, team-

based methods that rely to a large

degree on (1) broad data gathering

across a wide spectrum of factors and

(2) judgmental decision making. In this

field study, I observed many approach-

es that aimed effectively at the reduc-

tion or even elimination of risks, such

as simplifying work processes, reducing

development cycles, and testing prod-

uct feasibility early in the development

cycle. Often, companies combine, fine-

tune, and integrate these approaches to

fit specific project situations and their

people and cultures, to manage risks as

part of the total enterprise system. An

attempt is being made to integrate the

lessons learned from both the quantita-

tive and qualitative parts of this study.

Especially helpful in gaining additional

perspective and insight into the

processes and challenges of risk man-

agement, and in augmenting the quan-

titative data toward the big picture of

project risk management, was the

information obtained while working

with companies on specific assign-

ments (action research). This includes

discussions and interviews with project

April 2013 ■ Project Management Journal ■ DOI: 10.1002/pmj 31

leaders and senior managers and the

observations of project management

practices. Therefore, within the broader

context of this study, several lessons

emerged that should stimulate

thoughts for contemporary risk man-

agement practices, new tool develop-

ments, and future research.

• Lesson 1: Early recognition of undesir-

able events is a critical precondition

for managing risk. In addition, project

leaders must not only recognize

potential risk factors in general, but

also know when they will most likely

occur in the project life cycle.

Recognizing specific issues and con-

tingencies before they occur or early

in their development is critical to the

ability of taking preventive actions

and decoupling the contingencies

from the work process before they

impact any project performance

factors. Examples include the antici-

pation of changing requirements,

market conditions, or technology. If

the possibility of these changes is rec-

ognized, their probability and impact

can be assessed, additional resources

for mitigation can be allocated, and

plans for dealing with the probable

situation can be devised. This is simi-

lar to a fire drill or hurricane defense

exercise. When specific risk scenarios

are known, preventive measures, such

as early warning systems, evacuation

procedures, tool acquisitions, and

skill developments, can be put in

place. This readiness will minimize

the impact, if the risk situation actual-

ly occurs. While the field study clearly

shows the difficulties of recognizing

risk factors ahead of time, it is funda-

mental to any risk management

approach. It is also a measure of team

maturity and competency and gives

support to the observation made dur-

ing this field study that “contingencies

do not impact performance of all

projects equally.”

• Lesson 2: Unrecognized risk factors are

common in complex project environ-

ments. Contingencies (even after

affecting project performance) often

go unrecognized. In our field study,

more than half of the contingencies

that occurred were not anticipated

before causing significant performance

issues (Category-III risks or higher).

Most commonly, the impact is on

cost, schedule, and risk escalation.

“Delayed risk recognition is more

difficult and costly to correct than con-

tingencies treated early in their devel-

opment” was a remark often heard

during field interviews and in group

discussions. To minimize these prob-

lems, more collective, team-centered

approaches of monitoring the project

environment are needed. This

includes effective project reviews,

design reviews, focus groups, action

teams, gate reviews, and “manage-

ment by wandering around (MBWA).”

All these approaches are “catalysts”

toward making the project organiza-

tion more transparent, agile, and alert

to changes and issues in the work

environment.

• Lesson 3: Unchecked contingencies

tend to cascade and penetrate wider

project areas. Contingencies occurring

anywhere in a project have the ten-

dency to penetrate into multiple

subsystems (domino effect) and even-

tually affect overall project perform-

ance. Many of the contingencies

observed in this field study, such as

design rework of a component, a

minor requirements change, or the

resignation of a team member, may

initially affect the project only at the

subsystem level. These situations

might even be ignored or dismissed as

issues of no significance to the project

as a whole. However, all these contin-

gencies can trigger issues elsewhere,

causing workflow or integration

problems, and eventually resulting in

time-to-market delays, missed sales

opportunities, and unsatisfactory proj-

ect performance. Moreover, surprises,

no matter how small, often have psy-

chological effects on the organization,

leading to confusion, organizational

conflict, sinking team spirit, fading

commitment, and excuses to change

prior agreements. All these issues

eventually translate into reduced

organizational efficiency and lower

performance. Recognizing the cascad-

ing nature and multiple performance

impact of contingencies provides a

starting point for devising an effective

risk management strategy. It also

helps in conditioning the team toward

collective monitoring of the potential

problem areas and effective early

intervention.

• Lesson 4. Cross-functional collabora-

tion is an effective catalyst for collec-

tively dealing with threats to the proj-

ect environment. The project planning

phase appears to be an effective vehi-

cle for building such a collaborative

culture early in the project life cycle.

The active involvement of all stake-

holders—including team members,

support functions, outside contrac-

tors, customers, and other partners—

in the project planning process leads to

a better, more detailed understanding

of the project objectives and interfaces,

and a better collective sensitivity

where risks lurk and how to deal with

the issues effectively. Collaboration is

especially essential for complex and

geographically dispersed projects with

limited central authority and limited

ability for centrally orchestrated con-

trol. Throughout the project life cycle,

collaboration is a catalyst for identify-

ing risks early. It helps to create trans-

parency throughout the organization,

unifies team members behind the

requirements, and enhances the team’s

ability to collectively recognize and

deal with risks in the broader project

environment.

• Lesson 5: Senior management has a

critical role in conditioning the organi-

zational environment for effective risk

management. Many risk factors have

their roots outside the project organi-

zation, residing in the domain of the

broader enterprise system and its envi-

ronment. Examples are functional sup-

port systems, joint reviews, resource

allocations, facility, and skill develop-

ments, as well as other organizational

32 April 2013 ■ Project Management Journal ■ DOI: 10.1002/pmj

Managing Risks in Complex Projects

P A

P E

R S

components that relate to business

strategy, work process, team structure,

managerial command and control,

technical direction, and overall leader-

ship. All these organizational subsys-

tems have their locus outside the project

organization, controlled to a large

extent by senior management. In addi-

tion, a natural “impedance barrier”

seems to exist between the enterprise

systems and the project organization,

which makes external risks less recog-

nizable and manageable in their early

stages. Since early risk detection and

mitigation depend to a large degree on

the collective multifunctional involve-

ment and collaboration of all stakehold-

ers, it is important for management to

foster an organizational environment

conducive to effective cross-functional

communications and cooperation. In

addition, senior management can

unify the project community behind

the broader enterprise objectives by

clearly articulating business strategy

and vision, a contemporary process

that is known as strategic alignment

(Shenhar et al., 2007). Taken together,

senior management—by their involve-

ment and actions—can develop per-

sonal relations, mutual trust, respect,

and credibility among the various proj-

ect groups, its support functions, and

stakeholders, a critical condition for

building an effective partnership

among all members of the project

community. This is an ambiance sup-

portive to collective initiatives and out-

reach, conducive to early risk detection

and management.

• Lesson 6: People are one of the greatest

sources of uncertainty and risk in any

project undertaking, but also one of

the most important resources for

reducing risk. The quality of commu-

nications, trust, respect, credibility,

minimum conflict, job security, and

skill sets, all these factors influence

cooperation and the collective ability of

identifying, processing, and dealing with

risk factors. This field study found that

many of the conditions that stimulate

favorably risk management behavior

are enhanced by a professionally

stimulating work environment,

including strong personal interest in

the project, pride, and satisfaction

with the work, professional work

challenge, accomplishments, and

recognition. Other important influ-

ences include effective communica-

tions among team members and

support units across organizational

lines; good team spirit, mutual trust,

respect, low interpersonal conflict,

and opportunities for career develop-

ment and advancement; and, to some

degree, job security. All these factors

seem to help in building a unified

project team that focuses on cross-

functional cooperation and desired

results. Such a mission-oriented envi-

ronment is more transparent to

emerging risk factors and more likely

to have an action-oriented, collabo-

rative nature that can identify and

deal with emerging issues early in

their development.

• Lesson 7: Project leaders should have

the authority to adapt their plans to

changing conditions. Projects are con-

ducted in a changing environment of

uncertainty and risk. No matter how

careful and detailed the project plan is

laid out, contingencies will surface

during its execution that require

adjustment. Project managers and

their teams should not only have the

authority to adapt to changing condi-

tions, but also be encouraged to iden-

tify potential contingencies and pro-

pose plan changes for eliminating

risks before they impact the work

process.

• Lesson 8: Testing project feasibility

early and frequently during execution

reduces overall project risk. Advances

in technology provide opportunities

for accelerating feasibility testing to

the early stages of a project life cycle.

Examples are system integration,

market acceptance, flight tests, and

automobile crash tests that tradition-

ally were performed only at the end of

a project subphase or at a major inte-

gration point. However, with the help

of modern computers and informa-

tion technology, many of the compa-

nies in our study were able to reduce

risks considerably by advancing these

tests to the front end of the project or

to the early stages of a product or

service development. Examples are

CAD/CDE/CAM-supported simula-

tions and product/service application

modeling. A simulated jet flight or

automobile crash test is not only

much less costly and less time-con-

suming than the real thing, but also

yields valuable information for the

improvement and optimization of

the product design at its early stages,

long before a lot of time and resources

have been expended. Technology also

offers many other forms and methods

of early testing and validation, ranging

from 3-D printing, stereo lithography,

and holographic imagery for model

building to focus groups and early

design usability testing. These tech-

nology-based methods also allow

companies to test more project and

product ideas, and their underlying

assumptions for success, in less time

and with considerably fewer resources

than with traditional “end-of-the-

development” test methods.

• Lesson 9: Reducing work complexity

and simplifying work processes will

most likely reduce risk. Uncertainties

originate within the work itself. The

observations from this field study

show that the project work, together

with its complexities and processes,

contributes especially heavily to the

uncertainties and risks affecting proj-

ect success. Whatever can be done to

simplify the project and its scope,

deliverables, and work process will

minimize the potential for problems

and contingencies, make the project

more manageable, and increase its

probability of success. Work simplifi-

cation comes in many forms, ranging

from the use of prefabricated compo-

nents to subcontracting, snap-on

assembly techniques, material choic-

es, and high-level programming lan-

guages. Any innovation that reduces

April 2013 ■ Project Management Journal ■ DOI: 10.1002/pmj 33

complexity, development time, re-

source requirements, testing, produc-

tion setup, or assembly also reduces the

risk of contingencies to occur over

the development cycle. In addition, risk

and uncertainties can be reduced by

streamlining the work processes.

Contemporary project management

platforms, such as concurrent engi-

neering, stage-gate processes, or

agile/Scrum, in their right setting, can

simplify the work process, reduce

development time, and enhance orga-

nizational transparency.

Conclusion Risks do not affect all projects equally is

one strong conclusion from this field

study. Actual risk impact depends not

only on the risk event, but also on the

managerial actions of dealing with

the contingency and its timing, which

influence the magnitude of problems

caused by the event and the cascading

effects within the project organization.

The risk-impact-on-performance model

developed in this article contributes to

the body of knowledge by providing a

framework for describing the dynamics

and cumulative nature of contingen-

cies affecting project performance. The

empirical results show that effective

project risk management involves a

complex set of variables, related to task,

management tools, people, and organi-

zational environment. Simple analyti-

cal approaches are unlikely to produce

desired results but need to be augment-

ed with more adaptive methods that

rely on broad data gathering across a

wide spectrum of the enterprise and its

environment. The methods also have to

connect effectively with the organiza-

tional process and the people side of

project management. Some of the

strongest influences on risk manage-

ment seem to emerge from three enter-

prise areas: (1) work process, (2) organi-

zational environment, and (3) people. I

observed many approaches that effec-

tively reduced risks by simplifying the

work and its transfer processes, short-

ening development cycles, and testing

project feasibility early. The best suc-

cess stories of this field study point to

the critical importance of identifying

and dealing with risks early in the

development cycle. This requires broad

scanning across all segments of the

project team and its environment and

creative methods for assessing feasibilities

early in the project life cycle. Many risk fac-

tors originate outside the project organiza-

tion, residing in the broader enterprise and

its environment. Therefore, it is important

for management to foster an organization-

al environment conducive to effective

cross-functional communications and

collaboration among all stakeholders, a

condition especially important to early

risk detection and risk management.

Although no single set of broad

guidelines exists that guarantees proj-

ect success, the process is not random!

A better understanding of the organiza-

tional dynamics that affect project per-

formance, and the issues that cause

risks in complex projects, is an impor-

tant prerequisite and catalyst to build-

ing a strong cross-functional team that

can collectively deal with risk before it

impacts project performance.

Recommendations for Future Research By its specific design and objective, the cur-

rent research is exploratory. Investigating

organizational processes and manage-

rial practices toward project risk identi-

fication and mitigation is a relatively

broad, new, and multidimensional area

that reaches far beyond a journal article

but is holding many opportunities for

future research, some of them suggest-

ed in this section:

1. Testing of specific propositions and

hypotheses. While it was premature in

this article to test specific hypothe-

ses, the research questions identified

at the beginning (e.g., impact of con-

tingencies on project performance

and organizational conditions that

are most conducive for risk manage-

ment) could be expanded into more

formal propositions for future

research and hypothesis testing.

2. Risk perception by senior manage-

ment and impact on resource alloca-

tion. Because senior managers seem

to perceive less of a linkage between

risk and project performance,

less management attention and re-

sources might be directed toward

conditioning the organizational

environment to deal with risks that

specifically affect projects. This could

potentially influence the ability of

managing project risk significantly,

an area that should be investigated

further.

3. Influence of policies and organiza-

tional environment. Senior managers

seem to believe that overall policies

and organizational ambience have

no significant influence on risk man-

agement at the project level.

However, the analytical findings of

this study produced mixed results,

sometimes even suggesting that poli-

cies and organizational environment

have significant impact, a controver-

sy that should be more formally

investigated in future research.

4. Effective use of risk management tools

and techniques. Although project

managers widely use analytical risk

management tools, they do not seem

to give much credit to the effective-

ness of these tools and techniques for

dealing with risk. It would be inter-

esting to formally investigate why

project managers do not value these

tools as much as claimed by the liter-

ature, and how these risk manage-

ment tools could be better leveraged

in the field. ■

References Apgar, D. (2006). Risk intelligence:

Learning to manage what we don’t

know. Boston, MA: Harvard Business

School Press.

Barber, R. B. (2005). Understanding

internally generated risks in projects.

International Journal of Project

Management, 23(8), 584–590.

Bartlett, J. (2002). Using risk concept

maps in a project or programme.

34 April 2013 ■ Project Management Journal ■ DOI: 10.1002/pmj

Managing Risks in Complex Projects

P A

P E

R S

Proceedings of the Fifth European

Project Management Conference,

Cannes, France (pp. 1–5).

Bstieler, L. (2005). The moderating

effects of environmental uncertainty on

new product development and time

efficiency. Journal of Product Innovation

Management, 22(3), 267–284.

Buchanan, L., & O’Connell, A. (2006).

Chances are. Harvard Business Review,

84(1), 34–35.

Chapman, C., & Ward, S. (2003).

Project risk management: Process, tech-

niques and insight. London, UK: Wiley.

Cicmil, S., & Marshall, D. (2005).

Insight into collaboration at the proj-

ect level: Complexity, social interaction

and procurement mechanisms.

Building Research and Information,

33(6), 523–535.

Cooke-Davies, T., Cicmil, S.,

Crawford, L., & Richardson, K. (2007).

We’re not in Kansas anymore, Toto:

Mapping the strange landscape of

complexity theory, and its relationship

to project management. Project

Management Journal, 35(2), 50–61.

Cooper, D., Grey, S., Raymond, G., &

Walker, P. (2005). Project risk manage-

ment guidelines: Managing risk in large

projects and complex procurements.

Hoboken, NJ: Wiley.

Cooper, R., Edgett, S., & Kleinschmidt, E.

(2001). Portfolio management for new

products. Cambridge, MA: Da Capo

Press.

Danneels, E., & Kleinschmidt, E. J.

(2001). Product innovativeness from

the firm’s perspective. Journal of

Product Innovation Management,

18(6), 357–374.

Dey, P. K. (2002). Project risk manage-

ment. Cost Engineering, 44(3), 13–27.

DOD Directive 5000.1. (2007).

Washington, DC: Government Printing

Office.

Eisenhardt, K. M. (1989). Building the-

ories from case study research.

Academy of Management Review, 14(4),

532–550.

Elliott, M. (2001). The emerging field of

enterprise risk. Viewpoint, Number 2.

Marsh & McLennan Companies, Inc.

Retrieved from http://www.mmc.com

/views/autumn_01_elliott.shtml

Geraldi, J., & Adlbrecht, G. (2007). On

faith, fact and interaction in projects.

Project Management Journal, 38(1),

32–43.

Glaser, B. G., & Strauss, A. L. (1967).

The discovery of grounded theory:

Strategies for qualitative research.

Chicago, IL: Aldine.

Haas, K. (2009). Managing complex

projects: A new model. Vienna, VA:

Management Concepts.

Hanzhang, T., & Wilkinson, R. (1998).

The art of war. Hertfordshire, UK:

Wordsworth Editions.

Hillson, D. (1999, June/July). Business

uncertainty: Risk or opportunity.

ETHOS Magazine, pp. 14–17.

Hillson, D. (2000). Project risks:

Identifying causes, risks and effects.

PM Network, 14(9), 48–51.

Hillson, D. (2003, June). Gaining strate-

gic advantage. Strategic Risk Magazine,

pp. 27–28.

Hillson, D. (2010, February). Managing

risk in projects: What’s new? PMWorld

Today (Project Management eJournal).

Retrieved from http://www.risk

-doctor.com/pdf-files/feb10.pdf

International Organization for

Standardization (ISO) (2009). ISO

31000, Risk management: Principles and

guidelines. Geneva, Switzerland: Author.

Jaofari, A. (2003). Project management

in the age of change. Project

Management Journal, 34(4), 47–57.

Kallman, J. (2006). Managing risk. Risk

Management, 52(12), 46.

Loch, C. H., Solt, M. E., & Bailey, E. M.

(2008). Diagnosing unforeseeable

uncertainty in a new venture. Journal

of Product Innovation Management,

25(1), 28–46.

MacCormack, A. (2001). Developing

products on internet time.

Management Science, 47(1), 22–35.

Maylor, H., Vidgen, R., & Carver, S.

(2008). Managerial complexity in proj-

ect-based operations: A ground model

and its implications for practice.

Project Management Journal, 39(1),

15–26.

National Institute of Standards and

Technology. (2000). Managing techni-

cal risk: Understanding private sector

decision making on early stage,

technology-based projects (NIST

Publication No. GCR 00–787).

Washington, DC: US Government

Printing Office.

Patil, R., Grantham, K., & Steele, D.

(2012). Business risk in early design: A

business risk assessment approach.

Engineering Management Journal,

24(1), 35–46.

Project Management Institute. (2013).

A guide to the project management

body of knowledge (PMBOK® guide).

fifth ed. Newtown Square, PA: Author.

Shaw, C., Abrams, K., & Marteau, T.

(1999). Psychological impact of pre-

dicting individuals’ risks of illness: A

systematic review. Social Science &

Medicine, 49(12), 1571–1598.

Shenhar, A., & Dvir, D. (2007).

Reinventing project management: The

diamond approach to project manage-

ment. Boston, MA: Harvard Business

School Press.

Shenhar, A., Milosevic, D., Dvir, D., &

Thamhain, H. (2007). Linking project

management to business strategy.

Newtown Square, PA: Project

Management Institute.

Shenhar, A. J. (2001). One size does not

fit all projects: Exploring classical con-

tingency domains. Management

Science, 47(3), 394–414.

Skelton, T., & Thamhain, H. J. (2006).

Managing risk in new product develop-

ment projects: Beyond analytical meth-

ods. Project Perspectives, 27(1), 12–20.

Skelton, T., & Thamhain, H. (2007).

Success factors for effective R&D risk

management. International Journal of

Technology Intelligence and Planning,

3(4), 376–386.

April 2013 ■ Project Management Journal ■ DOI: 10.1002/pmj 35

Smith, P. G., & Merritt, G. M. (2002).

Proactive risk management. New York,

NY: Productivity Press.

Srivannaboon, S., & Milosevic, D. Z.

(2006). A two-way influence between

business strategy and project manage-

ment. International Journal of Project

Management, 24(2), 184–197.

Thamhain, H. (2004). Leading technol-

ogy teams. Project Management

Journal, 35(4), 35–47.

Thamhain, H. (2007). Success factors for

effective R&D risk management.

International Journal of Technology

Intelligence and Planning, 3(4), 376–386.

Thamhain, H. (2008). Team leadership

effectiveness in technology-based proj-

ect environments. IEEE Engineering

Management Review, 36(1), 165–180.

Thamhain, H. (2009). Leadership les-

sons from managing technology-inten-

sive teams. International Journal of

Innovation and Technology

Management, 6(2), 117–133.

Thamhain, H. (2011). Critical success

factors for managing technology-

intensive teams the global enterprise.

Engineering Management Journal,

23(3), 40–45.

Thamhain, H., & Skelton, T. (2005). Team

leadership effectiveness in technology-

based project environments. IEEE

Engineering Management Review,

33(2), 11–25.

Thamhain, H., & Skelton, T. (2006).

Managing the sources of uncertainty in

technology projects. Proceedings of the

2006 IEEE International Engineering

Management Conference, Salvador,

Bahia, Brazil (pp. 473–477).

Thamhain, H., & Skelton, T. (2007).

Managing globally dispersed R&D

teams. International Journal of

Information Technology and

Management, 7(2), 36–47.

Thamhain, H., & Wilemon, D. (1999).

Building effective teams in complex

project environments. Technology

Management, 5(2), 203–212.

Thieme R., Song, M., & Shin, G. (2003).

Project management characteristics

and new product survival. Journal of

Product Innovation Management,

20(2), 104–111.

Thomas, J., & Mengel, T. (2008).

Preparing project managers to deal

with complexity. International Journal

of Project Management, 26(3), 304–315.

Torok, R., Nordman, C., & Lin, S.

(2011). Clearing the clouds: Shining a

light on successful enterprise risk man-

agement (Executive Report, IBM

Institute for Business Value). Somers,

NY: IBM Global Services.

Verganti, R., & Buganza, T. (2005).

Design inertia: Designing for life-cycle

flexibility in Internet-based services.

Journal of Product Innovation

Management, 22(3), 223–237.

Wideman, R. M. (1992). Project and

program risk management: A guide to

managing project risks and opportuni-

ties. Newtown Square, PA: Project

Management Institute.

Williams, T. (2005). Assessing and mov-

ing from a dominant project manage-

ment discourse in the light of project

overruns. IEEE Transactions on

Engineering Management, 52(1), 497–508.

Williams, T., & Sumset, K. (2010).

Issues in front-end decision-making

on projects. Project Management

Journal, 41(2), 38–49.

Hans Thamhain is a professor of management and

director of the MOT and Project Management

Programs at Bentley University in Waltham,

Massachusetts. He has held management positions

with Verizon, General Electric, and ITT and has written

more than 70 research papers and six professional

reference books. He received the IEEE Engineering

Manager Award in 2001, PMI’s Distinguished

Contribution Award in 1998, and PMI’s Research

Achievement Award in 2006. He is profiled in Marquis

Who’s Who in America and holds New Product

Development Professional (NPDP) and Project

Management Professional (PMP) certifications.

Copyright of Project Management Journal is the property of John Wiley & Sons, Inc. and its content may not be

copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written

permission. However, users may print, download, or email articles for individual use.