The management of risks is a crucial element of project portfolio management. Risk management enables the organization to cope with arising opportunities and threats. In a project portfolio environment it is no longer sufficient to manage solely the risks of single projects (Olsson, 2008). Organizations tend to run several projects concurrently to maintain flexibility and efficiency. New risks emerge additionally to single project risks due to the dependencies between projects (Project Management Institute, 2008b). Therefore, literature suggests a portfolio-wide risk management that extends the management of single project risks (Artto et al., 2000, Lee et al., 2009, Olsson, 2008 and Pellegrinelli, 1997).
A portfolio-wide approach for risk management supports the alignment and redistribution of resources between the projects and considers additional portfolio risks. Thus, portfolio risk management is assumed to enhance transparency, the revelation of transferences of problems (Sanchez et al., 2009), the capacity to cope with risks (Lee et al., 2009), and the profoundness of information on which decisions are based on (McFarlan, 1981). By connecting information derived from the risk management of different single projects, portfolio risk management can identify risks that emerge in multiple projects simultaneously. Therefore, activities can be consolidated and duplication of work can be prevented. Consequently, portfolio risk management avoids failure and increases the possibility of the project portfolio success (De Reyck et al., 2005 and McFarlan, 1981). Besides the positive effects of portfolio risk management one also needs to consider that portfolio risk management is time consuming and involves costs. Therefore, it is worth investigating whether the benefits justify the costs (Kutsch and Hall, 2009). Portfolio risk management is rarely implemented de facto (de Reyck et al., 2005). Organizations seem to have a low consciousness of portfolio risks and of the need to view risks holistically (Olsson, 2007). The reason for this may be the special challenge of evaluating risks at the portfolio level. Alternatively, project portfolio managers may lack expertise and time or have a problem of cost justification (Kutsch and Hall, 2009 and Ward and Chapman, 1991).
The positive effects of single project risk management have widely been acknowledged in project management literature (de Bakker et al., 2011). However, research on managing risks within a project portfolio is relatively rare (Sanchez et al., 2009). There exist some conceptual research and single-case studies on portfolio risk management (Olsson, 2008 and Sanchez et al., 2008). However, to our knowledge no large-scale empirical study exists that examines risk management in a project portfolio environment. Further investigation is necessary to show where to focus when managing risks in a project portfolio. The main objective of this study is to examine the linkage between portfolio risk management practice and project portfolio success. Therefore, this study attempts to answer the following research question: How does portfolio risk management influence the success of a project portfolio?
This study makes meaningful contributions to the risk management and project portfolio management literature. This research provides a better understanding of portfolio risk management with its main constructs, underlying mechanisms, and their relationship to project portfolio success. Moreover, to measure the improvement through portfolio risk management, this study delivers a new procedure to operationalize the quality of risk management. We provide empirical evidence for the existence of a positive relationship between risk management quality, measured as risk transparency and risk coping capacity, and project portfolio success. Additionally, we show that the portfolio risk management constructs portfolio risk identification, the formalization of the risk management process, and risk management culture directly influence risk transparency, whereas risk prevention, risk monitoring, and the integration of risk management into project portfolio management are directly connected to risk coping capacity. These findings provide project portfolio managers with valuable heuristics and guidelines enhancing their decision-making. They are able to manage portfolio risks more effectively which eventually improves the success of the project portfolio. This model with its associated guidelines establishes a basis for supplemental empirical research in this field (e.g., on contingencies) and the development of tools specifically for managing risks in project portfolios. As earlier research indicates that management processes and tools are not used in practice as expected, further research in this area seems appropriate (Bannerman, 2008).
This study investigates risk management in a project portfolio environment. We provide a framework that empirically examines the relationship between portfolio risk management in terms of processes, formalization, and risk management culture, and project portfolio success.
6.1. Theoretical implications
This study contributes to the literature on project portfolio management in several ways. First, we introduce the construct risk management quality as a mediator between risk management and success. The mediating effect of risk management quality explains why and how portfolio risk management has positive effects on portfolio success. We provide an initial measure to gauge risk management quality. Two dimensions have been put forward to describe risk management quality: (1) risk transparency and (2) risk coping capacity. An increase in risk management quality lays the foundation for an efficient management of project portfolios by supporting the balance of the project portfolio (due to the enabled risk overview) and the alignment of projects to strategy (as a focus of efforts is facilitated).
Second, for the first time, we provide quantitative, empirical evidence for the relevance of managing project portfolio risks. The explicit search for portfolio risks positively influences transparency, which in turn affects portfolio success. Thus, there is a need to identify portfolio risks beyond the risks of single projects. When portfolio risks (for example in terms of carryover effects (Kitchenham et al., 2002)) are detected in addition to project risks, the overall risk level can be estimated more precisely. Better information in turn is assumed to facilitate better estimates (de Bakker et al., 2010) and better decision-making (McFarlan, 1981). This finding supports previous conceptual and qualitative studies on project portfolio risk management. The study tests the effects of the portfolio risks proposed by the Project Management Institute (2008b) and supports the qualitative finding of Olsson (2008) that the identification of portfolio common risks and trends leads to greater visibility to senior management.
Third, we find that an open and frank risk management culture enhances the ability to reveal portfolio risks that could threaten the organization. This form of communication is crucial because it enables managers to identify interdependencies and bottlenecks. Risk management culture is the most important factor for transparency. Hence, a clear and open communication is needed in order to identify interdependencies. This is in line with the findings of Ropponen and Lyytinen (2000) who find that the general awareness of risks and their management reduces risks. Furthermore, the findings support the view of Sanchez et al. (2009) who highlight the need to establish a strong risk management culture in order to increase the efficacy of risk management processes.
Finally, this study offers a deeper understanding of the performance impact of portfolio risk management practices. Formalization of the risk management process improves the identification and analysis of new risks and, therefore, decision-making because well-defined procedures facilitate a better process quality (Ahlemann et al., 2009). This extends the findings at the project level, for which a formal risk management process is recommended (Kwak and Stoddard, 2004 and Ropponen and Lyytinen, 2000). The adoption of risk reduction measures helps to reduce the probability and impact of risks. Therefore, fewer risks materialize and if risks materialize they are less alarming. This is in line with the findings of Ropponen and Lyytinen (1997) who find that risk reduction measures at the project level increase project success. The monitoring of risks and the integration of risk information into project portfolio management decisions allow the manager to quickly detect and react to the change of risks. Furthermore, the results indicate that in project portfolios consisting of a high percentage of mandatory or regulated projects the risk coping capacity is lower. A high percentage of mandatory or regulated projects may lead to a decrease of flexibility and paralyze the organization. Regarding the direct impact of portfolio risk management on project portfolio success, risk prevention has a direct positive impact on project portfolio success, whereas risk monitoring has a direct negative impact on project portfolio success. The negative impact of risk monitoring on project portfolio success can be explained by the fact that a high degree of risk monitoring may lead to a culture of mistrust, where risks cannot be communicated openly. Managers may get bogged down in details with a high degree of risk monitoring, running after problems, instead of pro-actively managing them. Besides, managers may have a false sense of security which causes neglect of other important areas. Moreover, control can negatively impact the ability to learn as well as lead to concealment and manipulation of data by the employees (Sethi and Iqbal, 2008). The competitive mediation indicates that another omitted mediator may exist that can be investigated in future research (Zhao et al., 2010). For example, flexibility could be investigated as a further mediator. Risk monitoring might negatively influence flexibility in general which in turn enhances portfolio success. The direct effect of risk monitoring on project portfolio success might disappear when flexibility is included into the model.
Contrary to the expected interaction effects between risk transparency and risk coping capacity, we could not show that simultaneous risk transparency and risk coping capacity increase the positive impact on project portfolio success. Hence, risk transparency and risk coping capacity seem to influence portfolio success independently. In comparison to previous research, we deliver first empirical results on portfolio risk by showing how risks need to be managed in a project portfolio. This investigation answers the call to extend risk management literature to the project portfolio context (Ropponen and Lyytinen, 2000, Sanchez et al., 2008 and Sanchez et al., 2009) because single project risk management is no longer sufficient in a project portfolio environment (Olsson, 2008).
6.2. Managerial implications
For managers, the findings highlight the importance of managing risks from a portfolio perspective as this will enhance project portfolio success. Therefore, senior management must ensure that the organizational structure allows for a holistic view on the project portfolio to recognize carry-over effects caused by interdependencies additionally to single project risks. Our study highlights six areas for portfolio risk management: portfolio risk identification, risk prevention, risk monitoring, integration of risk information into the project portfolio management, formalization of portfolio risk management, and risk management culture. Managers can use this knowledge as a basis for planning risk management procedures in a project portfolio. Most importantly, project portfolio coordinators are advised to integrate the risk information from the risk management process into the project portfolio management process since this enhances decision-making (Kwak and Stoddard, 2004 and Project Management Institute, 2008b). Furthermore, a strong risk management culture is emphasized because it improves the efficacy of the risk management process (Mongiardino and Plath, 2010 and Sanchez et al., 2009). As the costs for portfolio risk management are difficult to justify in advance (Kutsch and Hall, 2009), portfolio managers need to be aware of the trade-off between costs and benefits of portfolio risk management.
6.3. Limitations and avenues of future research
The results of this study need to be interpreted cautiously because this study entails some limitations. First, the independent and dependent variables have been measured in the same time period. This may incorporate the risk of halo effects or attribution bias because successful project portfolios are automatically associated with a high process quality, and vice versa. Consequently, the actual connection between portfolio risk management, risk management quality, and project portfolio success might be lower. Second, the focus of this study is on German organizations. Risks may be handled differently in other countries. Future studies can build upon our results and investigate risk management practices in other cultural surroundings. Third, some of the used measures have been newly developed for this study. While the constructs and their operationalization were based on extant literature, some measures may be subject to further refinement. For example, risk management quality could encompass further dimensions such as flexibility. Fourth, this study did not investigate contingency effects. However, literature has suggested modifying risk management practices to the characteristics of the environment and the project portfolio (Raz et al., 2002), because different strategies might be needed depending on the risk level (McFarlan, 1981). Furthermore, risk management in a project context is usually described through a probability-based framework (Loch et al., 2006), which is based on the assumption that the future states are known, predictable, and measurable (Pender, 2001). However, uncertainty implies the inability to predict the states of the environment (Milliken, 1987 and Sicotte and Bourgault, 2008). Therefore, some scholars claim that risk management is not sufficient to manage uncertainty (Pender, 2001 and Perminova et al., 2008). Further studies may include contingencies such as uncertainty to show the impact of environmental factors on different management approaches for handling risks.
In conclusion, the results of this study offer a platform for future efforts to develop specific tools for portfolio risk management as well as to further empirically investigate this rather new research field. Our findings on the mechanisms of portfolio risk management may be useful in future studies. Further research on risk management may consider the role of risk management quality or investigate specific measures for portfolio risk management. For example, the linkage between the different risk response measures and project portfolio success is worth investigating. Future research could also look at different management levels in an integrated model as this could enhance understanding of the overall risk management process. Finally, a qualitative approach could more deeply investigate individual portfolio risk management practices.
