1. Introduction

Portfolio management is a dynamic decision process that evaluates projects (Petit, 2012). By reviewing the written sources, the portfolio management of the project has been very noticeable in recent years. This approach involves a systematic process for selecting, supporting, and managing a set of projects.  (Hatefi, 2016). Risk Analysis is a strategy that helps in this selection (Jeffrey, 2010). The Commission on Insurance Terminology of the American Risk and Insurance Association in 1966 defined risk as to the uncertainty of the outcome of an event that has two or more possibilities. The events including risk identification management, analysis, prioritization, planning, reduction, and control may potentially lead to unwanted changes  (Martin & Robbert, 2002).

Project risk management usually refers to project performance improvement by diagnosis, analysis, and control of project risks which in fact, is a risk control process and adjusting its effects. Risk management is a systematic way to identify, assess and respond to a project’s risks  (Raz & Micheal, 2001). Indeed, one of the most important project issues that are considered as the main key in most multi-project organizations is "risk management"  (Elmar & Mark, 2010). The project management institute defined risk management as one of the eight main levels of the project management body of knowledge  (PMBOK Guide, 2017).

Risk assessment means the process of assigning the probability of an event (favorable or unfavorable) and its effects. The results of the risk assessment process are considered as inputs of other risk management steps  (Martin & Robbert, 2002). In other words, risk assessment is the process of estimating an event’s occurrence (favorable or unfavorable), and its effects (Zeng & Smith, 2007).

Multi-Criteria Decision-Making (MCDM) refers to cases that usually deal with various decision criteria and are occasionally contradictory and inconsistent. Decision-making is the process of choosing an option from the available options  (Azimian, Javadi, Farshchiha, & Nosohi, 2017). VIKOR method is a consensus method of the set of MCDM which is developed based on LP-metric by Zeng and Opricovic (Wei & Lin, 2008).

This study aims to assess and identify projects’ potential risks in the multi-project organization and prioritize the projects based on their risk values. To test the proposed method, available projects in the Malek-e-Ashtar University of Technology were investigated. The reason for selecting this organization for the study is related to its project-based feature. In this organization, various research and executive projects are being conducted simultaneously, and improving their performance is set as the organization's management priority.

Selecting low risky and appropriate projects in a multi-project environment has been the central focus of the present study. By reviewing the literature, it is revealed that there is a lack of research on selecting projects based on risk assessment in such organizations. Therefore, this study proposes a new framework that evaluates and categorizes the potential risks; thereafter, selects the best projects for mitigating risks in such organizations. In contrast, other methods surveyed in the literature focus on determining and evaluating the exiting risks in a specific project.  When there is a multi-project organization, selecting expedient projects can bring about a decrease in the entirety of faults occurring in such organizations. In this way, the best composition of projects can be performed according to fewer entire organizational failures. The research contribution comprises:

1. i) identifying the project potential risks in multi-project organizations;
2. ii) quantitative assessment and identification of risks’ weight;

iii) determining the existence of risks in projects; and

1. iv) selecting appropriate projects by a final projects risk evaluation and ranking them by the VIKOR method.

In the following, literature on the project risk assessment and management, MCDM methods, and VIKOR method is briefly reviewed and subsequently, the research methodology is developed and examined in a practical case. Finally, results are discussed and suitable conclusions are presented.

2. Literature review

Many studies have been conducted on risk assessment of projects. Among these studies, Barghi and Sikari (2020) presented a qualitative and quantitative project risk assessment using a hybrid PMBOK model developed under uncertainty conditions. In this research, the identified risks were structured and ranked using fuzzy DEMATEL and fuzzy ANP techniques. Shakilur Rahman and Mannan Adnan (2020) analyzed risk management (RM) and risk management performance measurement (RMPM) through an in-depth empirical analysis of two complex construction projects of  Finland. Masar et al (2019) described the current state of project risk assessment in Visegrad Group countries in the transport sector, based on empirical research, which was realized by authors in 2018/2019. This research was focused on analyzing the current state of project risk assessment in Europe, Asia, Africa, and America. Zolfaghai and Mousavi (2018) presented a novel approach of failure mode and effect analysis (FMEA) to prioritize construction project risks under uncertain conditions of projects. Also, a new version of the H-shapely VIKOR method was presented in this study by defining a new evaluation index for a ranking alternative. Kim et al (2016) presented an AHP-Fuzzy inference system (FIS) model to aid decision-makers in the risk assessment and mitigation of overseas steel plants projects. Gkanas et al (2014) assessed risk in dam projects using AHP and ELECTRE I. Teller and Kock (2013) showed that the management and risk analysis of the portfolio of projects will succeed in these projects. Taylan et al. (2014) by combining AHP and TOPSIS in a fuzzy environment evaluated the risks of projects. Kuo and lu (2013) used a fuzzy approach to Multiple-Criteria Decision-Making (MCDM) for risk assessment of Taiwan's capital construction projects. They were modeling assessments of ERP projects risks using Petri net approach. Honari et al (2012) proposed a hierarchical structure for ranking risk in power-plant projects. They used fuzzy-ANP for calculating weights. Then. The outputs of fuzzy-ANP calculations were used in a fuzzy-Topsis procedure for the evaluation of important risks. Morote and Ruz-Vila (2011) presented a fuzzy approach to construction projects risk assessment and used the definition of fuzzy set and hierarchical structure for risk assessment. Mojtahedi et al (2010) presented a new procedure for classifying potential risks which are named potential risks breakdown structure (PRBS) based on project work breakdown structure (WBS). Krane et al. (2010) classified the risk of seven major projects and introduced major risks that should be considered in these projects. The fuzzy multi-objective approach including Fuzzy TOPSIS and Fuzzy LINMAP methods were used by Ebrahimnejad et al (2010) to identify and assess the risk of projects. Zeyad et al (2004) used hierarchical analysis (AHP) to risk assessment in highway projects in China. Zeng and Smith (2007) used a fuzzy approach to decision-making and the risk assessment of a project.

2.1 Project Risk Assessment and Management

According to Kerzner (2004), risk management is the set of activities and measures to be adopted in dealing with the risks, including risk planning tasks, risk assessment (identification and risk analysis), selection of risk responding measures, and monitoring. Regardless of definitions, Gray (1995) proposed three attitudes to project risk management. The first attitude is the traditional type in which risk management may be a part of project management. In the second attitude, risk management is the final purpose of project management and the third attitude is innovative thinking in which risk management encompasses and includes all activities of project management. Turner (1999) claimed based on this innovative thinking that project risk management is the basis and essence of project management. Therefore, it is not only necessary to put a comprehensive view to it, but also it should be current in project organization as a systematic approach. Risk management is the systematic application of management policies, procedures, and related processes of analytic activities, assessment, and risk control. Risk management is the process of documenting the final decisions and identifying and applying criteria that could be used to minimize the risk to an acceptable level  (North, 1995). Systematic attitude to risk has caused increasing of attention to the risk management process. The related sciences gradually developed in the 90^th century and were confirmed as a new topic (Del Cano Gochi & De La Cruz Lopez, 2000). According to the standard definition of PMBOK[1], risk management is a system-oriented process to identify, analyze and respond to project risk throughout its lifetime. Based on this standard, project risk management includes all the processes involved in risk identification, regulation, and mitigation of a project. The objective is to increase the likelihood of positive risks (opportunities) and decrease the likelihood of negative risks (threats). This procedure contains components such as reporting risk, documentation risk, and also risk register and can lead to the selection of new strategies, implementation of programs blitz, applying corrective measures, or even a project re-planning. An effective monitoring process should provide information regarding the execution status and performance of response actions  (PMBOK Guide, 2017). In this definition, project risk management is divided into phases such as planning, identification, measurement and risk analysis, presentation responses (response versus risk), and risk control (Figure 1).

Fig 1. Risk management cycle

In Figure 1, identification is referred to the search and documentation of risks, converting risk data to required information for decision making and planning; in other words, translating risk information to decisions and response actions. Execution is defined as actions taken to respond to risks. Monitoring and control are also defined as tracking risk indicators and response measures and reforms based on distortions created in response to the risks. Communication may use as adoption required information considering system status and execution procedure of risk management process for project stakeholders. Risk assessment is a process with several steps. First, by using one of the tools of risk identification, major threats, and opportunities that can affect outputs, projects, or given processes are identified. After identifying the main risk, the second step is a precise evaluation of the frequency of occurrence and results for each of them; then various risks are rated based on adopted values. Thereby, a comparison of risks with each other becomes possible and in subsequent phases of the risk management process, one can be able to determine the appropriate responding action to risk  (PMBOK Guide, 2017).

2.2 Multi-Attribute Decision-Making (MADM)

Multiple-Attribute Decision-Making (MADM) can be formulated by the matrix presented in Table 1.

Table 1. Decision matrix

Here, A_i represents option (i), X_j represents index (j) and R_ij represents the value of index (j) for option (i). In the literature, two general groups of different methods are proposed for solving MADM such as method derived from the compensatory models and method derived from non-compensatory models. The non-compensatory model includes methods wherein exchanges between indexes are not allowed. In other words, the weak point in an index is not compensated by the advantages in other indexes. The advantage of using such a model belongs to their simplicity which is consistent with the behavior of the decision-maker and his limitation. Some of such methods may not even need to obtain information from the decision-maker. In contrast, the Compensatory model includes methods that allow the exchange between indexes.  For example, the changes (even minor) in one index can be compensated by an opposite change in another index. In Figure 2, a variety of evaluation methods of MADM problems are observed  (Asgharpour, 2003).

Fig 2. Types of the MADM methods

2.2.1 VIKOR Method

VIKOR is a decision-making method with adaptive multi-criteria that has been developed by Zeng and Opricovic. This method calculates options utility by distance index calculation from ideal and anti-ideal. This method includes the following steps (Wei & Lin, 2008):

1. Calculate the normalized value

Suppose that we have (m) options and (n) indexes. Different (i) options have been defined as A_i. The value of the index (j) for option (i) has characterized by R_ij. Equation (1) has been used for the process of normalization of values.

1. Determine the best and worst values

At this step, the best and worst values ​​for each of the criteria were identified and according to equation (2) is shown by f^*_j and f^-_j, respectively. Here, f^*_j is the best positive ideal solution for criterion (j) and f^-_j is the worst negative ideal solution for criterion (j). By combining all (f^*_j) an optimum combination that has the highest score is obtained. This instruction is the same for (f^-_j).

• Determine criteria weights

The weights of criteria were calculated for the expression of the importance of their relationship and were achieved in this study based on the senior managers’ viewpoints.

1. Calculation of the distance from the ideal solution

The distance of each alternative from the ideal solution was calculated and was summed for the final value according to equations (3) and (4).

S_i represents the option (i) distance from the positive ideal solution (best combination), and R_i represents the option (i) distance from the negative ideal solution (worst combination). The top rank and the worst rank are calculated based on the values of S_i and R_i, respectively. In other words, S_i and R_i are equal to L_1i and L_0i in the LP-metric method.

1. Calculation of the VIKOR value (Q_i)

VIKOR index value for each (i) is defined as:

Where , , ,  and is the strategic weight of maximum group utility. The distance from the negative ideal solution for option (i) is [  i.e., it is the majority approval for the (i) ratio while the distance from option (i) ideal solution is [  and as opposed with the option (i) ratio. So, when the  value is greater than 0.5, Q_i index will lead to the majority of approval and when the value is lower than 0.5, the Q_i index will lead to the majority of negative views. In general, when the  value is equal to 0.5, the consensus view of assessment experts is apparent.

• Ranking the options based on the Q_i values

Based on the Q_i values calculated in the previous step, the options are ranked and decision-making is performed.

To summarize, the risk in projects should be considered to succeed in any project. In this study, VIKOR is used for the assessment and ranking of the criteria. This method is of adaptive and compensatory subgroup and naturally, the methods of this group considering the options utility computing and calculation of distance index from the ideal and anti-ideal, have characteristics such as no need to determine the precise relationship between indexes, no need to do exchangeable comparisons between indexes and precision less effect and certainty of data. So, this method is used here as a proper method considering its less restriction than the other methods.

3. Research methodology

This research is typically applied-developmental, descriptive, and correlational based on qualitative and quantitative data. Data collection is sectional. Dependent variables are the final project's risk and independent variables are the values of projects' potential risks obtained from the questionnaire survey by individual unit analysis and spatial scale. Interfering variables are also the final weights of potential risks obtained from the VIKOR model and moderator variables determine the existence of risks in projects obtained from the survey with individual analysis unit and nominal scale (Figure 3).

Fig. 3. Graphical view of research variables

 The proposed procedure of this research is illustrated in Figure 4.

Fig. 4. Research steps

As the case study, MUT was selected. The research population included the current project managers and the managers of the research institute groups. The methods of data collection included questionnaires and interviews. The schematic model is illustrated in Figure 5.

Fig. 5. Schematic view of the proposed model

4. Findings

4.1 Identification of projects’ potential risks

Since this study, it was decided to help managers in decision-making and identify projects’ potential risks and also determine the suitable model for the risk’s qualitative analysis, a decision-making team was established in the early stage. They were a group of senior managers, research assistants, leaders of research groups, and faculty members of MUT. To assess the risk of the project in specified time intervals, by a meeting with decision-making group individuals and using brainstorming, the major threats and opportunities that could influence the projects were identified. These risks are as follows:

- Unpredictable external risks are defined as sanctions, war and weather conditions, and mishaps.

- Predictable external risks are defined as the poor financial condition of the employer, lack of technical information, and required documentation of the project by the employer.

- Unpredictable inner risks are defined as staff leave and sickness, operator and personnel unexpected errors, and so on. 

- Predictable internal risks are defined as the lack of timely financial payment of personnel, determination of projects' intellectual ownership, attracted and assigned timely projects personnel, good administrative support, and so on.

4.2 Assessment of the Identified Risks

To prioritize projects’ identified risks, a questionnaire including identified risks with five points Likert scale was prepared, and its validity was confirmed in the decision-making group. Afterward, a briefing of the questionnaire was given to all 13 current projects managers of MUT. Surveying results from 13 managers of the organization projects regarding the importance of identified risks are addressed in Table 2. The values in this table are obtained based on the projects managers’ comments and geometric mean regarding the occurrence, severity of occurrence, and detection rate of potential risks identified by the decision-making team.

Also, after collecting the questionnaires, Cronbach’s alpha method was used to determine the validity of responses in this study. After entering the data into the SPSS software, it was observed that the data had enough reliability.

Table 2. Results of the survey

Then, the comments' average value was determined using the geometric mean, and also the final value of risks weight was determined following normalization of calculated values using equations 3, 4, and 5 of the VIKOR method. To identify the projects’ final risks between zero and one, the VIKOR index final value was normalized (Table 3). Then, the research group managers were surveyed to determine the risk of each project. Since, available projects of MUT are divided based on their nature into research groups, using a nominal scale (0,1) and survey of individual analysis, the existence of potential risks in projects of each group was asked from the related group managers (Table 4).

Table 3. The results of the VIKOR model parameters calculation

Table 4. Determination of risks exist in the projects

Finally, the risk of each project was determined using a simple equation. The final value of projects risk is addressed in Table 5. In this table, the value of each project risk was calculated by the algebraic sum of the VIKOR normalized index (i.e., the last column in Table 3).

Table 5. The final value of the projects’ risk

5. Discussion

According to Table 3, it was determined that the value of the VIKOR parameter (Q) is the highest for risks of appropriate executive support, personnel errors, timely recruitment, and lack of information from the employer, respectively. Regarding the success of the projects under study, the results indicated the significance of those risks. The final value of project risks was determined and addressed in Table 5 by determining the existence of risks in projects by surveying the managers of the research groups (Table 4). The results of Table 5 pinpointed projects 3, 8, 12, and 13 with a higher risk than the others.

5.1 Theoretical implications

The literature review highlighted that the focus of previous studies was mostly on risk identification and the use of multi-criteria decision-making in risk prioritizing in specific projects. It also seems that less attention has been paid to simultaneously focusing on the two subjects and the calculation of projects’ final risk and their selection-based risks in a project-based organization (Table.6).

Table 6. Methods used in this study for selecting projects in a multi-project organization

5.2 Managerial implications

In this study, new risks were defined for the projects in the project-based organization, and also VIKOR model was used to assess the risks, and finally, the project's final risks comparisons were made. This research demonstrated that there is a possibility to use assessment methods of projects risk and MCDM as a powerful management tool for projects-driven organizations.

To obtain better results, respondents should first become familiar with the concepts, so that the senior managers of the organization can use different training methods toward project managers and managers of research groups can be familiar with the concepts of project risk. To have a high influence of mentioned analyses on the improvement of projects’ performance and to increase the efficiency and effectiveness of the entire organization, managers can use appropriate incentives and motivational tools such as the proposed approach in this study. Also, with the detection of high-risk projects they can make decisions to support them further.

6. Conclusions

An attempt was made in this paper to identify and assess the potential risks of the projects and project prioritizing based on risk value in the project-based organizations. After identifying the risks with the probability of influencing the available projects, the importance of each risk regarding occurrence, severity, and detection rate were determined by surveying. Then, VIKOR model relationships were calculated for each of them. Also, to determine the projects’ final risk, the existence of the risk in projects was checked by surveying the managers of the research groups and the risk final value of each project was determined. The case institute was a project-based organization wherein any type of implementation and research projects were carried out simultaneously, and their performance improvement was the priority of the managers. The results of this research were obtained considering the identified potential risks in the studied organization, based on surveying the projects’ managers using the VIKOR model for risks assessment.

6.1 Research limitations and future study agenda

Findings were merely limited to the cross-sectional data in the time limit of this research and were related to the available studies in the case institute. Some recommendations can be made to increase the number of identified potential risks and to analyze them using the fuzzy method. Also, the type of risks and the awareness of the understudy population are significantly important to assess them. It is possible to use other MCDM approaches for data analysis, e.g., in determining the existence of project risks, obtaining their weight, and using the combined weights in calculating the projects’ final risk. The findings of this study can provide a good basis for a more comprehensive assessment of projects using methods such as Data Envelopment Analysis (DEA). Furthermore, due to the progress of communities, the complexity of projects has increased, it is useful to define more risk areas to provide more complete risk coverage in multi-project organizations. Finally, it is recommended to researchers evaluate the proposed model in other organizations that are active in the field of concurrent projects.

[1]  Project Management Body of Knowledge