INTERNATIONAL JOURNAL OF COMPUTERS COMMUNICATIONS & CONTROL
ISSN 1841-9836, 9(5):584-592, October, 2014.

Choice of Countermeasures in Project Risk Management Using
Fuzzy Modelling

D. Kuchta, D. Skorupka

Dorota Kuchta*
1. Wroclaw University of Technology
Poland, 50-370 Wroclaw, Wybrzeze Wyspianskiego 27,
dorota.kuchta@pwr.wroc.pl
2. Tadeusz Kosciuszko Military Academy of Land Forces
Poland, 51-150 Wroclaw, ul. Czajkowskiego 109,
*Corresponding author

Dariusz Skorupka
Tadeusz Kosciuszko Military Academy of Land Forces
Poland, Wroclaw

Abstract: The paper proposes a new method for project risk management. It is
proposed how, after risk identification, the countermeasures for risk mitigation and
elimination can be selected, taking into account the cost and effort linked to them
as well as the weights assigned by the decision maker to risk attributes, such as
probability or consequences, and the values of those attributes. The risk attributes
and weights, as well as the maximal total risk and the maximal total effort of risk
mitigation accepted by the decision maker for the project are expressed as fuzzy
numbers, which in turn constitute models for linguistic expressions.
Keywords: project risk, risk mitigation, risk transfer, risk elimination, fuzzy logic-
based optimisation.

1 Introduction

Project risk management is a very important subject and there is a lot of literature connected
to it. There are also a lot of risk definitions (it is assumed here, after [1], that risk is defined as
an event which may happen and if it does, it will have negative consequences on at least one of
project success determinants1) and risk management methods or techniques (e.g. [1]). Most of
them can be summarized as follows:

I. Risk identification;

II. Risk evaluation - the risks identified in point I. are evaluated on the basis of their attributes
(like probability and consequences);

III. Risk elimination, transfer or mitigation - taking some steps or countermeasures which
eliminate some risks or decrease the evaluation of others;

IV. Risk control during the project execution;

V. Lesson learned recording.

The problem to which this paper wants to contribute is point III. of the above procedure.
There are no formal methods in the literature, apart from one presented in [10], helping the
decision maker in this step. Normally only informal procedures are proposed (e.g. [6]). And
in [10] the authors assume among others that the probability of the risks cannot be explicitly

1Project success determinants are discussed later in the paper.

Copyright © 2006-2014 by CCC Publications



Choice of Countermeasures in Project Risk Management Using Fuzzy Modelling 585

influenced by the countermeasures, but only the expected value of monetary losses, which in our
opinion is wrong - in reality usually each risk attribute (e.g. probability, consequences, etc.), can
be individually influenced by individual countermeasures. The authors of [10] assume also that
the goal is the maximization of the monetary expected value of risk reduced by the countermea-
sures, whereas we assume that the goal should be the minimization of countermeasures total cost
needed to attain a fixed total risk level of the project, which we think to be more realistic. Also,
in [10] crisp values are required for risk attributes, ever for quality, whereas we assume linguistic
expressions (fuzzy numbers) for risk attributes, like it is done e.g. in [4] and [9], as we think
crisp values would usually be difficult to obtain from the decision maker. Also, basing ourselves
on [9], it is assumed here that different risk attributes may have various weights in the eyes in
the decision maker, which in [10] is ignored. For one decision maker mostly the consequences
may count (this is the case for projects where consequences are injuries or deaths of human
beings), for some decision makers mostly the probabilities (it is so for many public projects,
where each problem, even a relatively small one, is noticed by the media who make a big deal of
it). What is more, nowhere in the literature the notion of risk levels (e.g. project level, closest
environment level, further environment level, national level, international level etc., introduced
in [8]) and the effort linked to an effective application of countermeasures on each of the different
levels are combined with the choice of risk countermeasures, and this is done in the present paper.

2 Basic notions and notation

As it was mentioned above, project risk is an event which might happen and if it happens,
it will have negative consequences on one of the success determinants of the project. There are
several determinants of project success (for a review see e.g. [2]), like time, quality, cost, customer
satisfaction, etc. Let us denote those determinants as Dl, l = 1, . . . ,L.

The risks may concern several levels ( [8]), e.g. the project level, the closer environment level
(for construction projects this would be the construction market level), the further environment
level (for construction projects this would be the national level), etc. The various levels are
denoted as Lt, t = 1, . . . ,T . The higher the level index, the harder accessible and the less
possible to influence the level is, thus the less manageable the risks linked to this level are.

It is assumed that (point I. of the project risk management procedure given above) P lt risks
for each level Lt, t = 1, . . . ,T and for each determinant Dl, l = 1, . . . ,L have been identified
(the risks will be denoted as Rt,lk , k = 1, . . . ,P

l
t ). Each risk R

t,l
k , if it happens, it concerns level

Lt (thus, if one wanted to mitigate or eliminate it, one would have to act on the respective level)
and will influence determinant Dl, l = 1, . . . ,L of project success. It is also assumed that each
risk is linked to exactly one level and to exactly one determinant, but this assumption would not
be difficult to be given up.

Each risk Rt,lk will have several attributes. Usually two or at the most three risk attributes
are considered: the probability of occurrence, the consequences of the occurrence (for the project
success determinant linked to the specific risk, i.e. risks may have consequences for time, cost,
quality, customer satisfaction etc.) and sometimes the difficulty in an early detection or in early
forecasting of the risk occurrence (e.g. [6]). Sometimes additional attributes may be important,
like the probability of the occurrence of consequences once the risk has happened, the degree of
influence we have on the occurrence of the risk etc. The latter attribute is especially important
in case we have to consider several levels on which the risks may occur: the further the level, the
less effective our countermeasures may be.

Let us denote the number of attributes as A, and the attributes themselves as va, a = 1, . . . ,A.
The attributes are functions of risks, thus the value of the a-th attribute of risk Rt,lk will be



586 D. Kuchta, D. Skorupka

va(R
t,l
k ), a = 1, . . . ,A,l = 1, . . . ,L, t = 1, . . . ,T, k = 1, . . . ,P

l
t . va(R

t,l
k ) will be all measured in

the same scale, their values will be given by experts.
As mentioned above, various risk attributes may have various weights in the eyes of the

decision maker. Each attribute va(R
t,l
k ) will be thus assigned a weight wa(R

t,l
k ), also according

to a given scale.
Finally, it is possible to use the defined parameters to evaluate each risk (point II. of the

project risk management procedure). The evaluation REV (Rt,lk ) of each risk may be defined
using one of the formulae proposed e.g. in [6]2, e.g. the following one:

REV (R
t,l
k ) =

A∑
a=1

wa(R
t,l
k ) ·va(R

t,l
k )

A∑
a=1

wa(R
t,l
k )

(1)

As a further step (point III. of the project risk management procedure), it is proposed to try
to identify certain countermeasures to eliminate or mitigate the risks. It is assumed that each
measure may concern only one level, one project success determinant and one risk attribute. This
assumption seems natural: one countermeasure can e.g. be effective only on the national level
and affect only the time, i.e. a possible delay being the consequence of a certain risk, another
countermeasure may concern only the project level and affect the cost and the probability of
an event which would increase cost. Let us introduce also a simplifying assumption that each
attribute of each risk can be affected by only one measure. Thus, for each l = 1, . . . ,L, t =
1, . . . ,T and a = 1, . . . ,A let us define a set of measures (Mt,l,ah ,h = 1, . . . ,H

l,a
t ). Then, for each

attribute va(R
t,l
k ), a = 1, . . . ,A of each risk R

t,l
k (k = 1, . . . ,P

l
t) it is identified which measure

among the measures
{
M

t,l,a
h , h = 1, . . . ,H

l,a
t

}
can be applied, and the index of this measure will

be denoted as M(va(R
t,l
k )). The value of each attribute of the risk R

t,l
k after the application of the

measure indexed by M(va(R
t,l
k )) will be equal to m(va(R

t,l
k )). Of course it is true m(va(R

t,l
k )) <

va(R
t,l
k ). For some risks and attributes no countermeasure may exist - then it is set everywhere

m(va(R
t,l
k )) = va(R

t,l
k ).

The evaluation of each risk after the application of the measures will be

REV (R
t,l
k ) =

A∑
a=1

wa(R
t,l
k ) ·m(va(R

t,l
k ))

A∑
a=1

wa(R
t,l
k )

(2)

Each measure will of course be linked to a cost, measured in monetary values, denoted as
C(M

t,l,a
h ), h = 1, . . . ,H

l
t, l = 1, . . . ,L, t = 1, . . . ,T, a = 1, . . . ,A. Apart from the cost, the

implementation of each measure will mean an effort, problems of various kind, the necessity to
seek the access to certain people, to ask for permissions, uncertainty as far the effect of the
measure is concerned, etc. - usually the bigger, the higher the level index is. Thus it is assumed
that the effort depends on the level, not on the individual measures (again, it is only a simplifying
assumption). It will be denoted as Et, t = 1, . . . ,T and evaluated by an expert in a fixed scale.
Each single measure Mt,l,ah , h = 1, . . . ,H

l
t, l = 1, . . . ,L, a = 1, . . . ,A will be thus linked to effort

Et.
2In [6] there is a discussion showing that from the practical point of view all the formulae are in fact equivalent.



Choice of Countermeasures in Project Risk Management Using Fuzzy Modelling 587

3 Model optimising the choice of countermeasures in project risk
management

In the model we assume that the project manager wants, if possible, to achieve a small project
overall risk level at the minimal cost. Also, the effort linked to the measures should be taken
into account. Thus in fact three objective functions should be present in the model: the overall
risk level, the cost of applying risk mitigation or elimination measures and the overall effort of
applying those measures.

In order to solve this multicriteria problem, let us choose the easiest approach, where the level
of all but one criteria has to be fixed, so that only one criteria formally remains as an objective
function. In our opinion in most cases the decision maker will have to maintain a certain level of
overall risk, and this level would be fixed beforehand. The decision maker would thus seek a way
to achieve this level at the minimal cost. Also, he would like to minimize the effort, but probably
rather as a secondary goal, trying to control it and be aware of it than to search for an absolute
minimum. That is why the following model is proposed, but of course other formulations of this
multicriteria problem would be possible too.∑

h=1,...,Hlt, l=1,...,L,
t=1,...,T,a=1,...,A

C(M
t,l,a
h ) ·x

t,l,a
h → min (3)

∑
l=1,...,L,t=1,...,T,
a=1,...,A,k=1,...,Plt

A∑
a=1

wa(R
t,l
k ) · (1−y

t,l
k,a) ·va(R

t,l
k ) +

A∑
a=1

wa(R
t,l
k ) ·y

t,l
k,a ·m(va(R

t,l
k ))

A∑
a=1

wa(R
t,l
k )

≤ RL (4)

∑
k∈{1,...,Plt} and M(va(Rt,lk ))=h

y
t,l
k,a ≤ M ·x

t,l,a
h (5)

for each h = 1, . . . ,Hlt, l = 1, . . . ,L, t = 1, . . . ,T, a = 1, . . . ,A∑
h=1,...,Hlt, l=1,...,L,
t=1,...,T,a=1,...,A

E(M
t,l,a
h ) ·x

t,l,a
h ≤ EL (6)

where xt,l,ah , h = 1, . . . ,H
l
t, l = 1, . . . ,L, t = 1, . . . ,T, a = 1, . . . ,A, will be equal to 1 if the

corresponding measure should be applied and to 0 otherwise, yt,lk,a, l = 1, . . . ,L, t = 1, . . . ,T, a =
1, . . . ,A, k = 1, . . . ,P lt will be binary variables fulfilling the constraint y

t,l
k,a = 0 (thus, being able

to be eliminated from the model) if the value of the a-th attribute of risk Rt,lk would not be
changed thanks to the corresponding countermeasure. The constant RL stands for the admissible
overall project risk level, the constant EL for the admissible effort level linked to the selected
countermeasures and the constant M for a sufficiently big number.

Actually, in practice most of the parameters in the above model may be impossible to deter-
mine in an exact way and may require a fuzzy formulation. Because of the limited scope of the
paper, we assume, basing ourselves on [4, 5, 7, 9], only the risk attributes and the weights of the
attributes to be fuzzy, as well the constants RL and EL and cost values will be crisp.

For the fuzzy modeling, let us use here the language from [9], where the authors consider
three risk attributes (probability of occurrence, severity of consequences, early detection diffi-
culty) whose values can take five fuzzy vales each (VH - very high, H - high, M - moderate, L



588 D. Kuchta, D. Skorupka

- low, VL - very low). The same 5 values are assigned in [9] to the attributes weights. The
human language assumed in [9] at the background is as follows (Ã = (a1,a2,a3) stands for the
triangular fuzzy number with support [a1,a3] and a2 as the value with the membership degree 1):

Table 1: Linguistic scale for risk attributes, their weights and the effort linked to the counter-
measures [9]

Linguistic term Corresponding triangular fuzzy number
Very low (VL) (0, 0, 0.25)

Low (L) (0, 0.25, 0.5)
Moderate (M) (0, 0.5, 0.75)

High (0, 0.75, 1)
Very High (VH) (0.75, 1, 1)

For RL and EL we will use fuzzy numbers à = (a1,a2,a3) with a2 = a3. The decision maker
might be supported in the choice of the fuzzy numbers for RL and EL by means of questions
similar to the following ones:

• For RL: how many serious risks at the maximum would he accept, and how many serious
risk he thinks have to be linked to each project at the minimum (as there are no projects
without risk and accepting risks opens new possibilities)?

• For EL: similar questions, but regarding difficult countermeasures.

With fuzzy parameters denoted by ,̃ we would have a mathematical programming problem
with fuzzy parameters in constraint (4), which would become

∑
l=1,...,L,t=1,...,T,
a=1,...,A,k=1,...,Plt

A∑
a=1

w̃a(R
t,l
k ) · (1−y

t,l
k,a) · ṽa(R

t,l
k ) +

A∑
a=1

w̃a(R
t,l
k ) ·y

t,l
k,a · m̃(va(R

t,l
k ))

A∑
a=1

w̃a(R
t,l
k )

≤ R̃L (7)

The rest of model (3) - (6) will remain unchanged.
Constraint (7) is not unequivocal. It may be interpreted in many ways, according to the way

the decision maker chooses to compare fuzzy numbers. Also, the fuzzy numbers on the left hand
side have to be multiplied with a constant and added one to another.

Let us thus discuss shortly basic arithmetical operations on fuzzy numbers and the simplest
approaches of comparing them. Let us thus consider two triangular fuzzy numbers à and B̃,
based, respectively, on the following triples of crisp numbers: (a1,a2,a3) and (b1,b2,b3). Then
we have:

• Ã + B̃ = (a1 + b1,a2 + b2,a3 + b3) (8)

• Ã · B̃ = (a1b1,a2b2,a3b3) if all the parameters are positive (9)

• For each crisp number r we have: r · Ã = Ã ·r = (ra1,ra2,ra3) (10)

If it comes to the inequality à ≤ B̃, it may be interpreted depending on the pessimism/opti-
mism degree of the decision maker. E.g. three interpretations listed below are possible, where
the first one is the most pessimistic (it is most difficult for à to satisfy it) and the last one the
most optimistic:



Choice of Countermeasures in Project Risk Management Using Fuzzy Modelling 589

• a3 ≤ b1 (11)

• a3+a2
2
≤ b2+b1

2
(12)

• a2 ≤ b2 (13)

• a2+a1
2
≤ b3+b2

2
(14)

• a1 ≤ b3 (15)

For other possibilities see e.g. [3]. Choosing (in cooperation with the decision maker) one of
the approaches, we can turn constraint (7) into a crisp constraint.

4 Example

Let us consider a real world construction project, presented in detail in [8]. There are over
30 risks there and a similar number of countermeasures. Here let us consider only a selection of
the data. Thus we have the following risks:

• on the project level, determinant time: R1,11 - erroneous identification of soil;

• on the project level, determinant cost: R1,21 - accidents during the construction;

• on the construction market level, determinant time: R2,11 - non-availability of work force
at the budgeted cost;

• on the construction market level, determinant cost: R2,21 - non-availability of required
equipment;

• on the national level, determinant cost: R3,21 - unfavorable inflation.

The values of the risk attributes were assessed by the experts, as well as the weights of the
attributes (we assume in the example that the weights are the same for all the risks).

Table 2: Risks attributes and their weights in the example
Risk R1,11 R

1,2
1 R

2,1
1 R

2,2
1 R

3,2
1 Weight of

the attribute
Probability of occurrence M VH M H H L
Consequences of occurrence H VH H M VH VH
Difficulty in early detection VH H L L L M
Difficulty in influencing the risk
by countermeasures

L L H H VH M

Five countermeasures have been identified, together with their cost and effort:



590 D. Kuchta, D. Skorupka

Table 3: Countermeasures, their cost, efforts and effects for the example
Countermeasure Risk and

attribute
influenced

Effect on
the at-
tribute

Cost of the coun-
termeasure (in
monetary units
denoted $)

Effort linked
to the coun-
termeasure

Having ready an alter-
native technology which
can be used immediately
when the soil problem is
detected, M1,1,21

R
1,1
1 conse-

quences
H → L 40 $ L

Additional check of all
the equipment and work-
ers training, M1,2,11

R
1,2
1 , proba-

bility
VH→H 30 $ L

Training offered to pupils
which are about to grad-
uate a construction high
school, M2,1,21

R
2,1
1 , proba-

bility
M→L 50 $ H

Renting or reserving
the needed equipment
already now, M2,2,11

R
2,2
1 , conse-

quences
M→VL 40 $ H

Using a more stable cur-
rency in all the transac-
tions, M3,2,11

R
3,2
1 , proba-

bility
H→L 20 $ VH

For the example we have:

• l = 1,2 (we consider two project success determinants: time and cost)

• t = 1,2,3 (we have three levels: the project level, the construction market level, the
national level);

• a = 1,2,3,4 (we have four risk attributes corresponding to the rows of Table 2);

• Hl,at = 1 for the following triples (t, l,a), which can be read off from the rows of Table 3:
(1,1,2),(1,2,1),(2,1,1),(2,2,2),(3,2,1). Otherwise it is equal to 0;

• decision variables (binary) are as follows: x1,1,21 ,y
1,1
1,2,x

1,2,1
1 ,y

1,2
1,1,x

2,1,2
1 ,y

2,1
1,1,x

2,2,2
1 ,y

2,2
1,2,

x
3,2,2
1 ,y

3,2
1,1.

Let us assume RL = EL = (2,3,3). We get then the following model (using values from
Table 1,2 and 3 and formulae (8)-(10)):

40x
1,1,2
1 + 30x

1,2,1
1 + 50x

2,1,2
1 + 40x

2,2,2
1 + 20x

3,2,2
1 → min (16)



Choice of Countermeasures in Project Risk Management Using Fuzzy Modelling 591

A =(0,75,1,1)(1−y1,11,2)(0,0,75,1) + (0,75,1,1)y
1,1
1,2(0,0,25,0,5)

+ (0,0,25,0,5)(1−y1,21,1)(0,75,1,1) + (0,0,25,0,5)y
1,2
1,1(0,0,75,1)

+ (0,0,25,0,5)(1−y2,11,1)(0,0,5,0,75) + (0,0,25,0,5)y
2,1
1,1(0,0,25,0,5)

+ (0,75,1,1)(1−y2,21,2)(0,0,5,0,75) + (0,75,1,1)y
2,2
1,2(0,0,0,25)

+ (0,0,25,0,5)(1−y3,21,1)(0,0,75,1) + (0,0,25,0,5)y
3,2
1,1(0,0,25,0,5)

=(0,0,75,1)(1−y1,11,2) + (0,0,25,0,5)y
1,1
1,2 + (0,0,25,0,5)(1−y

1,2
1,1)

+ (0,0,1875,0,5)y
1,2
1,1 + (0,0,125,0,375)(1−y

2,1
1,1) + (0,0,0625,0,25)y

2,1
1,1

+ (0,0,5,0,75)(1−y2,21,2) + (0,0,0,25)y
2,2
1,2 + (0,0,1875,0,5)(1−y

3,2
1,1)

+ (0,0,0625,0,25)y
3,2
1,1

(17)

B = (0,75,1,1) + (0,0,25,0,5) + (0,0,25,0,5) + (0,75,1,1) + (0,0,25,0,5) = (1,5,2,75,3,5)
(18)

A

B
≤ (2,3,3) (19)

y
1,1
1,2 ≤ Mx

1,1,2
1 ,y

1,2
1,1 ≤ Mx

1,2,1
1 ,y

2,1
1,1 ≤ Mx

2,1,2
1 ,y

2,2
1,2 ≤ Mx

2,2,2
1 ,y

3,2
1,1 ≤ Mx

3,2,2
1 (20)

(0,0,25,0,5)x
1,1,2
1 + (0,0,25,0,5)x

1,2,1
1 + (0,0,75,1)x

2,1,2
1

+ (0,0,75,1)x
2,2,2
1 + (0,75,1,1)x

3,2,2
1 ≤ (2,3,3)

(21)

Assuming the method (12) of comparing fuzzy numbers and combining (17), (18) i (19), we
get the following crisp linear programming model:

40x
1,1,2
1 + 30x

1,2,1
1 + 50x

2,1,2
1 + 40x

2,2,2
1 + 20x

3,2,2
1 → min

0,875(1−y1,11,2) + 0,375y
1,1
1,2 + 0,375(1−y

1,2
1,1) + 0,34375y

1,2
1,1 + 0,25(1−y

2,1
1,1)

+ 0,15625y
2,1
1,1 + 0,625(1−y

2,2
1,2) + 0,125y

2,2
1,2 + 0,34375(1−y

3,2
1,1) + 0,15625y

3,2
1,1 ≤ 2,5

(22)

y
1,1
1,2 ≤ Mx

1,1,2
1 ,y

1,2
1,1 ≤ Mx

1,2,1
1 ,y

2,1
1,1 ≤ Mx

2,1,2
1 ,y

2,2
1,2 ≤ Mx

2,2,2
1 ,y

3,2
1,1 ≤ Mx

3,2,2
1

0,375x
1,1,2
1 + 0,375x

1,2,1
1 + 0,875x

2,1,2
1 + 0,875x

2,2,2
1 + x

3,2,2
1 ≤ 2,5 (23)

Solving model (16),(20),(22),(23) we get the information that measures M1,1,21 and M
2,1,1
1

should be applied, at the cost of 80. However, if we change the weight of the risk attributes in
the last column of Table 2, e.g. if the probability gets the weight VH, there is no solution and
we have to accept a higher risk level: RL = (3,4,4). In that case the cheapest way of attaining
this risk level would be the application of measures M1,2,11 and M

3,2,1
1 .



592 D. Kuchta, D. Skorupka

5 Conclusions

A new method of selecting risk countermeasures to attain the desired risk level has been
proposed. It allows to choose risk countermeasures taking into account such elements as various
risk attributes and various weights assigned to them by the decision maker, various risk levels
(the ones closer to the project, where we have more influence, and the ones further away), the
monetary cost linked to the countermeasures as well as the immeasurable effort their application
implies. The information required from the decision maker may be given in linguistic terms,
modeled by fuzzy numbers. A real world example has been presented too.

Further research is necessary to verify the approach in other real world projects as well as
to support the decision maker in the choice of the definition of fuzzy inequalities, which may be
interpreted in many ways. The choice of the interpretation of fuzzy constraints has to correspond
to the preferences of the decision maker, otherwise the model will not lead to a satisfying solution.

Bibliography

[1] Courtot H. (1988), La gestion des risques dans les projets, Ed. Economica, Paris.

[2] Camilieri E. (2011), Project Success: Critical Factors and Behaviours, Gower Publishing
Company.

[3] Liu X. (2001), Measuring the satisfaction of constraints in fuzzy linear programming, Fuzzy
Sets and Systems, 122(2): 263-275.

[4] Mandal S., Maiti J. (2013), Risk analysis using FMEA: Fuzzy similarity value and possibility
theory based approach, Expert Systems with Applications, 41(7): 3527-3537.

[5] Meyer A., Zimmermann, H. (2011); Applications of fuzzy technology in business intelligence.
International Journal of Computers Communications & Control, 6(3): 428-441.

[6] Norman T.L. (2010), Risk Analysis and Security Countermeasure Selection, CRC Press.

[7] Shang K., Hossen Z. (2013); Research Paper: Applying Fuzzy Logic to Risk Assessment
and Decision-Making, Casualty Actuarial Society, Canadian Institute of Actuaries, Society
of Actuaries, 1-59.

[8] Skorupka D. (2012), Method of Construction Projects Risk Assessment, Lambert Academic
Publishing.

[9] Wang Y.-M., Chin K.-S., Poon G. K. K., Yang J.-B. (2009), Risk evaluation in failure mode
using fuzzy weighted geometric mean, Expert Systems with Applications, 1195-1207.

[10] Zhang Y., Zhi-Ping P. (2013); An optimization method for selecting project risk response
strategies, International Journal of Project Management, 32(3); 412-422.