Marle Franck
email: franck.marle@ecp.fr

A structured process to managing complex interactions between project risks

Keywords: Project risk management, Complexity, Interactions, Propagation analysis, Clustering

This paper presents a structured Project Risk Interactions Management (PRIM) process designed to make risk response planning decisions taking into account the complex interactions that potentially exist between project risks. Projects are facing tight constraints, uncertainty and change. Moreover, they are dealing with higher stakes and an ever-growing complexity, which implies that they are more than ever exposed to risks, and that these risks are strongly interrelated. Existing classical methods have some limitations for modeling and managing the project complexity, mainly the interactions that may exist between project risks. We propose to include the identification, assessment and analysis of these interactions into the classical Project Risk Management (PRM) process.This analysis gives new insights for risk response planning decisions. The strategies are always mitigation, acceptance, transfer or avoidance, but the risks which are defined as the most critical ones may be slightly different. There may also be innovative decisions, like breaking propagation transitions between interrelated risks, instead of acting on the risk itself. This process assists the project manager making decisions regarding risk response planning by providing new insights about the potential phenomena involved by complexity, about the internal weaknesses to cope with this complexity, and about the potential effectiveness of proposed mitigation actions. An example of application is detailed to illustrate the validity and the implementation issue of the process.

Introduction

A project is a temporary and unique endeavour undertaken to deliver a result, which generally corresponds to the creation of a product or service or to the improvement of a performance within the organization. Project management consists in the planning, execution, monitoring, control and closure of all aspects of a project, and in the motivation of all people involved in reaching its objectives (ISO 2003;[START_REF] Ipma | IPMA Competence Baseline (ICB), Version 3[END_REF][START_REF] Pmi | A guide to the project management body of knowledge (PMBOK)[END_REF]. [START_REF] Ulrich | Product design and development[END_REF] point that projects are rarely executed as planned. This is partly due to the existence of uncertainty and risk, mainly in the initial phases of the project, which commonly involve vague, qualitative and insufficient information [START_REF] Grubisic | Methodology for the integrated management of technical and managerial risks related to the product design process[END_REF]. Project risk is defined as "an uncertain event or condition that, if it occurs, has a positive or negative effect on at least one of the project objectives" [START_REF] Pmi | A guide to the project management body of knowledge (PMBOK)[END_REF]. If these risks are not managed pro-actively using a structured approach, then they can result in serious consequences for the project, as outlined in ISO 10006 (2003). According to [START_REF] Raz | A comparative review of risk management standards[END_REF], "the origins of operational risk management can be traced to the discipline of safety engineering". Modern risk management has evolved from this issue of physical harm that may occur as a result of improper equipment or operator performance. Many risk management methodologies and associated tools have been developed now in the context of project management, with qualitative and/or quantitative approaches, often based on the two concepts of probability and impact (or gravity) of the risky event.

Project Risk Management (PRM) is today crucial to the success of projects. Indeed, risks in projects have become higher in terms of number and global impact. That is why it has become increasingly important to effectively and efficiently manage project risks, in order to give a higher guarantee of success and comfort to project stakeholders, or at least to warn them against potential problems or disasters. Classical PRM process is comprised of four major phases: risk identification, risk analysis, risk response planning, and risk monitoring and control [START_REF] Pmi | A guide to the project management body of knowledge (PMBOK)[END_REF]. Risk identification is the process of determining events which, if they occurred, could affect project objectives positively or negatively. Risk analysis is the process of evaluating and prioritizing risks, essentially according to their characteristics like probability, impact and criticality. The process of risk response planning aims at choosing actions which reduce global risk exposure. Risk monitoring and control is the ongoing process of "implementing risk response plans, tracking identified risks, monitoring residual risks, identifying new risks, and evaluating risk process effectiveness throughout the project" [START_REF] Pmi | A guide to the project management body of knowledge (PMBOK)[END_REF].

Projects are facing a growing complexity, in both their structure and context. Project managers have to consider a growing number of parameters (environmental, social, safety, or security for instance) and a growing number of stakeholders, both inside and outside the project.The existence of numerous and diverse elements which are strongly interrelated is one of the main characteristics of complexity [START_REF] Chu | Theories of complexity -Common denominators of complex systems[END_REF][START_REF] Corbett | Tackling industrial complexity[END_REF][START_REF] Sherwood Jones | Diversity as a determinant of system complexity[END_REF]. The complexity of projects leads to the existence of a complexly interacted risk network.The existence of complex phenomenain the project structure is likely to notably reduce the performance of the risk management process [START_REF] Eckert | Change and customisation in complex engineering domains[END_REF]. Particular attention should be paid to this performance since poor or delayed risk mitigation decisions may have great potential consequences in terms of crisis, underachievement of objectives and avoidable waste [START_REF] Kloss-Grote | How to measure the effectiveness of risk management in engineering design projects ?[END_REF].

Our objective in this paper is to address project risk management from the perspective of managing complexity through the interaction between risks. Risk interactions should be modeled with a network structure instead of classical list or tree structure in order to represent the real complexity of the project. We propose an integrated 3-step approach for modeling, analyzing then making decisions related to the potential behavior of the project due to its complexity.

The paper is organized as follows. Section 2 introduces the issue of the presence of complexity in projects and the gap with the non-capacity of current project risk management methods to cope with it. Section 3 presents the process used for managing complex interactions between risks, called Project Risk Interactions Management (PRIM). Section 4 explains how risk interactions can be modelled through the use of matrix representations and graph theory.Section 5 illustrates the proposed analysis method, based on the assessment of external potential attacks (risks induced by complexity) and internal current weaknesses (lack of maturity to cope with the attacks). Section 6 introduces four types of decisions that may help to mitigate the project vulnerability due to its complexity, modifying the project risk network and/or the project organization. Our approach has been tested on a large project which is introduced in section 7. This project is the implementation of an entire tramway infrastructure in a city, including the design and delivery of the trains (the rolling stock), of operating systems (like signalling material or communication systems), and the construction of all the infrastructures (including the buildings, tracks and bridges).Some conclusions are drawn in Section 8.

Background and research issue: projects, complexity and risks

This section introduces the notion of complex system which can be used to characterize a project. Then, the consequences of complexity are analyzed and the limits of existing methods are underlined, in order to define our research objective.

Project as a complex system

According to systems analysis [START_REF] Penalva | OPM3: Organizational Project Management Maturity Model. Knowledge foundation[END_REF], (Le [START_REF] Moigne | Large engineering project risk management using a Bayesian Belief Network[END_REF], [START_REF] Boulding | General systems theory: the skeleton of science[END_REF], [START_REF] Marle | Methods for helping decision-making in projects[END_REF], a system is an object, which, in a given environment, aims at reaching some objectives (teleological aspect) by doing an activity (functional aspect) while its internal structure (ontological aspect) evolves through time (genetic aspect) without losing its own identity. Projects can thus be considered as systems. We state that "project complexity is the property of a project which makes it difficult to understand, foresee and keep under control its overall behaviour, even when given reasonably complete information about the project system. Its drivers are factors related to project size, project variety, project interdependence and project context" [START_REF] Vidal | Understanding project complexity: implications on project management[END_REF].Project managers have to consider a growing number of parameters (environmental, social, safety, or security for instance) and a growing number of stakeholders, both inside and outside the project.Project systems are then in essence complex and this complexity is undoubtedly a major source of risk, since the project organization may not be able to cope with it.The complexity of projects has some consequences and notably leads to the existence of a complexly interacted risk network.

Understanding the consequences of project complexity

The links between project complexity, project risks, project uncertainty and project performance are still unclear in the academic world as well as in the industrial one. For instance, Parsons-Hann and Liu state that "it is clear that requirements complexity contributes to project failure in organisations, what is not apparent is to what degree this statement holds true" [START_REF] Parsons-Hann | Measuring requirement complexity to increase the probability of project success[END_REF]. Even if the relation between risks and complexity has to be clarified, complexity appears to be one of the main reasons of the unpredictability of projects, particularly in terms of problems and failures.

We argue that two main classes of complexity induced risks can occur during a project. The first class gathers all the risks which are directly induced by project complexity. There is a high number and great diversity of objects to manage, with a high number and great diversity of parameters that characterize them.

By paying attention to the key aspects of complexity that can be risky (for instance, some interfaces within the project system), the identification of this first class of complexity induced risks will enable one to complete the risk lists which are usually done thanks to traditional risk identification methods.

The second class gathers all the risks which are indirectly induced by project complexity because of the propagation phenomena within the complex project system. In other terms, once an exhaustive project risk list is made, there is still some work to be done to identify and assess the risk of a propagation of one of this identified risk within the project system (as well as the underlying risk of positive feedback and amplification through the system). In the case of project management, the main consequence is that any change in any component in the project system may thus affect any other component of the project system in an unpredictable way because of change propagation. Propagation effects throughout the project structure are likely to notably reduce the performance of the risk management process [START_REF] Eckert | Change and customisation in complex engineering domains[END_REF]). The extreme case of this propagation behavior is the chain reaction phenomenon or the "domino effect". Another phenomenon is the loop, which is a causal path that leads from the initial occurrence of an event to the triggering of subsequent consequences until the initial event occurs once more. The next paragraph shows the limits of existing methods to cope with these complexity-induced risks, including complex phenomena like long reaction chains, amplifying reaction chains, loops or chaotic propagation.

Limits of existing project management and project risk management methods and research issues

Many risk management methodologies and associated tools have now been developed, locally [START_REF] Baccarini | The risk ranking of projects: A methodology[END_REF][START_REF] Bowles | The New SAE FMECA Standard[END_REF][START_REF] Chapman | The Controlling Influences on Effective Risk Identification and Assessment for Construction Design Management[END_REF][START_REF] Chapman | Project risk management: Process, techniques and insights[END_REF][START_REF] Gautier | Method of reliability analysis in the project information management process. Managing risks in projects[END_REF][START_REF] Henley | Probabilistic risk assessment[END_REF][START_REF] Kaplan | New Tools for failure and risk analysis, anticipatory failure détermination (AFD) and the theory of scenario structuring[END_REF][START_REF] Kawakita | The original KJ method[END_REF][START_REF] Keizer | From experience: applying the risk diagnosing methodology[END_REF][START_REF] Kerzner | Project management: A Systems Approach to Planning, Scheduling and Controlling[END_REF][START_REF] Klein | An approach to technical risk assessment[END_REF][START_REF] Kurtoglu | A graph based framework for early assessment of functional failures in complex systems[END_REF][START_REF] Riek | From experience: Capturing hard-won NPD lessons in checklists[END_REF][START_REF] Shimizu | Reliability Problem Prevention Method for Automotive Components-Development of GD'3' Activity and DRBFM method for Stimulating Creativity and Visualizing Problems[END_REF][START_REF] Smith | Proactive Risk Management. Controlling Uncertainty in Product Development[END_REF]Stamatelatos 2004;[START_REF] Stone | The function-failure design method[END_REF][START_REF] Tumer | Mapping function to failure mode during component development[END_REF]or as standards or norms [START_REF] Apm | Project Risk Analysis & Management (PRAM) Guide. High Wycombe[END_REF]AFNOR 2003;BSI 2002;IEC 1995;IEEE 2001;[START_REF] Ipma | IPMA Competence Baseline (ICB), Version 3[END_REF]MIL-STD-16291998;[START_REF] Pmi | A guide to the project management body of knowledge (PMBOK)[END_REF]PRINCE 1999). They are based on experience or on expertise, or on a mix of experience and expertise, including for instance some creativity based on an existing but insufficient experience. They are usually based on two main concepts: probability and impact or gravity, assessed by qualitative or quantitative approaches.

Many of these methodologies independently evaluate the characteristics of risks, and focus on analysis of individual risks. Risks are then ranked for one or more parameters by these methods and tools [START_REF] Baccarini | The risk ranking of projects: A methodology[END_REF][START_REF] Chapman | Project risk management: Process, techniques and insights[END_REF]. For example, common project risk lists exhibit each individual risk and its category or nature. A two-dimensional Farmer diagramdisplays probability and gravity of risks. We can also cite creativity-based techniques or expertise-based techniques, like expert judgment using Delphi, affinity diagram, peer interviews or risk diagnosis methodology [START_REF] Kawakita | The original KJ method[END_REF][START_REF] Keizer | From experience: applying the risk diagnosing methodology[END_REF][START_REF] Kerzner | Project management: A Systems Approach to Planning, Scheduling and Controlling[END_REF].Generally, these methods do not take into account the subsequent influence of risk and cannot represent the interrelation between risks.

To comprehensively understand a risk, it is helpful to identify its causes as well as its effects. Several methods include this principle, but they still concentrate on a single risk in order to simplify the problem (Carrand Tah 2001;[START_REF] Heal | Modeling interdependent risks[END_REF]. For instance, failure mode and effects analysis (FMEA) consists of a qualitative analysis of dysfunction modes followed by a quantitative analysis of their effects, with probability and gravity (Bowles1998; MIL-STD-1629 1998). Fault tree analysis (failure tree or dysfunction tree) and cause tree analysis are a family of cause and effect modeling methods.

They determine the conditions which lead to an event and use logical connector combinations [START_REF] Pahl | ) -A Systematic Approach[END_REF]). However, although causes and effects of one particular risk can be displayed, they are still single-risk oriented and unable to completely model the complex risk interactions.

Few specific methods allow risk correlations to be modeled with network structure. Several papers on the application of the Bayesian belief network (BBN) have appeared in recent years in the field of project risk management [START_REF] Fan | BBN-based software project risk management[END_REF]Lee et al. 2008), which could model risk interrelations, from multiple inputs to multiple outputs. Nevertheless, BBN demands oriented links, is inherently acyclic, and hence does not easily model the loop phenomenon when this exists. These methods are thus not always applicable for practical purpose and fail in some cases to represent the real complexity of interrelationships among risks.

The issue is that the complexity involves some phenomena which are difficult to manage with classical project risk management methods, in terms of anticipation and decision-making. Firstly, it is difficult to anticipate potential consequences of a risk, especially if it is considered and documented as isolated. For instance, there may be propagation from one "upstream" risk to numerous "downstream" risks, the climax of this phenomenon being the famous domino effect. Another example may be the existence of loops: amplifying loops are a great danger during projects and are all the more complicated to understand since the nature of the risks which exist within a loop is likely to be different. Secondly, some decisions have to be made after analysis in order to avoid, mitigate, transfer or accept project risks. It may include decisions on project processes, on project actors or organization, but it may also include decisions on project complexity. Our aim in this paper is to consider either classical response planning decisions but with a refined analysis process, or to consider innovative response planning decisions.

The global issue of existence of complexity in project is then to know how to seize the opportunities emerging from complexity and to know how to avoid or at least mitigate the negative effects of complexity. The main negative effect is the difficult in the project risk management process to anticipate correctly the potential behavior of the project and to make reliable risk response planning decisions. The next section introduces the Project Risk Interactions Management process which aims at assisting project manager to make more reliable analysis and decision.

The Project Risk Interactions Management process (PRIM)

Classical project risk management process identifies, analyzes and treats risks. However, there are still some phenomena which are not enough taken into account by classical project risk management methodologies, such as loops, reaction chains or non-linear couplings.We introduce the PRIM process, the structure of which is voluntary similar to the existing Project Risk Management (PRM) process. As shown in figure 1, both processes are to be coupled in order to use outputs from one process as inputs of the other one. The dotted lines and the white boxes show the classical sequence of subprocesses into the PRM process. Recommandation is to follow the complete process, including the subprocesses related to interactions between risks (full lines and grey boxes).

The additional steps are: Risk Interactions Identification, Risk Interactions Assessment, Vulnerability Analysis and finally Vulnerability Mitigation. The classical steps of risk management planning (upstream) and risk monitoring and control (downstream) are respectively inputs and outputs of the process, but are out of our research scope.

Please insertFigure 1

In this process, the interactions-based project risk network is first built in section 4. Secondly, a vulnerability diagnosis is made in section 5 considering two elements: the internal weaknesses of the project system and the potential phenomena due to complexity which could affect the project, either on its results or its processes. Vulnerability is the gap between these potential attacks and the internal capacity of the system to cope with them. Finally, mitigation actions are proposed in section 6, with some innovative actions like process improvement, actor reassignment, project organization reshuffling or complexity reduction.

The identification and assessment steps

This section introduces the processes which enable the structure of the complex risk network to be built. It includes two processes focused on individual risks (identification and assessment) and two processes focused on interactions between these risks (identification and assessment).

The existing processes: the risk identification and eva luation

As mentioned in the Section 2, risks are classically identified using experience and/or expertise and assessed in terms of probability and gravity. In this paper, we are considering classical methods for risk identification and assessment. How to build a risk list is not in our scope. Risk probability and gravity may be assessed on a qualitative scale (ordinal or cardinal scale with 5 or 10 levels for instance) or on a quantitative scale (percentage of occurrence or financial loss for instance).

The risk interactions identification process

Identification of risk interactions is the first step to determine and establish the possible cause-effect relationship between risks. Design structure matrix (DSM) has proved to be a practical tool in project management for representing and visualizing relations and dependencies among system components.

The DSM was introduced by Steward with tasks [START_REF] Steward | The Design Structure Matrix: a method for managing the design of complex systems[END_REF]) and has been used for planning issues combining tasks, people and product components [START_REF] Eppinger | A model-based method for organizing tasks in product development[END_REF][START_REF] Eppinger | Patterns of product development interactions[END_REF][START_REF] Sosa | A structured approach to predicting and managing technical interactions in software development[END_REF]). The main advantages of this approach are to overcome the problems associated with the visual display of complex networks, especially in the case of very complex structures, including lots of interactions and even loops. An additional advantage is that it allows for systematic identification by considering each cell across the matrix. The Risk Structure Matrix (RSM) is defined as the matrix where each cell (i,j) gives information about the existence of a potential cause-effect interaction between risks R i and R j [START_REF] Marle | Potential Applications of DSM principles in Project Risk Management[END_REF]. There is an interaction between two risks if the occurrence of the upstream risk may trigger the occurrence of the downstream risk. For instance, a delay of a task may involve a delay for its successors, an over cost for the project, a motivation issue for the resources.

The risk list is an input of the risk interaction identification process. However, one interesting result is that the risk interaction identification sometimes enables to update the risk identification, which is then simultaneously an input and an output of the interactions identification. In order to be more useful, this matrix needs to be transformed into a numerical one to catch the strength of risk interactions. This is the object of next paragraph.

The risk interactions assessment process

Probability assessment relies upon classical experience and expert judgment methodologies. However,the distinction is made between the probability to be triggered by another risk inside the network and the probability caused by external events or risks which are outside the system. Risks may occur because of one or multiple causes included in the risk list; this is what we call Transition Probability (TP). They may also occur for other reasons, not included in our model; this is what we call Spontaneous Probability (SP). Classical models mainly focus on SP.

A numerical structure matrix, called Risk Numerical Matrix (RNM) is introduced in order to provide more detailed information than the RSM about the risk network for assisting decision-making. Two ways for estimation can be used: direct assessment and relative assessment. Direct assessment is made for each potential interaction by one or more experts using their experience and/or expertise. Relative assessment consists in comparing the causes (or the effects) of a single risk which has multiple interactions.

The RNM thus permits to synthesize the existence and strength of local precedence relationships between risks as it combines the cause-oriented vision and the consequence-oriented vision of an interaction. Combining these two visions is helpful to avoid any bias or misevaluation which can happen when looking at the problem with single vision. In the risk network model, numerical value of cause-effect interactions in RNM can also be interpreted as the transition probability between risks. For example, if the element RNM(4,3) is equal to 0.25, then it means that the probability of risk R 4 originating from risk R 3 is 25% under the condition that R 3 is activated.

The identification and assessment of risks and risk interactions enable to build the project risk network. This network is displayed as a matrix and may be very complex, as each risk could cause multiple subsequent risks and can also be triggered by multiple risks. There exist different paths from one node to another, either direct paths or via multiple intermediary nodes. Assessment of individual interactions enables to analyse more global phenomena, like reaction chains or loops. This is the object of the next section.

The analysis of project vulnerability due to complexity

This section introduces the concept of project vulnerability,which is basically a gap between the potential risks and the capacity of the project to cope with them. This involves first definingvulnerability, then identifying and assessing internal weaknesses of the project and finally identifying and assessing potential phenomena that could affect negatively the project. This paper focuses on phenomena involved by complexity. This is therefore a particular case of project vulnerability which is addressed here.

The vulnerability diagnosis

As recent works or communications state it [START_REF] Zhang | A redefinition of the project risk process: Using vulnerability to open up the eventconsequence link[END_REF], the concept of vulnerability appears to be promising for efficient risk management, notably within the context of project management. Indeed, it enables to have a more systems-oriented vision than the traditional cindynics approach. This one focuses only on the evaluation of risks, instead of focusing on the weaknesses of a system facing these risks. We aim at developing the concept of project vulnerability with a systems thinking based view in order to highlight the potentially endangered elements of a project, including its processes, its organization and its outcomes.

After a broad state of the art in many scientific domains, including notably health, climatology, sustainable development,industrial engineering and project management, the following definition of project vulnerability has been proposed: "the characteristic of a project which makes it susceptible to be subject to negative events and, if occurring, which makes it non capable to cope with them, which may in the end allow them to degrade the project values" (Vidal and Marle2010). This permits to concentrate also on the existing weaknesses of a project system which may create potential damages regarding the project values creation. By focusing on this system, response plans may be more adapted to the existing current lacks of the project, and not only to potential future dangers.

As a whole, project performance degradation is the consequence of two coexistences. The first one conditions the apparition of vulnerability: coexistence of susceptibility to be subject to negative events and incapacity to cope with them if occurring. The second one is the temporal coincidence of a triggering event and a vulnerable ground for a risk to occur and to degrade the processes of values creation during the project. To summarize, the more there are potential risks and internal weaknesses, the more vulnerable the project is to these risks. It can then be comparable in terms of vulnerability to be in a dangerous context but with a skilled and mature organization or in a less dangerous context but with an inexperimented and not well organized structure. The aim of the next paragraph is to focus on the project system weaknesses and thus on the identification, evaluation and management of noncapabilities in terms of project maturity.

The internal weaknesses: focus on project maturity

The models that have received the greatest attention in the research literature are project management maturity models : Capability Maturity Model Integration (SEI, 2006), Berkeley PM Process Maturity Model [START_REF] Kwak | The Berkeley project management process maturity model: measuring the value of project management[END_REF], PM Solutions Project Management Maturity Model [START_REF] Crawford | Project Management Maturity Model. Providing a proven path to project management excellence[END_REF] [START_REF] Kerzner | Advanced project Management. Best Practices on implementation[END_REF].In general, the models measure progress along five well-defined stages, ranging from the most basic project management abilities to highly sophisticated project management practices and culture. They differ from one another in terms of covered scope. As well, they are designed to identify areas upon which improvement efforts should focus. However, they have been designed for long-term and organizational-level improvements, rather than short-term and project-level actions. We decided to focus on project maturity instead of project management or project organization maturity.

Andersen and Jessen (2003) define maturity as "a state where the organization is in a perfect condition to achieve its objectives. Project maturity would then mean that the organization is perfectly conditioned to deal with its project". For [START_REF] Kerzner | Advanced project Management. Best Practices on implementation[END_REF], "maturity in project management is the development of systems and processes that are repetitive in nature and provide a high probability that each project will be a success". According to Gonzalez and co-workers, aproject is mature when "processes which compose it are controlled and continuously improved during the project life cycle in order to allow achieving its objectives" [START_REF] Gonzalez Ramirez | Assessing project maturity: a case study[END_REF].

Our project maturity model adopts a two dimensional framework. Both of the dimensions are based on accepted standards (the PMBOK and the previously introduced maturity models). The first dimension reflects the different stages of the project lifecycle. The second dimension adopts the structure of the PMI's nine knowledge areas [START_REF] Pmi | A guide to the project management body of knowledge (PMBOK)[END_REF], but may be organized in more or less key areas depending on the specific context of the company. Each area may be decomposed into key processes based on specific capabilities and needsof each project.

The evaluation process is based on the SCAMPI method (SEI, 2006). The Standard CMMI Appraisal Method for Process Improvement (SCAMPI) is the official SEI method to provide benchmark-quality ratings relative to CMMI models. SCAMPI appraisals are used to identify strengths and weaknesses of current processes, reveal development/acquisition risks, and determine capability and maturity level ratings. A questionnaire has been built for each key area and contains questions that are related to the maturity goals and process issues described at each level. They help to determine to what extent the project has mechanisms in place to achieve these goals and to solve maturity issues. Questions are designed and customized to the project to reflect the type of work actually carried out by the organization. Quantifying what managers understand about project management principles and determining which methods are currently used on projects may lead to improvements in management efficiency.

The project office aims at providing projects with performant and up-to-date processes, methods and tools, including documentation, training and coaching activities. The assessment of project maturity may show some lacks, whether in definition of adequate processes, methods and tools by the project office or in implementation by the projects of these elements. This is why maturity is simultaneously assessed by project members and by project office members. The first use of maturity assessment is then to act directly on the project, in order to make it more capable to cope with potential risks. The second use of maturity assessment is to continuously improve the processes, methods, tools and documents provided by the project office, which is similar to existing project management maturity models.After the assessment phase, there are therefore four possible cases:

 Case 1: the process is not mature enough in both its definition and its implementation. This is the most vulnerable situation, since potential dangers will have more chance to affect negatively the project.  Case 2: the process is not mature enough in its definition. What is implemented corresponds to what is recommended by the project office, but is not enough. There is here a high level of vulnerability, since the company itself may be not mature enough to provide projects with adequate processes, methods and tools in order to face the risks that may occur. In some cases, a project may be more mature, since an innovation has been made by its members. Then, it is up to the project office to capture this positive experience and to propagate it to other projects.  Case 3: the process is not mature enough in its implementation, not in its definition. The effort should be focused on implementation, including convincing project managers and members, training and coaching, in order to be less vulnerable. The vulnerability is high for the project but less at the organizational level. The organization is capable, but the transmission to each project should be more efficient.  Case 4: the process is mature enough in both its definition and its implementation. A continous improvement is always useful, but this is the lowest vulnerable situation.

The action plan has to be decided and implemented depending on the risks that the project may face and the will of the organization to put priority on an aspect rather than others. There must be first an analysis of the potential risks the project may have to deal with, which is the object of the next paragraph.

The potential attacks due to complexity: dynamic analysis of potential propagation through the complex project risk network

In the context of project management, it is too difficult, costly and impractical to carry out physical studies on the project itself. Namely, continuously repeating projects as experiments in reality is unfeasible. Therefore, in our research on project risk management, we model and analyse risk network through discrete event simulation with the Arena software. The risk network model is introduced in the software to calculate propagation through 10000 simulated iterations. Risk probability can be reevaluated and expressed as statistical risk frequency in simulation. Simulated frequency represents the average occurrence of the risk during the project, which may be greater than 1 because of loops.The simulation model can also be used to anticipate the consequences of one particular risk or a certain scenario. We simulate the scenario by setting the appointed spontaneous probability of related risks, and then all the potential consequences of this scenario can be observed after simulation. For example, if we assign 100% spontaneous probability to one risk while all the other risks have the value of 0%, then the simulation demonstrates both its direct and indirect impacts on other risks in the network.Besides probability and gravity, criticality is another important indicator for analyzing and prioritizing risks. It is generally a combination of probability and gravity, or is simply defined as the product of them in many classical methods.The prioritization results based on the re-evaluated indicators provide project manager with a new understanding of risks and their relative severity in the project. The shift of risk prioritization also influences the planning of mitigation actions.

The results can then provide project managers with new insight on risks and their relations [START_REF] Fang | Modeling risk interactions to re-evaluate risks in project management[END_REF]. Some risks may have a different place in the ranking, in terms of probability or criticality. This is due to their position in the network, and not only to their individual assessment. For instance, accumulation risks may have a higher ranking after simulation, mainly because they have lots of direct and indirect causes. On the contrary, source risks may be considered as important in the initial estimation, but not so much after simulation. In terms of criticality, the simulated value takes into account the global consequences of a risk, direct and indirect. This means that some risks may have many consequences and then have to be considered as more important than with the initial ranking. On the contrary, some have a more local impact. All these information assist decision-makers to plan risk mitigation actions. As estimations and rankings change, the priority and then the mitigation actions will change.

As a conclusion of this section, it is to be recalled that the same complex risk network will not involve the same consequences depending on the maturity of the organisation and of its managers and experts. That means that complexity is not in itself a problem, and that we should analyze the gap between the complexity level and the capacity of the project organization to deal with it, including anticipation and coordination. This gap is defined as the vulnerability of the project due to existence of complexity.

The mitigationactions

This section combines classical risk mitigation strategies with new ones which are specific to the issue of complexity. Classical mitigation actions are avoidance, mitigation (reduction of probability and/or gravity), transfer and acceptance. Facing the complexity of risk interactions, four additional strategies may be adopted: improving the process maturity, changing the actors and/or the organization to adapt it to the current complexity, and reducing the complexity to make the project more able to cope with it.

Actions on the project processes

This type of action consists of increasing maturity in a plan-do-check-act wheel, in a classical continuous improvement process. The main contribution is to reduce the internal weaknesses of the project management system (section 5.2), which reduces the vulnerability (section 5.1) of the project to phenomena induced by complexity (section 5.3). More details are available in (Gonzalez Ramirez 2009), but the basic short term action is to implement correctly what is provided by the project office, or to simultaneously develop and implement something which was missing or very unmature. This gap between current and required maturity levels in a specific area will have more or less consequences depending on the level of exposure to dangers related to this area. The more dangers there are, the higher the required maturity is, and so the higher the priority to invest in maturity improvement is.

Actions on the project organization

The organization breakdown structure determines the interfaces within and between smaller groups. If this organization is not in line with the reality of complexity and complex interfaces between project actors (risk owners), then the capacity of communication and coordination is decreased and vulnerability is increased.

Existing techniques for breaking down risk lists are mainly mono-criteria, since project risks are usually grouped by their nature (financial, technical, etc…), by their criticality value (low, high, etc…) or by their ownership. The risk owners are responsible for the occurrence and/or for the consequence of a risk within the project organisation. Whatever the criterion used for the decomposition of an initial risk list, and whatever the rigour and detail level used, there will always be interactions between risks which do not belong to the same cluster. Our aim here is to propose a methodology which will minimize the amount of interactions which are left outside the formed clusters, which is equivalent to maximising the amount of interactions inside clusters.

The problem of reforming teams inside a project organization considering interactions between risks can be formulated as a clustering problem applied on the Risk Numerical Matrix. A clustering approach for this specific problem has already been introduced [START_REF] Marle | Potential Applications of DSM principles in Project Risk Management[END_REF]. Clustering risks in order to maximise intra-cluster global interactions value allows for facilitating the coordination of risk analysis and response planning activities, as it underlines the need for cooperation and transversal communication within the project team.

Actions on the project actors

The actors assigned to nodes (risks) of a graph are in a more or less complex context, since they are directly or indirectly involved in more or less interfaces. That means that an actor may be assigned or reassigned, not only depending on classical factors such as skills or motivation, but also on her capacity to manage complexity, that is to say to manage numerous interfaces with heterogeneous risks. The identification of actors who are in such a context is detailed in [START_REF] Marle | Risk assessment method in project actor choice[END_REF]. The main contribution is to identify complementary requirements of an actor's assignment depending on her position in the network. If the risk that is managed by the actor is a source, or a transition or an accumulation risk, then the characteristics of the actor should be slightly different.

Another action is to assign some actors to manage the clusters previously formed in section 6.2. For each cluster, all the risk owners who are present in it should initiate discussions during a first meeting and then nominate/vote for the future Risk Cluster Owner (RCO). The RCO will be accountable for facilitating coordination between the interrelated risks and for anticipating the potential behaviour of this part of the risk network.

Two criteria for this RCO selection are the transversal vision on the project and a sufficient level of authority. This implies that a shift should be operated in the skills of the RCOs. Such project members should indeed show great adaptability since they need to manage heterogeneity inside the cluster(s) they are in charge of. They must have not only technical or project-related skills, but also the capability to manage inter-personal situations with members who have different backgrounds and different goals [START_REF] Zika-Viktorsson | Project competence in product development[END_REF].

Finally, a last action consists of reassigning the same owner to several interrelated risks, instead of having several different actors. The basic assumption is to consider that it will be easier for a single actor to consider interactions, potential propagation and then to make coordinated decisions on several risks if she is owner of the whole. Of course, it strongly depends on the nature of the risks and on the skills of the actor, but in some cases, it can bring locally less coordination difficulty in some dense parts of the risk network.

Actions on the project complexity

In classical methods, actions are decided on risks having the highest ranking or priority, often in terms of criticality. These actions can be for instance communicating, training, buying additional or better material resources, choosing a supplier, or increasing the number of tests.

Based on the analysis of the risk network and the induced project vulnerability, we get risk reevaluation and new prioritization results, which means that a new mitigation action plan can be developed. The new actions include: (1) classical mitigation actions, but applied to risks with reevaluated values and rankings;

(2) non-classical mitigation actions, which mitigate propagation occurrence, instead of mitigating risk occurrence. Strategies for mitigating risks in different categories are likely to be different. In addition to the scope of local target on one or several specific risks, mitigation actions could also be proposed to achieve global effects on the risk network.

In the simulation model, different kinds of mitigation actions can be tested by changing the value of the parameters, so that the effects on a part of or on the global risk network can be observed. For a particular risk, classical mitigation action is conducted by giving risk a lower spontaneous probability without considering its interactions with other risks. A complementary preventive action is to cut off the input links or to reduce the transition probability values. This strategy is compatible with accumulation or transition risks. Instead of acting on a risk, the action focuses on the sources of this risk. For instance, the choice of suppliers or the communication plan are potential sources of many risks in a project, so paying enough attention to these points at the beginning of the project may help avoid many risks arising. Blocking the output links can be regarded as the action of confining its further propagation in the network. This is well adapted to source and transition risks. Instead of acting on the risk, the action focuses on its consequences. We do not avoid this risk, but we implement an action to avoid its propagation and amplification to the rest of the project.

Finally, the main innovation here is to act also on interactions, not only on risks. The mitigation actions can be identified using the structure of the network and the results of the propagation analysis.

Breaking some links between risks may be more effective than trying to avoid some risks.

Application to an industrial project

The industrial background of this study is a large project, which consists in building the infrastructure and associated systems of the future tramway of a city with a population of 750 000. The lead company is a designer and manufacturer of trains, which recently extended its scope by proposing "turn key" projects, including not only the trains, but also the complete infrastructure around the trains. This project thus comprises:

• The construction of a depot to stock trains and to execute their control and maintenance, •

The installation of tracks throughout the city, over land with many steep slopes, •

The delivery of the corresponding trains, including redesign activities if the current version does not fit with city's specific requirements, •

The establishment of a traffic signalling operating system, which gives priority to the tramway so as to guarantee travel time performance levels.

Gathering the basic data

A project risk management process was implemented and led to the existence of a list of 42 risksclassified according to six risk classes (risk nature): contractual, financial, technical, project management, stakeholder management and country. Risk ownership in terms of responsibility is shared by 12 actors in the project. Basic characteristics have been assessed (Table 1), including spontaneous probability, gravity and then criticality and criticality ranking (for prioritization).

When performing the risk interaction identification, new risks appeared, for two reasons. Some were a consequence or cause of other risks already present in the initial list; others were seen as intermediary risks which were useful to explain the link between two or more existing risks which were present in the initial list. As a whole, 14 new risks were identified (see Table 1), which represents an increase of nearly 32% in the number of identified risks. Finally, this step raises the issue of risk formulation as in [START_REF] Lough | Promoting risk communication in early design through linguistics analyses[END_REF], as they were not initially formulated in a standard way, which made it more difficult to identify some interactions.

Please insert Table 1

The assessment of the existing risk interactions was then performed on a 10-level Likert scale, due to the high expertise of interviewees. Six of the risks which were present in the initial list (R 1 , R 8 , R 11 , R 15 , R 23 and R 34 ) were considered as poorly interrelated with others and possibly negligible for this study. Some difficulties while performing the assessment were encountered. In particular, this step requires the participation of several experts involved in the project since it necessitates a very wide overview of the project elements and stakes. In the end, the RNM was obtained.

Analyzing the potential complexity-induced phenomena and the lacks of maturity

The internal weaknesses have been restricted to the detection of maturity lacks in the existing key areas which are specific to this project. The following processes have been identified and then assessed, both in terms of adequate definition by the project office and adequate implementation by the project : Cost management; External Stakeholders management; Financial management; Internal Stakeholders management; Law; Procurement management; Quality Management; Risk Management; Scope management; Technical : Safety; Technical : Security; Technical : Track installation; Technical: Train design; Time management.

The three following values have been compared: the current process maturity, the potential process maturity (if all existing methods, tools and documentation provided by the project office were implemented) and the required process maturity, which depends on the relative priority given by the company in this project. For a given area, the current and required values are related to the specific context of each project. The figure 2 shows the results of the maturity assessment, with the expression of the gap between Current Maturity and Potential Maturity (CM-PM) and the gap between Current Maturity and Required Maturity (CM-RM).

Please insert Figure 2

This gives precious information on the weakest points of the project. We also know whether it is possible to react quickly or not, by an effort of implementation of existing available practices provided by the project office. When the lack of maturity is not due to unadequate implementation, then it is potentially more dangerous, since improvement will not be so easy and on a short-term scale. For instance, processes like "Law management", "Risk management" and "Security management" have been emphasized as strong weaknesses of the current project. The "Time management" and stakeholders management, including internal, external and specifically subcontractors and suppliers (procurement), have also been underlined as weaknesses that may put the project in danger. This is mainly due to the history of the company, which was a designer and manufacturer of train, and not a civil engineering company. It was therefore not used to manage numerous subcontractors and suppliers for work which is not related to the train, but to the infrastructure. Even the time management process is not exactly the same for new product development projects and engineering contractual projects, even if both are run under pressure. The second part of the diagnosis is then to analyze whether some specific and today undetected phenomena could occur in the project, aggravating existing risks or occurring in areas where the project is not able to cope with them.

As shown in figure 3, some risks appear to be high accumulation risks (or absorbers), notably the budget-related ones in terms of "profit return" (R 43 ), "rejection of extension of time" (R 37 ) and "liquidated damages" (R 2 ). These need considerable attention, since many paths in the risk network are likely to lead to them. On the contrary, some risks engender many paths in the risk network, like "Civil Work Delay" (R 18 ). They may be the original cause of numerous undesired effects, also called multipliers [START_REF] Eckert | Change and customisation in complex engineering domains[END_REF]). Some are simultaneously multipliers and absorbers, like "travel time performance" (R 10 ) or "risk on certification" (R 39 ).

Please insert figure 3

The difference between initial spontaneous probability and simulated frequency (Table 2) shows the underestimation of some risks due to their position in the network and the neglectance of this complexity in classical methods. After simulation, some risks have been upgraded in terms of criticality ranking (column "ranking gap" in table 2). Moreover, some paths have been detected as possible amplifying reaction chains, starting from an initial technical event with low gravity "civil work delay" (R 18 ) and finishing with a financial event with high gravity "return profit decrease" (R 43 ). This is the length and the heterogeneity of the paths that makes them all the more difficult to detect and manage.

Please insert table 2

Combining the two previous analyses, a vulnerability diagnosis has been made for this project, enabling managers to focus on the combination of complexity-induced risks and maturity weaknesses. Three main following vulnerabilities have been detected.

The management of Civil Work with new internal and external resources and stakeholders, and a contract based on delay penalties. This is a world that was quite new for the train company, and it hired highly experimented and skilled people from civil engineering companies. But, the maturity of a company is not increasing so fast, and many issues could arise in this specific part of the project, including difficulties to manage deadlines, to manage technical issues, to manage contracts and to manage people.

The interaction with local stakeholders, including the city, the state, the banks, the electricity company, the civil engineering subcontractors, the raw materials suppliers. In fact, the shareolder agreement for future city concession during the operations and maintenance phase consists of different national stakeholders and the train company. That means that, in some cases, one national stakeholder could be the source of a problem, but then the train company will have difficulty to reach the assigned objectives. Then, the city will not validate the next milestone and the train company will have penalties or even threats by the national banks to stop financing the project.

The building of the maintenance depot, which serves as a storage place for the trains. This requires havingsimultaneously tracks installed and energized, trains developed, manufactured and delivered and depot infrastructure built. The vulnerability is then on the synchronization of three elements of different natures, since a problem on one of these elements could have directly strong direct and indirect consequences. The direct consequence is a delivery delay in the next project milestone, involving penalties. The indirect consequence is to have the risk of vandalism if the depot is ready but not the trains, and to have to store in an alternative place and with overcosts the trains if they are ready but not the depot. The last part of the problem is to have the depot and the trains, but not the tracks because of installation problems (the machine that has been specially designed for track installation) or energization problems (with the local electricity company).

It has to be noted that some vulnerabilities have been emphasized because of simultaneous existence of a particular risk (heterogeneous reaction chain, amplifying the initial phenomenon into a last phenomenon of another nature)and a maturity lack in this domain. For instance, the train development, which is not a neglectible part of the project, has been assessed as enough mature and so less risky, except for the final delivery of trains, tracks and depot which should be synchronized.

Determining a response plan to mitigate the project vulnerability due to complexity

Some actions have been proposed based on the previous analyses and vulnerability diagnosis.

The maturity improvement of vulnerable processes. The processes identified before as unmature and potentially attacked by related phenomena have been highlighted as priorities of improvement. First of all, the "Security" aspects were addressed because of their emergency. This is a process that influences the construction phase of the project. The "Law" process has been seen as a priority for this project, in order to adapt to local changes, but has been identified at the company-level as a priority for future pre-project analyzes. This is more a long-term organizational improvement. Similarly, for the "Risk management" and "Time management" processes, short-term actions have been conducted, including the study described in this paper, in order to better understand the potential causes and effects of undesirables events, particularly focused on the delivery time consequence. This is mainly due to the structure of the project, where everything is transformed into time and then cost parameters because of the penalty based contract. Simultaneously, long-term actions have been studied, in order to improve the maturity of the organization for future projects.

The clustering of risks considering their interactions. A reshuffled organization has been proposed using the clustering algorithm on risks (Figure 3 and Table 1). The risk clusters determine human groups because of the ownership assignment of actors to risks. The proposed clusters are slightly different than the current structure in six classes or twelve ownerships (Table 1). Namely, there are approximately 30 % of the risks which are grouped together in both structures. This means that interactions are mainly between risks of different natures. It enables better communication between people, since it does not seek the identification of ownership, responsibility and/or accountability, but the identification of risk interdependencies.

Another interesting point is to compare the different clustering approaches. In this case, risks were clustered according to their interactions (CBI), according to their initial risk owner (CBO) and according to their class (CBC). When comparing these different alternatives, it can be said that clustering by interactions leads to an important improvement regarding the consideration of interactions (as shown in figure 4). Indeed, the intra-cluster value of CBI is increased by 32% when comparing with CBC and by 61% when comparing with CBO. Moreover, this increase is all the more noticeable given that some risks are left outside clusters in the case of CBI, meaning that the formed clusters are denser. In terms of value, CBI is as balanced as CBO (standard deviation of clusters value) but with a double mean value. At the same time, CBI is close to CBC in terms of mean value, but with a standard deviation which is much lower. In terms of cluster size, CBI has far smaller clusters than CBC with a more balanced structure.

Please insert Figure4

The obtained clusters seem to be quite consistent with the fieldwork, as they form groups of risks which seem to be relevant in the task of assisting project risk management. Cluster C 8 and C 4, for instance, group possible chain reactions which could imply delays (respectively for permits and authorizations, train delivery, depot construction and track installation) and then impact on the final performance indicator which is the profit (in C 1 ). The delivery of this part of the project requires simultaneously three things: the depot, the tracks and the trains. If one of these is late, then there is a problem with associated damages.

The interesting thing is to mix different risks, respectively design-related risks in cluster C 8 and construction-related risks in cluster C 4 , in order to show their combined influence on a final issue (the depot with the trains on the tracks). The influence of a wrong interface rail / wheel on the redesign of the train and then on the right delivery of the depot including the trains is a link between train design and contractual delivery. The influence of the performance of the track installation machine (which is an internal design) on this contractual intermediary milestone is also noticeable. Finally, a chain starting from a civil work-related risk (R 49 "error in the topography") and connecting to contractualrelated risks (R 12 "Operating certificate delay" and R 10 "Travel time performance") through designrelated risks (R 5 "Traction/braking function" and R 46 "Train performance") is another example of heterogeneous propagation chains that is of our interest.This appears to be all the more interesting since such chain reactions were not previously highlighted and managed during the project. For instance, there were no discussions between actors 1, 2, 3, 4, 5 and 8, respectively owners of risks of cluster C 4 . In retrospect, this interface should have been particularly highlighted, since three different natures of risks involve the same conclusion, which is a failure in an intermediary delivery milestone. Similarly, actors 1, 4 and 9 are encouraged to communicate together about their potential risk interactions. This includes also the link between clusters C 8 and C 4 , for a global understanding of this problem, but with only two clusters with several common actors. With one or two clusters, we are able to group people linked by complex and currently unmanaged potential reaction chains. This analysis helped us to identify possible mitigation actions on actors'assignments and on risk network complexity.

The assignment of risk cluster owners. The assignment of one of the individual risk owners to the ownership of the global cluster was proposed in some cases. Indeed, this is not mandatory since the aim is not to add managerial complexity but to assist the coordination in some specific cases. Secondly, it is related to the structure of the cluster, depending on its size, diversity and number of different actors. If a cluster of 8 risks is represented by only two actors, then the situation is different than in a cluster of 5 risks with 5 different actors. Clusters C 1 , C 4 , C 5 and C 8 are composed of risks involved in key potential reaction chains, with lots of difficulties to manage them properly because of heterogeneity of risk classes and risk owners. The owner of C 1 was actor 2, since he managed the most important and absorbers risks related to damages and final profit. Actor 2 has been also assigned to C 4 , since it was mainly a Civil Work related cluster. It is to be noted that this is a coincidence that the same actor was simultaneously assigned to contractual and financial parameters on the one side and to civil work (but then contractual) parameters on the other side. Actor 4 was assigned to C 5 , since she managed several critical risks. Finally, cluster C 8 has been assigned to actor 1, since the productrelated risks are dominant, even if the track installation related risks are also present.

The reassignment of some risk owners to different risks than their current assignment. Indeed, some of them are currently assigned to several independent risks, meaning that they have to work in parallel on several potential propagation paths, or that they have to be included in several clusters.In this case, some owners were proposed, depending on their skills and accountability in the project, to swap some of their risk ownerships. Secondly, the project management team initially thought that actors 2 and 4were in the most critical situation, because of the number and importance of their assignments. This analysis gave them new information:

• Actor 8 may strongly impact the project, far more than the initial assignments.

• Actors 3, 5 and 6 are assigned to totally independent risks, which means that they have to manage interactions only with other actors. In this project, only one assignment change was proposeddue to the position in the network and the potential lack of capacity to manage this complexity, consisting of replacing actor 8 by actor 2 for ownership of risk R 18 . The decision was not easy to implement, but it has been considered as a positive and necessary change.

The complexity reduction actions. Some mitigation actions are devised and tested in the risk network model by simulation. Table 2 compares their effects on the global risk network, i.e., the reduction obtained on the simulated frequency of all the risks after the action is conducted. Three are classical mitigation actions using the initial criticality value. Actions 1, 2 and 3 are respectively the probability mitigation of risks R 3 , R 29 and R 40 . Actions 4, 5 and 6 are refined mitigation actions, using the refined values of risks and their position in the network. They act on different risks (R 18 , R 37 , R 10 instead of R 3 , R 29 and R 40 ) and with a different mitigation strategy (acting simultaneously on occurrence of risks and transitions between risks). First results show that the combination of classical actions (called plan 1 in table 2) is not so efficient than the combination of innovative actions (plan 2).

Conclusions and further works

This proposal of a Project Risk Interactions Management process is complementary to the existing Project Risk Management process, not in replacement. It just introduces a change of paradigm, for instance to cluster risks according their interactions and not for their similarity-dissimilarity in terms of nature or criticality. It is also an extension of scope for cause-effect analysis, since long-term chains or loops are developed.Our objective is the improvement of coordination through the better recognition and handling of risks interactions. Our works and case study have shown possible significant improvements regarding this specific objective. They also underline the need for a shift in the way project risk management should be approached.

A vulnerability diagnosis based on assessment of internal weaknesses and potential phenomena due to complex interactions is proposed. Lacks of maturity on key processes are to be analyzed, in order to determine whether the project is able or not to deal with potential risks related to these processes. Through the simulation experiments, we can anticipate the potential consequences of risks, and get the refined evaluation of risk characteristics, such as simulated risk frequency and risk criticality. It is then possible to prioritise risks based on these refined characteristic values. Some risks are underestimated because classical methods do not properly take into account risk interactions and possible propagation phenomena. Grouping risks in clusters which maximise the values of risk interactions within them appears to be a promising approach to handle project risks and their interactions. Indeed, such clusters are generally assigned to project team members. Each person in charge of a cluster can thus manage risks which are closely related in terms of possible causes or consequences.

There are some limitations and potential extensions of this model. In this study, we assume that the identified risk interactions are independent. However, sometimes the effect of an interaction is influenced by other related interactions. To address this limitation, more identification work about cross-impact between risk interactions by experts and decision-makers is required. In future works, more parameters like cost of actions will be included, thus the mitigation plan can be optimized under constraints. Risks with positive effects in the network will be considered by introducing negative risk gravity and negative values in the risk numerical matrix. In addition, risk lifecycles should be registered, so that outdated risks will be deleted in the network structure during the monitoring and control phase. AFNOR (2003). FD X 50-117: Management de projet, Gestion du risque, Management des risques d'un projet, AFNOR. Andersen, E. and S. Jessen (2003). "Project maturity in organizations " International Journal of Project

Figure 1 :

 1 Figure 1: the Project Risk Interactions Management process, included in the classical Project Risk Management process

Figure 4 .

 4 Figure 4. Comparison of clustering approaches

Table 2 .

 2 Simulation Results with and without implementation of mitigation plan

Table 1Risk values and classifications, including proposed clusters

Figure 2. Project Maturity Assessment