Chao Fang
email: chao.c.fang@gmail.com

Franck Marle
email: franck.marle@ecp.fr

A Simulation-Based Risk Network Model for Decision Support in Project Risk Management

Keywords: Project risk management, Complexity, Risk network, Simulation, Decision support system

This paper presents a decision support system (DSS) for the modeling and management of project risks and risk interactions. This is a crucial activity in project management, as projects are facing a growing complexity with higher uncertainties and tighter constraints. Existing classical methods have limitations for modeling the complexity of project risks. For example, some phenomena like chain reactions and loops are not properly taken into account. This will influence the effectiveness of decisions for risk response planning and will lead to unexpected and undesired behavior in the project. Based on the concepts of DSS and the classical steps of project risk management, we develop an integrated DSS framework including the identification, assessment and analysis of the risk network. In the network, the nodes are the risks and the edges represent the cause and effect potential interactions between risks. The proposed simulation-based model makes it possible to re-evaluate risks and their priorities, to suggest and test mitigation actions, and then to support project manager in making decisions regarding risk response actions. An example of application is provided to illustrate the utility of the model.

Introduction

Project risk management (PRM) is crucial and indispensable to the success of projects. Indeed, risks in projects have become higher in terms of number and global impact. Projects are more than ever exposed and averse to risks, and stakeholders are asking for more risk management to cover themselves against financial or legal consequences. That is why it has become increasingly important to effectively and efficiently manage project risks, in order to give a higher guarantee of success and comfort to project stakeholders, or at least to warn them against potential problems or disasters. Several standards have been developed in the field of risk management and specifically in project risk management [START_REF]APM, Project Risk Analysis & Management (PRAM) Guide[END_REF][START_REF]ISO/IEC Guide 73:2002. Risk Management -Vocabulary -Guidelines for use in standards[END_REF][START_REF]1995 Risk Management: part 3guide to risk analysis of technological systems[END_REF][START_REF]IEEE, IEEE Standard 1540-2001: standard for software life cycle processesrisk management[END_REF][START_REF]ISO, ISO 10006 -Quality Management Systems -Guidelines for quality management in projects[END_REF][START_REF] Pmi | A guide to the project management body of knowledge (PMBOK)[END_REF].

Classical PRM process is comprised of four major phases: risk identification, risk analysis, risk response planning, and risk monitoring and control [START_REF] Pmi | A guide to the project management body of knowledge (PMBOK)[END_REF]. Risk identification is the process of determining events which, if they occurred, could affect project objectives positively or negatively. Risk analysis is the process of evaluating and prioritizing risks, essentially with respect to their characteristics like probability and impact. The process of risk response planning aims to choose actions which can reduce global risk exposure with least cost. Risk monitoring and control is the ongoing process of "implementing risk response plans, tracking identified risks, monitoring residual risks, identifying new risks, and evaluating risk process effectiveness throughout the project" [START_REF] Pmi | A guide to the project management body of knowledge (PMBOK)[END_REF].

Projects are facing a growing complexity, in both their structure and context. In addition to the organizational and technical complexities described by Baccarini [START_REF] Baccarini | The risk ranking of projects: a methodology[END_REF], project managers have to consider a growing number of parameters (e.g., environmental, social, safety, and security) and a growing number of stakeholders, both inside and outside the project. The existence of numerous and diverse elements which are strongly interrelated is one of the main characteristics of complexity [START_REF] Chu | Theories of complexity -Common denominators of complex systems[END_REF][START_REF] Corbett | Tackling industrial complexity[END_REF][START_REF] Jones | Diversity as a determinant of system complexity[END_REF]. The complexity of project leads to the existence of a network of interdependent risks. For instance, there might be propagation from one "upstream" risk to numerous "downstream" risks; on the other side, a "downstream" risk may arise from the occurrence of several "upstream" risks which may belong to different categories.

The extreme case of this propagation behavior is the chain reaction phenomenon or the "domino effect".

Another phenomenon is the loop, namely a causal path that leads from the initial occurrence of an event to the triggering of subsequent consequences until the initial event occurs once more. An example of loop is that one initial risk, project schedule delay, may have an impact on a cost overrun risk, which will influence a technical risk, and then propagate to and amplify the original risk of schedule delay.

Many risk management methods and associated tools have now been developed. They are usually based on two concepts: probability and impact, assessed by qualitative or quantitative approaches.

Criticality is an aggregate characteristic used to prioritize risks. It is generally a combination of probability and impact, or is simply defined as the product of them. Many of these methods independently evaluate the characteristics of risks, and focus on the analysis of individual risks. Risks are usually listed and ranked by one or more parameters [START_REF] Baccarini | The risk ranking of projects: a methodology[END_REF][START_REF] Chapman | Project risk management -Processes, techniques and insights[END_REF]. Generally, these methods do not take into account the subsequent influence of risks and cannot represent the interrelation between them. We can also cite the creativity-based or the expertise-based techniques, like expert judgment using Delphi, affinity diagram, peer interviews or risk diagnosis methodology (RDM) [START_REF] Kawakita | The original KJ method[END_REF][START_REF] Keizer | From experience: applying the risk diagnosing methodology[END_REF][START_REF] Kerzner | Project management: A Systems Approach to Planning, Scheduling and Controlling[END_REF].

To comprehensively understand a risk, it is helpful to identify its causes as well as its effects. Several methods include this principle, but they still concentrate on a single risk for simplifying the problem [START_REF] Carr | A fuzzy approach to construction project risk assessment and analysis: construction project risk management system[END_REF][START_REF] Heal | Modeling interdependent risks[END_REF]. For instance, failure modes and effects analysis (FMEA) consists in a qualitative analysis of dysfunction modes followed by a quantitative analysis of their effects, in terms of probability and impact [START_REF] Bowles | The New SAE FMECA Standard[END_REF][START_REF]Procedures for performing FMECA[END_REF]; fault tree and cause tree analyses determine the conditions which lead to an event and use logical connector combinations [START_REF] Pahl | Engineering Design -A Systematic Approach[END_REF]. These methods are unable to model complex interactions among different risks.

Few specific methods are able to model risk correlations with a network structure. Several papers on the application of the Bayesian belief network (BBN) have appeared in recent years in the field of project risk management [START_REF] Fan | BBN-based software project risk management[END_REF][START_REF] Lee | Large engineering project risk management using a Bayesian Belief Network[END_REF], which could model risk interrelations, from multiple inputs to multiple outputs.

Nevertheless, BBN demands oriented links, is inherently acyclic, and hence does not easily model the loop phenomenon; this oversight could potentially lead to a disaster in real projects. These methods are thus not always applicable for practical purpose and fail in some cases to represent the real complexity of the interdependencies among risks.

Therefore, to manage a project with complexly interrelated risks, it is important to firstly integrate the multiple dimensions of risks, including classical characteristics like probability and impact, and secondly to bring the modeling of risk interactions into the PRM process. Risk interactions should be modeled with a network structure instead of a classical list or tree structure for representing the real complexity of the project. In this paper, we propose an integrated framework for modeling and analyzing the risk network behavior to support decision-making for risk management. We use classical project risk list, which usually only takes into account the negative aspects of risks, as the inputs of the network model. Thus, this paper mainly focuses on the conventional risks with negative effects. Existing methods like the design structure matrix (DSM) for dependency modeling and the analytic hierarchy process (AHP) for pairwise comparison evaluation are employed to identify and evaluate risk interactions. Simulation technique is used to analyze propagation phenomena and to re-evaluate risks. The aim is to support decision-makers in planning risk response actions with a structured and repeatable approach.

The paper is organized as follows. Section 2 presents the framework of decision support system for risk management. Section 3 introduces the process of building the project risk network model. Section 4 describes the potential applications of this model to support managerial decision-making. An example of an application to a real project in the entertainment industry is presented in Section 5 to illustrate the proposed method. We conclude the paper in Section 6 with a discussion of the utility of the model and the perspective on the future work.

The framework of decision support system for PRM

Our framework is a decision support system (DSS) with five phases: (1) risk network identification;

(2) risk network assessment; (3) risk network analysis; (4) risk response planning; and (5) risk monitoring and control. Figure 1 illustrates this framework. The innovative steps based on the classical risk management process and the new generated outcomes are highlighted in the figure .   In phase [START_REF] Adla | A cooperative intelligent decision support system for boilers combustion management based on a distributed architecture[END_REF], potential project risks are identified by classical methods and the result is usually a project risk list. Based on this list, risk interactions are identified and represented using a matrix-based method. In phase (2) of the risk network assessment, the probability and impact of identified risks are evaluated by classical methods; then the strength of risk interactions is assessed with an AHP-based method, in terms of the causal probability between risks. One innovation of this framework is that in the first two phases, in addition to project risks, risk interactions are also identified and evaluated. This makes it possible to construct the project risk network. In phase (3), the risk network is modeled and run in a discrete-event simulation context. This enables an analysis of the propagation behavior in the network and thus a re-evaluation of risks considering their correlations. Sensitivity analysis is also performed to enhance the reliability of the network analysis phase. The response planning phase (4) consists of three activities: (a) potential mitigation actions are identified according to the analytical results from the previous phase, and they are preliminarily evaluated by experts (some unfeasible actions can be screened out through this activity); (b) candidate actions are tested in the simulation model for estimating their effects on a specific target or on the global risk network; and (c) mitigation actions are re-evaluated in terms of their effects, i.e., the level of residual risks that is expected to remain after the implementation of these actions. Then, the project manager makes decisions about the actions suggested by the system.

Finally, the evolution of the risk network is monitored and the effectiveness of the actions is evaluated to keep the project under control. The phase of monitoring and control provides feedback for the previous phases, which allows the modification and improvement of their results. This decision support system for project risk management is a cooperative DSS [START_REF] Adla | A cooperative intelligent decision support system for boilers combustion management based on a distributed architecture[END_REF][START_REF] Bui | An agent-based framework for building decision support systems[END_REF][START_REF] Gachet | A Jini based software framework for developing distributed cooperative decision support systems[END_REF]. Decisionmakers (usually the project manager and the team of experts) are allowed to modify, complete, and refine the managerial suggestions proposed by the system. It is also necessary for them to participate in each phase of risk management to provide their knowledge, expertise and experience. Figure 1. Framework of the decision support system for PRM

Project risk network model

There are a number of methods for the classical steps of risk identification and risk analysis. These classical methods are used to study individual project risks. Their result, such as the project risk list, serves as the input to study risk interactions for building the risk network model.

Identification of risk network (phase 1)

Identification is the first step of determining the cause-effect relationship between risks. The design structure matrix (DSM) method introduced by Steward [START_REF] Steward | The Design Structure Matrix: a method for managing the design of complex systems[END_REF] has proven to be a practical tool for representing and analyzing relations and dependencies among system components [START_REF] Browning | Applying the design structure matrix to system decomposition and integration problems: a review and new directions[END_REF][START_REF] Danilovic | Managing complex product development projects with design structure matrices and domain mapping matrices[END_REF]. For our study, we use the concept of DSM with risks, in the context of project management. The interrelations between project objects such as tasks, actors and product components facilitate identifying the interrelations between the risks related to these objects. For instance, the project schedule gives information about tasktask sequence relationships. This helps to identify the correlation between two risks of delay for these tasks. A component-component relationship (functional, structural or physical) means that the risks, which may be related to product functions, quality, delay or cost, can be linked, since one problem on one component may have an influence on another (e.g., budget limits). In a similar way, the domain mapping matrix (DMM) introduced by Danilovic and Browning [START_REF] Danilovic | Managing complex product development projects with design structure matrices and domain mapping matrices[END_REF] and the multiple-domain matrix (MDM) introduced by Lindemann, Maurer and Braun [START_REF] Lindemann | Structural Complexity Management: An Approach for the Field of Product Design[END_REF] are helpful in identifying risk interactions across different domains of the project.

According to Thompson's study on relationships in the organizational structure [START_REF] Thompson | Organizations in action[END_REF], there are three basic types of relationships between each pair of risks:



Dependent: risks are engaged in a potential precedence relationship.



Interdependent: risks are engaged in a mutually dependent relation, directly or within a bigger loop.

 Independent: risks are not related.

A fourth type of activity relationshipcontingent is introduced by Browning in [START_REF] Browning | Applying the design structure matrix to system decomposition and integration problems: a review and new directions[END_REF]. The nature of interactions can also be classified into several categories. Multiple links with different natures might exist between two risks. They are expressed as a potential causal relationship between the risks.

Risk interaction is considered as the existence of a possible precedence relationship between two risks. We define the risk structure matrix (RSM), which is a binary and square matrix with RSM ij = 1 when there is a link from R j to R i . It does not address concerns about the probability or impact assessment of this interaction. We put a sanity check between R i and R j . Suppose we know that R i declared R j as a cause, if R j did not declare R i as a consequence, then there is a mismatch. Each mismatch is studied and solved, like the analogous works by Sosa about the interactions between project actors [START_REF] Sosa | The Misalignment of product architecture and organizational structure in complex product development[END_REF]. Figure 2 gives an example to show the use of such a RSM to represent the risk network.

Figure 2. Illustration of risk structure matrix (RSM)

Assessment of risk network (phase 2)

In the assessment phase, the risk network parameters are evaluated, such as risk impact, spontaneous probability of risks and transition probability between risks.

Risk evaluation

As mentioned in the Introduction, risks are classically assessed in terms of probability and impact.

Risk impact can be assessed on a qualitative scale (e.g., ordinal or cardinal scale with 5 or 10 levels) or on a quantitative scale (e.g., financial loss). In this paper, we use classical methods for the impact assessment, based upon a mix of previous experience and expert judgment.

For the probability assessment, we make a distinction between the probability of a risk to be triggered by another risk inside the network and its probability caused by external events or risks which are outside the system. Spontaneous probability can be interpreted as the evaluated likelihood of a risk, which is not the effect from any other activated risks inside the system. Qualitative scales are often used to express probability with 5 to 10 levels (e.g., very rare, rare, unlikely, etc.) which correspond to non-linear probability measures (e.g., 10 -4 , 10 -3 , 10 -2 , etc.). Logarithmic scales have been used by statisticians for many decades [START_REF] Fleiss | Statistical methods for rates and proportions[END_REF]. They allow us to distribute probabilities unevenly. In practice, they devote more space to small values, imposing a compressed, logarithmic mapping. Based on this principle, we can use, for example, Equation (1) for converting qualitative scales into quantitative measures of risk spontaneous probability:

() 10 s p     (1)
where p indicates the quantitative probability measure, s indicates the qualitative scale value, with parameters 0, 0   .

Risk interactions evaluation

A numerical structure matrix can provide more detailed information than a binary one about the risk network for assisting decision-making. Evaluation is the process of measuring and estimating the strength of the link between risks. Two ways can be used for the estimation: direct assessment and relative assessment. Direct assessment is made for each potential interaction by one or more experts according to their experience and/or expertise. Relative assessment consists in comparing the causes (or the effects) of a single risk which has multiple interactions. This involves using the principle of pairwise comparisons in the analytic hierarchy process (AHP) developed by Saaty [START_REF] Saaty | Decision-making with the AHP: Why is the principal eigenvector necessary[END_REF]. An AHP-based assessment has been developed by Marle to obtain the numerical values of the strength of risk interactions [START_REF] Marle | Interactions-based risk clustering methodologies and algorithms for complex project management[END_REF]. The main principles are introduced in the next paragraphs and displayed in Figure 3.

 Step 1: Decomposing individual sub-problems

For each risk R i , we isolate the risks which are related with R i in column (possible effects) and in row (possible causes). This identification enables one to generate the Binary Cause (or Effect) Vectors, with regard to risk R i , respectively called BCV|R i and BEV|R i .

 Step 2: Evaluating the relative strength

We build up two matrices (Cause or Effect Comparison Matrices) with regard to one risk R i (respectively CCM|R i and ECM|R i ). The AHP is based on the use of pairwise comparisons, which lead to the elaboration of a ratio scale. In our case, we have two parallel pairwise comparison processes to run.

The first one consists in the ranking in rows for each project risk. The criterion according to which the alternatives are evaluated is the contribution to R i in terms of risk input. In other words, for every pair of risks which are compared, R j and R k (thus following RSM ij =RSM ik =1), the user should assess which one is more important to risk R i in terms of the probability of triggering R i . These assessments are expressed by numerical values thanks to the use of traditional AHP scales. The second one is the ranking in columns, according to the same principles. Numerical Cause or Effect Matrices (NCM and NEM). The i-th row of NEM corresponds to the eigenvector of CCM|R i which is associated to its maximum eigenvalue. The j-th column of NCM corresponds to the eigenvector of ECM|R j which is associated to its maximum eigenvalue.

 Step 5: Compiling the results

The two previous matrices are aggregated into a single Risk Numerical Matrix (RNM), the values of which assess the relative strength of local interactions. The RNM is defined by a geometrical weighting operation in Equation ( 2) (based on the assumption that both estimations in terms of cause and effect can be considered equivalent). We choose the geometrical mean rather than arithmetic mean because it tends to favor balanced values (between the two assessments). RNM ij is defined as the strength of the cause and effect interaction from R j to R i .

( , ) ( , ) ( , ), ( , ),0 ( , ) 1

RNM i j NCM i j NEM i j i j RNM i j      (2)
Figure 3. Description of the transformation process from RSM to RNM

The RNM thus permits to synthesize the existence and strength of local precedence relationships between risks, as it combines the cause-oriented vision and the consequence-oriented vision of an interaction. This is helpful to avoid any bias or misevaluation which can happen when looking at the problem with single vision. In the risk network model, numerical values of cause-effect interactions in the RNM can also be interpreted as the transition probability between risks. For example, if the element RNM(4,3) is equal to 0.25, then the probability of risk 4 originating from risk 3 is considered to be 25%

under the condition that risk 3 is activated.

Applications to support managerial decision-making

This section presents an analysis of the risk network (Section 4.1) based on the data gathered in Section 3. The results of this analysis help the project manager make decisions about risk mitigation actions (Section 4.2). Finally, the risks and the effects of actions are monitored in order to keep the project under control (Section 4.3).

Risk network analysis (phase 3)

It is difficult to calculate the risk propagation in the network, especially with complex phenomena like loops. Furthermore, in the context of project management, it is costly and unfeasible to carry out concrete experimental studies on projects. Simulation is an alternative tool for empirical research in DSS [START_REF] Arnott | Eight key issues for the decision support systems discipline[END_REF]. Nowadays, simulation has become more popular and powerful than ever since computer and software technologies have significantly developed. Simulation techniques are widely used to build model-driven decision support systems [START_REF] Power | Model-driven decision support systems: Concepts and research directions[END_REF]. They assist decision-maker in anticipating the effects of events, actions and resource allocations by assessing their potential consequences. Therefore, in this research, we model and analyze the project risk network through simulation using the software ARENA. ARENA is a powerful and widely used simulation tool in industry. It is suitable for modeling complex system and simulating discrete events.

Modeling risk interactions in simulation enables us to analyze the propagation behavior in the risk network. A large number of iterations are conducted for each scenario of simulation. The occurrence of every risk is recorded during the simulation. The simulation results can be analyzed to support decisionmaking for risk management.

Risk re-evaluation

After taking into account the risk propagation behavior, risk probability can be re-evaluated and expressed as statistical risk frequency in the simulation. In practice, a risk could occur more than once during one replicate of the project simulation. This is consistent with the real-life situations. Simulated frequency represents the average occurrence of a risk during the project, which may be greater than 1. The relationship between simulated risk frequency and risk probability is expressed in Equation ( 3):

1 2 3 1 [ ] ( ) 2 ( ) 3 ( ) ... lim ( ) m i i i k i m k RF i P R P R P R k P R            (3)
where RF [i] indicates the simulated risk frequency of R i , and P k (R i ) indicates the probability of R i occurring k times during the project.

The simulation model can also be used to anticipate the consequences of one particular risk or a certain scenario. We simulate the scenario by setting the appointed spontaneous probability of certain risks, and then all the potential consequences of this scenario can be observed after simulation. For example, if we assign 100% spontaneous probability to one risk while all the other risks have the value of 0%, then the simulation shows both its direct and indirect impacts on other risks in the network. The consequences of a risk are defined in Equation ( 4) for re-evaluating its impact in the global scope:

1 [ ] [ ] [ ] n i j CR i RF j RI j     (4)
Here CR[i] is the consequences of R i , and RF i [j] indicates the simulated risk frequency of R j originating from R i . RI[j] is the evaluated risk impact of R j , which may be expressed on qualitative or quantitative scales, as mentioned in Section 3.2.1.

The local criticality of a risk can be re-evaluated by multiplying its simulated frequency and its local evaluated impact, as in the following equation:

[ ] [ ] [ ] LC i RF i RI i   (5)
In a similar way, we can refine the estimation of risk criticality by incorporating all the consequences of the risk in the network. The simulated global criticality of R i is defined by Equation ( 6):

[ ] [ ] [ ] GC i RF i CR i   (6)

Risk prioritization

In the process of PRM, risk prioritization is relied on to plan response actions. We simulate the risk propagation in the network to obtain different indicators for risk prioritization, such as the refined risk frequency and criticality. The prioritization results based on the re-evaluated indicators provide the project manager with a new understanding of risks and their relative severity in the project. The shift of risk prioritization also influences the planning of mitigation actions.

Sensitivity analysis

Uncertainties exist in the assessment phase of evaluating risks and risk interactions. The reliability of analysis results therefore needs to be considered. Sensitivity analysis regards the study of the behavior of a model to ascertain how much its outputs depend on the input parameters [START_REF] Saltelli | Sensitivity Analysis[END_REF]. In this respect, sensitivity analysis is performed to examine the effects of input uncertainties on the outputs. For example, we evaluate risks with three-level spontaneous probabilities (optimistic, most likely, and pessimistic value).

Depending on the varying input values, the corresponding criticality of each risk is obtained. Sensitivity analysis is a useful tool of DSS to verify the final ranking of the alternatives [START_REF] Mészáros | On sensitivity analysis for a class of decision systems[END_REF]. It helps to enhance the robustness of the system and the reliability of its managerial suggestions.

Mitigation action planning and test (phase 4)

In project risk management, mitigation is an important and common treatment strategy to reduce local or global risk exposure. Taking early action to reduce the probability and/or impact of a risk occurring on the project is often more effective than trying to repair the damage after the risk has occurred [START_REF] Pmi | A guide to the project management body of knowledge (PMBOK)[END_REF] propagation instead of risk occurrence. Strategies for mitigating risks in different categories are likely to be different. For example, risks without any input while leading to many outputs are likely to be source risks; risks with many inputs as well as many outputs can be considered as transition risks in a project; risks without output are accumulation risks, often related to project performance like schedule, cost or quality. In addition to the scope of local target on one or several specific risks, mitigation actions could also be proposed to achieve global effects on the risk network.

In the simulation model, different kinds of mitigation actions can be tested by changing the values of the parameters, so that the effects on a part of or on the global risk network can be observed. For a particular risk, classical mitigation action is conducted by giving the risk a lower spontaneous probability without considering its interactions with other risks. A complementary preventive action is cutting off the input links or reducing their transition probability. This strategy is compatible with the accumulation or transition risks. Instead of acting on a risk, the action focuses on the sources of this risk. For instance, the choice of suppliers and the communication plan are potential sources of many risks in the project, so that paying enough attention to these points at the beginning of the project may help to avoid many subsequent risks. Blocking the output links of a risk can be regarded as the action for confining its further propagation in the network. This is suitable for the source and transition risks. Instead of acting on the risk, the action focuses on its consequences. For instance, even if it is not possible (or would involve huge overcosts) to avoid a small delay in the delivery of a part in a civil engineering project, it is possible to negotiate a contract in which the penalties will begin at a higher threshold. We do not avoid this risk, since uncertainty is inherent in this work, but we implement an action to avoid its propagation and amplification to the rest of the project.

Risk network monitoring and control (phase 5)

Planned risk response actions are executed during the project, but their performance needs to be measured, in order to make sure that they have the desired effects on risks, while not inducing secondary effects. Moreover, the project, its environment and therefore the risks in the network, are continuously evolving. The status of the risk network should thus be continuously monitored throughout the project.

Risk network monitoring and control could result in periodic risk reviews, identification of new risks, and reporting on response action performance and any unanticipated effects. This phase provides feedback for the previous phases of the DSS. The project manager can use this information to modify the risk network structure and its parameters in phases 1 and 2, to update the risk analysis reporting in phase 3, and to amend the response plan in phase 4.

An illustrative example

In this section, we illustrate the application of our method to a project of staging a musical show in Paris, France. The project is the production of a family musical show, including costumes, lightning and sound design, casting management, rehearsal management, fund raising and overall project management.

The duration of the project is 15 months and the team is composed of 18 people, plus the actors and actresses. The following analysis shows the implementation and the results of the DSS in each phase of project risk management.

Phases 1 and 2: risk network modeling

The first action consisted in interviewing the persons directly involved in the project risk management process, namely the risk owners and the project manager. These participants were given a short background questionnaire on their experience in the organization and in this kind of project. They were also given a presentation of the method, including the analysis that will be made using the input data they were going to provide. To avoid potential differences among interviewers and their interviewing techniques, only one interviewer was used for all the interviews. Through the interviews and meetings we were able to perform the identification and assessment of risks and risk interactions. During the final meeting, the evaluations were exposed and discussed by all the participants. Some changes were made during the discussion and a consensus was reached at the meeting, which lasted about three hours. As a whole, three weeks were needed to build up the RNM.

In every identification process, there is a limit to the scope when considering risks inside or outside the project risk list. Downstream limits are generally the final expected project results, which may include immediate results like profit, delivery time or post-project results related to operation, maintenance or recycling phase. Upstream limits are generally decided depending on the influence or capacity of actions that the decision-makers have on these causes. The identification of risk interactions has been done on direct cause or effect relationship. In the end, the aggregation of local cause-effect relationships made it possible to display the global project risk network. This permitted us to organize a meeting where the interviewees had the possibility to add or remove nodes and edges in the risk network.

The assessment of risks was then performed using the 10-level qualitative scale; and the strength of risk interactions was assessed using a developed AHP-based method, as described in Section 3.2.2. Due to the high level of expertise of interviewees, this step was done quite quickly (for several hours, including the interviews and two meetings). In order to get the spontaneous probability, they supposed that none of the identified cause would occur and then they were asked: "what is the remaining probability of this event to occur?" Qualitative probability is converted into numerical probability through Equation ( 1), where the parameters are set as 5, 8

  by experience. The only difficulty was that it appeared easier for the risk owners to consider the interactions with causes that could affect them, than to consider the interactions with effects of their own actions and decisions. But this potential bias was fixed by the meetings and the simultaneous presence of the different correlated owners. This approach enabled us to get the consistency on both the existence and the assessment of each interaction, because the two involved owners (respectively for the cause and effect risks) were present.

The left part of Table 1 shows the risk names and their initial evaluated characteristics. Figure 4 displays the risk numerical matrix with evaluated transition probability of the risk interactions. For instance, in the (7,11)-th item of the matrix, the value 0.327 denotes that the transition probability from risk 11 (Bad scenic, lightning and sound design) to risk 7 (Cancellation or delay of the first performance) is 32.7%.

Even with a mix of individual and collective work, misjudgments are possible and the estimations remain uncertain or unreliable. This is all the more true that we are not in a context with lots of experience, where estimations could be considered as quite reliable. This is why we decided to run the sensitivity analysis, in order to consider the uncertainties on the inputs and their influence on the outputs.

This work is detailed at the end of Section 5.2.

Phase 3: risk network analysis

In the simulation, one important question is: "how many iterations are needed to reach a chosen level of precision of the results?" Reference [START_REF] Banks | Discrete-Event System Simulation[END_REF] gives some formulas that can be used to estimate a minimal number of iterations. While for our study, it is difficult to estimate a satisfactory number of iterations because it depends on the size and the complexity of the risk network (particularly the influence of loops).

However, we can still accomplish sufficient runs by increasing the number of iterations until the output, namely the simulated risk frequency, become stable enough.

In the case study, we increase the number of simulation iterations gradually from 1 000, 2 000, … , to 10 000. The criterion for evaluating the stability of the output is defined as the following equation:

2 1 [] n i RF i Threshold     (7)
where [] RF i  indicates the deviation of the simulated frequency of Risk i with the previous simulation.

The threshold is set to be 10 -6 in the test, which ensures that the output deviation with regard to each risk does not exceed 10 -3 . The criterion is always achieved after 6 000 iterations. For statistical and computational convenience, 10 000 iterations are conducted in each scenario of the risk network model.

The simulation time is not a limiting factor, since it costs less than 5 minutes for 10 000 iterations using the software ARENA on a normal PC.

The propagation behavior in the risk network is analyzed as discussed in Section 4. Eckert and co-authors defined (in the context of change propagation in design projects) the four following categories of risks: constants, absorbers, carriers and multipliers [START_REF] Eckert | Change and customisation in complex engineering domains[END_REF]. Some risks appear to be high accumulation risks, or "absorbers", notably the risks R10 (Low team communication) and R17 (Low cast motivation). This can be seen in Figure 4 with an important number of inputs (in rows) for these risks.

The changes on the risk occurrence assessment are visible in Tables 1 and2, both in the absolute value and in terms of ranking. The risks of this kind are unlikely to occur spontaneously, but some other identified risks may lead to them. Some risks have been moderately anticipated by the classical method, but they are still to some extent underestimated, such as R4 (Unsuitable cast) and R7 (Cancellation or delay of the first performance). Overall, a number of risks have increased occurrence frequency in varying degrees, which reflect their intensity of interactions in the network.

On the contrary, some risks engender many paths in the risk network. For example, R01 (Low budget), R02 (Infractions against law) and R10 (Low team communication) are called "multipliers" and they may be the original cause of numerous undesired effects. Their direct consequences (in columns) can be seen in Figure 4, but their global consequences in the network are only visible in Tables 1 and2, with the gap between classically evaluated impacts and simulated consequences of the risks. Among these risks, R02 and R10 are some of the "leverage points" which are initially underestimated with low impact, nevertheless they should be mitigated because they have a large potential to trigger other risks. R05

(Unsuitable ticket price-setting) is another example of the "leverage points", which does not have numerous direct outputs but has a high impact on some important risks like R01 (Low budget), with RNM(1,5)=0.770.

The risk prioritization results have changed after the simulation. Several risks have increased in the ranking in terms of frequency or criticality, while several other risks have decreased. For example, in the classical method, R03 (Low communication and advertising for the show) was considered to be the most critical risk, but the one with the highest simulated global criticality is R01 (Low budget). The value gap between risks has also changed. For example, R02 (Infractions against law) and R04 (Unsuitable cast) are evaluated with similar criticality. After re-evaluated by the simulation, R02 is still ranked above R04, and the relative gap between them has widened. This is the opposite situation for R05 (Unsuitable ticket pricesetting) and R10 (Low team communication): R10 is still behind R05, but closer.

Our focus is then what Eckert and co-workers defined as the "avalanches", i.e., the unpredictable propagation of initial events [START_REF] Eckert | Change and customisation in complex engineering domains[END_REF]. They and other co-authors also discussed some patterns defining local propagation motifs and defining relationships between two or three elements [START_REF] Giffin | Change propagation analysis in complex technical systems[END_REF]. We are focusing on more global patterns, which are potentially the combinations of the local ones, like long propagation chains, heterogeneous propagation chains and loops. In these three cases, the anticipation and then the decision-making are very hard, because of the difficulty to connect elements with different natures of risks, different actors, and different occurrence times.

Regarding the uncertainties of the estimated input values for the simulation, the spontaneous probability of each risk is assessed by the experts with three-level values: optimistic, most likely, and pessimistic, shown in Table 3. Sensitivity analysis is performed on the three-level values of spontaneous probability. Each risk has a dissimilar range of simulated global criticality, as shown in Figure 5. For example, R02 (Infractions against law) and R05 (Unsuitable ticket price-setting) have similar most likely values of criticality, but R05 has a larger potential range and thus it could be more unstable in the project. With respect to the risk prioritization, in all situations, R01 (Low budget) has higher simulated criticality than R02. Prioritized by the most likely value, R02 is superior to R03 (Low communication and advertising for the show); nevertheless, under certain circumstances, R03 will lead to higher impact and be more critical than R02.

Figure 5. Sensitivity analysis results of project risks

Phase 4: Mitigation actions planning and test

The simulation-based model allows the project manager to test the proposed actions before the implementation in order to get the anticipation of their impacts on the network. The presented examples of actions are to achieve two different goals: the local mitigation of particular risks, and the global risk exposure mitigation of the risk network. This is a prototype which does not take into account all the desired information about the action, including its cost and its difficulty or feasibility of implementation.

Local mitigation

In the simulation results of the case study (Table 2), we find that some risks had a significant increase in terms of frequency and ranking, such as R10 (Low team communication) and R17 (Low cast motivation). For mitigating their occurrence, there are different possible strategies, which are displayed in Table 4. In the first place, if we only apply classical actions by reducing their spontaneous probability to 0% (we suppose that the spontaneous probability can be reduced to 0% for the test in the prototype simulation model), R10 and R17 still have high simulated frequencies at the value of 0.516 and 0.468 respectively. In fact, the increase of simulated frequency is due to their input links from other risks. This explains why we design and test the non-classical actions on the risk interactions. By cutting several of their input links (links from R03, R04 and R07 to R10, and links from R03, R10 and R13 to R17), the frequency of these "absorber" risks has decreased a lot, shown in Table 4. For instance, acting on the transition between R13 (Low complicity between cast members) and R17 (Low cast motivation) may involve finding other motivation drivers which make the cast less sensitive to team complicity. This new action on the link is different from reducing the occurrence of R13, for example, by proposing teambuilding activities.

Global mitigation

With regard to the global risk network, R03 (Low communication and advertising for the show) has the highest evaluated criticality using the classical method. In the simulation analysis, R01 (Low budget) becomes the top risk in terms of global criticality. Some mitigation actions are devised and tested in the risk network model. Figure 6 compares their effects on the global risk network, i.e., the residual simulated frequency of all the risks after the action is conducted. Action 1 mitigates R03 according to the classical analysis; action 2 mitigates R01 based on the new prioritization by the simulation model; in the third action, a new action is executed by cutting the link from R05 (Unsuitable ticket price-setting) to R01 (Low budget), together with the classical action 2 on R01. Concretely, this could be done by increasing the part of the budget which comes from sponsorship and external investors, independently of the sales income.

The financial risk is then shared with different stakeholders. Even if the incomes from ticket presales are lower, this approach still ensures the normal operation of the project, while not to get the project stalled or to induce other risks for lack of funds. In this prototype model for mitigation actions test, we make the assumption that the risk interaction can be completely cut off, i.e., the transition probability can be reduced to 0%.

The results in Figure 6 demonstrate the effectiveness of applying the risk network model to support mitigation actions planning.

Phase 5: monitoring and control

The sensitivity analysis results demonstrate the impact of uncertainties in the assessment phase on the subsequent analysis phase. In addition, there exist potential changes in the project and uncertainties in the external environment as the project advances. Therefore, considering the reliability of the analysis results and the uncertainties in the later phases of the project, the risk network should be monitored after the implementation of actions, and the response plans will be modified and improved. With regard to the current example, this study took place at the end of the project in order to verify the usefulness of the developed prototype of DSS. The application of the monitoring phase will be included in future real-time case studies.

Conclusions and perspective

This paper has presented an interactions-based risk network model using advanced simulation. The model addresses the limitations of current methods regarding modeling complexity in project risk management. The performance of the model and the satisfaction of the users are validated by the project manager and the associated experts with whom we cooperated for the application to a real musical show project. The DSS enables the project manager to save time for designing risk response plan, and to reduce the cost of dealing with contingencies. Proactive risk management can be achieved by monitoring the status of the risk network and adjusting the risk mitigation plan as the project progresses.

The integrated DSS framework provides the project manager with a structured procedure and a series of methods to model, analyze and control the risk network. The project manager and the team of experts are involved throughout the whole process of the DSS to construct the risk network model and decide the risk response plans. Through modeling the propagation behavior in the project risk network, the model enables the project manager to gain innovative insights into the risks, into the relationships between them, and into the global risk network behavior. The refined risk analysis and prioritization results support the project manager in making decisions, for instance, re-assigning the risk ownership and planning more effective mitigation actions. The model is also useful for testing and evaluating the proposed action plans.

In addition to the examples of actions tested in Section 5.3, a complete list of mitigation actions is proposed to the project manager based on the DSS. The project manager is able to choose a portfolio of actions to manage the project risks.

The selected case study analyzes a number of typical risks in a project of staging a musical show.

Moreover, the approach manipulates values of risks and risk interactions, independently of their nature, their number and the type of project. In the risk management of any kind of project, generally risks are all assessed in terms of probability and impact, which are here included in the simulation model. This is why the approach can be generalized and applied to a much wider set of projects. Since the model uses matrixbased and simulation-based methods, the approach is possible to be applied in some very complex situations.

There are some limitations and potential extensions of the model. Although the identified risk interactions are assumed to be independent in this study, sometimes the effect of an interaction is influenced by other related interactions. To address this limitation, more identification work about crossimpact between risk interactions by experts and decision-makers is required. In the future work, more parameters like cost of actions will be included so that the mitigation plan can be optimized under resource constraints. Risks with positive effects in the network will be considered, such as risks with positive impact or so-called opportunities like surplus budget and some conditions like good team communication which may mitigate some other negative risks. In addition, risk lifecycles should be registered, so that outdated risks will be deleted in the network structure during the monitoring and control phase. The effectiveness of the model also depends on the validity of the input estimations. At the end of Section 5.2, we performed a preliminary sensitivity analysis on the three-level estimations of risk spontaneous probability, demonstrating the influence of input uncertainties on the risk analysis results.

Reference [START_REF] Aven | Some considerations on the treatment of uncertainties in risk assessment for practical decision making[END_REF] discusses the challenges involved in the representation and treatment of uncertainties in risk assessment, with regard to decision support. This provides some guidance for our future work on the modeling of input assessment uncertainties and their propagation in the risk network for project risk management. The DSS will be applied to projects in different industries and with different levels of complexity.

 Step 3 : Step 4 :

 34 Calculating the eigenstructures Eigenvectors of each matrix ECM|R i and CCM|R i are now calculated. It enables one to find the principal eigenvectors, corresponding to the maximal eigenvalue. They are called Numerical Cause or Effect Vectors and are relative to one risk R i (NCV i and NEV i ). The consistency of the results should be tested thanks to the AHP consistency index. Aggregating the eigenvectors For each risk R i , Numerical Cause or Effect vectors (NCV and NEV) are respectively aggregated into

Figure 4 .

 4 Figure 4. Risk numerical matrix of the project

Figure 6 .

 6 Figure 6. Comparison of effects on the global risk network by applying different mitigation actions

  . In classical methods, courses of action are carried out on risks having the highest ranking or priority, in other words, on risks with the highest criticality. These actions are in practice, for instance, internal or external communication actions, training of members, buying additional or superior material resources, choosing a cheaper, more stable or closer supplier, or increasing the number of tests. Mitigation actions always consume time, money and resources. It requires a leader, or at least one project member accountable for them. They should be included in the project plan like every action contributing to the delivery of the project result.

Based on the simulation analysis of the risk network, we get the risk re-evaluation and new prioritization results. Hence, a new risk response plan can be developed. The new actions include:

[START_REF] Adla | A cooperative intelligent decision support system for boilers combustion management based on a distributed architecture[END_REF]

classical mitigation actions, but applied to risks with re-evaluated values and rankings (simulated values may be different from initial estimated values); (2) non-classical mitigation actions, which mitigate risk

Table 1 ,

 1 we consolidate the re-evaluation results of risks, and compare them with the results of classical method.

1.1 and 4.1.2. In

Table 1 .

 1 Project risk list and the comparison of re-evaluated simulation results with those of classical method Based on the results in Table 1, risks are prioritized by different indicators, shown in Table 2. It gives a different insight on risk priorities due to the changes in risk evaluations and risk rankings.

				Evaluation Results by Classical Method	Re-Evaluation Results by Simulation
	Risk ID	Risk Name	Nature	Qualitative Probability (Evaluated)	Spontaneous Probability (Eq (1))	Qualitative Impact (Evaluated)	Qualitative Criticality (QP*QI)	Evaluated Criticality (SP*QI)	Simulated Frequency (Statistic)	Consequences of Risk (Eq (4))	Simulated Local Criticality (Eq (5))	Simulated Global Criticality (Eq (6))
	R01 Low budget	Cost and time	8	0.500	7	56	3.50	0.807	32.07	5.65	25.88
	R02 Infractions against law	Contract	7	0.360	5	35	1.80	0.696	17.46	3.48	12.15
	R03	Low communication and advertising for the show	User/customer	8	0.500	9	72	4.50	0.771	12.36	6.94	9.53
	R04 Unsuitable cast	Organization	5	0.126	9	45	1.13	0.495	15.53	4.45	7.69
	R05 Unsuitable ticket price-setting Strategy	7	0.360	6	42	2.16	0.364	31.19	2.18	11.36
	R06	Unsuitable rehearsal management	Controlling	3	0.011	8	24	0.09	0.266	13.89	2.13	3.69
	R07	Cancellation or delay of the first performance	Cost and time	5	0.126	8	40	1.01	0.425	15.40	3.40	6.55
	R08 Poor reputation	User/customer	3	0.011	7	21	0.08	0.388	8.73	2.72	3.39
	R09	Lack of production teams organization	Organization	4	0.050	6	24	0.30	0.049	17.62	0.29	0.85
	R10 Low team communication	Organization	3	0.011	6	18	0.07	0.529	19.11	3.18	10.11
	R11	Bad scenic, lightning and sound design	Technical performance	2	0.001	7	14	0.01	0.393	12.07	2.75	4.75
	R12 Bad costume design	Technical performance	3	0.011	8	24	0.09	0.400	13.50	3.20	5.40
	R13	Low complicity between cast members	Technical performance	3	0.011	7	21	0.08	0.383	13.94	2.68	5.34
	R14	Too ambitious artistic demands compared to project means	Requirements	7	0.360	2	14	0.72	0.445	7.88	0.89	3.51
	R15	Few spectators / Lukewarm reception of the show	User/customer	2	0.001	9	18	0.01	0.196	15.88	1.76	3.11
	R16	Technical problems during a performance	Technical performance	4	0.050	5	20	0.25	0.191	7.07	0.96	1.35
	R17 Low cast motivation	Organization	2	0.001	4	8	0.00	0.469	8.63	1.88	4.05
	R18 Unsuitable for family audiences Strategy	2	0.001	5	10	0.01	0.002	7.84	0.01	0.01
	R19 Low creative team leadership Controlling	3	0.011	10	30	0.11	0.014	17.43	0.14	0.24
	R20 Low creative team reactivity	Controlling	2	0.001	2	4	0.00	0.001	7.91	0.00	0.01

Table 3 .

 3 Evaluated three-level values of risk spontaneous probability

	Risk ID	Optimistic	Spontaneous Probability Most Likely	Pessimistic
	R01	0.450	0.500	0.950
	R02	0.100	0.360	0.600
	R03	0.350	0.500	0.650
	R04	0.010	0.126	0.200
	R05	0.250	0.360	0.700
	R06	0.005	0.011	0.200
	R07	0.010	0.126	0.150
	R08	0.010	0.011	0.100
	R09	0.010	0.050	0.200
	R10	0.010	0.011	0.050
	R11	0.001	0.001	0.020
	R12	0.005	0.011	0.020
	R13	0.005	0.011	0.100
	R14	0.100	0.360	0.900
	R15	0.000	0.001	0.100
	R16	0.045	0.050	0.070
	R17	0.000	0.001	0.050
	R18	0.000	0.001	0.002
	R19	0.005	0.011	0.012
	R20	0.000	0.001	0.002

Table 4 .

 4 Effects of different mitigation actions on particular risks

	Risk ID	Simulated Risk Frequency	Simulated Frequency after Taking Action Classical Mitigation New Mitigation Actions on Risks Actions on Risk Interactions
	R10	0.529	0.516	0.194
	R17	0.469	0.468	0.205

Acknowledgements

The authors acknowledge Dr. Ludovic-Alexandre Vidal for his help on the case study. We are also grateful to the anonymous referees for their valuable comments and suggestions.