Risk–Response Budgeting: A Financial Optimization Approach to Project Risk Management

Abstract

Projects are exposed to risks that may hinder their success regarding cost, schedule, and quality/content. After identifying these risks, the project manager must select a subset for mitigation, constrained by a limited risk response budget. The problem lies in the uncertainties surrounding risk realization, their impact on the project’s parameters, and the outcomes of the risk response plan. This paper proposes a method for allocating the risk–response budget to mitigate project risks. The method begins with a Monte Carlo simulation to assess each risk’s impact and residual impact post-mitigation. These simulation results are the input for mathematical programming calculations, determining the optimal budget allocation among the risks based on various objective functions (e.g., maximizing expected net savings or minimizing variance). Each objective function can yield a different optimal budget allocation, so the final step involves weighing all results to make a conclusive decision. A case study illustrates the proposed method.

1. Introduction

Risk management is vital in achieving a project’s objectives, particularly given the complex nature of projects, which usually involve numerous risks relevant to the various stakeholders (Wu & Zhou, 2019). Project risk management is usually carried out according to project management standards, some listed in Barghi and Sikari (2020). The best-known standard is the Project Management Body of Knowledge (PMBOK) (PMI, 2021), which consists of nine areas of knowledge for successful project management. One of those is risk management. According to the PMBOK, risk management is the process of identifying, analyzing, evaluating, and responding to a project’s risks.

Existing risk–response budgeting methods, such as Monte Carlo simulation, Decision Tree Analysis, and the Risk-Based Project Value (RPV) framework, offer valuable quantitative approaches but have notable limitations. Monte Carlo simulation (Cochrane, 1992; PMI, 2021) effectively models probabilistic uncertainties but lacks direct guidance for optimal budget allocation at the individual risk level, making it unsuitable for preventive decision-making (Sato & Hirao, 2013). Decision Tree Analysis (Matsubara, 2001) provides structured decision-making based on expected value calculations, but its applicability is constrained by exponential complexity in large-scale projects, leading to impractical decision trees. The RPV framework (Sato & Hirao, 2013) optimizes budget allocation by assessing marginal cost trade-offs; yet, it does not fully integrate multi-criteria risk assessment or account for interdependencies between risks.

It is well known that managing risks and planning responses to them are important factors in a project’s success. A plan for responding to a project’s risks should be drawn up once the risks have been identified and analyzed. If the response to a risk is other than acceptance or wait-and-see, the project manager should prioritize the risks that will receive a response, given that there is only a finite budget for providing risk response. The most common method of prioritizing risks is a probability and impact matrix. In such a matrix, a score is determined for each identified risk, which reflects the likelihood of its occurrence, usually on a scale of 1–5, and a score indicating its negative impact on the project, using the same scale. Multiplying the likelihood of occurrence by the impact scores yields the risk’s severity score and its priority in receiving a response. However, a risk’s scores for occurrence and impact are random variables rather than a single average value as defined by the matrix. Moreover, the potential outcomes of the risk response are also random variables. Finally, the budget that is allocated according to the severity score does not guarantee that the finite budget for risk response will minimize the project’s total risk. For example, the entire budget might be invested in mitigating only one risk due to its severity, while allocating the budget among other risks would yield a higher benefit to the project.

A new method is proposed here for allocating a finite risk response budget. The method comprises a number of stages: identification of the project risks using best practices; analysis of the risks in order to assess their potential impact on the project’s cost, schedule, and quality, in addition to their likelihood of occurrence; devising risk responses and evaluating their cost and residual impact; a Monte Carlo simulation to gauge risk impacts and residual post-response effects; mathematical programming to allocate the budget optimally across risks, subject to the various objectives, such as maximization of expected saving and minimization of total variance; and finally, the aggregation and weighting of the results in order to make the final decision.

The primary research gap that our paper addresses is the lack of a holistic approach that integrates preventive and reactive risk management strategies while considering multiple decision criteria beyond expected value. To bridge this gap, our approach combines Monte Carlo simulation, integer linear programming (ILP) optimization, and multi-criteria decision-making, enabling a more robust, flexible, and computationally efficient risk–response budgeting strategy. This method ensures that budget allocation decisions account for risk reduction effectiveness and cost-efficiency, providing project managers with a practical, data-driven framework to enhance decision-making under uncertainty.

The rest of the paper is organized as follows. Section 2 provides a literature review. Section 3 presents the proposed method. Section 4 presents the criteria for allocating a finite risk–response budget. Section 5 presents a case study, and Section 6 is a summary.

2. Literature Review

Project risks are uncertain events or conditions that can adversely affect a project’s outcome, schedule, cost, or quality (PMBOK Guide, PMI, 2021; Benek & Yazici, 2024). There are numerous methods of risk management, including PERT networks, probability-impact risk matrices, Pareto diagrams, stochastic simulation models, decision trees, Failure Mode and Effects Analysis (FMEA), System Dynamics models, and sensitivity analysis (PMI, 2021; Muriana & Vizzini, 2017), each of which has its advantages and disadvantages. Project risk management, which is a relatively young scientific field (Aven, 2016), has evolved significantly with advances in theoretical frameworks, models, and practical approaches. Komarek et al. (2020) claimed that a positive expected return is usually one of the benefits of taking risks.

Effective project risk management seeks to identify and prioritize risks. George (2020) highlighted the challenge of risk identification by noting that project managers often focus on mitigating known risks while neglecting unknown ones. Willumsen et al. (2019) pointed out that the perceived value of risk management can be subjective in complex project environments. Kutsch et al. (2014), Lehtiranta (2014), and Oehmen et al. (2014) emphasized that organizations often struggle to create value using risk management practices, which can become disconnected from stakeholders’ actual needs if overly formalized (Olechowski et al., 2012). Kwon and Kang (2019) propose a method for estimating project budget reserves for identified and unidentified risks, addressing existing approaches’ gaps.

In Monte Carlo simulation, project parameters are iterated multiple times with variable input values chosen randomly from probability distributions (PMI, 2021). Though this type of simulation is primarily used for schedule and cost management, it is also a valuable risk management tool (Avlijaš, 2019). It can help estimate the probability functions of risks and their impact on cost, time, and quality (Platon & Constantinescu, 2014). Kantianis (2023) developed an approach for finding a practical solution to stochastic crash problems based on combining traditional network scheduling, Monte Carlo simulation, and linear programming. Tabejamaat et al. (2024) stressed the inherent uncertainty of projects and the need for effective risk assessment and management strategies.

Sato and Hirao (2013) considered the challenge of correctly allocating a project’s budget among its critical risks and proposed mathematical models to optimize budget allocation to maximize project value. Zhang and Guan (2021) integrated fault tree analysis and optimization models into the budget allocation process, with emphasis on the minimization of risk subject to budget constraints. Given a project’s characteristics and constraints, Guan et al. (2021) developed models to allocate budgets effectively between risk prevention and risk protection.

Guan et al. (2023) highlighted the importance of budget allocation in project risk management and proposed an optimization model based on fault tree analysis. Various studies have explored optimization methods for risk response, focusing on the maximization of response effects (Fang et al., 2013; Zhang & Fan, 2014; Todinov, 2013, 2014), the minimization of response costs (Fan et al., 2008), or the maximization of expected utility (Zhang & Zuo, 2016). Ben-David and Raz (2001) and Kuo et al. (2019) proposed minimizing total risk cost. The methods above are commonly subject to constraints related to budget, accepted loss, project duration, and quality (Kayis et al., 2007; Zhang & Fan, 2014; Zuo & Zhang, 2018). Guan et al. (2023) emphasized that the quality of optimization solutions depends on the reliability of the input data.

Xie (2010) presented a model-driven decision support system for risk analysis in product development. His model simulates the life cycle of a large batch of products and tracks products in operation and service phases. Da Silva et al. (2022) identified critical variables for defect occurrence, constructed empirical functions for two response variables, modeled uncertainties using triangular probability functions, and performed optimization via Monte Carlo simulation to achieve the best fit.

3. The Proposed Method

Project risks are uncertain events or conditions that, if they occur, can positively or negatively affect project objectives (PMI, 2021). These risks can influence project costs, schedules, or overall performance, requiring effective strategies to minimize their impact (Hillson, 2002). Mitigation variables are actions taken to reduce the likelihood or consequences of risks, such as contingency planning, resource reallocation, or additional funding for critical tasks (Aven, 2016).

Our model starts with a Monte Carlo simulation to assess the impact of risks on the project, both with and without risk–response measures. Experts provide estimates for the simulation parameters. The simulation results then serve as inputs for integer linear programming (ILP) and multi-criteria decision-making, which allocate a finite risk–response budget efficiently, taking into account both preventive and reactive mitigation strategies.

Below, we present the key variables in our model framework to ensure an optimal balance between cost and risk mitigation.

$P_{\mathit{max},j}$—The maximum probability that the $j$-th risk would occur. It is used to model the worst-case scenario for the risk occurrence. This value is typically determined based on historical data or expert opinion;

$P_{\mathit{min},j}$—The minimum probability that the $j$-th risk would occur. It is used to model the best-case scenario for the risk occurrence. This value is typically determined based on historical data or expert opinion;

$S_{\mathit{max},j}$—The maximum possible impact or severity of the $j$-th risk, if it would occur. For example, this might include the maximum possible additional cost or time delay that could occur due to the risk;

$S_{\mathit{min},j}$—The minimum possible impact or severity of the $j$-th risk, if it would occur. For example, this might include the minimum possible additional cost or time delay that could occur due to the risk.

The model also incorporates other relevant parameters:

$C_j$—Estimated cost for risk response and mitigating the impact of the $j$-th risk;

$\alpha$—a probability that an impact would exceed a benchmark.

The proposed method comprises several stages:

Stage 1—Risk identification according to best practices;

Stage 2—Risk analysis according to best practices. The output of this stage is a list of risks that can potentially be mitigated by a risk response, which typically includes an investment of resources. The risks are denoted by $R_j,j=1,2,\dots ,n.$;

Stage 3—Simulate a random impact for each risk $R_j$. Each risk may have a negative impact on the project according to the following three success factors: cost $\left(i=1\right)$, time $\left(i=2\right)$, and quality $\left(i=3\right)$. The impact of each factor is a random variable whose expected value and variance can be obtained by a three-point estimation. Three-point estimation is a widely used technique in project management for estimating uncertain values, especially in cost and schedule forecasting. It is based on three main estimates: Optimistic estimate (a) the best-case scenario with minimal risk and no delays. Most likely estimate (m) the most likely outcome based on current conditions and historical data. Pessimistic estimate (b) the worst-case scenario, which takes into account potential risks and disruptions. This method is commonly implemented within the Program Evaluation and Review Technique (PERT) (Malcolm et al., 1959; Kerzner, 2022), in which the expected value of an estimate is calculated using the following weighted average formulas. The estimator for expected value (denoted E): $E={\displaystyle \frac{a+4m+b}{6}}$ and the estimator for variance (denoted Var)$Var={\left({\displaystyle \frac{b-a}{6}}\right)}^2.$

By incorporating uncertainty into estimates, the three-point estimation method improves the accuracy of project planning and risk assessment (PMI, 2021). This helps reduce biases associated with point estimates and supports better decision-making in project management.

According to the adjusted equations to our case:

$$E_{i,j}={\displaystyle \frac{a_{i,j}+4m_{i,j}+b_{i,j}}{6}},{\mathit{Var}}_{i,j}={\left({\displaystyle \frac{b_{i,j}-a_{i,j}}{6}}\right)}^2$$

(1)

where $a_{i,j},$ is the optimistic (low) negative impact associated with the factor $i$ of risk $R_j$, $m_{i,j},$ is the most likely impact and $b_{i,j},$ is the pessimistic (high) impact of each risk based on expert judgment.

In order to simulate the random impact of $R_j$, given that it has been realized, three random results are generated, one for each factor. For the $k$th Monte Carlo simulation, $k=1,2,\dots ,K$, these values can be easily simulated by Excel “Inverse Normal” based on Equation (2) below. The term $x$ represents a random variable uniformly distributed between 0 and 1, and its value is different whenever generated.

$$z_{i,j,k}=NORM.INV\left(x,E_{i,j},Va{r}_{i,j}\right)i=1,2,3.$$

(2)

where x is a random variable distributed between 0 and 1, which receives a different value in each simulation.

The $k$th random impact of $R_j$ over the three dimensions given that the risk has been realized is given by: ${\displaystyle \sum _{i=1}^3{z}_{i,j,k}}$;

Stage 4—Simulate the occurrence probability of $R_j$ (denoted as $P_j$) which is also a random variable, such that $\left(P_{\mathit{min},j}\le P_j\le P_{\mathit{max},j}\right)$ where the bounds, $P_{\mathit{min},j}$ and $P_{\mathit{max},j}$ can be estimated based on expert judgment. Intuitively, providing an occurrence probability range rather than a single value is likely easier. It is important to preserve this range rather than use an average probability of risk occurrence since the probability range affects the variance of the risk impact.

For the $k$th Monte Carlo simulation, the random occurrence probability $P_{j,k}$ is calculated according to the following equation:

$$P_{j,k}=x\cdot \left(P_{\mathit{max},j}-P_{\mathit{min},j}\right)+P_{\mathit{min},j}$$

(3)

Stage 5—Estimate the average weighted impact of each risk $R_j$ as defined by $L_{j,0,k}=P_{j,k}{\displaystyle \sum _{i=1}^3{z}_{i,j,k.}}$ Therefore, the average impact of $R_j$ and its variance over K simulations are calculated by the following two equations, respectively:

$$L_{j,0}={\displaystyle \frac{1}{K}}{\displaystyle \sum _{k=1}^K{P}_{j,k}{\displaystyle \sum _{i=1}^3{z}_{i,j,k}}}={\displaystyle \frac{1}{K}}{\displaystyle \sum _{k=1}^K{L}_{j,0,k}}j=1,2,\dots ,n.$$

(4)

$${Var}_{j,0}={\displaystyle \sum _{i=1}^K\frac{{\left(L_{j,0,k}-L_{j,0}\right)}^2}{K}},j=1,2,\dots ,n.$$

(5)

Stage 6—Calculate the residual impact of the risk following a risk response. To mitigate the negative impact of $R_j$, the project manager can invest resources in a risk response. However, the mitigation rate is also a random variable whose value ranges between the bounds $S_{\mathit{min},j}$ and $S_{\mathit{max},j}$, which can be estimated by experts. For the kth simulation, the random mitigation rate $S_{j,k}$ is calculated as follows:

$$S_{j,k}=x\cdot \left(S_{\mathit{max},j}-S_{\mathit{min},j}\right)+S_{\mathit{min},j}$$

(6)

The weighted impact of $R_j$ in the kth simulation, following a risk response, is given by $L_{j,1,k}=L_{j,0,k}\left(1-S_{j,k}\right).$ Therefore, the average residual impact of $R_j$ and its variance over K simulations and its variance following a risk response are calculated by the following two equations, respectively:

$$L_{j,1}={\displaystyle \frac{1}{K}}{\displaystyle \sum _{k=1}^K{L}_{j,1,k}},j=1,2,\dots ,n.$$

(7)

$${Var}_{j,1}={\displaystyle \sum _{i=1}^K\frac{{\left(L_{j,1,k}-L_{j,1}\right)}^2}{K}},j=1,2,\dots ,n.$$

(8)

4. Criteria for Allocating a Finite Risk–Response Budget

Here are various criteria that can be objective functions.

4.1. Maximizing Net Expected Saving

As mentioned, the term $L_{j,0}$ is the average impact of $R_j$ without a risk response and $L_{j,1}$ is its average mitigated impact. The expected saving generated by the risk response to $R_j$ is ${\overline{u}}_j=L_{j,0}-L_{j,1}.$ The cost of mitigating $R_j$ is $C_j$ and the total budget for risk response for all risks is denoted by B. We define $Y_j$ as a binary variable whose value is 1 if $R_j$ is mitigated and 0 if it is not. To find the response plan that maximizes the project’s net expected savings, subject to a risk response budget, the following binary linear programming problem is solved:

$$\begin{array}{l}Max{\displaystyle \sum _{j=1}^n{Y}_j\times {\overline{u}}_j}-{\displaystyle \sum _{j=1}^n{Y}_j\times C_j}\\ s.t.\\ {\displaystyle \sum _{j=1}^n{Y}_j\times C_j\le B}\\ Y_j=0,1j=1,2,\dots ,n.\end{array}$$

(9)

4.2. Maximizing Expected Saving

The maximization problem (9) does not allow for investment in risk response if the net result is negative. In other words, if $\left({\overline{u}}_j<C_j\right)$, then $R_j$ would not obtain a response, even if there is an unused budget. However, decision-makers tend to invest in risk response even if the expected value of their action is negative (e.g., insurance). To overcome this drawback, here is a modified model:

$$\begin{array}{l}Max{\displaystyle \sum _{j=1}^n{Y}_j\times {\overline{u}}_j}\\ s.t.\\ {\displaystyle \sum _{j=1}^n{Y}_j\times C_j\le B}\\ Y_j=0,1j=1,2,\dots ,n\end{array}$$

(10)

4.3. Minimizing the Variance

If the risks are statistically uncorrelated, then their impact on the project before any risk response measures is a random variable with an expected value of ${\displaystyle \sum _{j=1}^n{L}_{j,0}}$ (the sum of the expected impacts of all the risks) and variance of ${\displaystyle \sum _{j=1}^n{Var}_{j,0}}$ (the sum of the variances of all the risks). Given that a higher variance represents a higher risk, another goal might be to minimize the variance of the total impact of the risk response.

If $R_j$ receives a risk response, its variance changes from ${Var}_{j,0}$ to ${Var}_{j,1}$, which will also change the total variance of its impact on the project. Typically, a risk response reduces the expected impact of a risk and the variance of its residual impact. However, this is not a necessary outcome. To find the response plan that minimizes the project’s total variance subject to a finite risk–response budget, the following binary linear programming problem is solved. The variables $X_j,Y_j$ are binary, such that $X_j+Y_j=1.$ Thus, if the risk $R_j$ receives a response, then $X_j=0,Y_j=1$; if it does not, then $X_j=1,Y_j=0.$

$$\begin{array}{l}Min{\displaystyle \sum _{j=1}^n\left(X_j\times {Var}_{j,0}+Y_j\times {Var}_{j,1}\right)}\\ s.t.\\ {\displaystyle \sum _{j=1}^n{Y}_j\times C_j\le B}\\ X_j+Y_j=1j=1,2,\dots n.\\ X_j,Y_j=(0,1)j=1,2,\dots n.\end{array}$$

(11)

4.4. Minimizing the Probability of an Impact That Exceeds a Benchmark

Assume that the initial potential impact of risk $R_j$ is normality distributed with mean $L_{j,0}$ and variance ${Var}_{j,0}$. After the risk response, the impact of $R_j$ is normality distributed with $L_{j,1}$ and ${Var}_{j,1}$. If the risks are statistically uncorrelated, then their total impact on the project before taking any risk response is a random variable with an expected value of ${\displaystyle \sum _{j=1}^n{L}_{j,0}}$ and variance of ${\displaystyle \sum _{j=1}^n{Var}_{j,0}}.$

If the goal of the risk response is to minimize the probability that the random total impact on the project, denoted $L,$ exceeds a given benchmark impact value, denoted by $a$; then, the objective function is to minimize the probability $P\left(L>a\right).$ This probability can be written as: $P\left(L>a\right)=1-P\left(L\le a\right)=1-P\left(z\le {\displaystyle \frac{a-{\displaystyle \sum _{j=1}^n{L}_{j,0}}}{\sqrt{{\displaystyle \sum _{j=1}^n{Var}_{j,0}}}}}\right),$ where $z$ is a standard normal random variable. Following the risk response, this probability becomes: $P\left(L>a\right)=1-P\left(z\le {\displaystyle \frac{a-\left({\displaystyle \sum _{j=1}^n{X}_j\times L_{j,0}}+{\displaystyle \sum _{j=1}^n{Y}_j\times L_{j,1}}\right)}{\sqrt{{\displaystyle \sum _{j=1}^n\left(X_j\times {Var}_{j,0}+Y_j\times Va{r}_{j,1}\right)}}}}\right),$ where $X_j,Y_j$ are binary variables, such that $X_j+Y_j=1,$ Thus, if the risk $R_j$ receives a response, then $X_j=0,Y_j=1,$ and if it does not, then $X_j=1,Y_j=0.$ To minimize $P\left(L>a\right),$ the following optimization problem should be solved:

$$\begin{array}{l}Max{\displaystyle \frac{a-\left({\displaystyle \sum _{j=1}^n{X}_j\times L_{j,0}}+{\displaystyle \sum _{j=1}^n{Y}_j\times L_{j,1}}\right)}{\sqrt{{\displaystyle \sum _{j=1}^n\left(X_j\times {Var}_{j,0}+Y_j\times {Var}_{j,1}\right)}}}}\\ s.t.\\ {\displaystyle \sum _{j=1}^n{Y}_j\times C_j\le B}\\ X_j+Y_j=1j=1,2,\dots n.\\ X_j,Y_j=(0,1)j=1,2,\dots n.\end{array}$$

(12)

Note that the objective function of (12) is non-linear and finding the optimal solution will require a searching tool such as Excel-Solver.

4.5. Minimizing the Maximum Regret

Savage (1954) was one of the first to use regret in decision-making, and regret models were later developed by Bell (1982) for decision-making under uncertainty. Regret is defined as the difference between the payoffs obtained from the best decision that could be made if the state of nature were known in advance and those obtained from the actual decision. Since decision-makers wish to avoid regret, they prefer the decision with minimal potential regret.

The regret for not implementing a risk response in the simulation k is given by $Max\left((L_{j,0,k}-L_{j,1,k}-C_j),0\right),k=1,\dots ,K.$ The maximum regret for not implementing a risk response to $R_j$ over the K simulations is given by $MR{g}_j=\underset{k}{Max}\left(Max\left((L_{j,0,k}-L_{j,1,k}-C_j),0\right)\right),k=1,\dots ,K.$ Conversely, if $R_j$ did receive a risk response and the risk was not realized, then the regret would be $C_j$. To find a response plan that minimizes the sum of the maximum regret over all risks subject to a finite risk–response budget, the following binary linear programming problem is solved:

$$\begin{array}{l}Min{\displaystyle \sum _{j=1}^n{X}_j\times MR{g}_j}+{\displaystyle \sum _{j=1}^n{Y}_j\times C_j}\\ s.t.\\ {\displaystyle \sum _{j=1}^n{Y}_j\times C_j\le B}\\ X_j+Y_j=1j=1,2,\dots n.\\ X_j,Y_j=(0,1)j=1,2,\dots n.\end{array}$$

(13)

4.6. The Minimax Criterion

The minimax criterion was first suggested by Savage (1954). The objective of the minimax criterion is to minimize the maximum possible loss that can be incurred in the worst-case scenario or outcome. In the current context, the worst impact that results from $R_j$ in K simulations in the absence of a risk response is given by $\underset{k}{Max}\left\{L_{j,0,k}\right\},k=1,\dots ,K.$ while in the case of a risk response, it is given by $\underset{k}{Max}\left\{L_{j,1,k}+C_j\right\},k=1,\dots ,K.$ To find a response plan that minimizes the sum of the worst-case impacts for any decision, the following binary linear programming problem is solved:

$$\begin{array}{l}Min{\displaystyle \sum _{j=1}^n{X}_j\times \left(\underset{k}{Max}\left\{L_{j,0,k}\right\}\right)}+{\displaystyle \sum _{j=1}^n{Y}_j\times \left(\underset{k}{Max}\left\{L_{j,1,k}\right\}+C_j\right)}\\ s.t.\\ {\displaystyle \sum _{j=1}^n{Y}_j\times C_j\le B}\\ X_j+Y_j=1j=1,2,\dots n.\\ X_j,Y_j=(0,1)j=1,2,\dots n.\end{array}$$

(14)

A feasible solution to problems (9)–(14) always exists, as the trivial solution where all risks receive zero mitigation budget (i.e., $Y_i=0\forall i$) satisfies all constraints. Moreover, if the total budget is sufficient to cover the mitigation cost of at least one risk, it is always possible to allocate the budget entirely to that risk while assigning zero to all others. This is also a feasible solution since it adheres to the budget constraint. While feasibility is ensured, optimality is not necessarily guaranteed. Since the problem is formulated as an integer linear programming (ILP) model, solving it optimally can be computationally challenging, particularly for large-scale instances, as ILP is classified as NP-hard (Karp, 1972; Nemhauser & Wolsey, 1988). However, various optimization techniques and heuristics can efficiently obtain near-optimal solutions in practical applications.

All the criteria used in this paper are well-known and widely used in the literature.

Table 1. Summary of the criteria.

Criterion	Description	Reference	Best Use Case
Maximizing Net Expected Saving	Maximizes the difference between expected cost savings and mitigation costs.	Hertz (1964)	When cost–benefit trade-offs must be considered in budget-constrained projects.
Maximizing Expected Saving	Focuses on maximizing absolute expected savings without considering cost.	Aven (2016)	When maximizing potential savings is the top priority, regardless of mitigation cost.
Minimizing Variance	Reduces uncertainty in project outcomes by ensuring stable cost savings.	Markowitz (1952)	Risk-averse organizations prioritize financial stability and predictability.
Minimizing the Probability of Exceeding a Benchmark	Limits the likelihood of extreme financial losses or schedule overruns.	Kaplan and Garrick (1981)	When compliance, safety, or regulatory thresholds must not be exceeded.
Minimizing Maximum Regret	Reduces worst-case deviation from the optimal decision, minimizing future regret.	Savage (1954)	When decision-makers face uncertainty and wish to balance flexibility with risk reduction.
Minimax Criterion	Minimizes the worst possible loss, ensuring robustness against worst-case scenarios.	Wald (1945)	In highly uncertain environments where extreme risks (e.g., cybersecurity, disaster planning) must be mitigated.

summarizes the criteria, their descriptions, references, and best use cases.

4.7. Allocating a Finite Risk–Response Budget

Each of the methods presented in Section 4.3 can yield a different solution, which implies a different set of risks for risk response. Therefore, decision-makers face several choices. The first is to choose the method that best represents their preferences. The second is to weigh the possible solutions offered by some or all of the methods, in which case the number of times each risk is selected for a risk response must be decided on (ranging from zero up to the number of methods chosen by the decision-maker). If $R_j$ receives a risk response according to method $m,\left(m=1,\dots ,M\right)$, then $S_{j,m}=1$; otherwise, $S_{j,m}=0$. The term $S_j={\displaystyle \sum _{m=1}^M{S}_{j,m}}$ is the number of methods in which $R_j$ receives a risk response. To find the response plan that weights the results of the various methods subject to a finite risk–response budget, the following binary linear programming problem is solved:

$$\begin{array}{l}Max{\displaystyle \sum _{j=1}^n{Y}_j\times S_j}\\ s.t.\\ {\displaystyle \sum _{j=1}^n{Y}_j\times C_j\le B}\\ Y_j=0,1j=1,2,\dots ,n.\end{array}$$

(15)

A critical limitation of risk assessment in our proposed method is the reliance on subjective expert judgments, which can introduce biases due to cognitive heuristics, overconfidence, or limited information availability. To mitigate these biases and improve the robustness of our risk response budget allocation, three key techniques can be incorporated: (1) sensitivity analysis, (2) Bayesian updating, and (3) the Delphi method.

• Sensitivity analysis (see Aven, 2012) helps to assess the extent to which changes in the parameters provided by experts affect the overall risk reduction strategy. By systematically varying the parameters of risk impact and response effectiveness within a reasonable range, we can determine how sensitive the final budget allocation is to fluctuations in expert inputs. This approach allows project managers to identify critical risks where accurate estimation is essential and uncertainty may require further empirical validation.
• Bayesian updating (see Aven, 2012; O’Hagan et al., 2006) provides a structured way to incorporate real-world data into expert judgment. Instead of treating initial expert estimates as static inputs, we apply Bayes’ theorem to update probability distributions as new data becomes available iteratively;
• The Delphi method (see Cuhls, 2023 and references therein) was developed in the 1950s by the RAND Corporation for military forecasting and has since become a widely used technique for gathering expert opinions. It involves multiple surveys in which experts provide information anonymously, and the results are shared in subsequent rounds to refine judgment and achieve consensus. The method is beneficial in situations of uncertainty, providing both qualitative and quantitative insights. Key features include expert anonymity, iterative feedback, and statistical measures of consensus. In our case study, the Delphi method was used.

By incorporating these techniques into our Monte Carlo simulation and risk response process, the accuracy and reliability of the decision-making framework can be improved. The refined model ensures that risk mitigation decisions are data-driven and adaptable to evolving project conditions.

5. Case Study

The case study was carried out for a large infrastructure company with a total annual budget of about $1.5 billion, which executes about 200 projects nationwide. To demonstrate the proposed method, a single project with a budget of $3.8 million and a planned duration of 18 months was selected. The project involved the construction of an office building of about 1500 m². During the risk identification phase, 13 risks could be assigned a specific risk response (see Table 1), and the total budget needed to provide a risk response for all of them was $625 thousand. However, the available budget for risk response was only $300 thousand.

Table 2. Risks.

Risk	Description	Risk Impact	Response	Response Cost
R1	Skilled Labor Shortage	200	Cross-training programs and hiring skilled workers in advance.	50
R2	Design Changes	165	A well-defined and approved design before starting construction. A comprehensive design review.	50
R3	Regulatory Compliance Issues	100	Hire a compliance expert and obtain necessary permits in advance.	30
R4	Currency Exchange Fluctuations	200	Hedge against currency risks and monitor exchange rates.	50
R5	Weather Delays	185	Monitor weather forecasts and plan construction activities accordingly. Use temporary shelters.	60
R6	Site Accidents	250	Implement stricter safety protocols, provide extended safety training, and conduct frequent regular safety audits.	60
R7	Financial Instability of Contractors and Suppliers	220	Regularly assess the financial stability of key contractors and suppliers.	50
R8	Subsurface problems or ancient remains.	295	Conduct a thorough site investigation before construction begins.	70
R9	Contractual Disputes	170	Clearly define contract terms and involve legal experts for legal consultation and contract review.	40
R10	Environmental Issues	150	Perform environmental impact assessments and follow best practices.	40
R11	Electrical Interruption	120	Backup generators.	30
R12	Materials quality Issues	135	Source materials from reputable suppliers and conduct quality assurance measurements.	50
R13	Community opposition	175	Perform community engagement initiatives to engage with the local community, address concerns, and communicate transparently.	45
Sum		2365		625

presents the estimated impact of each risk (in thousands of dollars) if it is realized, the proposed response, and the estimated cost of each response (also in thousands of dollars).

5.1. Simulation of the Risks

Following the sequence of stages described in Section 3, we next performed a Monte Carlo simulation with 500 runs for each risk. This yields the risk’s impact on the project and the results of the risk response. The simulation results are summarized in

Table 3. Simulation results.

Risk	Without a Risk Response				With a Risk Response
	Expected Impact Given that the Risk Is Realized	Expected Impact of the Risk ${\mathit{E}}_{\mathit{j},0}$		Variance of the Risk ${\mathit{V}\mathit{a}\mathit{r}}_{\mathit{j},0}$	Expected Impact of the Mitigated Risk ${\mathit{E}}_{\mathit{j},1}$	Variance of the Mitigated Risk ${\mathit{V}\mathit{a}\mathit{r}}_{\mathit{j},1}$	Cost of the Response ${\mathit{C}}_{\mathit{j}}$	Expected Saving
R1	199.33	120.11		190.60	24.03	58.43	50	96.07
R2	165.33	132.67		272.13	93.14	199.04	50	39.53
R3	101.17	60.63		46.67	24.17	18.22	30	36.47
R4	200.00	110.28		79.68	60.47	32.47	50	49.81
R5	185.83	120.91		58.29	60.99	64.94	60	59.92
R6	250.50	87.93		561.98	26.08	72.70	60	61.84
R7	221.17	123.01		517.65	61.70	177.01	50	61.31
R8	295.83	131.67		763.70	39.15	119.68	70	92.52
R9	170.33	118.69		190.71	53.52	134.15	40	65.17
R10	148.33	103.96		124.08	67.50	61.08	40	36.46
R11	121.50	60.53		59.25	30.50	29.17	30	30.04
R12	133.33	79.96		79.84	23.64	27.27	50	56.32
R13	174.67	104.57		160.32	62.84	99.82	45	41.73
Sum	2367.32	1354.92		3104.90	627.73	1093.99	625	727.19
Risk	Maximum Regret (Without Response Cost)		Maximum Regret $\mathit{M}\mathit{R}{\mathit{g}}_{\mathit{j}}$		Maximum Impact of the Risk (Without a Response) $\underset{\mathit{i}}{\mathit{M}\mathit{a}\mathit{x}}\left\{{\mathit{L}}_{\mathit{j}\mathbf{,}\mathbf{0}\mathbf{,}\mathit{i}}\right\}$		Maximum Impact of the Mitigated Risk (Without the Response Cost) $\underset{\mathit{i}}{\mathit{M}\mathit{a}\mathit{x}}\left\{{\mathit{L}}_{\mathit{j}\mathbf{,}\mathbf{1}\mathbf{,}\mathit{i}}\right\}$
R1	212.25		162.25		233.81		41.22
R2	112.18		62.18		221.85		135.37
R3	97.81		67.81		121.42		36.70
R4	169.72		119.72		236.20		79.65
R5	146.26		86.26		209.67		80.96
R6	290.59		230.59		308.85		55.14
R7	209.44		159.44		285.32		99.67
R8	333.53		263.53		352.53		75.38
R9	171.12		131.12		221.75		94.17
R10	162.42		122.42		181.09		97.33
R11	114.93		84.93		144.98		44.88
R12	137.11		87.11		155.40		38.77
R13	161.22		116.22		210.76		93.60
Sum	2318.58		1693.58		2883.63		972.84

.

5.2. Maximizing the Net Expected Saving

The first criterion for a risk response plan is to maximize the net expected savings (Section 4.1). Thus, we plug the data from Table 2 into Equation (9) and rearrange it according to the LINDO syntax to yield the following binary linear optimization program (Box 1) (which can easily be solved using LINDO):

Box 1. Maximizing the net expected savings.

Max

96.07Y1 + 39.53Y2 + 36.47Y3 + 49.81Y4 + 59.92Y5 + 61.84Y6 + 61.31Y7 + 92.52Y8 + 65.17Y9 + 36.46Y10 + 30.04Y11 + 56.32Y12 + 41.73Y13 − 50Y1 − 50Y2 − 30Y3 − 50Y4 − 60Y5 − 60Y6 − 50Y7 − 70Y8 − 40Y9 − 40Y10 − 30Y11 − 50Y12 − 45Y13

Subject to

50Y1 + 50Y2 + 30Y3 + 50Y4 + 60Y5 + 60Y6 + 50Y7 + 70Y8 + 40Y9 + 40Y10 + 30Y11 + 50Y12 + 45Y13 <= 300

End

Integer 13

The variables $Y_1,\dots ,Y_{13}$ represent binary decision variables associated with selecting or allocating resources for the 13 identified risks. Each $Y_i i=1,\dots ,13$ is one of the corresponding risks selected to have a risk mitigation budget, and zero if it is not. These variables are used to model the inclusion of each risk–response measure in the optimization model and are integral to determining the optimal risk–response budget allocation.

The solution yields a net expected saving of $117.86 thousand (the values of the decision variables are presented in

Table 4. Decision variables to maximize net expected saving.

Variable	Y1	Y2	Y3	Y4	Y5	Y6	Y7	Y8	Y9	Y10	Y11	Y12	Y13
Value	1	0	1	0	0	0	1	1	1	0	0	1	0

). According to this criterion, R1, R3, R7, R8, R9, and R12 would receive a risk response and the entire risk–response budget of $300 thousand would be used.

5.3. The Results for All of the Criteria

A similar analysis to that in Section 5.2 was carried out for all criteria described in Section 4. The results, which are presented in Table 4, show which risks would receive a risk response according to each decision criterion, subject to a budget constraint of $300 thousand. As shown in

Table 5. Decision variables.

Risk	Criterion 1 Net Saving	Criterion 2 Saving	Criterion 3 Variance	Criterion 4 Probability	Criterion 5 Regret	Criterion 6 Minimax	Sum
R1	1	1	1	1	1	1	6
R2	0	0	0	0	0	0	0
R3	1	1	0	1	0	0	3
R4	0	0	0	0	0	0	0
R5	0	1	0	0	0	0	1
R6	0	0	1	1	1	1	4
R7	1	1	1	1	1	1	6
R8	1	1	1	1	1	1	6
R9	1	1	0	1	1	1	5
R10	0	0	1	0	0	0	1
R11	0	0	1	0	1	1	3
R12	1	0	0	0	0	0	1
R13	0	0	0	0	0	0	0
Sum	6	6	6	6	6	6

, R1 receives a risk response across all six criteria, while R4 and R13 receive no risk response under any criterion.

The number of criteria according to which a risk would receive a response can itself be a criterion for making the final decision (as explained in Section 4.4). Therefore, we plug the data from Table 4 into Equation (15) and rearrange it according to the LINDO syntax to yield the following binary linear optimization program (Box 2) (which can easily be solved using LINDO):

Box 2. Weighting the criteria.

Max

6Y1 + 0Y2 + 3Y3 + 0Y4 + 1Y5 + 4Y6 + 6Y7 + 6Y8 + 5Y9 + 1Y10 + 3Y11 + 1Y12 + 0Y13

Subject to

50Y1 + 50Y2 + 30Y3 + 50Y4 +60Y5 + 60Y6 + 50Y7 + 70Y8 + 40Y9 + 40Y10 + 30Y11 + 50Y12 + 45Y13 <=300

End

Integer 13

The results are presented in

Table 6. Final decision variables.

Variable	Y1	Y2	Y3	Y4	Y5	Y6	Y7	Y8	Y9	Y10	Y11	Y12	Y13
Value	1	0	1	0	0	1	1	1	1	0	0	0	0

.

According to this criterion, R1, R3, R6, R7, R8, and R9 would receive a risk response subject to a budget constraint of $300 thousand. It is possible to modify (15) so as to make the final decision according to only some of the criteria or to assign a different weight to each criterion.

5.4. The Complexity of the Method

Monte Carlo simulation is used to model and understand the impact of uncertainty and risk, involving linear complexity O(N) when estimating outcomes through repeated random sampling (Glasserman, 2004). If each sample requires complex internal computations (e.g., integration or optimization), the time complexity may increase and become O(N*M), where M represents the number of computations per sample. On the other hand, integer linear programming (ILP) problems are classified as NP-hard (Vanderbei, 2020), meaning they are computationally hard to solve due to the combinatorial explosion of possibilities as the number of variables and constraints increases. However, finding an optimal solution is possible when the number of variables is relatively small, though the computational effort may grow significantly with larger instances.

5.5. Comparison of Risk–Response Budgeting Methods

Sato and Hirao (2013) identify Monte Carlo simulation (Cochrane, 1992) and Decision Tree Analysis (Matsubara, 2001) as key quantitative risk-analysis methods in project management (PMI, 2021). However, both have limitations in preventive decision-making and handling multiple interdependent risks.

Unlike traditional methods that rely primarily on expected value (e.g., Monte Carlo, Decision Trees), our approach incorporates multiple risk–response criteria, enabling a more nuanced and effective budget allocation. By integrating ILP optimization, we overcome the scalability challenges of Decision Trees while maintaining the probabilistic rigor of Monte Carlo simulations. Our method enhances risk budgeting by combining Monte Carlo simulations, ILP optimization, and multi-criteria decision-making, ensuring a holistic, scalable, and proactive risk management strategy. A comparison between our method and Sato and Hirao (2013) and two additional methods is presented in

Table 7. A comparison table.

Method	Key Characteristics	Limitations	Comparison to Our Approach
Monte Carlo Simulation (Cochrane, 1992)	Simulates probability distributions to estimate project costs and risks.	It does not support preventive risk mitigation; it focuses on overall cost rather than specific risk budgeting.	Our approach extends Monte Carlo by integrating budget optimization, ensuring actionable allocations rather than estimates.
Decision Tree Analysis (Matsubara, 2001)	Evaluate risk scenarios using expected value calculations at decision nodes.	Becomes computationally infeasible for large projects due to exponential tree growth.	Our ILP-based method efficiently allocates budgets across multiple risks.
Risk-Based Project Value (RPV) Framework (Sato & Hirao, 2013)	Optimizes budget allocation to maximize project value. Uses sensitivity analysis to assess budget impact.	Focuses mainly on marginal cost trade-offs, without explicitly considering multiple risk criteria.	Our approach expands RPV by integrating multi-criteria decision-making, balancing cost, risk severity, and dependencies.

.

6. Conclusions

Managing project risks effectively subject to a finite budget requires practical tools and techniques. This paper presents a new risk management method, combining Monte Carlo simulation with mathematical programming to determine the optimal allocation of a finite budget among a project’s risks. By simulating the impact of the risks and their residual effects after mitigation, the method provides the input for mathematical models that can optimize budget allocation.

The proposed method allows decision-makers to select or weigh multiple objective functions according to their preferences. This enables decision-makers to select a single objective function that aligns with their strategic goals or weigh multiple objective functions to make a more balanced decision. Finally, the method can accommodate sensitivity analysis, thus enabling decision-makers to identify the set of risks that would receive a response if the budget were increased or decreased. A real-world case study illustrates the method’s practicality and usefulness for project managers.

6.1. Limitations

The quality of the experts’ subjective estimates and the statistical forecasts limits the method’s efficiency. A further challenge is accurately identifying the statistical dependencies between random variables.

6.2. Future Research

Future research direction is extending this method to managing risks across a portfolio of projects or even at an organizational level, thus enhancing its applicability and robustness.