MIT Open Access Articles

Risk Management in Product Design: Current

State, Conceptual Model and Future Research

The MIT Faculty has made this article openly available. Please share
how this access benefits you. Your story matters.

Citation: Oehmen, Josef et al. “Risk Management in Product Design: Current State, Conceptual
Model and Future Research.” ASME, 2010. 1033–1041.

As Published: [Link]

Publisher: ASME International

Persistent URL: [Link]

Version: Author's final manuscript: final author's manuscript post peer review, without
publisher's formatting or copy editing

Terms of use: Creative Commons Attribution-Noncommercial-Share Alike 3.0

 Final Manuscript

Risk Management in Product Design:

Current State, Conceptual Model and Future Research

Josef Oehmen (corresponding author)

Department of Mechanical Engineering, Massachusetts Institute of Technology, Cambridge, Massachusetts 02139
Email: oehmen@[Link]

Mohammad Ben-Daya
Systems Engineering Department, King Fahd University of Petroleum and Minerals, Dhahran 31261, Saudi Arabia
Email: bendaya@[Link]

Warren Seering
Department of Mechanical Engineering, Massachusetts Institute of Technology, Cambridge, Massachusetts 02139
Email: seering@[Link]

Muhammad Al-Salamah
Systems Engineering Department, King Fahd University of Petroleum and Minerals, Dhahran 31261, Saudi Arabia
Email: salamah@[Link]

Published as: Oehmen, J., Ben-Daya, M., Seering, W., Al-Salamah, M.: Risk Management in Product Design: Current State, Conceptual
Model and Future Research. DETC2010-28539. Proceedings of the ASME 2010 International Design Engineering Technical Conference
& Computers and Information in Engineering Conference IDETC/CIE 2010. August 15-18, 2010, Montreal, Canada. ISBN 978-0-7918-
3881-5

ABSTRACT
Risk management is an important element of product design. It helps to minimize the project- and product-related risks such as
project budget and schedule overrun, or missing product cost and quality targets. Risk management is especially important for
complex, international product design projects that involve a high degree of novel technology.
This paper reviews the literature on risk management in product design. It examines the newly released international standard
ISO 31000 “Risk management – Principles and guidelines” and explores its applicability to product design. The new standard consists
of the seven process steps communication and consultation; establishing the context; risk identification; risk analysis; risk evaluation;
risk treatment; and monitoring and review.
A literature review reveals, among other findings, that the general ISO 31000 process model seems applicable to risk
management in product design; the literature addresses different process elements to varying degrees, but none fully according to
ISO recommendations; and that the integration of product design risk management with risk management of other disciplines, or
between project and portfolio level in product design, is not well developed.

INTRODUCTION
Product design (PD) is a complex task, as it integrates technical challenges and the preferences of a multitude of stakeholders
from both inside and outside the organization to devise one overall optimal set of specifications. The task is becoming more
challenging as companies focus on their core competencies. This leads to a lower degree of internal value creation and increases the
importance of partners along the value chain, be it in marketing, the outsourcing of parts of the design or manufacturing, the supply
chain management, distribution, service or recycling of a product. The fact that most companies and partners in a value chain act
globally presents additional complexity, as the communication and coordination now also has to bridge significant geographic and
cultural distance.
For this paper, we follow the definition of risk as the “effect of uncertainty on objectives” [1]. Assuming that the overall
objectives of PD are to achieve high product quality, low product cost, short development time and low development cost (see e.g.
[2]), these objectives also constitute the main categories of PD risks. Possible sources of uncertainty, i.e. risk causes, are the company
itself with its processes, people and technological resources; its partners and supply chain, such as suppliers, customers and service
providers; as well as external factors, such as competitors and political, social or environmental forces. There are numerous examples

Page 1
 Final Manuscript

of risks in PD that led to varying degrees of failure of the PD process and the product in the market. One of the most recent examples
of PD project cost and schedule overrun is the case of the Boeing 787 Dreamliner [3], or the large scale cost overrun of 30-40% in
major PD projects of the Department of Defense [4]. Products from the consumer industry, for example Apple’s Newton MessagePad
introduced in 1993, often suffer from risks related to product quality and performance, and the associated product price [5].
Risk management (RM) in PD is an important tool to minimize these risks of a PD projects and thus increase their likelihood of
success and create value. RM contributes directly to project and product success by creating transparency regarding the risk
situation, thus focusing management attention and enabling them to minimize PD risks. It allows for considering both risk and return
in PD projects and contributes by increasing the quality of the PD processes, one of the main determinants of product success [6].
Additionally, there is an increasing pressure on organizations to execute risk management processes as part of corporate governance,
risk management and compliance (GRC) activities of controlling and internal audit departments [7]. This makes it even more
important for engineers and engineering managers to define and implement a value-creating PD risk management process, before
the discussion is dominated by corporate functions that lack a detailed understanding of engineering processes.
A review of the literature by the authors has shown that a multitude of risk management approaches in PD exist. But there
seems to be no common process framework that would provide the necessary context and structure in which to discuss the different
pieces of the body of knowledge presented in the literature.
Very recently, the International Standard ISO 31000 “Risk Management – Principles and guidelines” and its accompanying
documents have been published [1, 8, 9]. Its process model is based on the national standard AS/NZS 4360 [10]. It describes a
generic process for risk management “to ensure that risk is managed effectively, efficiently and coherently across an organization”
[8], but also addresses the management system that surrounds the risk management process. One claim of the generic ISO risk
management process is that it is applicable to organizations and functions within organizations within different sectors. Therefore,
this paper attempts to structure the existing PD risk management literature according to the newly proposed ISO process.
The goals of this paper are
 to review and summarize the literature in PD risk management;
 to explore whether the generic ISO risk management process is a sensible unifying framework and conceptual model to
review and present the literature on risk management in PD; and
 to identify gaps in the current literature as possible future research opportunities.
The remainder of the paper consists of a brief description of the research method, an overview of risk management process
frameworks for PD, especially the ISO 31000 framework, a discussion of the PD risk management literature by process step, a
summary of the findings, and the conclusion.

Table 1. OVERVIEW OF LITERATURE IN THE CONTECT OF THE ISO 31000 STANDARD

Category Literature references

Risk management processes [8, 10-23]
RM process elements
Communication and consultation [3, 12, 13, 17-20, 24-39]
Establishing the context [14, 18]
Risk identification [14, 18, 25-27, 40-47]
Risk analysis [14, 18, 26, 40-42, 45, 46, 48-57]
Risk evaluation [12, 18, 45, 46, 49-53, 56, 58, 59]
Risk treatment [18, 24, 26, 41, 60]
Monitoring and review [18, 24, 45, 52]

RESEARCH METHOD AND OVERVIEW OF THE LITERATURE

The large area of reliability and safety engineering is only represented by selected papers. The related field of Robust Design that
can be interpreted as performance- and quality-oriented risk management was excluded from this review. Also, not all 93 papers can
be discussed in this paper, and the review thus remains incomplete; however, the authors have made every reasonable effort to
include highly cited papers as well as all papers that are relevant to achieve the papers’ objectives stated above (please refer to Tab. 1
for an overview).

Page 2
 Final Manuscript

The discussion of the literature is divided into two main sections: Literature addressing the risk management process as such,
and the second, larger category, literature addressing the different elements of the risk management process, discussed step by step
along the risk management process.

RISK MANAGEMENT PROCESSES IN PD AND THE INTERNATIONAL STANDARD ISO 31000

A number of process models existed for risk management in PD prior to the publication of the ISO 31000 standard. In project
management, a field related to PD, a well-known risk management process was defined by the Project Management Institute [15],
but there also exist a multitude of other approaches [16, 17]. An explicit PD risk management process is presented in [18]. Several
risk management processes for problem subsets exist, such as reliability & safety related risk management [19, 20], focus on
performance and quality risk in PD [21-23], risk management in software development [11], or risk management in highly regulated
environments such as the pharmaceutical industry [12, 13]. The main shortcoming of the process models is that they either focus on
the management of specific risks within PD, and / or lack an integration with other functions and risk management processes in the
company.

2. Establishing the
context

Risk assessment
1. Communication and consultation

3. Risk

7. Monitoring and review

identification

4. Risk analysis

5. Risk evaluation

6. Risk treatment

Figure 1: RISK MANAGEMENT PROCESS

(FOLLOWING ISO 31000 [8])

The approach of the ISO 31000 is to provide a generic risk management framework that is applicable to different industries and
different problem scopes. A very similar process model, based on the AS/NZS 4360 risk management standard has been utilized
before to give an overview of specific risk management methods for concurrent engineering PD projects [14] (also see [9] for a list of
specific methods and their applicability in the different process steps). The process model consists of the following 7 main steps
(descriptions quoted or paraphrased from [8], also see Fig. 1).
1. Communication and consultation: Communication and consultation with external and internal stakeholders should take place
during all stages of the risk management process. It should facilitate the exchange of necessary information and coordination of
stakeholders and their perceptions throughout the entire risk management process. More specifically, the communication and
consultation between the stakeholders for the different process steps should focus on: objectives, scope and criteria (establishing the
context); risk sources, consequences and related events (identification); analysis method and data generation (analysis); judgment of
evaluation criteria (evaluation); and appropriate treatment measures (treatment).
2. Establishing the context: By establishing the context, the objectives, scope and criteria for the remaining risk management
process are defined. This addresses both company external and as well as internal factors, the role of the risk management process

Page 3
 Final Manuscript

within the company, as well as the basic criteria used to evaluate risks. The main input provided to the risk identification process is
the scoping of risk causes and impacts.
3. Risk identification: This step consists of identifying sources of risk, areas of impact, and events with their causes and
consequences. The aim of the step is to create a comprehensive list of risks based on events that have a significant influence on the
achievements of the objectives. This commented list of identified risks is the main output for the following risk analysis step.
4. Risk analysis: The analysis of the risks identified previously develops a deeper understanding of these risks. It generates the
necessary information for a correct evaluation of the risk (both regarding the appropriate method for evaluation, as well as the
necessary data), and for the development of effective treatments. Both evaluation method and the collected data constitute the
input
5. Risk evaluation: During risk evaluation, based on the information gathered in the risk analysis, decisions are made regarding
which risks need treatment and the priority of the risk treatments. It uses the criteria that were defined during the establishment of
the context. The prioritized list of risks is then transferred to the risk treatment step.
Steps 3-5 (risk identification, analysis and evaluation) constitute the risk assessment process.
6. Risk treatment: For every risk that needs treatment, one or more options to deal with the risk are selected and implemented.
It involves assessing different treatments, assessing the resulting residual risk, and deciding whether additional risk treatments are
necessary to achieve the intended risk reduction. The decided treatments, their expected benefits, and the evaluated risks, are
passed on to the monitoring and review process.
7. Monitoring and review: The identified risks, including the identification of emerging risks, are monitored and reviewed, so
changes to their evaluation and treatment can be made if necessary. The execution of the risk management process is monitored and
reviewed as well to enable process control and improvements. Therefore, the monitoring and review process interacts with all other
processes, regarding the process design, execution, as well as the current risk situation.

RISK MANAGEMENT PROCESS IN PRODUCT DESIGN

In this section, the 7 risk management process elements proposed by the ISO 31000 are interpreted and discussed in the context
of PD risk management. The current literature is then reviewed for each process element and the findings are presented in the light
of the ISO 31000 recommendations.

Step 1: Communication and consultation

One goal of the ISO 31000 is to establish communication between today’s ‘functional silos’ in risk management. There are two
dimensions to this integration: along the different processes of the value chain, and along different levels of decision making and
responsibility in the hierarchy.
The integration with other risk management processes along the value chain should address functions such as marketing,
production, supply chain management, service and recycling / refurbishment. Also, interfacing with the risk management activities in
central support functions, such as finance, HR and IT, should be considered.
In the other dimension, PD risk management activities on the project level have to be integrated with portfolio and / or program-
level risk management, and corporate or enterprise-level risk management. Also, project-level risk management has to integrate
specific risk management activities, for example regarding technical, environment, health, safety and reliability-related risks.
The literature contains examples of companies that standardized their risk management process across their different projects
according to corporate guidelines, or across multiple teams on different sites in the same project [12, 13, 24-26]. Other papers
explicitly integrate risks across different sources (i.e. different functions) within PD risk management, e.g. [18, 27], or focus on
specific elements of PD risk management, such as safety and reliability [19, 20]. These papers do not, however, address the
integration with other risk management processes.
Several authors address the PD – supply chain interface in risk management [3, 28-31, 39]. One common theme is the high
significance that PD plays in creating and therefore also treating risks that may only emerge during supply chain management. Thus,
the coordination of the risk management processes mainly focuses on the steps of identification and treatment. Although the PD-
supply chain interface seems to receive some level attention, no complete integration model could be identified in the literature.
The interface between project-level and portfolio-level risk management in PD also received some level of attention. While most
authors focus on the application or adaption of specific portfolio risk management concepts to PD [32-36, 38], some do address the
interaction between portfolio and project risks [17, 37], but not as a central element and it therefore remains vague.

Step 2: Establishing the context

Establishing the context for PD risk management should contain the following elements: The scoping of the risk management
process has to define the goals of the PD process, in order to establish the basic categories of risks (risk being defined as the effect of

Page 4
 Final Manuscript

uncertainty on objectives), such as PD project schedule and cost, and product performance and cost. To develop the criteria for risk
evaluation, these goals should be broken down into measurable units, as well as their relation to overall corporate goals (e.g. return
on investment or NPV of the PD project) described. The scoping also has to define which areas of risk causes should be considered,
e.g. from within the company itself, from the network of partner companies along the value chain, or from surrounding external
factors such as political, economic or competitive influences. Another important element to define the scope is to provide a clear
definition of the system, product or product family that the risk management is applied to, as well as the elements of the PD project
or process that are to be analyzed in detail. Also, the question on how to integrate the risk management process with the PD process,
so that it becomes a natural part of it and not an artificial annex, has to be answered.
Concrete techniques to understand the context and delimit the scope of the risk management process that are recommended in
the literature include project network diagrams (or Gantt charts), design structure matrices, and functional or object-oriented
modeling of the task [14]. Other authors address this question implicitly as part of the risk identification process, e.g. through
detailed definition of the project and its “significant features” [18].
In most cases, the process of establishing the context is not discussed by itself, but rather treated as a boundary condition set by
the scope of the reported research (i.e. it was addressed at some stage of the design of the research, but not as part of the risk
management process itself).

Step 3: Risk identification

The goal of the risk identification is to develop a detailed list of risks that affect the objectives of the PD process. It includes the
identification of the risk sources from within or outside of the PD process, understanding how the risks impact one or more of the PD
objectives, and understanding the actual cause-and-effect chain of events that describe the risk. The risk identification should be
carried out within the boundaries of the risk management scope that was defined before.
Not surprisingly, a high number of publications deal with risk identification, often combined with risk evaluation and / or
treatment methods (see below). A variety of techniques are presented in the literature for risk identification: The most creative and
open are brainstorming and Delphi surveys [18, 40]. Quality function deployment (QFD) analyses the engineering and customer
perspective to identify risks [41, 42]. Life cycle cost analysis identifies the main cost drivers to derive cost-oriented risks [43]. An
analysis of the design process focuses on the different activities in PD, their relation and the scheduling to identify potential risks [18,
27, 44]. Similarly, a process FMEA identifies risks along the failure modes of the PD process [45, 46]. Scenarios can be used to judge
the PD systems response to changes in the environment and identify the related risks [47]. By conducting a fault trees analysis (FTA)
or developing cause-and-effect diagrams, related risks can be identified systematically [14, 26]. Checklists ensure that risks from
previous PD projects are considered [14, 18, 25].
Notably, in many cases the PD objectives are established simultaneously with the risk identification, for example in QFDs or
process FMEAs. This may account for the underrepresentation of the second step (establishment of context) in the current literature.
Also, not all techniques focus on developing or understanding causal relationships (e.g. checklists), while others do so explicitly (e.g.
FTA). The relationship between risk identification and a previously defined scope is acknowledged only implicitly.

Step 4: Risk analysis

During the risk analysis, the understanding of the PD risks that were identified in the previous steps is further deepened. This
should involve qualifying or quantifying risk level, such as probability distributions of objective achievements (e.g. finishing date of
PD project), or likelihood and consequences of specific PD risks (e.g. likelihood of failing a customer review and the associated delay).
It also includes analyzing the root causes that determine the level of risk (e.g. knowledge of customer requirements), and
understanding how different risks are related to each other (e.g. schedule slip to additional cost). Part of this step is judging the
quality of the result of the risk analysis, e.g. accuracy of data or the sensitivity of the overall result to single influencing factors.
Several different approaches could be identified in the PD risk management literature: Of the different approaches mentioned
above, most notably FMEA [45, 46], FTA [14, 26] and QFD [41, 42] incorporate methods to quantify the likelihood of occurrence of a
certain event and / or its consequences, thus quantifying the risks (although the quantification can involve individual or group
judgments and estimates). Risk and the value of creating or retaining the possibility of multiple decision options is analyzed with
adaptations of real options theory, both qualitatively [48] as well as quantitatively [49-51]. Quantifications based on combining the
utility of the achievement of PD objectives (e.g. distribution of end-user utility across a possible performance spectrum of the
product) with the probability distribution of the objective achievement (e.g. probability distribution of the performance) is presented
in [52, 53]. Design structure matrices (DSM) can be used to capture likelihood and consequences of certain events to compute an
overall risk [54], and are combined in one example with fuzzy pareto sets and Monte Carlo simulation to derive risk-opportunity plots
for design alternatives [57]. Another approach is expert surveys and Delphi studies to quantify risks [40, 55]. Based on expert
judgment and available statistical data, the probability distribution of the achievement of an objective (in this example the net

Page 5
 Final Manuscript

present value of the PD project) can be computed using Monte Carlo simulations [51, 56]. A somewhat different approach is the
analysis of the risk through readiness scales, such as technology, manufacturing or service readiness of a product [58].
The review of the literature reveals that research mostly focuses on quantitative methods, although also a certain number of
qualitative approaches are present. Risk consequences are discussed in terms of cost, schedule, performance or overall utility, rarely
in high-level terms such as net present value or return on investment. With the exception of [18], no additional analysis of cause and
effect relationships beyond the initial risk identification is mentioned. The review of the literature makes it also obvious that many
different interpretations of the term risk in PD exist and that there is no agreement on how to quantify this risk, or in which
dimensions.

Step 5: Risk evaluation

In the risk evaluation process step, the priorities for treatment are assigned to the PD risks that have been previously identified
and analyzed. Thresholds for risks should be established (e.g. regarding tolerable schedule and cost overruns), taking both company-
internal (e.g. program management) as well as company-external (e.g. customers) stakeholders into account.
The execution of the risk evaluation in the literature, present both implicitly as part of the risk analysis and explicitly as a
separate risk ranking step, is strongly dependent on the method that was used to analyze the risks. One-dimensional rankings can be
found, e.g. risk priority numbers in FMEA [45, 46], values for real options [49-51, 59], as well as the risk-corrected utility [52, 53] or
the probability distribution of the net present value of different options under risk [56]. Multi-dimensional techniques represent two
decision-relevant dimensions per evaluated risk, usually probability- and consequence-related. The risks are depicted in a risk matrix
and thus more detailed information is available to the decision maker [12, 18].
Although the literature discusses the basic question of ranking the analyzed risks, no examples of discussion of risk tolerance, be
it with internal or external stakeholders, could be identified in the literature. The method that comes closest is the risk-adjusted
utility discussed in the previous section.

Step 6: Risk treatment

The risk treatment step comprises the assessment of the different treatment options available to reduce PD risks, the selection
of the most effective treatment, as well as its implementation.
A QFD-analysis based collection of technical and organizational examples of risk treatments is shown in [41]. Risk treatment
planning and generic, high-level response strategies are discussed in [18, 24], technology validation is mentioned by [26], and
knowledge management by [60] as possible treatments.
Although risk treatment features prominently in many reviewed papers as an important PD risk management process step (e.g.
[18, 25, 45, 46]), it is difficult to identify concrete examples of actual risk treatment options in PD. No examples could be identified in
the literature that showed the assessment of alternative treatment options and a structured selection process.

Step 7: Monitoring and review

The monitoring and review process addresses both the PD risk management process itself as well as the PD risks. The specific
implementation of overall risk management process and its integration with other risk management processes and various
stakeholders (see step 1) has to be monitored and if necessary adapted. The understanding of the risk situation in PD has to be kept
current and the risk management process, either in its entirety or parts thereof, has to be executed repeatedly at certain intervals
(e.g. before reviews or larger milestones). In this way, new information can be integrated into the risk assessment and its accuracy
improved.
Examples in the literature include monitoring the overall risk situation [24] by tracking the aggregated risk severity of a project
over time, risk reduction profiles for single risks [52], or a combination of both [45]. An overview of different management tools, such
as top 10 lists, a risk dashboard, and an overview of current action plans is given in [18].
No examples, either theoretical or practical, could be identified in the literature that showed a monitoring and review process
that addresses the PD risk management process itself.

PD RISK MANAGEMENT CASE STUDIES AND APPLICATION EXAMPLES IN THE LITERATURE

The case studies and application examples of PD risk management techniques in industry are discussed in the following.
A case study from the pharmaceutical industry [13] describes an approach for managing the risks involved in marketing drugs.
Although a highly regulated industry, the case illustrates the benefits of a formal risk management process and the importance of
starting such a process as early as possible in the development process. [12] illustrates a proposed risk management process for the
pharmaceutical industry with hypothetical examples, [56] applies risk-adjusted net present value simulations to drug development
projects.

Page 6
 Final Manuscript

The impact of PD on supply chain risk was addressed through a case study in the clothing industry in [29]. In particular, the case
examines the role that design can play in managing risk in the clothing and textile industries in an increasingly global supply chain.
The Boeing 787 Dreamliner development project uses novel supply chain concepts intended to significantly reduce development
cost and time. However, the series of delays in plane delivery to customers motivated a case study [3] that looks at the challenges
faced by Boeing and concludes with some lessons learned that can benefit other companies when designing their supply chain for
new product development.
A number of other publications use examples from the aeronautics, defense and space industry to illustrate the application of
their methods: [44] describes changes to the PD process at Rocketdyne due to risk management considerations; [59] uses a real
options based project valuation approach at Boeing, [52, 54] illustrate their risk quantification method with the example of an
unmanned combat air vehicle; [51] performs value-at-risk analyses for satellite fleet design at Lockheed Martin; and [26] discusses
the NASA process to manage technical risks.
Examples from the automotive industry for the use of FMEA during PD are presented in [45]. The development of a hydrogen-
enhanced automotive combustion engine is the example in [57].
Other application examples include the application of qualitative real options at the National Ignition Facility [48] and a
description of the PD risk management process of Intel [24].

DISCUSSION OF MAIN FINDINGS AND POSSIBLE TOPICS FOR FUTURE RESEARCH

This section summarizes the main findings of the literature review and discusses the discrepancy between the ISO 31000
recommendations and the current state found in the PD risk management literature. All those findings represent possible future
research topics.
The reference model for risk management processes proposed by the ISO 31000 standard provided a useful framework to
organize and discuss the literature on PD risk management. It seems to be a promising candidate to serve as a reference model for
PD. The review of the literature above has shown that all process elements are being addressed by the current literature, but to
varying degrees. While many examples of papers dealing with risk identification or analysis were found, only very few explicitly
address the remaining process steps.
Comparing the process standards set forth by the ISO 31000, all process steps show varying degrees of deficiencies (see the
discussion of the different process steps above for details on the identified literature): In communication and consultation, no in-
depth integration with other risk management processes could be found, although some first examples of interfacing with supply
chain and portfolio-level risk management could be identified. The establishment of the context, it seems, is not currently regarded
as a separate process step in the PD risk management literature. One of its main elements, establishing the PD objectives, is usually
addressed as part of the risk identification. In risk identification, understanding the causal relationships between different risks, as
well as explicitly defining the scope of the identification, was only observed to a limited degree in the literature. The main
observations regarding the risk analysis are that no agreement seems to exist regarding the PD objective to use as the basis to
quantify risks, or what the high level objectives with relevance to the entire company are. Measures such as return on investment or
net present value of the project are only rarely used. For risk evaluation, an explicit discussion of risk tolerance in PD is currently
absent in the literature. The topic of risk treatment is, despite its obvious importance, only addressed marginally in the literature. In
particular, examples and discussions on how to evaluate alternative treatment options are absent. Similarly, the monitoring and
review process is not strongly represented in the literature, and no examples on how to apply monitoring and review to the risk
management process itself could be found.
Taking a more global view, no case study was found in the literature that presented an industrial application example of an
integrated PD risk management process comparable to the one proposed by ISO 31000. Case studies are generally rare. Concrete
industry involvement more often takes the form of application examples to illustrate the general feasibility (in one It is also not
possible to judge if this discrepancy is justified by certain application-related requirements, as no clear picture exists of what these
requirements of industry regarding a risk management process in PD actually are.
The literature review also showed that so far no common modeling approach regarding risks in PD exists (this question is not
addressed by ISO 31000).

CONCLUSION
In this paper, we presented a review of the current literature on risk management in product design (PD). As a framework for the
review, the ISO 31000 risk management process elements were used.
The review showed that the ISO process seems applicable to risk management in PD. At the same time, numerous shortcomings
of the current risk management process implementation in PD compared to the ISO 31000 recommendations were discovered. All

Page 7
 Final Manuscript

those gaps present opportunities for future research topics. The review also showed that comprehensive case studies on the
application of risk management in product development are missing.
This paper is limited in several important aspects: First, as discussed in the introduction, this is not a complete review of the PD
risk management literature, although every effort has been made to include the papers relevant for the questions discussed here
from our more extensive collection. Also, only the part of the ISO 31000 addressing the risk management process as such was
discussed, both the risk management principles as well as the implementation framework remain excluded from this paper. The
current PD literature could have been structured in many different ways, such as along risk sources or effects, along PD process
stages or general PD process models.

ACKNOWLEDGMENTS
The authors would like to thank the King Fahd University of Petroleum and Minerals (KFUPM) in Dhahran, Saudi Arabia, for
funding the research reported in this paper through the Center for Clean Water and Clean Energy at MIT and KFUPM, as well as the
Lean Advancement Initiative at MIT for funding support.

REFERENCES
[1] ISO, 2009, ISO Guide 73:2009 - Risk management - Vocabulary, International Organization for Standardization, Geneva.
[2] Ulrich, K. T., and Eppinger, S. D., 1995, Product design and development, McGraw-Hill, New York.
[3] Tang, C. S., and Zimmerman, J. D., 2009, "Managing New Product Development and Supply Chain Risks: The Boeing 787
Case," Supply Chain Forum: An International Journal, 10(2), pp. 74-85.
[4] GAO, 2006, Defense Acquisitions - Major Weapon Systems Continue to Experience Cost and Schedule Problems under DOD’s
Revised Policy (GAO-06-368), United States Government Accountability Office, Report to Congressional Committees, Washington.
[5] Bayus, B. L., Jain, S., and Rao, A. G., 1997, "Too Little, Too Early: Introduction Timing and New Product Performance in the
Personal Digital Assistant Industry " Journal of Marketing Research, 34(1), pp. 50-63.
[6] Cooper, R. G., and Kleinschmidt, E. J., 1995, "Benchmarking the Firm's Critical Success Factors in New Product
Development," Journal of Product Innovation Management, 12(5), pp. 374-391.
[7] Spira, L. F., and Page, M., 2002, "Risk Management - The reinvention of internal control and the changing role of internal
audit," Accounting, Auditing & Accountability Journal, 16(4), pp. 640-661.
[8] ISO, 2009, ISO 31000:2009(E) - Risk management - Principles and guidelines, International Organization for Standardization,
Geneva.
[9] ISO, 2009, ISO/IEC 31010: Risk management - Risk assessment techniques, International Organization for Standardization &
International Electrotechnical Commission, Geneva.
[10] AS/NZS, 2004, AS/NZS 4360:2004 - Risk Management, Standards Australia and Standards New Zealand, Sydney.
[11] Hall, E., 1998, Managing Risk - Methods for Software Systems Development, Addison Wessley Longman, Reading, MA.
[12] Hulbert, M. H., Feely, L. C., Inman, E. L., Johnson, A. D., Kearney, A. S., Michaels, J., Mitchell, M., and Zour, E., 2008, "Risk
Management in the Pharmaceutical Product Development Process," Journal of Pharmaceutical Innovation, 3(4), pp. 227-248.
[13] Katsanis, L. P., and Pitta, D., 2006, "Managing the risk aspects of the product development process at the Upjohn Company,"
Journal of Product & Brand Management, 15(4), pp. 250-254.
[14] Ahmed, A., Kayis, B., and Amornsawadwatana, S., 2007, "A review of techniques for risk management in projects,"
Benchmarking: An International Journal, 14(1), pp. 22-36.
[15] PMI, 2004, A Guide to the Project Management Body of Knowledge (PMBOK Guide), Project Management Institute, Newton
Square (PA).
[16] Chapman, C., and Ward, S., 2003, Project Risk Management: Processes, Techniques and Insights, Wiley, Hoboken, NJ.
[17] Sanchez, H., Robert, B., Bourgault, M., and Pellerin, R., 2008, "Risk management applied to projects, programs, and
portfolios," International Journal of Managing Projects in Business, 2(1), pp. 14-35.
[18] Smith, P. G., and Merritt, G. M., 2002, Proactive Risk Management - Controlling Uncertainty in Product Development,
Productivity Press, New York.
[19] Department of Defense, 1980, MIL-STD-1629 A, Procedures for Performing a Failure Mode, Effects and Critically Analysis,
Washington D.C.
[20] Stamatelatos, M., Apostolakis, G., Dezfuli, H., Everline, C., Guarro, S., Moieni, P., Mosleh, A., Paulos, T., and Youngblood, R.,
2002, Probabilistic Risk Assessment Procedures Guide for NASA Managers and Practitioners, NASA, Office of Safety and Mission
Assurance, Washington.
[21] Creveling, C. M., Slutsky, J., and Antis, D., 2003, Design for Six Sigma in technology and product development, Prentice Hall
PTR, Upper Saddle River, N.J.

Page 8
 Final Manuscript

[22] Singh, J., 2006, "Comparative analysis of robust design methods," Ph.D. thesis, [Link]
Massachusetts Institute of Technology, Dept. of Mechanical Engineering, Cambridge, MA.
[23] Yang, K., and El-Haik, B., 2009, Design for six sigma : a roadmap for product development, McGraw-Hill, New York.
[24] Goodman, A., Hinman, E. J., Russell, D., and Sama-Rubio, K., 2007, "Managing Product Development Risk," Intel Technology
Journal, 11(2), pp. 105-113.
[25] Kayis, B., Zhou, M., Savci, S., Khoo, Y. B., Ahmed, A., Kusumo, R., and Rispler, A., 2007, "IRMAS – development of a risk
management tool for collaborative multi-site, multi-partner new product development projects," Journal of Manufacturing
Technology Management, 18(4), pp. 387-414.
[26] Silk, E. A., and Dash, P. H., 2008, "Risk management in space systems design and technology development," Proceedings of
the Institution of Mechanical Engineers, Part G: Journal of Aerospace Engineering, 222(6), pp. 907-913.
[27] Larson, N., and Kusiak, A., 1996, "Managing Design Processes: A Risk Assessment Approach," IEEE Transactions on Systems,
Man, Cybernetics - Part A: Systems and Humans, 26(6), pp. 249-259.
[28] Laínez, J. M., Reklaitis, G. V., and Puigjaner, L., 2009, "Financial and financial engineering considerations in supply chain and
product development pipeline management," Computers and Chemical Engineering, 33(12), pp. 1999-2011.
[29] Khan, O., Christopher, M., and Burnes, B., 2008, "The impact of product design on supply chain risk: a case study,"
International Journal of Physical Distribution & Logistics Management, 38(5), pp. 412-432.
[30] Khan, O., and Creazza, A., 2009, "Managing the product design-supply chain interface: Towards a roadmap to the “design
centric business”," International Journal of Physical Distribution & Logistics Management, 39(4), pp. 301-319.
[31] Tang, C. S., 2008, "Making products safe: process and challenges," International Commerce Review, 8(1), pp. 48-55.
[32] Cardozo, R. N., and Smith, D. K., 1983, "Applying Financial Portfolio Theory to Product Portfolio Decisions: An Empirical
Study " The Journal of Marketing 47(2), pp. 110-119.
[33] Cardozo, R. N., and Smith, D. K., 1985, "On the Use of Financial Portfolio Theory in Marketing Decisions: A Reply to Devinney,
Stewart, and Shocker," Journal of Marketing, 49(4), pp. 113-115.
[34] Devinney, T. M., and Stewart, D. W., 1988, "Rethinking the Product Portfolio: A Generalized Investment Model "
Management Science, 34(9), pp. 1080-1095.
[35] Devinney, T. M., Stewart, D. W., and Shocker, A. D., 1985, "A note on the application of portfolio theory: a comment on
Cardozo and Smith," Journal of Marketing, 49(4), pp. 107-112.
[36] Santiago, L. P., and Vakili, P., 2005, "Optimal Project Selection and Budget Allocation for R&D Portfolios," Proceedings of the
IEEE conference on Technology Management: A Unifying Discipline for Melting the Boundaries, 31 July-4 Aug., 2005, pp. 275-281.
[37] Cooper, R. G., Edgett, S. J., and Kleinschmidt, E. J., 2001, "Portfolio management for new product development: results of an
industry practices study," R&D Management, 31(4), pp. 361-380.
[38] Leong, S. M., and Lim, K. G., 1991, "Extending Financial Portfolio Theory for Product Management," Decision Sciences, 22(1),
pp. 181-193.
[39] Oehmen, J., Ziegenbein, A., Alard, R., and Schönsleben, P., 2009, "System-oriented Supply Chain Risk Management,"
Production Planning & Control, 20(4), pp. 343-361.
[40] Browning, T. R., 1999, "Sources of Schedule Risk in Complex System Development," Systems Engineering, 2(3), pp. 129-142.
[41] Reich, Y., and Paz, A., 2008, "Managing product quality, risk, and resources through resource quality function deployment,"
Journal of Engineering Design, 19(3), pp. 249-267.
[42] Leung, P., Ishii, K., Abell, J., and Benson, J., 2008, "Distributed System Development Risk Analysis," Journal of Mechanical
Design, 130(5), pp. 1-9.
[43] Markeset, T., 2003, "Integration of RAMS and risk analysis in product design and development work processes: A case
study," Journal of Quality in Maintenance Engineering, 9(4), pp. 393-410.
[44] Ahmadi, R., and Wang, R. H., 1999, "Managing development risk in product design processes," Operations Research, 47(2),
pp. 235-246.
[45] Segismundo, A., and Miguel, P. A. C., 2008, "Failure mode and effects analysis (FMEA) in the context of risk management in
new product development - A case study in an automotive company," International Journal of Quality & Reliability Management,
25(9), pp. 899-912.
[46] Kmenta, S., Fitch, P., and Ishii, K., 1999, "Advanced Failure Modes and Effects Analysis of Complex Processes," Proceedings of
the 1999 ASME Design Engineering Technical Conferences, September 12-15, 1999, Las Vegas, Nevada, pp. 1-9.
[47] Miller, K. D., and Waller, H. G., 2003, "Scenarios, Real Options and Integrated Risk Management," Long Range Planning,
36(1), pp. 93-107.
[48] Alessandri, T. M., Ford, D. N., Lander, D. M., Leggio, K. B., and Taylor, M., 2004, "Managing risk and uncertainty in complex
capital projects," The Quarterly Review of Economics and Finance, 44(5), pp. 751–767.

Page 9
 Final Manuscript

[49] Huchzermeier, A., and Loch, C. H., 2001, "Project management under risk: Using the real options approach to evaluate
flexibility in R&D," Management Science, 47(1), pp. 85-101.
[50] Santiago, L. P., and Bifano, T. G., 2005, " Management of R&D Projects Under Uncertainty: A Multidimensional Approach to
Managerial Flexibility," IEEE Transactions on Engineering management, 52(2), pp. 269-280.
[51] Hassan, R., Neufville, R. d., Weck, O. d., Hastings, D., and McKinnon, D., 2005, "Value-at-Risk Analysis for Real Options in
Complex Engineered Systems," eds., 4, pp. 3697-3704.
[52] Browning, T. R., Deyst, J. J., Eppinger, S. D., and Daniel E. Whitney, 2002, "Adding Value in Product Development by Creating
Information and Reducing Risk," IEEE Transactions on Engineering Management, 49(4), pp. 443-458.
[53] Ben-Asher, J. Z., 2008, "Development Program Risk Assessment Based on Utility Theory," Risk Management, 10(4), pp. 285-
299.
[54] Browning, T. R., and Eppinger, S. D., 2002, "Modeling Impacts of Process Architecture on Cost and Schedule Risk in Product
Development," IEEE Transactions on Engineering Management, 49(4), pp. 428-442.
[55] Thuyet, N. V., and Ogunlana, S. O., 2007, "Risk management in oil and gas construction projects in Vietnam," International
Journal of Energy Sector Management 1(2), pp. 175-194.
[56] Blau, G., Mehta, B., Bose, S., Pekny, J., Sinclair, G., Keunker, K., and Bunch, P., 2000, "Risk management in the development of
new products in highly regulated industries," Computers and Chemical Engineering, 24(2-7), pp. 659-664.
[57] Smaling, R., and de Weck, O., 2007, "Assessing Risks and Opportunities of Technology Infusion in System Design," Systems
Engineering, 10(1), pp. 1-25.
[58] Tang, V., and Otto, K. N., 2009, "Multifunctional Enterprise Readiness: Beyond the Policy of Build-Test-Fix Cyclic Rework,"
Proceedings of the ASME 2009 International Design Engineering Technical Conferences & Design Theory and Design IDETC/DTM 2009
, August 30 - September 2, 2009, San Diego, California, pp. 1-9.
[59] Mathews, S., 2009, "Valuing Risky Projects with Real Options," Research Technology Management, 52(5), pp. 32-41.
[60] Cooper, L. P., 2003, "A research agenda to reduce risk in new product development through knowledge management: a
practitioner perspective," Journal of Engineering and Technology Management, 20(1-2), pp. 117-140.

Page 10