# A Framework Based on Fuzzy Logic to Manage Risk in an Open Innovation Context

Ricardo Santos, Antonio Abreu, J. Calado, José Miguel Soares, José Martins

► To cite this version:

Ricardo Santos, Antonio Abreu, J. Calado, José Miguel Soares, José Martins. A Framework Based on Fuzzy Logic to Manage Risk in an Open Innovation Context. 21th Working Conference on Virtual Enterprises (PRO-VE), Nov 2020, Valencia, Spain. pp.336-349, 10.1007/978-3-030-62412-5_28 . hal-03745829

HAL Id: hal-03745829

https://inria.hal.science/hal-03745829v1

Submitted on 4 Aug 2022

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# A Framework based on Fuzzy Logic to Manage Risk in an Open Innovation Context

Ricardo Santos¹², Antonio Abreu¹³ J.M.F. Calado¹⁴, José Miguel Soares⁵,
José Duarte Moleiro Martins⁶⁷

¹ISEL- Instituto Superior de Engenharia de Lisboa, Instituto Politécnico de Lisboa

²GOVCOPP - University of Aveiro, Portugal

³CTS Uninova, Faculdade de Ciências e Tecnologia, Universidade Nova de Lisboa, Portugal

⁴IDMEC-IST-UL, Lisboa, Portugal

⁵ISEG - Lisbon School of Economics and Management, Universidade de Lisboa, Portugal

⁶ISCAL - Instituto Superior de Contabilidade e Administração de Lisboa

⁷UNIDE – ISCTE – IUL, Lisboa, Portugal

ricardosimoessantos84@ua.pt

**Abstract.** Virtual enterprises (VE), is well-known to make use of open innova-
tion to achieve competitiveness, through innovation on product development.
However, its limited resources, combined with the innovation resulted from the
diversity of partners involved, rises some challenges to its management, specifi-
cally regarded with risk management. To fulfill these requirements, risk manage-
ment's models, have been conceived to assist managers, on preventing threats
with such risks, although without adequately incorporate the influence of each
process domain on product development, as well as the subjectivity regarding
human perception. In order to consider these issues, this work presents an ap-
proach, supported by fuzzy logic, to assess the risk's level on product develop-
ment in an open innovation context. The model robustness, will be assessed
through a case study, where it will be also discussed the benefits and challenges
found.

**Keywords:** Collaborative Networks, Open Innovation, New Product Develop-
ment, Risk Management, Fuzzy Logic

# 1 Introduction

The uncertainty with the economic context, and the market competition as well, have pushed companies to find ways to survive [1]. Based on works, found on literature, innovation should exist on new product development (NPD), so the organizations, can reach competitive advantage in the existed (or even new) markets [2].

In this context, a VE (virtual enterprise) arises as an (temporary) organization's al-
liance (on collaborative context), with the purpose of sharing different assets, namely
resources (e.g. materials, equipment, etc.) and competencies, to develop products that
provides a better answer to the opportunities that might appear on market [3].

However, NPD it is not an easy task, especially for VEs, given the existence of
several risks, regarding the different processes of each component/phase of the product.

Thus, and to benefit from the collaborative network, it's suggested the use of suitable risk models in an OI (Open Innovation) context, since that OI operates essentially in a collaborative context [4]. However, there is few risk assessments approaches on literature, related to the application in OI's context on behalf of NPD [2-3].

Furthermore, the choice of the OI’s “right” actor/partner, allows the risk’s minimization on each product process, and therefore, the minimization of the global risk of the product development, assuming therefore, one of the proposes to develop such approaches. On these context, risk management, could support VEs to mitigate unwanted risks that can jeopardize the success on NPD [5], by using it as a procedure to identify, evaluate, watch and also report, all the risk’s involved here, regarding the probabilities of occurrence and also the impact as well. The evaluation and the assessment of each risk, allows the elaboration of a set of procedures to reduce the impact of any negative effects that might appear [4]. Based on common practices, on behalf of project management applications, there are on literature, several risk assessment approaches, that can be identified, namely; DT (Decision Trees), FTA (Fault Tree Analysis) [4], FMEA (Failure Mode Effects Analysis) [5], AHP (Analytic Hierarchy Process) [6] and RDM (Risk Diagnosing Methodology) [7], among others. However, there are works that relates innovation with product development. An example, is found on [3], regarding the development of a risk-based technology management approach, by considering both innovation and product delivery quantitative objectives, with the aim of tracking and the monitoring them, during its life cycle. In [8], are identified some of the risks, commonly appeared on open innovation projects, related to a set of situations, such as the leakage within market information, the external technology dependence, the difficulties arise with the protection of the intellectual property, among others. Still regarding the intellectual property protection, in [9], it is highlighted several factors related to this issue. Among the risk models existed on literature, is the work of [9], with focus on the integration of costumer’s risk assessment in NPD, or the work from [10], where it was designed an approach based on an open-source software to provide early warnings, as well as their mitigation.

Despite the existence of several methods found on literature, there are few ap-
proaches, related to risk management on VEs, where it's intended to explore a possible
existence of influence between the processes involved on the development of the prod-
uct, by also including at the same time, the human perception on defining each risk
based on its probability of occurrence and impact as well [11]. Thus, in this paper, it
will be presented an approach to incorporate such issues, where on Section 2 it's de-
scribed the research method, followed by Section 3, which describes the validation
method of the approach, proposed in this work. Section 4 ends up with the conclusions
and some future work recommendations.
# 2 Research Method

## 2.1 Proposed Approach

According to what was referred before, it was developed an approach to assess and account, an eventual relationship regarding the risk related to each project (concerning the development of each individual component/system product by considering different domains) and the risk, associated to each VE's domain, as an organization created to develop the product. Based on [2-3][5] and [11], it's shown on Fig. 1, the risk taxonomy adopted, regarding Process and Product Risk levels.

<figure><img src="image_3.png" /><figcaption>Fig. 1. Adopted risks (adapted from [11])</figcaption></figure>

The execution of a project (with success or not), might have impact on several domains of each organization, in particular on VE [2-3][11]. Considering, that each process, regarding to a product's system component, has a development project involved and therefore a risk associated to it, the correspondent Project Risk Management (PRM), can be considered as part of the VE's Risk Management (VERM), responsible for the NPD (Fig. 2).

<figure><img src="image_4.png" /><figcaption>Fig. 2. Hierarchical risk level relationship between PRM and CRM</figcaption></figure>
Furthermore, the Process Risk of a given process *n* (PrR*n*), is obtained by considering the risk achieved on its several domains, such as the C*n* (Cost), P*n* (Performance), S*n* (Schedule), etc. Thus, and by knowing that each PRM assesses its correspondent process through its different domains (cost, time and performance), each PRM regarding each process can be linked to the VERM, through the product development, which is considered as the origin of the VE.

Therefore, some studies (e.g. [6][12]) suggests that a given process’s risk, can influence the risk value of the VE’s overall PR (Product Risk) on its different domain. Thus, in study we have considered the following ones, namely, S (Strategic), O (Operations) and F (Finance).

The need of qualifying and even quantifying this influence, is to predict a possible
effect from a given process *n* to the VE's behavior, through the transition from a current
phase into a new one, which results through its application [5]. The categories of the
risk mentioned here, i.e., S (Schedule), P (Performance) and C (Cost), are presented
and discussed on [2-3][7][12], as a set of risk elements that normally concerns the pro-
ject management. Thus, and based on [2-3][6-7], the process risk was defined, as:

* S (Schedule): Accomplishment degree of the timeframe, in order to fulfill the deadlines of the project, according to the initially planned [2].

* P (Performance): Degree of accomplishment, regarding the technical and business goals, related to the project, based on the outputs of the process [6].

* C (Cost): Degree of accomplishment, regarding budget constraints, related to the project [3][7].

Each project, in this way, can impact the corporate risk of the organization, through
their associated domains with it (e.g. O (Operations), S (Schedule), F (Finance), E (En-
vironment) and IS (Information Systems)).

In this case, and as product (VE) domains, it was considered the following ones:

* Strategic risk (S): Related to errors that might be occur, such as a product's technology that might not satisfy the consumer's requirements [3][7].

* Operational risk (O): Regarding the deployment of the process, which includes some of the problems associated to the distribution and also the procurement (e.g. delay related to the production with the product to be launched on market) [2].

* Financial risk (F): Resulted from the product financing (VE) (e.g. access to working capitals, foreign exchange rates, interest rate risk), liquidity problems (e.g. credit risks), among others. [1-2].

Apart from the domains presented here, this model can be also expanded into other
risk categories.

## 2.2 Model's Architecture

The model presented here, was developed according to the concept of NPD (Fig.2), and it's based on a single method to include the uncertainty and ambiguity of human perception on risk assessment (Fig.3) regarding product development.

Therefore, and according to the relation described before (Fig.2), the method described here, recurs to fuzzy logic to perform an analysis (quantitative and qualitative)
of PR's assessment in an OI context. This is performed by integrating process and product development risk levels as unique approach.

<figure><img src="image_5.png" /><figcaption>Fig. 3. Proposed model.</figcaption></figure>

The 1st level, has the purpose of assessing the PRn (process risk by considering a given process n), while the 2nd level, assesses the PR (product risk) level, by considering the InfPRpn (influence related to each process n) on the PR (product's risk) (Fig.3).

Regarding each process risk type, considered on Fig.1 (i.e. S (Schedule), P (Performance) and C (Cost)), there is an individual risk (Rpn), related to each product's process n, which is obtained from each correspondent Ipn (expected impact) and its correspondent Ppn (probability of occurrence) considered here (Fig.3), namely:

$$SR_{Prn} = SP_{Prn} \cdot SI_{Prn} \qquad (1)$$

$$PR_{Prn} = PP_{Prn} \cdot PI_{Prn} \qquad (2)$$

$$CR_{Prn} = CP_{Prn} \cdot CI_{Prn} \qquad (3)$$

Based on Figs.2 and 3, the Process Risk (PrRpn) related to a given process n, is obtained by gathering all of the risk categories referred here, namely:

$$Pr R_{Prn} = \omega_{SR} \cdot SR_{Prn} + \omega_{PR} \cdot PR_{Prn} + \omega_{CR} \cdot CR_{Prn} \qquad (4)$$

Through Fig. 3, there is a set of weights (ωRpn) each one corresponded to a process risk category, namely Schedule (S), Performance (P) and Cost (C). Such weights,
satisfies the following condition:

$$1 = \omega_{SR_{Prn}} + \omega_{TR_{Prn}} + \omega_{CR_{Prn}} \quad (5)$$

A possible influence, concerning each process risk n (PRPR), related to each PD (product development domain), is also accounted in this model by considering the existence of an expected impact variable (I<sub>PR→PD</sub>), that affects one (can be more) product domains. In this work, we have accounted 3 product development domains, on behalf of the VE considered here, i.e.: S (Strategic), O (Operations) and F (Finance). Based on the risks C (Cost), S (Schedule) and P (Performance), it was obtained a set of values of impact, regarding each product development domain (I<sub>PR→PD</sub>) considered here. For each product development domain (PD), and based on the risk manager's perception, only one value is selected, among the different values of influence, from each impact value (I<sub>PR→PD</sub>) for each process domain, namely; Schedule (S), Performance (P) and Cost (C). Thus, and for each product domain, fuzzy logic is used based on a set of qualitative (linguistic) variables and inference rules, in order to achieve the correspondent values of I<sub>PR→PD</sub>. The variable Ind\_Inf<sub>PRn</sub> (indirect influence of a given process n) on each product domain, is obtained by accounting the maximum value of 3 impact values regarding each product domain (I<sub>PR→PD</sub>), obtained before, i.e.:

$$Ind\_Inf_{PRn} = \max\{SI_{PRn→S}, PI_{PRn→S}, CI_{PRn→S}, \dots, SI_{PRn→O}, PI_{PRn→O}, CI_{PRn→O}\} \quad (6)$$

The direct influence, resulted from the impact of each process domain, is also considered here, to account the possible impact of the resources used on each process, over the resources applied on the NPD context, in terms of its availability.

Therefore, the process domain that brings more impact, allows the definition of the direct influence, regarding a certain process n (Dir\_Inf<sub>PRn</sub>), which is defined, by obtaining the maximum of the 3 values mentioned above, namely:

$$Dir\_Inf_{PRn} = \max\{SI_{PRn}, PI_{PRn}, CI_{PRn}\} \quad (7)$$

Thus, the total influence from a given process n on product development (InfPR<sub>PRn</sub>) will be obtained through the sum of Ind\_Inf<sub>PRn</sub> with the Dir\_Inf<sub>PRn</sub>, i.e.:

$$InfPR_{PRn} = Ind\_Inf_{PRn} \cdot \omega_{Ind} + Dir\_Inf_{PRn} \cdot \omega_{Dir} \quad (8)$$

The weights ω<sub>Dir</sub> and ω<sub>Ind</sub>, are corresponded each one, to the direct and indirect influence, with the purpose of ponder the relative importance, defined by the risk manager for each one of the values achieved before. All of these weights, complies with the following expression/condition:

$$1 = \omega_{Dir.} + \omega_{Ind.} \quad (9)$$

Thus, the product development risk for each project n (PRPR), is resulted from the combination of the P<sub>PR→PD</sub> (probability of occurrence of the event), the I<sub>PR→PD</sub> (expected impact of PR in the organization) and the InfPR<sub>PRn</sub> (influence from the process n on product development), i.e.:

$$PR_{PRn} = P_{PR→PD} \cdot I_{PR→PD} \cdot InfPR_{PRn} \quad (10)$$

With I<sub>PR→PD</sub> and P<sub>PR→PD</sub>, being the external impact in a given product domain (PD) (I<sub>PR→PD</sub>) and the correspondent value of probability of occurrence (P<sub>PR→PD</sub>). Both
values, results from the selection of the maximum product value, regarding each product domain (PD) considered here (i.e. S (Strategic), F (Finance) and O (Operations)), namely:

$$ \langle I_{PR \to PD}, P_{PR \to PD} \rangle = \max \{ I_{PR \to S} \times P_{PR \to S}, I_{PR \to O} \times P_{PR \to O}, \dots, I_{PR \to PD} \times P_{PR \to PD} \} \quad (11) $$

The Product Risk (PR), is therefore obtained from the contribution of each Process Risk (PrRPm) considered, and according to its relative importance ($\omega_{Pm}$), i.e.:

$$ PR = \omega_{Pr1} \cdot PR_{Pr1} + \omega_{Pr2} \cdot PR_{Pr2} + \omega_{Prn} \cdot PR_{Prn} $$

(12)

Where $\omega_{Pr1}$, $\omega_{Pr2}$ and $\omega_{Pm}$, are weights, used to define the relative importance for the process's 1, 2 and n.

## 2.3 Fuzzy Deployment

The risk levels, regarding the values of PrRPm and PR, results from each correspondent FIS (Fuzzy Inference System) (Fig.3) considered here and following a set of IF-AND-THEN heuristic rules (by impact category). Through Fig.3 and regarding the Process Risk Level, the FIS F1, follows the (1-3) expressions, related to the inputs $I_{Pm}$ and $P_{Pm}$, namely:

$$ \neg R_{Pm} = \neg P_{Pm} \cap \neg I_{Pm} \quad (13) $$

Therefore, the heuristic rules, concerning the FIS F1 (Fig. 4), are defined according to the sentence: "IF $I_{Pm}$ (Impact) is I AND $P_{Pm}$ (probability of occurrence) is P, THEN the $R_{Pm}$ (process risk) is R".

A similar logic, based on (10), can also be performed, for the $PR_{Pm}$ (Product Risk level), although, by also accounting the influence related to process n on product development ($InfPR_{Pm}$), i.e.:

$$ PR_{Pm} = P_{PR \to PD} \cap I_{PR \to PD} \cap InfPR_{Pm} \quad (14) $$

Therefore, the heuristic rules, regarding FIS F3 (Fig. 4), can be stated as: "IF $InfPR_{Pm}$ (Process n Influence on Product) is Inf AND $P_{PR \to PD}$ (probability of occurrence) is P AND $I_{PR \to PD}$ (impact) is I, THEN product risk level (PR) is PR (Fig. 3).

The possible influence of the process n, regarding each VE domain, can also be accounted by recurring to FIS F2 (Fig.3), to perform the follow statement: "IF $CI_{Pm \to PD}$ (impact) is Ic AND $PI_{Pm \to PD}$ (impact) is Ip AND $SI_{Pm \to PD}$ (impact) is, THEN the average value of process n impact over each one of the product domains $I_{Pm \to PD}$ is Inf".

## 2.4 Linguistic Variables

Regarding the number of linguistic levels, and according to [11], it's normally advised that this value should not exceed 9 levels, since it represents the limits of human perception in terms of discrimination. Thus, and based on such recommendations, the linguistic variables were established in order to not surpass 5 levels, with each one, having a pertinence function of the triangular type. For all the domains of the process's probability of occurrence ($P_{Pm}$), on Table 1, are shown the pertinence functions.

Similar table was also performed, by considering the probability of occurrence of
the product's risk ($P_{PR→PD}$). The pertinence functions, regarding the different expected impacts, considered for each process $n(I_{Prn})$, are presented on Table 2.

Similar table was also used, related to the correspondent (and also expected) $I_{Pm→PD}$ (impact values regarding each process domain over each product domain) considered in this work. On Table 3, it's presented the pertinence functions, regarding the process risk ($R_{Prn}$) for each process domain. Similar table was also considered for $PR_{Prn}$.

<table><caption>**Table 1.** Pertinence functions, regarding the probability of occurrence (P)</caption><thead><tr><th>Pertinence Levels</th><th>Description</th><th>Frequency</th><th>Fuzzy Parameters [α, β, γ]</th></tr></thead><tbody><tr><td>Rare</td><td>It is estimated that the event will occur only in exceptional circumstances.</td><td>Event has occurred or is expected to occur once in the next 48 months</td><td>(0, 0, 0.25)</td></tr><tr><td>Unlikely</td><td>The event is not likely, but it can occur.</td><td>Event has occurred or is expected to occur once in the next 24 months</td><td>(0, 0.25, 0.50)</td></tr><tr><td>Likely</td><td>Probable occurrence event</td><td>Event has occurred or is expected to occur once in the next 18 months</td><td>(0.25, 0.50, 0.75)</td></tr><tr><td>Very Likely</td><td>The event will likely occur</td><td>Event has occurred or is expected to occur once in the next 12 months</td><td>(0.5, 0.75, 1.0)</td></tr><tr><td>Expected</td><td>The event is expected to occur</td><td>Event has occurred or is expected to occur once in the next 6 months</td><td>(0.75, 1, 1)</td></tr></tbody></table>

<table><caption>**Table 2.** Pertinence functions, for each impact (I) and process domain</caption><thead><tr><th rowspan="2">Pertinence Levels</th><th colspan="3">Process Domain</th><th rowspan="2">Fuzzy Parameters [α, β, γ]</th></tr><tr><th>Schedule (S)</th><th>Performance (P)</th><th>Cost (C)</th></tr></thead><tbody><tr><td>Neglectable</td><td>Insignificant impact on the processes required to obtain deliverables. No changes in established activities</td><td>Insignificant impact on the initial project budget (&lt;2%)</td><td>Timing delay is easily recoverable.</td><td>(0,0.25)</td></tr><tr><td>Low</td><td>Prevents the fulfillment of one or more activities established for each project task. No task changes.</td><td>Low impact on project budget (2-5%)</td><td>Low schedule delay is not recoverable.</td><td>(0.25, 5.0)</td></tr><tr><td>Moderate</td><td>Prevents the fulfillment of one or more tasks. No requirement changes.</td><td>Moderate impact on the initial project budget (5-10%)</td><td>Moderate delay in the completion of the project. Without compromising the project requirements.</td><td>(2.5, 5.0, 7.5)</td></tr><tr><td>High</td><td>Prevents the fulfillment of one or more project requirements. Scope change required.</td><td>High impact on the initial project budget (10-30%)</td><td>Acceleration in the fulfillment of tasks with anticipation of the project calendar.</td><td>(5, 0.75, 5.10)</td></tr><tr><td>Severe</td><td>It prevents the fulfillment of the project's objective (ε), and it is not possible to achieve it even with changes in scope.</td><td>Impact on the initial heavy budget making the project unfeasible (&gt;30%)</td><td>Project deadline exceeded making it impossible to complete the project since the project is no longer adequate to the organizational reality.</td><td>(7.5, 10.0, 10.0)</td></tr></tbody></table>

<table><caption>**Table 3.** Pertinence functions, regarding the product risk level</caption><thead><tr><th>Pertinence Levels</th><th>Description</th><th>Fuzzy Parameters [α, β, γ]</th></tr></thead><tbody><tr><td>Very low</td><td>Risk can be accepted as it does not pose a threat to the project/organization, it must be monitored to ensure that its level does not change.</td><td>(0, 0, 0.25)</td></tr><tr><td>Low</td><td>Risk can be accepted. Risk control must be carried out based on a cost-benefit analysis</td><td>(0, 0.25, 0.50)</td></tr><tr><td>Moderate</td><td>Risk must be mitigated; the effectiveness of controls must be monitored.</td><td>(0.25, 0.50, 0.75)</td></tr><tr><td>High</td><td>Efforts should be made to mitigate risk as soon as possible.</td><td>(0.50, 0.75, 1.0)</td></tr><tr><td>Very High</td><td>Immediate action must be taken to mitigate the risk.</td><td>(0.75, 1.0, 1.0)</td></tr></tbody></table>

## 2.5 Software Implementation

The inference rules, as well as the definition of the membership functions, was built, by using Matlab® Fuzzy Logic Toolbox™ (version R2016a) software, to develop and assess each FIS (Fuzzy Inference System) behavior.
All the three FIS, considered here (i.e. F1, F2 and F3), were implemented by recur-
ring to Mamdani's inference system (Fig. 4), due to its wide acceptance on literature
and better adaptation to human inputs[11].

Regarding the Pr level, F1 has its inputs based on the $\bar{P}_{Prn}$ (Probability of occur-
rence), and its correspondent $\bar{I}_{Prn}$ (expected impact value), with the output, being the $\bar{R}_{Prn}$ (Process Risk Level) related to each process domain considered. Regarding the
implementation of FIS F2, it has on its inputs the expected impact variables $SI_{Prm \to PD}$,
$PI_{Prm \to PD}$ and $CI_{Prm \to PD}$, where the output of F2 is $\bar{I}_{Prm \to PD}$ (average impact concerning
process n, related to each domain of the product).

<figure><img src="image_6.png" /><figcaption>Fig. 4. FIS’s deployment on Matlab</figcaption></figure>

The inputs of FIS F3, are the variables $P_{PR \to PD}$, $I_{PR \to PD}$ and $InfPR_{Prn}$, while the output consists of the variable product risk level (PR) from Process $n$ ($PR_{Prn}$).

Regarding the available defuzzification approaches, it was used the centroid
method, for each FIS proposed in this paper, given its widely application ([11]).

Regarding the FIS “F1”, on Fig. 5, it is presented the surfaces, regarding each risk
category (domain) of the process, considered in this work.

<figure><img src="image_7.png" /><figcaption>Fig. 5. FIS’s surface, for each process level domain (F1) a) Schedule b) Performance c) Cost</figcaption></figure>

The differences achieved with the three obtained surfaces, are mainly resulted from
the difference with the inference rules, regarding each domain considered, which allows
the achievement of different output combinations regarding the same values of inputs.

3 Case Study

A case study was used to assess the model’s robustness, which was based on a VE,
established in order to develop an electric vehicle in open innovation context, to achieve
different innovations, with one of them related to its autonomy.

This VE, is based on a collaboration network, formed by 14 partners, which in-
volves several industries and 2 research centers, regarding to each car part.
The purpose, was to share the resources, skills, and core competencies among the partners involved in order to obtain a set of innovations around the product development, which includes a better response to the market requirements, the reduce of time to market, and the increase of the credibility of the project to obtain the necessary funds from the European union and private investors.

Other innovations have been achieved within the car and through the development of the different car's components, essential to build the vehicle according to the purposes of the virtual enterprise. From all the processes, involved on VE's product development, we have selected a set of 5 processes, which are presented on Table 4.

<table><caption>**Table 4.** OI's partners</caption><thead><tr><td>Pr.</td><td>Prod. Ref.</td><td>Description</td><td>Actors Involved</td></tr></thead><tbody><tr><td>...</td><td>...</td><td>...</td><td>...</td></tr><tr><td>1</td><td>K01Pr2</td><td>Traction control system</td><td>P8,P7</td></tr><tr><td>2</td><td>K02Pr2</td><td>HMI development software</td><td>P2,P11</td></tr><tr><td>3</td><td>K87Pr2</td><td>GPS Navigation System</td><td>P4</td></tr><tr><td>...</td><td>...</td><td>...</td><td>...</td></tr><tr><td>4</td><td>K02Pr3</td><td>Chassis' design</td><td>P2,P5,P9</td></tr><tr><td>...</td><td>...</td><td>...</td><td>...</td></tr><tr><td>5</td><td>K01Pr5</td><td>New Protocol Communication (car lights, error code diagnosis)</td><td>P5, P6</td></tr><tr><td>...</td><td>...</td><td>...</td><td>...</td></tr></tbody></table>

As it described on Table 4, each process is related to a given car (product) part, whose responsibility (in some cases), can be shared by more than one OI's partner.

Each process has different risk types, namely the performance (ex.: failure on meeting a set of requirements defined to the traction control system), cost (ex.: unexpected costs related to the car chassis) and schedule (ex.: non-compliance related to the deadlines with navigation (GPS) system design).

Based on the model, presented on Fig.3, and regarding its application, a group of risk managers, each one, regarding each network partner (and therefore each process), have assessed the process involved here, on behalf of the 17 variables to use, and regarding the inputs of the model, shown on Fig.3.

Thus, on Table 5 are described the same inputs, as well as the inputs, regarding the different weights. Such results, presented on Table 5, and based on qualitative (linguistic) values, were further converted into a quantitative ones, by using a series of intervals, to improve the analysis of the obtained results, concerning the 5 project considered here, including the overall product development risk as well.

Table 6, presents the main output values from the model, which includes the weight values ($\omega_{SRn}$, $\omega_{PRn}$, $\omega_{SRn}$), related to the process risk level, the weight values ($\omega_{Dir}$, $\omega_{Ind}$) related to the influence of each process n and finally, the weight values $\omega_{Prn}$, (regarding the product level) related to each process n.

Based on the results presented on Table 5 and 6, we verify that the process nr. 3, is more likely to violate the initial budget, which brings more risk. However, and given its reduced influence over the product under development, the PR's value from process number 3 ($PR_{Pr3}$) are small, with the contribution to the product risk, being even smaller, becoming almost neglectable, given the $\omega_{PRn}$ (relative importance), defined by the risk manager.
<table><caption>**Table 5.** Inputs used and obtained outputs</caption><thead><tr><th rowspan="2">N.</th><th rowspan="2">Pr.</th><th colspan="8">FIS F1</th><th colspan="3">FIS F3</th></tr><tr><th>SI<sub>Prn</sub></th><th>SP<sub>Prn</sub></th><th>PI<sub>Prn</sub></th><th>PP<sub>Prn</sub></th><th>CI<sub>Prn</sub></th><th>CP<sub>Prn</sub></th><th>I<sub>aro</sub></th><th>P<sub>aro</sub></th><th>InfP<sub>Prn</sub></th></tr></thead><tbody><tr><td rowspan="5">Inputs</td><td>1</td><td>Insignificant</td><td>Low</td><td>Low</td><td>Rare</td><td>Rare</td><td>Unlikely</td><td>Insignificant</td><td>Insignificant</td><td>Insignificant</td></tr><tr><td>2</td><td>Low</td><td>Moderate</td><td>Low</td><td>Unlikely</td><td>Unlikely</td><td>Unlikely</td><td>Moderate</td><td>Low</td><td>Low</td></tr><tr><td>3</td><td>Insignificant</td><td>Low</td><td>Moderate</td><td>Likely</td><td>Likely</td><td>Likely</td><td>Moderate</td><td>Moderate</td><td>Moderate</td></tr><tr><td>4</td><td>Insignificant</td><td>Low</td><td>Moderate</td><td>Very likely</td><td>Expected</td><td>Expected</td><td>High</td><td>Moderate</td><td>High</td></tr><tr><td>5</td><td>Low</td><td>Moderate</td><td>Moderate</td><td>Expected</td><td>Expected</td><td>Expected</td><td>Severe</td><td>Low</td><td>Severe</td></tr></tbody></table><table><thead><tr><th rowspan="2">N.</th><th rowspan="2">Pr.</th><th colspan="8">FIS F2</th><th colspan="3">FIS F3</th></tr><tr><th>SI<sub>Prn</sub></th><th>PI<sub>Prn</sub></th><th>CI<sub>Prn</sub></th><th>SI<sub>aro</sub></th><th>PI<sub>aro</sub></th><th>CI<sub>aro</sub></th><th>SI<sub>var</sub></th><th>PI<sub>var</sub></th><th>CI<sub>var</sub></th></tr></thead><tbody><tr><td rowspan="5">Inputs</td><td>1</td><td>Insignificant</td><td>Insignificant</td><td>High</td><td>Insignificant</td><td>Insignificant</td><td>Insignificant</td><td>Low</td><td>Insignificant</td><td>High</td></tr><tr><td>2</td><td>Low</td><td>Moderate</td><td>Low</td><td>Severe</td><td>Moderate</td><td>Low</td><td>Insignificant</td><td>Severe</td><td>Low</td></tr><tr><td>3</td><td>Moderate</td><td>Moderate</td><td>Moderate</td><td>Moderate</td><td>Insignificant</td><td>Moderate</td><td>Moderate</td><td>Moderate</td><td>Moderate</td></tr><tr><td>4</td><td>High</td><td>Moderate</td><td>High</td><td>High</td><td>Moderate</td><td>High</td><td>Low</td><td>High</td><td>High</td></tr><tr><td>5</td><td>Severe</td><td>Severe</td><td>Low</td><td>Severe</td><td>Low</td><td>Severe</td><td>Low</td><td>Severe</td><td>Low</td></tr></tbody></table><table><thead><tr><th rowspan="2">Pr.</th><th rowspan="2">Pr.</th><th colspan="8">FIS F1</th><th colspan="3">FIS F2</th><th colspan="3">FIS F3</th><th colspan="3">Legend (variable levels)</th></tr><tr><th>SR<sub>Prn</sub></th><th>PR<sub>Prn</sub></th><th>CR<sub>Prn</sub></th><th>ω<sub>SR</sub></th><th>ω<sub>PR</sub></th><th>ω<sub>CR</sub></th><th>ω<sub>Ind.</sub></th><th>ω<sub>Dir.</sub></th><th>PR<sub>Prn</sub></th><th>PR<sub>Prn</sub></th><th>ω<sub>PRn</sub></th><th>PR<sub>Prn</sub></th><th>Linguistic</th><th>Numeric</th><th>(1)</th><th>(2)</th></tr></thead><tbody><tr><td rowspan="5">Outputs</td><td>1</td><td>1,75</td><td>3,35</td><td>7,12</td><td>0,27</td><td>0,21</td><td>0,52</td><td>0,62</td><td>0,38</td><td>4,88</td><td>3,80</td><td>0,21</td><td>0,80</td><td></td><td></td><td></td><td></td></tr><tr><td>2</td><td>3,90</td><td>5,62</td><td>2,70</td><td>0,36</td><td>0,14</td><td>0,50</td><td>0,59</td><td>0,41</td><td>3,54</td><td>5,23</td><td>0,19</td><td>0,99</td><td></td><td></td><td></td><td></td></tr><tr><td>3</td><td>0,67</td><td>3,32</td><td>5,72</td><td>0,30</td><td>0,22</td><td>0,48</td><td>0,47</td><td>0,53</td><td>5,60</td><td>3,70</td><td>0,17</td><td>0,63</td><td></td><td></td><td></td><td></td></tr><tr><td>4</td><td>1,12</td><td>7,49</td><td>5,87</td><td>0,39</td><td>0,17</td><td>0,44</td><td>0,57</td><td>0,43</td><td>4,29</td><td>4,95</td><td>0,22</td><td>1,09</td><td></td><td></td><td></td><td></td></tr><tr><td>5</td><td>3,18</td><td>5,20</td><td>8,70</td><td>0,37</td><td>0,13</td><td>0,50</td><td>0,47</td><td>0,53</td><td>6,20</td><td>6,36</td><td>0,21</td><td>1,34</td><td></td><td></td><td></td><td></td></tr><tr><td colspan="2">Product Risk (PR)</td><td colspan="8"></td><td colspan="3">4,85</td></tr></tbody></table>

<table><caption>**Table 6.** Outputs, regarding the process and product risks</caption><thead><tr><th>Pr.</th><th>SR<sub>Prn</sub></th><th>PR<sub>Prn</sub></th><th>CR<sub>Prn</sub></th><th>ω<sub>SR</sub></th><th>ω<sub>PR</sub></th><th>ω<sub>CR</sub></th><th>ω<sub>Ind.</sub></th><th>ω<sub>Dir.</sub></th><th>PR<sub>Prn</sub></th><th>PR<sub>Prn</sub></th><th>ω<sub>PRn</sub></th><th>PR<sub>Prn</sub></th><th>Linguistic</th><th>Numeric</th><th>(1)</th><th>(2)</th></tr></thead><tbody><tr><td>1</td><td>1,75</td><td>3,35</td><td>7,12</td><td>0,27</td><td>0,21</td><td>0,52</td><td>0,62</td><td>0,38</td><td>4,88</td><td>3,80</td><td>0,21</td><td>0,80</td><td></td><td></td><td></td><td></td></tr><tr><td>2</td><td>3,90</td><td>5,62</td><td>2,70</td><td>0,36</td><td>0,14</td><td>0,50</td><td>0,59</td><td>0,41</td><td>3,54</td><td>5,23</td><td>0,19</td><td>0,99</td><td></td><td></td><td></td><td></td></tr><tr><td>3</td><td>0,67</td><td>3,32</td><td>5,72</td><td>0,30</td><td>0,22</td><td>0,48</td><td>0,47</td><td>0,53</td><td>5,60</td><td>3,70</td><td>0,17</td><td>0,63</td><td></td><td></td><td></td><td></td></tr><tr><td>4</td><td>1,12</td><td>7,49</td><td>5,87</td><td>0,39</td><td>0,17</td><td>0,44</td><td>0,57</td><td>0,43</td><td>4,29</td><td>4,95</td><td>0,22</td><td>1,09</td><td></td><td></td><td></td><td></td></tr><tr><td>5</td><td>3,18</td><td>5,20</td><td>8,70</td><td>0,37</td><td>0,13</td><td>0,50</td><td>0,47</td><td>0,53</td><td>6,20</td><td>6,36</td><td>0,21</td><td>1,34</td><td></td><td></td><td></td><td></td></tr><tr><td colspan="2">Product Risk (PR)</td><td colspan="8"></td><td colspan="3">4,85</td></tr></tbody></table>

The process that will bring more threats to the NPD's manager is Pr5 (process number 5), due to its high risk's value, which is achieved through $PR_{Pr5}$, and also, by its influence over Product Risk, being therefore expressed through the risk on the product from $PR_{Pr5}$ (process number 5). This analysis, also allows to identify the process that has high risk, as well as the cause associated to it, with the purpose of studying new measures/actions to reduce the risk associated, even before the development of the process number 5. Through the results referred above, it can be possible to reorder the 5 process's, by prioritizing them, based on the risks related ($PrR_{Prn}$). The process with more risk is number.5 (Pr5), followed by the processes Pr 3, Pr1, Pr 4 and Pr 2.

## 4 Conclusions of the Work

The aim of this work, was to develop an approach to evaluate the VE's product risk, in an OI context, not only by accounting the different risks related to each process domain of the VE's product, but also, by considering the possible influence regarding each process risk on the VE's overall risk through its different domains.

The obtained results, allows to show the influence that each process can have on each VE's domain, and therefore into its overall risk, being therefore an advantage, when compared to other methods, since it can assess the contribution (in terms of risk) of each process into to the VE's overall risk.

Furthermore, the approach developed in this work, allows the evaluation and prioritization of each process considered here, based on its risk. The method also provides information regarding the source of risk that contributes to the VE's overall risk, allowing therefore to identify the OI's partner that contributes more to the VE's overall risk.
Nevertheless, the deployment of FIS's to evaluate the several risks considered here, have reduced the ambiguity and uncertainty, related with risk analysis.

A future work should also analyze the risk concerning each individual activity as-
sociated to each process, by accounting the threats and the opportunities.

**Acknowledgements.** This work, was in part supported by IPL (Polytechnic Insti-
tute of Lisbon) through the IDI&CA (Projects for Research, Development, Innovation
and Artistic Creation) context, on behalf of the research and development project
ANEEC - Assessment of the level of business efficiency to increase competitiveness,
IPL/2020/ANEEC_ISCAL. Partial support also from the Center of Technology and
Systems – UNINOVA, and the FCT Foundation (project UIDB/00066/2020).

**References**

1. Mansor, N., Yahaya, S., N., and Okazaki, K., Risk factors affecting new product development (NPD), *Int. J. Recent Res. Appl. Stud.*, vol. 27, no. 1,18-25 (2016)

2. Abreu, A., Martins, J.,M., Calado, M.F.J., A fuzzy reasoning approach to assess innovation risk in ecosystems. Open Engineering, vol.8, 551-561 (2018)

3. Coras, E.L., Tantau, A.,D.: A risk mitigation model in SME's open innovation projects, Management & Marketing, Economic Publishing House, vol. 8, no.2 (2013)

4. Camarinha-Matos, L.M. and Afsarmanesh, H.: A Comprehensive Modeling Framework for Collaborative Networked Organizations. *Journal of Intelligent Manufacturing*, vol. 5, no.18, pp. 529-542 (2007) doi:10.1007/s10845-007-0063-3.

5. Rosas J., Macedo P., Tenera A., Abreu A., Urze P.: Risk Assessment in Open Innovation Networks. In: Camarinha-Matos L., Bénaben F., Picard W. (eds) Risks and Resilience of Collaborative Networks. PRO-VE 2015. IFIP Advances in Information and Communication Technology, vol 463. Springer, Cham (2015)

6. Kim, Y., Vonortas, N. S. Managing risk in the formative years: Evidence from young enterprises in Europe. Technovation.: vol. 8, no.34, 454-465 (2014)

7. Song, W., Ming, X., & Xu, Z.: Risk evaluation of customer integration in new product de-
velopment under uncertainty, Computers & Industrial Engineering, vol.3, 402-412 (2013)

8. Xiaoren, Z., Ling, D., Xiangdong, C.: Interaction of open innovation and business ecosystem. International Journal of u-and e-Service, Science and Technology, vol.1, no.7, 51-64 (2014)

9. Rossi, B., Russo, B., Succi, G.; Adoption of free/libre open source software in public organ-
izations: factors of impact. Information Technology & People, vol. 2, no.25, 156-187 (2012)

10. Abreu, A., Martins, J. and Calado, J.,M.,F.: Fuzzy Logic Model to Support Risk Assessment in Innovation Ecosystems. In: 13th CONTROLO, Ponta Delgada, pp. 104-109 (2018)

11. Meyer, W. G. Quantifying risk: measuring the invisible. Paper presented at PMI® Global Congress 2015 EMEA, London, England. Newtown Square, PA: PMI (2015)

12. Grace, M. F., Leverty, J. T., Phillips, R. D., Shimpi, P.: The value of investing in enterprise risk management. Journal of Risk and Insurance, vol. 2, no. 82, 289-316 (2015)