A Predictive Control Architecture for Information Technology Program Portfolio Risk Management Using Causal Machine Learning

There is something formally unusual about how most IT program portfolios are governed. At each reporting interval, performance data comes in, risk scores get generated, and governance teams have to decide which investments need escalation, which interventions to apply, and how to spread limited oversight resources across what can be dozens of concurrent programs. Strip away the terminology and this is a control problem in the classical sense. A reference trajectory exists: every investment on schedule and within budget. The current state is observable through performance metrics and model-generated risk scores. Control inputs exist too, in the form of governance interventions that can alter the trajectory of an at-risk investment. Yet, as far as we are aware, this framing has not shown up in the project management or IT governance literature.

What governance offices do looks more like proportional threshold control: a risk score crosses a line, and the investment gets escalated. We ask what a more deliberate version of that decision problem would look like, and what it would take to build it responsibly.

One question sits at the center of this: explainable machine learning tools, SHapley Additive exPlanations (SHAP) in particular, are now routinely used to tell governance teams which project characteristics drive predicted risk. It is easy to treat those attribution scores as a ready-made intervention guide. We test that assumption directly, and the answer turns out to be partly yes and partly no. SHAP measures how a feature associates with a model's prediction. It does not measure what happens if you actually intervene on that feature. The two line up only when there is no confounding, which is rarely true of observational governance data. We estimate the real causal effect of three governance interventions using inverse probability weighting (IPW), set those effects against SHAP attribution computed from the same data, and follow the consequence of any mismatch all the way through to an actual governance decision, using a Model Predictive Control (MPC) architecture as the mechanism that makes that decision.

What we find is more specific, and more useful, than a flat verdict on whether SHAP can be trusted. SHAP correctly picks out the single most causally effective intervention in this dataset, cost variance control enforcement. It gets the other two wrong relative to each other, understating how protective a defined iteration cadence really is while overstating incremental development adoption. Run the numbers through a Monte Carlo simulation of the governance controller, though, and this particular mistake barely moves the outcome, because governance effort concentrates on the lever both methods agree matters most. That does not mean attribution method never matters. It means we now have a specific, testable condition under which it matters less than you might expect, and, by the same logic, a condition under which it would matter far more.

This paper contributes four things. First, a formally specified MPC architecture for IT portfolio governance. Second, causal estimates of governance intervention effects via IPW, built on an adjustment set we document in full and bootstrap uncertainty we report rather than assume. Third, a direct, same-data comparison between associational and causal effect sizes that shows both where they diverge and where that divergence does, and does not, change a governance decision. Fourth, an honest accounting of what cross-sectional data can and cannot support: portfolio dynamics here are a stated assumption, tested through sensitivity analysis, not a claim the data itself could ever justify.

Section 2 covers related work. Section 3 lays out the proposed methodology: control architecture, mathematical formulation, and causal gain estimation. Section 4 describes the experimental setup. Section 5 gives results. Section 6 discusses implications and limitations. Section 7 concludes.

3.2 Governance interventions

Three interventions serve as control inputs, labeled T1 through T3. T1 is adopting an incremental development methodology for investments not already using it. T2 is enforcing cost variance control, keeping absolute cost variance inside a 5 percent band. T3 is adopting a defined iteration cadence. A fourth comparison, T4, major versus standard investment classification, is handled separately, as a structural comparison rather than a control input, since a natural classification variable has no business sitting in the same input vector as interventions someone can actually choose to apply.

3.3 System components

Three components make up the architecture. The state estimator is an Extreme Gradient Boosting (XGBoost) classifier [9] trained only on structural investment characteristics, with T1 through T3 deliberately left out, producing a probabilistic risk estimate for each investment. The plant model is a state space representation whose control gain matrix carries the IPW-estimated causal effect of each intervention. The controller runs a finite-horizon optimization over that plant model, constrained by how many interventions can actually be applied per period. Figure 1 lays out the resulting architecture.

3.4 State space representation

For a portfolio of N investments, we represent the risk dynamics as:

$r(k+1)=a \cdot r(k)+B u(k)+d(k)$   (1)

Here r(k) is the risk state vector at period k, u(k) is the binary intervention vector, B is the control gain matrix built from the IPW-estimated ATEs in Section 3.8, d(k) is a stochastic disturbance term, and a is scalar persistence parameter.

The persistence parameter a needs its own discussion. Our dataset is cross-sectional: every investment appears once, with no genuine period-over-period record of its own risk trajectory. So a cannot be, and is not, pulled from longitudinal autocorrelation, because that data simply is not there. We treat it instead as a stated modeling assumption and report results across a sensitivity range in Section 5 (a = 0.70, 0.80, 0.90) rather than commit to one number. Investments are modeled as decoupled, a diagonal state transition, which also means no off-diagonal coupling terms are derived from SHAP attribution. Given our own finding that SHAP does not reliably capture causal structure, using it to build part of the state matrix would have undercut the paper's own argument.

3.5 Control problem

At each period, the controller solves:

$\min J=\Sigma[r(t) Q r(t)+u(t) R u(t)]$    (2)

Subject to the dynamics in Eq. (1), a resource constraint capping applied interventions per period at a fixed budget U_max, and an eligibility rule barring an intervention already present for a given investment from being reapplied. Here Q and R are weighting matrices that penalize portfolio risk and intervention effort, respectively, and the sum runs over the prediction horizon.

3.6 Why attribution scores are not control gains

SHAP values measure how sensitive a trained model's output is to a feature within the data it was trained on. That is not the same as measuring how the outcome actually responds if you intervene on that feature. The two line up only without confounding, a condition that rarely holds when interventions get adopted selectively by agencies or investments that already differ systematically in other ways [10]. Recent formal work goes further and proves that certain SHAP score definitions can assign misleading importance under identifiable conditions [11]. Feature dependence adds another layer: correlated or interacting features can distort marginal attribution even when confounding is not the issue [12, 13].

3.7 Adjustment sets and identification

For each intervention, we chose a confounder set based on domain knowledge, variables plausibly affecting both treatment adoption and outcome, observable independent of the treatment decision, and not sitting on the causal pathway between treatment and outcome. Table 1 lists the treatment, outcome, and adjustment set used for each intervention. We left investment status at the time of reporting out of the adjustment set on purpose, since it is measured at the same time as the outcome and risks acting as a collider rather than a genuine confounder [14].

Table 1. Treatments, outcome, and adjustment sets

3.8 Inverse probability weighting estimation and results

We estimated propensity scores with logistic regression, class-weight balanced, on the documented adjustment set, following standard propensity score practice for adjusting confounding in observational data [15, 16]. Average treatment effects (ATEs) came from IPW, with 95 percent confidence intervals built from 500 bootstrap iterations [17]. We also computed E-values [18] to gauge how robust these effects are to unmeasured confounding. Table 2 lays out the full results alongside the mean absolute SHAP value for each intervention, from a model trained separately, specifically for this comparison.

Table 2. Causal average treatment effects (ATEs), bootstrap confidence intervals, E-values, and SHapley Additive exPlanations (SHAP) comparison

All three interventions show protective effects that are statistically significant. T2, cost variance control, has both the largest causal effect and the highest SHAP importance. T1 and T3 sit close together in true causal magnitude, -0.0660 and -0.0678, yet SHAP rates T1 higher (0.1845 against 0.0816), flipping their actual order. E-values between 1.67 and 2.98 mean a fairly strong unmeasured confounder would be needed to explain these effects away entirely; we report that as a robustness bound, not as proof there is no such confounder. Because these ATEs come from cross-sectional data, we treat each one as a fixed, constant gain applied at every period of the simulation described in Section 4.2, rather than as a dynamically re-estimated effect. That is a modeling simplification, stated here explicitly, and it carries the same caveat as the persistence parameter a in Section 3.4: it is a stated assumption, not a claim this dataset could support empirically.

We set out a predictive control architecture for IT portfolio governance, parameterized with causally estimated rather than associational intervention effects. Using real IPW estimation, a documented adjustment set, and bootstrap uncertainty quantification, we found three governance interventions with statistically significant protective effects. Set against SHAP-based attribution, the picture that emerges is a real but conditional divergence: SHAP gets the dominant lever right and the secondary ones wrong, and that divergence has almost no bearing on aggregate governance outcomes precisely when the dominant lever is the one correctly identified, a result that held across every resource constraint we tested. The natural next step is extending this architecture to genuinely longitudinal portfolio data, where the persistence assumption used here could give way to a directly estimated dynamic model.