Project Risk Assessment of Renewable Energy Projects in Electricity Market Structures: A Systematic Literature Review

Abstract

Risk assessment frameworks for renewable energy projects are predominantly designed for liberalised electricity markets, leaving state-dominated and single-buyer systems analytically underserved. This systematic literature review (SLR) synthesises 116 peer-reviewed studies (2015–2026) following a PRISMA-compliant, Kitchenham-guided protocol to identify and critically evaluate project-level risks and assessment methodologies across diverse electricity market structures. Three contributions are made: (i) a market-structure-differentiated risk taxonomy showing how risk profiles differ structurally across liberalised, hybrid, and single-buyer markets; (ii) the Integrated Risk Assessment Framework for Renewable Energy Projects (IRAF-REPs), a five-layer architecture connecting market structure context, risk category taxonomy, assessment methods, project lifecycle phases, and risk-register standards (ISO 31000/COSO); and (iii) a structured three-horizon future research agenda. Market/price risk (~68%) and policy/regulatory risk (~58%) dominate the reviewed literature, while counterparty/PPA risk—dominant in single-buyer contexts—is largely absent from quantitative frameworks. Monte Carlo simulation and real options analysis lead quantitative practice in liberalised-market studies; the hybrid Monte Carlo-System Dynamics (MC-SD) combination appears in fewer than 4% of studies despite its conceptual suitability for single-buyer contexts. Five research gaps are identified. Findings advance SDG 7, SDG 13, and SDG 9, with direct governance relevance for Indonesia/PLN and comparable Global South economies.

1. Introduction

1.1. Context and Motivation

The rapid global scale-up of renewable energy—solar photovoltaic, wind, geothermal, and hydropower—requires not only advances in technology and policy but also robust, quantitative frameworks for assessing project-level risk. Renewable energy projects are capital-intensive, long-lived infrastructure assets embedded within electricity market structures that fundamentally shape their financial viability and risk exposure. A solar project in Germany’s liberalised wholesale market faces predominantly stochastic price risk, addressable through Monte Carlo simulation and real options analysis. The same project in Indonesia, where PT PLN (Persero) acts as the sole electricity purchaser under a Power Purchase Agreement (PPA), faces counterparty risk, regulatory-discretion risk, and currency risk—a structurally different engineering-economic challenge requiring a structurally different analytical response.

Electricity demand in Southeast Asia is projected to nearly double by 2040 [1,2], requiring approximately USD 5.7 trillion in annual global investment through 2030 [3]. Yet the majority of developing economies operate under state-dominated or single-buyer electricity structures [4] for which the standard toolkit of Monte Carlo price simulation and real options analysis is necessary but insufficient. Indonesia’s state-owned utility PLN operates a single-buyer procurement framework under the RUPTL 2025–2034, targeting50+ GW of new renewable capacity by 2034 [5]. PLN’s mandatory risk management obligations under PER-2/MBU/03/2023 [6] require quantitative risk assessment aligned with ISO 31000 [7] and COSO [8]—yet no existing framework systematically connects market structure, risk categories, methods, and lifecycle phases within a risk-register architecture. That gap is what this paper addresses. A recent empirical study of the Java–Madura–Bali power system demonstrates the complexity of optimisation in Indonesia’s regulated electricity market under multiple stakeholder constraints [9], underscoring the need for a structured risk assessment architecture of the type this paper proposes.

1.2. Indonesia as a Theoretically Representative Case

Indonesia operates a single-buyer electricity market structure—a system fundamentally different from the liberalised wholesale markets that dominate the risk assessment literature. In a single-buyer model, one designated entity holds the exclusive right to purchase all electricity generated within the system. In Indonesia, this role is performed by PT PLN (Persero), the state-owned electricity utility, which acts as the sole off-taker for electricity from all generation sources, including independent power producers (IPPs).

This structure creates four defining characteristics that shape project-level risk. First, PLN determines electricity procurement through the RUPTL—a centralised ten-year electricity supply business plan—rather than through competitive market pricing. Second, IPPs have no direct access to end consumers; their revenue depends entirely on Power Purchase Agreements (PPAs) negotiated with PLN. Third, PPA tariffs are subject to PLN’s financial conditions and government approval, exposing project developers to regulatory-discretion risk and below-cost-recovery pricing. Fourth, since no wholesale market exists, there is no market-clearing price signal to guide investment or manage risk through hedging instruments. These four features collectively create the counterparty/PPA risk that dominates the single-buyer risk profile and is essentially absent from liberalised-market risk frameworks. Isnandar et al. [9] characterise this structure as a ‘heavily regulated electricity market’ in which PLN simultaneously acts as system operator, single buyer, and regulated entity—a concentration of institutional roles that produces the multi-stakeholder risk dynamics this review analyses.

Indonesia’s configuration—single-buyer structure, RUPTL planning instrument, mandatory ISO 31000-aligned risk management under PER-2/MBU/03/2023, and a 2060 NZE commitment requiring50+ GW of new renewable capacity by 2034—is representative of dozens of economies including Bangladesh, Egypt, Vietnam, and many sub-Saharan African countries. Sirin et al. [4] demonstrate empirically that the single-buyer model functions as a structural barrier to renewable deployment through risk allocation asymmetries that deter private investment. The analytical implication is that frameworks built for competitive markets require structural adaptation, not merely contextual application, in single-buyer settings.

1.3. Theoretical Positioning

This paper draws on three underutilised theoretical traditions:

• Institutional Theory [10]: North’s framework explains why risk profiles differ systematically across market structures. Single-buyer markets create institutional risk asymmetry through centralised investment incentives and regulatory discretion.
• Socio-Technical Transition Theory [11,12]: The Multi-Level Perspective explains how risk categories and optimal methods evolve along the transition pathway. Kitzing et al. [13] apply an evolving risk perspective to policy instrument choice; this paper extends that logic to the full risk assessment methodology.
• Risk Governance Theory [14]: Renn’s framework bridges quantitative risk models and practical risk register integration under ISO 31000/COSO.

This positioning shapes the paper’s central argument: renewable energy risk assessment is not a technically neutral activity—it is institutionally situated. Frameworks designed for competitive markets embed assumptions that break down in single-buyer contexts.

1.4. Research Gaps and Objectives

Five gaps justify this review, ordered to match the synthesis in Section 3.5: (1) limited integration of risk categories and methods into ISO 31000/COSO-aligned risk registers [15,16,17]; (2) underrepresentation of single-buyer and developing-country market structures [18,19,20,21,22]; (3) the rarity of the hybrid Monte Carlo–System Dynamics (MC-SD) methodology despite its conceptual advantages [23,24,25]; (4) the absence of cross-risk interaction modelling, with risk categories typically treated in isolation [26,27]; and (5) the neglect of temporal risk dynamics across the project lifecycle. The institutional and socio-technical-transition grounding that most engineering-oriented assessments lack is addressed through the theoretical positioning in Section 1.3 and applied throughout the synthesis. The IRAF-REP framework is proposed as an integrative synthesis architecture designed to respond collectively to these five gaps. Accordingly, the identified gaps motivate RQ1–RQ3 and define the analytical scope of the framework developed in this study. Three research questions are as follows:

• RQ1: What risks are most frequently reported, and how do risk profiles differ across market structure types?
• RQ2: Which assessment methods are applied, and which are most suitable for which market structures?
• RQ3: What research gaps exist, and what future research agenda follows from the synthesis?

Three novel contributions result: (i) a market-structure-differentiated risk taxonomy; (ii) the IRAF-REP framework; and (iii) a structured future research agenda.

These contributions are positioned explicitly against prior systematic reviews. Existing reviews have significantly advanced understanding of renewable-energy investment uncertainty, valuation methods, and policy-related risks. However, the literature remains fragmented with respect to how electricity market structures shape project-level risk profiles and influence the suitability of different risk-assessment methods. The present review addresses this unresolved gap. Earlier reviews have mapped renewable-energy investment uncertainty and catalogued risk-assessment methods—Ioannou et al. [17] survey risk-based energy-system planning, Alonso-Travesset et al. [18] review economic and regulatory uncertainty in system design, Murgas et al. [28] review wind-investment evaluation under uncertainty, and Cabo-Rodriguez et al. [29] review offshore-wind valuation under uncertainty. None of these reviews, however, uses electricity market structure as the primary analytical axis; none separates single-buyer/PPA counterparty risk from conventional market/price risk; none integrates risk categories, assessment methods, lifecycle phases, and ISO 31000/COSO risk-register standards into a single architecture; and none develops a dedicated research agenda for single-buyer and developing-country systems. These four points of differentiation define the contribution of the present review, and the IRAF-REP is advanced as a conceptual architecture requiring empirical validation rather than as a validated instrument.

2. Methodology

This study follows a PRISMA-compliant systematic review protocol [30] combined with Kitchenham (2004) guidelines for systematic reviews in applied sciences. The Parsifal web-based tool supported protocol definition, search execution, and data extraction. The complete methodological workflow is shown in Figure 1.

This systematic review was conducted and reported in accordance with the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) 2020 guidelines [30]. The completed PRISMA 2020 checklist is provided as Supplementary Material S1. The PRISMA 2020 flow diagram is presented in Figure 2 (Section 2.3). This review was not prospectively registered on a public registry prior to data extraction; authors note this as a limitation (see Data Availability Statement). Registration on a public registry such as the Open Science Framework (OSF, https://osf.io) or INPLASY (https://inplasy.com) is recommended for future systematic reviews of this type.

2.1. Search Strategy

Five databases were searched: IEEE Xplore, Web of Science (ISI), ScienceDirect, Scopus, and SpringerLink. The PICOC framework structured search terms. The corrected Boolean search string is

(“Electricity Market” OR “Competitive Market” OR “Hybrid Market” OR “Liberalized Market” OR “Monopoly Market” OR “Single Buyer Market”) AND (“Renewable Energy Projects” OR “Clean Energy Projects” OR “Energy Transition Projects” OR “Green Energy Projects” OR “Low-carbon Energy Projects” OR “Sustainable Energy Projects”) AND ((“Quantitative Risk Assessment” OR “Numerical Risk Assessment” OR “Quantitative Risk Analysis” OR “Risk Modelling” OR “Statistical Risk Assessment”) OR (“Qualitative Risk Assessment” OR “Descriptive Risk Assessment” OR “Expert-based Risk Evaluation” OR “Qualitative Risk Analysis” OR “Subjective Risk Assessment”)) AND (“Risk Impact” OR “Risk Consequesnce” OR “Risk Effects” OR “Risk Outcome” OR “Risk Severity”)

Note: An earlier parenthesisation error (top-level OR between the qualitative block and preceding terms) has been corrected; the string now uses AND to connect all four major blocks, ensuring all retrieved studies address both electricity market context and at least one form of risk assessment.

The fourth Boolean block (risk-impact terms) was applied as a precision refinement rather than as the sole determinant of relevance. The search strategy was intentionally designed to prioritise studies that explicitly addressed renewable-energy project risks within an electricity-market context and to reduce retrieval of the unrelated energy-policy and electricity-market literature. Consequently, studies discussing concepts such as offtaker risk, power-purchase agreements, auction mechanisms, independent power producers, project finance, or curtailment risk could still be retrieved where these concepts were discussed within a broader risk-assessment context. We acknowledge, however, that a phrase-based block may have reduced recall for some relevant studies that used alternative terminology. This limitation is noted in Section 6, and a broadened, sensitivity-tested search strategy incorporating additional procurement, financing, and market-structure terminology is recommended for future extensions of this review.

2.2. Inclusion and Exclusion Criteria

Inclusion:

• Studies addressing electricity market contexts for renewable energy projects.
• Studies discussing quantitative and/or qualitative risk assessment methods.
• Peer-reviewed journal articles and conference papers in English, 2015–2026.

Exclusion:

• Studies not framed within an electricity market context.
• Studies unrelated to RE projects or risk assessment.
• Duplicates, grey literature, editorials, and non-empirical book chapters.
• Non-English publications.

Note on 2026 references: Papers appearing as formally accepted early-access articles are included and labelled [Early access] in the reference list.

Distinction between systematically reviewed evidence and contextual sources. The 116 studies constitute the systematically reviewed academic corpus. Policy and regulatory documents—including the RUPTL, PER-2/MBU/03/2023, PLN’s RUPTL Risk Profile, and IEA/IRENA reports—are not part of this corpus and were not screened against the inclusion criteria; they are used solely for contextualization and for illustrating the framework and are cited separately from the reviewed studies. The exclusion of grey literature therefore applies to the systematic review evidence base and does not preclude the use of policy and regulatory documents for contextualization, interpretation, and framework illustration.

2.3. Study Selection

A total of 1305 records were retrieved: IEEE Xplore (621), Web of Science (312), ScienceDirect (146), Scopus (214), SpringerLink (12). After removing 36 duplicates, 1269 unique records underwent title/abstract screening, yielding 375 for full-text assessment. Following full-text reading and quality evaluation against the three QA criteria (Section 2.4), 116 papers were retained (IEEE: 10; WoS: 22; ScienceDirect: 28; Scopus: 54; SpringerLink: 2). The full selection process is shown in Figure 2.

Screening was conducted in two stages (title/abstract followed by full text). Screening was conducted by all authors; disagreements were resolved by consensus discussion, with U.K. consulted as arbiter for cases that remained unresolved. Formal inter-rater agreement statistics (e.g., Cohen’s kappa) were not computed during the original screening process; this is acknowledged as a documentation limitation and noted in Supplementary Material S2. Records were exported in a standard bibliographic format and deduplicated within Parsifal using combined DOI and title matching, with residual near-duplicates removed manually. The deduplication process identified 36 duplicate records among the 1305 retrieved records, resulting in 1269 unique records entering screening. This count is reported directly from the original Parsifal project records and is therefore presented as an observed outcome of the documented screening workflow rather than as a retrospectively reconstructed estimate. Because the search strings were adapted to the syntax and indexing structures of individual databases, the retrieved record sets were not expected to exhibit complete cross-database redundancy. To improve transparency and reproducibility, Supplementary Material S2 reports the search date, recovered database-specific search strings, inclusion/exclusion filters, database retrieval counts, PRISMA screening statistics, and the deduplication procedure used in Parsifal. The original Parsifal project records supporting the reported screening workflow and duplicate counts were retained and are summarised in S2. Database-specific query adaptations that were not preserved in the original project records could not be reproduced verbatim and are therefore acknowledged as a documentation limitation rather than a methodological limitation.

Figure 2. PRISMA 2020 flow diagram of the study selection process. From: Page MJ, McKenzie JE, Bossuyt PM, Boutron I, Hoffmann TC, Mulrow CD, et al. The PRISMA 2020 statement: an updated guideline for reporting systematic reviews. BMJ 2021;372:n71. https://doi.org/10.1136/bmj.n71.

Figure 2. PRISMA 2020 flow diagram of the study selection process. From: Page MJ, McKenzie JE, Bossuyt PM, Boutron I, Hoffmann TC, Mulrow CD, et al. The PRISMA 2020 statement: an updated guideline for reporting systematic reviews. BMJ 2021;372:n71. https://doi.org/10.1136/bmj.n71.

2.4. Quality Assessment

Each study was evaluated against the following: (QA1) Does it address RE project implementation? (QA2) Does it discuss risk assessment methods for RE projects? (QA3) Does it address the electricity market context? Criteria scored Yes (1), Partially (0.5), or No (0); studies scoring at least 0.5 on all three were retained.

The QA1–QA3 criteria were intentionally designed as relevance- and scope-oriented assessment criteria rather than formal risk-of-bias instruments. Their purpose was to ensure that retained studies directly addressed the intersection of renewable-energy project implementation, risk-assessment methodologies, and electricity-market structures, which constitutes the core focus of this review. Consequently, the assessment supports study selection and thematic mapping rather than ranking the methodological rigour of individual studies.

This approach reflects the configurative (mapping) objective of the review. The study seeks to characterise how risk categories, assessment methods, and market structures are represented across the literature and to synthesise these findings into the Integrated Renewable Energy Project Risk Assessment Framework (IRAF-REP). Unlike aggregative systematic reviews or meta-analyses that estimate pooled effects and therefore require formal risk-of-bias appraisal, the present review focuses on conceptual synthesis and framework development.

The reviewed corpus comprises heterogeneous study types, including simulation and optimisation studies, Monte Carlo analyses, multi-criteria decision-making approaches, engineering case studies, surveys, literature reviews, and framework-development papers. Established risk-of-bias instruments such as ROBINS-I, JBI, CASP, and Cochrane appraisal tools were developed primarily for experimental and observational study designs and are not readily transferable across this diverse evidence base. For this reason, a purpose-specific assessment framework was adopted to evaluate relevance and applicability to the research objectives and to ensure that retained studies directly addressed renewable-energy project implementation, risk-assessment methods, and electricity-market structures.

Nevertheless, this assessment approach does not differentiate highly rigorous studies from exploratory studies to the same degree as formal methodological appraisal tools. This limitation is acknowledged explicitly in Section 6. Future empirical extensions of this work may incorporate a more granular appraisal framework that evaluates methodological robustness, validation procedures, data quality, and reporting transparency, particularly when applying IRAF-REP to specific renewable-energy project portfolios.

2.5. Data Extraction and Bibliometric Analysis

A structured Parsifal form captured authors/year, title, objective, methodology, risk categories, assessment methods, RE technology type, key findings, and stated gaps. The full 116-entry extraction table is in Appendix A.

Coding protocol. Risk categories were assigned by full-text coding into the seven-category taxonomy; studies could be coded into more than one category, so category frequencies are not mutually exclusive and do not sum to 100%. The market-structure risk-intensity ratings (Absent, Minor, Moderate, Dominant) were operationalised from the extracted data as a combination of (i) how frequently a category was reported within studies addressing each market structure and (ii) the qualitative prominence assigned to it in those studies’ findings, rather than as a single extracted numeric field. Dominant indicates that a risk category was consistently identified as a primary concern within studies addressing a given market structure; Moderate indicates recurring but secondary prominence; Minor indicates occasional mention; and Absent indicates that the category was not substantively discussed. The methodological–sophistication axis is an interpretive analytical ranking of method classes—not a quantity extracted from individual studies and is presented as such. The coding rules, category definitions, and decision examples are provided as a supplementary codebook (Supplementary Material S3).

Bibliometric analysis using VOSviewer version 1.6.20 on the retrieved corpus identified three main thematic clusters, visualised in Figure 3: (1) quantitative risk modelling (MCS/ROA) concentrated in Europe/North America; (2) policy and regulatory risk in liberalised markets; and (3) an emerging, sparse developing-country and single-buyer literature. Keyword co-occurrence analysis confirms that ‘single-buyer’, ‘Indonesia’, and ‘risk register’ are among the lowest-density terms in the corpus, confirming Gaps 1 and 2. The MC-SD hybrid appears as an isolated gap node with high conceptual centrality but low co-occurrence frequency—a visual representation of Gap 3. The three-phase temporal trend is consistent with the socio-technical transition framing: as renewables shift from niche to regime contestation, research emphasis moves from investment-level risk toward system-level risk governance.

3. Results

3.1. Overview of Included Studies

The 116 included studies span 2015 to 2026 across five databases. Journals most frequently represented include Renewable and Sustainable Energy Reviews (~25), Energy Economics (~12), Renewable Energy (~10), Energy Policy (~8), and Energies (~7). Publication trend and geographic distribution are visualised in Figure 4. Figure 5 presents the publication trend and geographic distribution of included studies. The PRISMA 2020 flow diagram is presented in Figure 2 (Section 2.3).

Publication Trend and Thematic Evolution

Three phases are identifiable. Phase 1 (2015–2018): foundational literature on price risk modelling, policy risk, and investment uncertainty (~50 papers). Phase 2 (2019–2022): expansion toward market design reform, energy transition risk, and advanced quantitative methods (~42 papers). Phase 3 (2023–2026): emerging focus on hybrid frameworks, carbon market interactions, and developing-country contexts (~24 papers). This evolution is consistent with the socio-technical transition framing: as renewables enter regime contestation, research emphasis shifts from project-level to system-level risk governance.

3.2. RQ1—Risk Categories and Market-Structure Differentiation

3.2.1. Electricity Market Structure Definitions

Before presenting the risk category analysis, it is necessary to define the four electricity market structure types used as the analytical framework throughout this review. These structures differ in how electricity procurement and pricing operate, the degree of market competition, and the institutional role of state actors—all of which produce systematically different risk profiles for renewable energy projects.

Liberalised Market: Electricity is traded through competitive wholesale markets where multiple buyers and sellers interact, and prices are determined by supply and demand. Investors face price risk directly through market exposure. Generation projects sell electricity at market-clearing prices or through bilateral contracts negotiated under competitive conditions. Dominant in Europe and North America [31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71].

Hybrid/Transitional Market: A mixed system where competitive market mechanisms coexist with regulated procurement and state support instruments (feed-in tariffs, auctions, contracts for difference). Policy risk is elevated during the transition because regulatory frameworks are actively changing, creating uncertainty about which rules will persist. Prevalent in Southeast Asia and transitioning economies [72,73,74,75,76].

Single-Buyer Market: A state-owned utility holds exclusive monopsony purchasing power over all electricity generation. Private developers sell electricity only through PPAs with the utility; no competitive wholesale market exists. Revenue certainty depends on the utility’s financial health, regulatory discretion, and government policy—making counterparty/PPA risk the dominant project-level risk. Indonesia (PLN), several MENA economies, and many sub-Saharan African markets operate under this structure [4,21,64,77,78].

Monopoly/Vertically Integrated Market: A single state entity controls generation, transmission, distribution, and retail. Investment and procurement decisions are made centrally through government planning instruments. Political risk and cost-recovery tariff risk dominate the project risk profile. Market competition is absent, and private investment is heavily dependent on government-controlled pricing and procurement frameworks [77,79,80].

These structural distinctions are not merely taxonomic. As the risk intensity matrix in Figure 6 demonstrates, they produce fundamentally different risk compositions—a finding that has significant implications for which assessment methods are analytically appropriate.

3.2.2. Risk Category Frequency and Market-Structure Analysis

The synthesis reveals seven major risk categories. Figure 5 visualises their frequency across the 116 studies, while Figure 6 provides a cross-tabulated risk intensity matrix showing how each category’s prominence varies by market structure type. Three analytical patterns emerge from this cross-tabulation that are not visible from frequency counts alone.

Figure 6. Risk intensity matrix: prominence of each risk category by market structure type. Intensity scores (Absent/Minor/Moderate/Dominant) were assigned through qualitative coding of the 116 reviewed studies based on reporting frequency and thematic prominence within each market structure. * Counterparty/PPA risk is analytically distinct from Market/Price risk in single-buyer contexts and absent in fully competitive markets.

Figure 6. Risk intensity matrix: prominence of each risk category by market structure type. Intensity scores (Absent/Minor/Moderate/Dominant) were assigned through qualitative coding of the 116 reviewed studies based on reporting frequency and thematic prominence within each market structure. * Counterparty/PPA risk is analytically distinct from Market/Price risk in single-buyer contexts and absent in fully competitive markets.

Analytical Pattern 1—Market Structure Determines Risk Composition, Not Just Risk Level. The heatmap in Figure 6 reveals that different market structures do not simply elevate or suppress the same risks—they produce qualitatively different risk compositions. In liberalised markets, market/price risk is dominant (score 3) while counterparty/PPA risk is absent (score 0): investors face the wholesale market directly and bear price volatility, but there is no single counterparty whose default could cancel the project. In single-buyer markets, this relationship inverts: market/price risk drops to Minor (score 1) because PLN sets PPA prices administratively, while counterparty/PPA risk becomes dominant (score 3) because PLN is the only offtaker. This inversion is theoretically significant—it means that a risk management framework calibrated for liberalised markets will systematically misallocate risk management resources when applied to a single-buyer context such as Indonesia’s PLN.

Analytical Pattern 2—Policy Risk Is the One Universal Risk, But for Different Reasons. Policy and regulatory risk is the only category that is Moderate or Dominant across all four market structure types. However, the nature of this risk differs structurally. In liberalised markets, policy risk is primarily about subsidy withdrawal and carbon pricing uncertainty [35,81]. In single-buyer markets, it is dominated by tariff-setting discretion and regulatory renegotiation of PPAs [4,21]. In hybrid and transitional markets, it reflects the uncertainty of the transition path itself—what instruments will remain and which will be phased out [13]. The identical risk label therefore conceals fundamentally different underlying mechanisms, explaining why no single analytical method addresses policy risk adequately across all contexts.

Analytical Pattern 3—Social/Stakeholder Risk Is Systematically Underweighted Relative to Its Impact. Social and stakeholder risk is Minor across all market structure types in the reviewed literature (~12% of studies). This is analytically inconsistent with empirical evidence: Stanitsas and Kirytopoulos [51] document cases where stakeholder failures alone terminated fully financed projects. The underrepresentation is not because social risk is unimportant—it is because it resists the probabilistic parameterisation that quantitative methods require. This is a structural gap in the field’s methodological toolkit, not a reflection of social risk’s actual significance in project outcomes.

3.2.3. Market/Price Risk (~68%)—Dominant but Institutionally Partial

Market and price risk is the most frequently reported category (~79 studies), typically modelled using geometric Brownian motion or mean-reverting processes [18,28]. From an institutional theory perspective [10], this dominance reflects data availability path dependence: liberalised markets provide continuous price time series that readily parameterise stochastic models. In single-buyer markets, by contrast, price risk manifests as PLN’s tariff-setting discretion and below-cost-recovery PPA pricing—a contractual risk that standard stochastic models cannot capture without structural adaptation.

3.2.4. Policy/Regulatory Risk (~58%)—Transition-Dependent

Policy and regulatory risk (~67 studies) encompasses feed-in tariff adjustments, subsidy withdrawal, and permitting delays. Applying the socio-technical transition lens [11,12], policy risk is highest in the middle transition stages when renewables compete with incumbent fossil infrastructure. Kitzing et al. [13] formalise this, showing optimal policy instruments change as transition proceeds. Dukan and Kitzing [81] demonstrate empirically that de-risking through policy design reduces WACC by 10–40%—a finding with direct RUPTL planning implications.

3.2.5. Technical, Financial, Operational, Environmental, and Social Risks

Technical and resource risks (~52 studies) cover VRE intermittency, equipment failure, and grid integration. Financial risks (~46 studies) encompass LCOE uncertainty, cost overruns, and constrained project finance—with elevated WACC in developing-country contexts [4,21,76,78,80,82,83,84,85,86,87,88]. Operational/grid risks (~29 studies) cover curtailment and balancing costs [89,90,91,92,93,94,95,96]. Environmental and climate risks (~23 studies) are reported disproportionately in hydropower and offshore wind studies, with Yuksel et al. [97] assigning environmental risk the highest weight (0.2478) in hydropower investment. Social and stakeholder risks (~14 studies, ~12%) are the most underrepresented category in quantitative analysis—a consequential gap from a risk governance perspective, as stakeholder engagement failures can terminate projects entirely [14,51].

3.3. RQ2—Risk Assessment Methods and Market-Structure Fit

Figure 7 shows overall method prevalence. Figure 8 adds a second analytical dimension: where each method sits relative to market context (x-axis: market openness) and methodological sophistication (y-axis), with bubble size indicating adoption frequency. This analysis reveals a structural misalignment between where methods are needed and where they are deployed.

Analytical Finding 1—A Sophistication-Openness Correlation That Should Not Exist. Figure 8 reveals a clear positive correlation: the more competitive the market (rightward), the more sophisticated the methods (upward). MCS, ROA, and stochastic optimisation cluster in the upper-right quadrant (liberalised markets, high sophistication). Delphi, AHP, and fuzzy logic cluster in the lower-left (single-buyer/monopoly, low sophistication). This correlation is analytically troubling because it implies that the markets with the highest institutional complexity—single-buyer systems where PLN concentrates enormous procurement power and regulatory authority—are addressed with the least rigorous methods. The correlation is not driven by inherent analytical difficulty but by data availability: liberalised markets produce tradeable price time series, while single-buyer markets produce administrative tariff decisions. This is a solvable data infrastructure problem, not a fundamental methodological barrier.

Analytical Finding 2—The MC-SD Position Defines the Research Frontier. In Figure 8, the MC-SD hybrid sits in the upper-left quadrant: high methodological sophistication, targeted at single-buyer and transitional markets, but adopted in fewer than 4% of studies. This position is not accidental—it reflects the method’s conceptual design. MC captures the probabilistic distribution of risk factors (analogous to what MCS does for price risk in liberalised markets); SD captures the feedback dynamics between PLN’s procurement decisions, private investor responses, and grid integration outcomes. Within the reviewed corpus, no study was found to achieve both simultaneously for the single-buyer context. The small bubble size in that quadrant is therefore the clearest visual representation of the field’s most important methodological gap.

Analytical Finding 3—System Dynamics Is Misclassified as a Risk Assessment Method. System Dynamics appears in approximately 8 studies but in a predominantly descriptive mode—mapping causal loop structures rather than generating probability distributions. When SD is used analytically, it typically produces scenario narratives rather than risk registers [13,77,98,99,100,101,102,103]. This means SD’s placement in Figure 8 overstates its current contribution to risk quantification. It is better understood as a structural analysis tool that, once hybridised with MCS, would become a genuine risk assessment method. This distinction matters for the research agenda: the priority is not to use more SD but to integrate MC stochasticity into SD’s dynamic structure.

3.3.1. Quantitative Methods—Powerful but Market-Constrained

MCS (~28 studies) and ROA (~22 studies) dominate quantitative practice and are well-suited to liberalised markets with competitive price data. Murgas et al. [28] found MCS used in 51.6% of wind investment studies; Carozzani and D’Alpaos [104] found geometric Brownian motion as the dominant ROA uncertainty model (61.3%). Both methods are structurally limited in single-buyer contexts where the primary uncertainty is contractual rather than price-distributional. Stochastic optimisation (~18 studies) and System Dynamics (~8 studies [13,77,98,99,100,101,102,103]) address portfolio and feedback dimensions respectively, but SD is typically deterministic—a key limitation addressed by the MC-SD hybrid. A notable exception is Isnandar et al. [9], who combine a multi-agent system (MAS) paradigm with System Dynamics to simulate generation dispatch optimisation under carbon policy scenarios in the Indonesian regulated electricity market—a multiparadigm approach directly aligned with the MC-SD hybrid concept identified as Gap 3.

3.3.2. Qualitative Methods—Dominant in Single-Buyer Contexts

MCDM/AHP (~15 studies) and Delphi (~10 studies) appear disproportionately in studies addressing non-liberalised markets—an implicit institutional adaptation that has not been explicitly theorised. Zhou and Yang [105] applied AHP with PEST criteria to distributed wind risk; Yuksel et al. [97] developed a spherical fuzzy entropy-MAIRCA model for hydropower; Nur et al. [21] used Delphi for Indonesian geothermal PPP risk allocation. These methods compensate for absent competitive market data through expert judgement, but cannot produce the probability distributions required for ISO 31000 quantitative prioritisation.

3.3.3. The MC-SD Gap

The MC-SD hybrid appears in fewer than 4% of studies. The socio-technical transition literature [11,12] demonstrates that energy market risks are dynamically co-produced by policy choices, investment responses, and system operations. A model capturing both the probabilistic distribution of individual risk factors (MCS) and the feedback dynamics between market actors (SD) is conceptually well-suited for risk assessment in evolving electricity markets. Its near-absence represents one of the most promising and underexplored methodological opportunities in the field. Isnandar et al. [9] provide the closest existing implementation: their multiparadigm (MAS-FC) model for the Java–Madura–Bali system quantifies interactions between generation company agents, the PLN system operator agent, and consumer agents under carbon policy scenarios. Extending this approach to incorporate probabilistic uncertainty quantification through Monte Carlo simulation and System Dynamics (SD), which can capture the institutional interactions and response dynamics that are structurally unique to regulated single-buyer markets, would represent the MC-SD integration identified in this review as a priority methodological advancement for single-buyer market contexts.

3.4. Analytical Synthesis—Market Structure vs. Risk Profile

Table 1. Analytical synthesis: market structure, dominant risks, assessment methods, and main limitations.

Market Structure	Dominant Risks	Common Methods	Main Limitations	Evidence	Institutional Logic
Liberalised	Price volatility; merchant revenue; portfolio risk	MCS, ROA, Stochastic Optimisation	Ignores institutional centralisation; limited counterparty analysis	Europe, N. America [31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71]	Market pricing logic: investors face price competition directly; risk is stochastic and distributional
Single-Buyer	Counterparty/PPA risk; tariff risk; offtake reliability; currency risk	MCDM, Delphi, qualitative scenario	Lacks stochastic treatment; no joint risk modelling; no lifecycle view	Indonesia, MENA [4,21,64,77,78]	Monopsony governance logic: state utility holds procurement power; risk is contractual and relational
Hybrid/Transitional	Regulatory uncertainty; subsidy phaseout; dual-market exposure	Hybrid (ROA-MCS, MCDM-probabilistic)	Weak lifecycle integration; limited dev.-country application	SE Asia, Africa [72,73,74,75,76]	Transition instability logic: competing regimes create mixed risk signals; uncertainty is structural
Monopoly/Vert. Integrated	Political risk; procurement monopoly; tariff risk	Qualitative, expert elicitation	Severely underrepresented; no hybrid quantitative frameworks	Selected dev. countries [77,79,80]	State planning logic: risk is politically determined; probabilistic modelling requires institutional buy-in

Note: Evidence column indicates predominant geographic/institutional contexts of supporting studies.

presents the core analytical synthesis of this review, characterising how risk profiles, method choices, and limitations co-vary across market structure types. This is the paper’s primary empirical contribution.

Three patterns stand out. First, there is a systematic inverse relationship between market competition and method sophistication: liberalised markets attract MCS and ROA while single-buyer and monopoly markets rely on qualitative approaches—a structural data constraint, not a deliberate methodological choice. Second, all market types share the limitation of weak lifecycle integration. Third, single-buyer markets entirely lack stochastic treatment, creating a direct conflict with ISO 31000 and PER-2/MBU/03/2023 requirements for probabilistic risk quantification.

Cross-market analytical comparison—what the literature is missing. Comparing the four market rows in Table 1 reveals a pattern that goes beyond individual gaps: the literature has developed deep analytical capability for one market type (liberalised) and shallow capability for all others. Of the 116 studies, approximately 75 address liberalised markets, 12 address single-buyer contexts, 18 address hybrid markets, and 11 address monopoly/vertically integrated systems. This is not proportional to where global renewable energy capacity needs to be built. The IEA’s 2030 investment requirements are concentrated in South and Southeast Asia, sub-Saharan Africa, and Latin America—all predominantly single-buyer or hybrid market contexts [3]. The field has, in effect, been solving a problem that belongs primarily to the OECD while the analytically harder and practically more urgent problem—renewable energy risk in state-dominated electricity systems—remains underserved. This is the overarching analytical conclusion of this review. The empirical complexity of Indonesia’s regulated electricity market—in which PLN must simultaneously satisfy economic dispatch, carbon emission targets, and multi-stakeholder constraints—has been documented by Isnandar et al. [9], confirming that the risk landscape in state-dominated systems is qualitatively different from what standard liberalised-market risk models address.

3.5. RQ3—Research Gaps

Gap 1: Limited risk register integration.

Within the reviewed corpus, no study was found to produce a risk register aligned simultaneously with ISO 31000, COSO, and a national electricity planning instrument. The IRAF-REP Layer 5 architecture is designed to address this gap.

Gap 2: Single-buyer and developing-country market structures.

Fewer than 10% of studies address single-buyer or developing-country markets. Sirin et al. [4] establish empirically that single-buyer models are structural barriers to renewable deployment. Institutional theory predicts systematically different risk profiles in monopsony versus competitive markets—a prediction confirmed but not yet translated into dedicated analytical frameworks.

Gap 3: Hybrid MC-SD methodologies.

The MC-SD combination is the most underexplored methodological opportunity. Its development would provide simultaneous probabilistic quantification and dynamic feedback modelling—particularly relevant where RUPTL planning cycles generate correlated risks across categories.

Gap 4: Cross-risk interaction modelling.

Individual risk categories are modelled in isolation. Compounding effects—simultaneous policy risk and PPA renegotiation—are not captured. Correlation matrices or joint probability models capturing these interactions would substantially improve risk register accuracy [15,16,17,18].

Gap 5: Temporal dynamics across the project lifecycle.

Most studies treat risk as static. The transition literature [11,12,13] demonstrates that risk profiles shift as technologies mature. A lifecycle-integrated framework modelling risk evolution from planning through decommissioning is both theoretically motivated and practically required for ISO 31000-compliant risk register maintenance.

4. The IRAF-REP: Integrated Risk Assessment Framework for Renewable Energy Projects

Drawing on the systematic synthesis above, this paper proposes the IRAF-REP—a five-layer architecture that connects the dimensions identified as analytically separate in the existing literature. Figure 9 presents the framework; the layers are described below.

4.1. Framework Description

• Layer 1—Market Structure Context: The entry point. Market structure type determines the institutional risk environment and pre-conditions which risk categories and methods are most relevant.
• Layer 2—Risk Category Taxonomy: The seven risk categories are applied with market-structure weighting. Single-buyer contexts weight counterparty, policy/regulatory, and financial risks most heavily. Cross-risk interaction modelling (Gap 4) is embedded as a connecting element.
• Layer 3—Risk Assessment Methods: Methods are selected based on market structure and data availability. For single-buyer and monopoly markets, MCDM/Delphi is recommended near-term; MC-SD integration is the priority medium-term development (highlighted in Figure 9).
• Layer 4—Project Lifecycle Phase: Risk profiles are sequenced across planning/development, construction/commissioning, operation/maintenance, and decommissioning. Political and permitting risks dominate planning; counterparty and curtailment risks dominate operations.
• Layer 5—Risk Register Integration: Outputs from Layers 2–3 are mapped into ISO 31000 probability x impact matrices, COSO ERM enterprise frameworks, and specifically the PLN/RUPTL national planning instrument, producing a RUPTL-integrated probabilistic risk register as mandated by PER-2/MBU/03/2023.

The feedback loop in Figure 9 is theoretically important: risk outcomes at lower layers (e.g., construction cost overruns) update risk profile assessments at upper layers (e.g., revising financial risk weighting for the operational phase). This dynamic updating distinguishes the IRAF-REP from a static risk checklist and aligns it with ISO 31000’s continuous monitoring requirement.

Figure 9. The Integrated Risk Assessment Framework for Renewable Energy Projects (IRAF-REP). The dashed feedback loop (right) indicates that risk outcomes at lower layers update risk profile assessments at upper layers. Layer 5 includes a specific adaptation for PLN/RUPTL national planning under PER-2/MBU/03/2023.

Figure 9. The Integrated Risk Assessment Framework for Renewable Energy Projects (IRAF-REP). The dashed feedback loop (right) indicates that risk outcomes at lower layers update risk profile assessments at upper layers. Layer 5 includes a specific adaptation for PLN/RUPTL national planning under PER-2/MBU/03/2023.

It is important to note that the IRAF-REP is a conceptual synthesis architecture derived from the systematic analysis of 116 studies. It is intended as a structured foundation for future empirical validation rather than a tested instrument. Readers should interpret the framework as a theoretically grounded proposal; empirical calibration remains as the primary short-term research priority.

4.2. IRAF-REP Application to Indonesia/PLN—Illustrative Risk Register

To demonstrate operational deployability, Table 2 applies the IRAF-REP to a representative Indonesian renewable energy project under the single-buyer market structure. The risk events and their probability/impact characterisation are grounded in PLN’s official Profil Risiko RUPTL 2025–2034, published by PLN’s Directorate of Risk Management [106]. The table adapts this source material to the IRAF-REP architecture; scores are illustrative rather than empirically measured. The operational context draws on Indonesia’s Java–Madura–Bali power system, which operates 327 generation units (47.3 GW) with coal-fired generation comprising 60.4% of installed capacity [9].

Table 2. Illustrative IRAF-REP risk register output for a representative Indonesian RE project under PLN single-buyer structure. Risk events and probability/impact scores are grounded in PLN’s official RUPTL 2025–2034 Risk Profile [106]; values have been adapted for illustrative purposes and do not represent measured empirical data. Probability and impact are each rated 1–5, and the resulting risk level is read from the official risk matrix (Peta Risiko) prescribed by Peraturan Menteri BUMN PER-2/MBU/03/2023 (Figure 10). Accordingly, the reported risk indices correspond to predefined matrix positions and risk-ranking categories within the BUMN framework rather than direct Probability × Impact multiplication scores. The Indonesian state-owned-enterprise risk-management standard is aligned with ISO 31000 and COSO ERM 2017.

Risk Category (Layer 2)	Risk Identification	IRAF Layer	Prob. (1–5)	Impact (1–5)	Risk Level	Mitigation
Counterparty/PPA	Mismatch Between Electricity Demand Growth and RUPTL Projections	L2, L3, L4, L5	5	5	25 (High)	Periodically review electricity demand projections; Strengthen marketing programs and partnerships
Policy/Regulatory	Changes in Sectoral Regulations/Policies Affecting PLN’s Going Concern	L2, L4	3	5	23 (High)	Conduct regulatory impact analysis for existing and upcoming regulations; Maintain active coordination with regulators
Technical/Resource	Delays in Generation, Transmission, and Substation Project Completion	L2, L3	5	5	25 (High)	MCS on resource data; P90 design basis; O&M reserve fund
Financial/Investment	Limitation of investment capability	L2, L3, L4, L5	5	5	25 (High)	Prioritise capital expenditure allocation; Align project priorities with load growth and system needs
Social/Stakeholder	Delays in Rural Electrification Programs	L2, L4	4	3	14 (Moderate)	Early community engagement; Strengthen coordination with the Ministry of Environment and Forestry

Note: Risk events and characterisations are adapted from PLN’s Profil Risiko RUPTL 2025–2034 [106]; probability and impact values have been adjusted for illustrative purposes. Full empirical calibration using actual PLN project-level data is the primary short-term research priority (Table 4).

Table 2. Illustrative IRAF-REP risk register output for a representative Indonesian RE project under PLN single-buyer structure. Risk events and probability/impact scores are grounded in PLN’s official RUPTL 2025–2034 Risk Profile [106]; values have been adapted for illustrative purposes and do not represent measured empirical data. Probability and impact are each rated 1–5, and the resulting risk level is read from the official risk matrix (Peta Risiko) prescribed by Peraturan Menteri BUMN PER-2/MBU/03/2023 (Figure 10). Accordingly, the reported risk indices correspond to predefined matrix positions and risk-ranking categories within the BUMN framework rather than direct Probability × Impact multiplication scores. The Indonesian state-owned-enterprise risk-management standard is aligned with ISO 31000 and COSO ERM 2017.

Risk Category (Layer 2)	Risk Identification	IRAF Layer	Prob. (1–5)	Impact (1–5)	Risk Level	Mitigation
Counterparty/PPA	Mismatch Between Electricity Demand Growth and RUPTL Projections	L2, L3, L4, L5	5	5	25 (High)	Periodically review electricity demand projections; Strengthen marketing programs and partnerships
Policy/Regulatory	Changes in Sectoral Regulations/Policies Affecting PLN’s Going Concern	L2, L4	3	5	23 (High)	Conduct regulatory impact analysis for existing and upcoming regulations; Maintain active coordination with regulators
Technical/Resource	Delays in Generation, Transmission, and Substation Project Completion	L2, L3	5	5	25 (High)	MCS on resource data; P90 design basis; O&M reserve fund
Financial/Investment	Limitation of investment capability	L2, L3, L4, L5	5	5	25 (High)	Prioritise capital expenditure allocation; Align project priorities with load growth and system needs
Social/Stakeholder	Delays in Rural Electrification Programs	L2, L4	4	3	14 (Moderate)	Early community engagement; Strengthen coordination with the Ministry of Environment and Forestry

Note: Risk events and characterisations are adapted from PLN’s Profil Risiko RUPTL 2025–2034 [106]; probability and impact values have been adjusted for illustrative purposes. Full empirical calibration using actual PLN project-level data is the primary short-term research priority (Table 4).

Table 2 makes visible four analytical points that the current literature does not address.

Figure 10. Risk matrix (Peta Risiko) defined in Peraturan Menteri BUMN PER-2/MBU/03/2023, used as the basis for the risk-level assignments in the illustrative register (Table 2). Vertical axis: probability level (1–5); horizontal axis: impact level (1–5); the matrix represents a calibrated probability-impact mapping prescribed by the BUMN risk-management framework; therefore, the matrix index values (1–25) represent predefined risk-ranking positions within the PER-2/MBU/03/2023 framework rather than direct Probability × Impact multiplication scores.

Figure 10. Risk matrix (Peta Risiko) defined in Peraturan Menteri BUMN PER-2/MBU/03/2023, used as the basis for the risk-level assignments in the illustrative register (Table 2). Vertical axis: probability level (1–5); horizontal axis: impact level (1–5); the matrix represents a calibrated probability-impact mapping prescribed by the BUMN risk-management framework; therefore, the matrix index values (1–25) represent predefined risk-ranking positions within the PER-2/MBU/03/2023 framework rather than direct Probability × Impact multiplication scores.

First, three risk categories—counterparty/PPA, technical/resource, and financial/investment—all score High (25/25), with the maximum probability (5 = Almost Certain) and maximum impact (5 = Very High). This clustering at the ceiling of the risk matrix is distinctive to the single-buyer context: in liberalised markets, counterparty risk is distributed across many buyers, and financing risk is mediated by competitive capital markets. In a PLN single-buyer system, both converge on one institutional actor, producing an inherently concentrated risk profile that standard quantitative frameworks are not designed to capture.

Second, Policy/Regulatory risk level is High (23), reflecting PLN’s exposure to sectoral regulatory changes affecting its going-concern position—including carbon tax implementation, Power Wheeling proposals, and RUPTL revision cycles. Notably, this risk operates as a driver of all three highest-scoring (25) risks: regulatory instability affects PPA terms (counterparty), delays project approvals (technical) and constrains financing access (financial). The cross-risk dashed line in Figure 9 (Layer 2) precisely represents this interaction, and Table 2 makes its practical significance concrete.

Third, Social/Stakeholder risk level is moderate (14), driven by delays in rural electrification programmes in remote and conflict-affected areas. This risk category is systematically underweighted in the quantitative literature reviewed in Section 3.2, which focuses almost exclusively on financial and technical risk metrics. In a single-buyer market serving a geographically dispersed archipelago of 17,000 islands, social and logistical barriers to electrification represent a material project risk that no existing quantitative risk framework in the reviewed corpus addresses.

Fourth, and analytically most important: the recommended mitigations for all five risks are institutional and governance interventions—regulatory impact analysis, capital expenditure prioritisation, stakeholder coordination, demand forecasting reviews—not technical engineering responses. This confirms the core argument of Section 5.2: risk management in single-buyer electricity systems is primarily an institutional design problem. The implication for the IRAF-REP is that its Layer 5 integration with PLN/RUPTL governance instruments is not supplementary but central to its practical utility.

4.3. Conceptual Status and Validation Pathway

The IRAF-REP framework has not yet been empirically validated and should therefore be interpreted as a conceptual synthesis architecture rather than a validated operational decision-support tool. Its present status is that of a conceptual synthesis whose internal consistency rests on the systematic evidence in Section 3.2, Section 3.3 and Section 3.4 and on the positioning relative to prior reviews in Section 1.4; we distinguish this conceptual contribution from a validated methodological one. The IRAF-REP is developed as a contextual implementation of ISO 31000:2018 and COSO ERM 2017—operationalized in the Indonesian setting through PER-2/MBU/03/2023—for renewable-energy projects under the RUPTL;

Table 3. Mapping of each IRAF-REP layer to the ISO 31000:2018 clauses and COSO ERM 2017 components it implements and contextualises for renewable energy projects under the RUPTL. Correspondences reflect the authors’ structural interpretation and reflect a conceptual (structural) correspondence: the IRAF-REP is positioned as a contextual implementation of these standards, not as an extension beyond them.

IRAF-REP Layer	ISO 31000:2018 Correspondence	COSO ERM 2017 Correspondence	Contextual Implementation in IRAF-REP (RUPTL/Single-Buyer)
Layer 1—Market Structure Context	Clause 6.3/5.4.1: establish external context, but market structure is not specified as a variable	Strategy & Objective-Setting: business context considered, but market-structure types not differentiated	Implements the context-setting step by operationalising electricity market structure as the explicit context variable for RE projects, distinguishing liberalised, hybrid, single-buyer, and monopoly systems
Layer 2—Risk Category Taxonomy	Clause 6.4.2: risk identification, method-agnostic	Performance: identifies risks across the entity	Implements risk identification as a seven-category taxonomy weighted by market structure, with cross-risk links made explicit for the single-buyer context
Layer 3—Risk Assessment Methods	Clause 6.4.3: risk analysis, technique not prescribed	Performance: assesses and prioritises risks	Implements risk analysis by conditioning method choice on market structure and data availability (MCDM/Delphi near-term; MC-SD medium-term)
Layer 4—Project Lifecycle Phase	Clause 6.6: monitoring and review over time	Review & Revision: reassessment as context changes	Implements monitoring and review by sequencing risk profiles across planning, construction, operation, and decommissioning phases
Layer 5—Risk Register Integration	Clauses 6.4.4 and 6.7: evaluation (P × I) and recording/reporting; continuous monitoring	Information, Communication & Reporting	Implements evaluation and recording/reporting by mapping outputs onto the PER-2/MBU/03/2023 risk matrix and the RUPTL planning instrument, with a feedback loop for dynamic updating

maps each layer to the specific ISO 31000:2018 clause and COSO ERM 2017 component that it derives from and implements, rather than positioning the framework as filling a gap in those standards. A structured validation pathway is therefore proposed: (i) face and content validation through expert review and a Delphi process with single-buyer-market practitioners (for example, PLN risk and planning staff and independent-power-producer developers); (ii) comparative benchmarking of IRAF-REP outputs against existing frameworks (ISO 31000/COSO registers and method-specific approaches such as MCS, ROA, and MCDM) applied to the same illustrative project; and (iii) empirical calibration using actual PLN project data, the primary short-term research priority in

Table 4. Structured future directions for renewable energy risk assessment in electricity market structures.

Horizon	Research Priority	Focus Area	Data Requirements
Short Term (1–3 yrs)	MC-SD hybrid framework development, Cross-risk correlation modelling; probabilistic social risk methods; lifecycle risk profiling Practitioner Delphi validation of the IRAF-REP: structured expert consultation with PLN risk managers, IPP developers, and DFI officers to validate layer definitions and risk-category weightings	Studies: Implementation of Renewable Energy Project in Indonesia. Expert-validated layer definitions and risk-category weights; documented face and content validity	Empirical PLN project data; expert panels; ISO 31000-aligned risk registers Expert panel; Delphi instrument; PLN institutional access
Medium Term (3–6 yrs)	Dynamic lifecycle risk models	Comparable single-buyer markets and validation across three or more developing-country electricity market structures	System data from grid operators; long-run PPA contract performance databases
Long Term (6–10 yrs)	AI-enhanced adaptive risk assessment; digital twin frameworks; climate-resilient market modelling Cross-country IRAF-REP validation across at least three single-buyer markets beyond Indonesia (e.g., Bangladesh, Egypt, Vietnam), with transferability treated as a hypothesis rather than assumed	Globally transferable risk governance frameworks for state-dominated sectors Empirically tested transferability; a cross-market risk taxonomy	Cross-country datasets; ML training corpora; climate scenario archives Country regulatory documents; PPA performance databases; in-country expert panels

. Until these steps are completed, the framework should be interpreted as a testable proposal rather than a demonstrated improvement over current practice.

5. Discussion

5.1. Institutional Situatedness of Risk Assessment—Why the Method-Market Mismatch Persists

The most important theoretical finding is that renewable energy risk assessment is institutionally situated. The dominance of MCS and ROA in liberalised-market studies reflects their institutional fit with competitive price data, not their general superiority. The dominance of MCDM and Delphi in single-buyer studies reflects an implicit, untheorised institutional adaptation to absent market data. But the analysis in Section 3.3 raises a harder question: why has this mismatch persisted for a decade without being corrected?

North’s institutional theory [10] offers a direct answer: institutions exhibit path dependence. Early investments in stochastic price modelling for liberalised markets created competency lock-in that persists even after the empirical context changes.

The energy economics and engineering communities built their risk assessment toolkits during the 1990s–2000s liberalisation wave. That intellectual infrastructure—datasets, software tools, journal conventions, pedagogical traditions—is now deeply embedded. Adapting it to single-buyer contexts requires not just new methods but new data infrastructure, new theoretical frameworks, and new practitioner communities.

This represents a higher institutional transition cost than is typically acknowledged. Roberts et al. [107] and Turnheim and Geels [108] demonstrate that incumbent structural persistence is the norm in energy transitions; overcoming it requires deliberate institutional intervention, not simply incremental research effort.

The practical implication: bridging the method-market gap requires co-production between academic researchers and national utilities.

5.2. The Precision-Comprehensiveness Tension—Why It Cannot Be Resolved by Method Selection Alone

MCS and ROA offer precision for specific risk factors but miss cross-category interactions. MCDM methods offer comprehensiveness but cannot generate probability distributions for ISO 31000 quantitative prioritisation. SD models capture dynamic feedback but are deterministic. Prior SLRs have noted this tension without analysing why it persists [17,18]. The analysis in Section 3.3 and Section 3.4 provides the answer: the tension is not primarily a methodological problem but a data architecture problem.

Consider what an ideal risk assessment for a PLN solar project would require (1) probability distributions for resource, technology, and cost parameters (MCS inputs); (2) a dynamic model of how PLN’s tariff decisions respond to market conditions over time (SD inputs); (3) expert judgements on social acceptance and political risk (MCDM inputs); and (4) a cross-risk correlation matrix linking policy risk to financial risk to counterparty risk. Currently, each of these data types exists in different institutional silos—resource data at meteorological agencies, tariff history at PLN, social risk assessments in environmental impact studies, political risk ratings at credit agencies. Within the reviewed literature, no single analytical framework was found to draw on all four simultaneously. The IRAF-REP’s five-layer architecture is designed precisely to define what data each layer requires, creating a blueprint for the data integration that the precision-comprehensiveness tension demands. The multiparadigm approach demonstrated by Isnandar et al. [9] for the Indonesian regulated market—combining generation unit parameters, system operator constraints, consumer demand data, and carbon policy scenarios in a single simulation framework—offers a methodological precedent for this kind of data integration.

This reframing has a practical consequence: the near-term research priority is not primarily to develop new mathematical methods but to build the data infrastructure that existing methods cannot currently access. A nationally standardised PLN project risk database—covering PPA terms, tariff histories, resource performance, and grid integration outcomes—would immediately enable the calibration of quantitative models that currently rely on European proxies. This is a governance and data policy recommendation as much as a research agenda item.

5.3. Indonesia as a Global South Governance Model

Fouquet and Pearson [109] and Loorbach et al. [110] demonstrate that energy transition pathways in developing economies differ qualitatively from OECD contexts. Sovacool et al. [111] show that decarbonisation in developing countries involves justice and equity dimensions that standard financial risk models do not address. The IRAF-REP, by explicitly incorporating market structure as a first-order analytical input, is designed to accommodate these qualitative differences—making it potentially transferable to Bangladesh, Egypt, Vietnam, and comparable single-buyer economies—a transferability we frame as a hypothesis for future cross-country validation rather than an established property.

Indonesia’s theoretical significance as a Global South representative case rests on four structural features that are broadly shared across developing economies. First, PLN’s institutional dominance replicates the governance pattern found in state-owned utilities across sub-Saharan Africa (e.g., ESKOM in South Africa, KPLC in Kenya), South Asia (e.g., NTPC in India, BPDB in Bangladesh), and Southeast Asia (e.g., EVN in Vietnam, EGAT in Thailand). In each case, a single state entity controls electricity procurement, and private renewable energy investors face counterparty risk rather than market price risk. Risk assessment frameworks calibrated for competitive European markets are institutionally misaligned with this dominant global governance reality.

Second, Indonesia’s regulatory framework—which mandates quantitative risk assessment under ISO 31000 and COSO through PER-2/MBU/03/2023, while simultaneously operating a procurement system (RUPTL) that lacks an integrated probabilistic risk register—represents a gap that is characteristic of developing economies at the early stage of regulatory modernisation. The gap between regulatory aspiration (requiring quantitative risk management) and analytical capacity (lacking the methods and data to deliver it) is one of the institutional challenges that the IRAF-REP is intended to help address through a structured risk-assessment architecture. This makes Indonesia not merely a locally relevant case but a theoretically significant test bed for developing transferable frameworks.

Third, Indonesia’s scale—50+ GW of required new renewable capacity by 2034, the world’s largest archipelagic geography, and grid infrastructure gaps across 17,000 islands—means that the risk assessment challenges it faces are more complex, not simpler, than those faced by most comparable economies. Although this complexity makes Indonesia a demanding test case, transferability to other single-buyer systems cannot be assumed by construction: Bangladesh, Egypt, Vietnam, South Africa, and comparable economies differ materially in tariff formation, financing structure, grid topology, private-sector participation, and political economy. Transferability is therefore presented as a hypothesis to be tested through comparative application rather than an automatic consequence of Indonesian complexity.

Fourth, the institutional similarities across these economies extend beyond procurement structure to financing constraints. High WACC, limited domestic capital markets, currency risk, and dependence on multilateral development bank financing are shared structural conditions that amplify the project-level risks identified in this review—particularly financial/investment risk and counterparty/PPA risk. Kern and Smith [112] demonstrate that these institutional constraints shape technology adoption pathways in ways that standard techno-economic models miss; Roberts et al. [107] show that incumbent structural persistence requires deliberate institutional intervention rather than incremental research effort. The IRAF-REP is proposed as an institutional architecture that may support such intervention, subject to the validation pathway described in Section 4.3.

5.4. SDG Alignment and Policy Implications

The findings of this review carry direct implications for three Sustainable Development Goals that together define the global clean energy governance agenda.

SDG 7 (Affordable and Clean Energy): The IEA estimates that achieving universal clean energy access requires USD 5.7 trillion in annual investment through 2030 [3]. IRENA [113] demonstrates that the majority of this investment must flow to developing economies—precisely the single-buyer and state-dominated markets that this review shows are analytically underserved. Inadequate risk frameworks create a measurable cost: Dukan and Kitzing [81] show that de-risking through better policy design reduces WACC by 10–40%, directly lowering the cost of renewable energy. A risk framework that cannot capture the dominant risks in single-buyer markets (counterparty/PPA risk, regulatory-discretion risk) systematically overstates investment risk, raising WACC and deterring capital from exactly the markets where SDG 7 progress is most needed.

SDG 13 (Climate Action): The Paris Agreement’s 1.5 degree C target requires near-complete decarbonisation of the global electricity sector by 2050. The IEA Net Zero by 2050 roadmap [114] identifies Southeast Asia, sub-Saharan Africa, and South Asia as the regions where the gap between required and projected renewable capacity is largest. These are overwhelmingly single-buyer and hybrid market economies. If risk-averse private investors avoid these markets due to inadequate risk transparency and framework misalignment—as the evidence in this review suggests they currently do—the global clean energy transition will be concentrated in already-advanced economies, systematically missing the Paris targets. Improving risk assessment frameworks in single-buyer markets is therefore not a peripheral technical question but a structural requirement for climate action.

SDG 9 (Industry, Innovation, and Infrastructure): The IRAF-REP’s five-layer architecture provides an explicit innovation roadmap for risk assessment methodology, directly advancing SDG 9’s target of promoting sustainable industrialisation and fostering innovation. The framework’s Layer 5 integration with national planning instruments (RUPTL, PER-2/MBU/03/2023) demonstrates how academic risk methodology can be translated into governance infrastructure—the type of capacity-building that SDG 9 specifically targets for developing economies.

The interconnection between these three SDGs is analytically important. Governance quality—the institutional capacity to design and implement effective risk management frameworks—is a mediating variable linking all three. Studies including Kern and Smith [112] and Sovacool et al. [111] demonstrate that governance quality shapes both the pace and equity of energy transitions. Beyond risk-assessment methods, the measurement of climate-policy effectiveness is itself methodologically fragmented: Matukhno et al. [115] show that national climate-policy ratings diverge in scope, indicator design, and scoring logic, and propose a transparent cross-index protocol for comparing them—reinforcing that governance-quality assessment, like project-risk assessment, is strengthened by explicit, comparable frameworks rather than reliance on any single metric. A deeper treatment of enterprise risk management (ERM), complex-adaptive-systems perspectives, and energy governance is beyond the scope of this review and is identified as part of the future research agenda. A risk assessment framework that is institutionally adapted to single-buyer governance realities—as the IRAF-REP is designed to be—directly strengthens the governance infrastructure that mediates SDG 7, SDG 13, and SDG 9 progress simultaneously. This is why embedding the IRAF-REP within national planning instruments such as Indonesia’s RUPTL is not merely a technical improvement but a governance reform with direct SDG implications.

6. Limitations

This review has six limitations that should be considered when interpreting its findings.

First, despite searching five major databases, studies published in regional journals or in languages other than English may have been missed. This could introduce geographic and linguistic bias, particularly for developing-country literature that is sometimes published in national or regional outlets.

Second, the inclusion criteria require studies to explicitly frame their analysis within an electricity market context. Relevant risk assessment work framed primarily as technology or finance research—without explicit market framing—may therefore have been excluded, potentially understating the breadth of available methods.

Third, the three-criterion quality assessment (QA1-QA3) was designed as a relevance- and scope-oriented screening instrument rather than a formal methodological-quality or risk-of-bias assessment. Consequently, the review does not differentiate highly rigorous studies from exploratory studies, nor does it weight findings according to methodological quality, validation strength, data quality, or reporting transparency. This approach is consistent with the configurative (mapping) objective of the review but should be considered when interpreting the synthesis and the resulting IRAF-REP framework.

Fourth, the frequency figures reported in this review are systematic estimates derived from the data extraction database. The inherent heterogeneity of study designs, risk taxonomies, and reporting conventions across 116 papers means that exact cross-study frequency comparisons are approximate rather than precise.

Fifth, the IRAF-REP is a conceptual synthesis architecture. It is designed as a foundation for future empirical validation rather than a tested instrument. Readers should interpret the framework as a theoretically grounded proposal; its empirical calibration using actual project data from single-buyer electricity markets—including Indonesia/PLN—remains the primary short-term research priority identified in Table 4.

Sixth, the systematic review base depends on search and deduplication choices that are only partly documented in the original project records. Although Supplementary Material S2 reports the search date, recovered database-specific search strings, inclusion/exclusion filters, retrieval counts, screening statistics, and the deduplication procedure used in Parsifal, not all original database-specific query logs and search-interface settings were retained. Consequently, some aspects of the search process cannot be reproduced verbatim and should be interpreted as a documentation limitation rather than a methodological one.

7. Future Directions

Table 4 presents a structured future research agenda across three horizons, directly responding to the five identified gaps.

Short-term priorities address tractable methodological foundations. Medium-term priorities address the IRAF-REP’s most critical gap—MC-SD hybrid validation, a collaborative research opportunity for Indonesia, and comparable economies. Long-term priorities position the field for AI-enhanced adaptive frameworks and digital twins for energy project risk—a frontier just beginning to emerge in adjacent fields.

8. Conclusions

This SLR synthesised 116 peer-reviewed studies on renewable energy project risk assessment within electricity market structures (2015–2026). Three conclusions respond directly to the research questions:

RQ1: Market/price risk (~68%) and policy/regulatory risk (~58%) dominate, but risk profiles differ structurally across market types. Single-buyer markets face institutionally structured counterparty and regulatory-discretion risk that standard stochastic models do not capture. Social/stakeholder risks remain underrepresented despite their material project impact.

RQ2: MCS and ROA dominate quantitative practice but are designed for liberalised markets. MCDM and expert methods dominate single-buyer studies—an implicit institutional adaptation. The MC-SD hybrid, conceptually well-suited for capturing both probabilistic uncertainty and institutional feedback, appears in fewer than 4% of studies.

RQ3: Five gaps are identified: limited risk register integration; single-buyer market underrepresentation; absent MC-SD hybrids; absent cross-risk interaction modelling; and neglected lifecycle dynamics. The IRAF-REP is designed to respond to all five in an integrated manner—pending the empirical validation identified as the primary research priority with a specific application pathway for Indonesia and a transferability hypothesis for comparable Global South governance contexts.

The paper’s overarching argument is that renewable energy risk assessment is institutionally situated. The IRAF-REP provides an institutionally adaptive architecture—and Indonesia is the theoretically significant case through which to validate it.

The five research gaps identified in this review collectively define the research agenda for the next phase of work. The absence of a quantitative risk assessment framework designed specifically for single-buyer electricity markets—one that integrates probabilistic uncertainty quantification with institutional feedback dynamics—is not merely a literature gap. It is a practical barrier to renewable energy investment in the economies where the global energy transition most urgently needs to accelerate.

The MC-SD hybrid methodology is proposed as the most promising path toward such a framework: Monte Carlo simulation to capture the probabilistic distribution of project-level risk factors, and System Dynamics to model the feedback loops between PLN’s procurement decisions, private investor responses, and grid integration outcomes. Together, these methods would produce a risk assessment capability that is both analytically rigorous and institutionally adapted to single-buyer governance realities. A multiparadigm MAS-FC model for the Java–Madura–Bali power system has already demonstrated the feasibility of combining agent-based and system dynamics approaches in the PLN regulated market [9]; adding Monte Carlo probabilistic uncertainty quantification and System Dynamics for feedback to this architecture would constitute the full MC-SD integration this review identifies as its highest-priority methodological recommendation.

The development and empirical validation of this integrated framework—the IRAF-REP in its fully operationalised form—using actual project data from PLN’s renewable energy programme under RUPTL 2025–2034, constitutes the direct research continuation of this systematic review. Indonesia’s scale, governance complexity, and regulatory mandate for quantitative risk management make it the theoretically and practically ideal case for this validation. The transferability of a validated Indonesian framework to comparable Global South governance contexts—Bangladesh, Egypt, Vietnam, and beyond—represents the broader contribution to equitable energy transition governance that this research programme ultimately serves.