11

PROJECT RISK MANAGEMENT

Project risk management includes the processes for conducting risk management planning, identification, analysis, response planning, and controlling on a project. Project risk management is essential for successful project management and should be applied throughout a project's life cycle. The root objectives of project risk management are to increase the likelihood and impact of positive events or opportunities while decreasing the likelihood and impact of negative events or threats to the project. Project risk management can be considered an extension of other project management processes, for example, addressing the uncertainty in project estimates and validity of assumptions. Project risk management assists stakeholders by providing greater certainty about project outcomes, reducing risk exposure, determining project strategies for bidding and contract negotiation, and estimating the cost and schedule for contingency reserves.

Most of the material on project risk management in the PMBOK® Guide and in the Practice Standard for Project Risk Management [5] is applicable to risk management for construction projects. This section of the Construction Extension presents additional considerations and guidelines for managing construction project risks.

11.1Project Risk Management in Construction

Every construction project, regardless of its size and complexity, continually faces a variety of uncertain situations due to factors common to the construction industry, such as:

• Long duration and aggressive schedules;
• Changing environment and the dynamic nature of the workplace;
• Complex technical processes;
• Open locations highly exposed to environmental agents;
• Unskilled workforce;
• Material shortages;
• Different organizations actively involved in the construction project with different goals, interests, and expectations;
• Many works being of public interest;
• Change in material prices; and
• Regulatory requirements.

Appendix X3 describes the most common causes of risks in construction projects.

Construction organizations should address risk management proactively as a team and consistently throughout the construction project life cycle. While risk management offers a proactive approach, management of issues is a reactive approach.

Some significant considerations should be taken when performing risk management in certain construction projects involving unique characteristics, for example, construction projects developed under collaborative construction project arrangements and public-private partnerships as well as international construction projects.

11.2Project Risk Management Planning

Careful and explicit planning enhances the probability of success for other project management processes. Planning is also important to provide sufficient resources and time for risk management activities, to establish an agreed-upon basis for evaluation risks, and to define the required level of risk management. Additional considerations, helpful documents, and tools and techniques for risk management planning in construction projects as described below should be considered.

11.2.1Bidding and Contract Documents

During the bidding phase, the bidding and contract documents can be a request for proposal, invitation for bid, or a similar document that the bidding team uses to implement risk management. The signed contract, together with the proposal and bidding documentation, can be considered the formal document that authorizes the project, much like a project charter authorizes the formal existence of a project.

11.2.2Organizational Methods

The method by which the organization addresses topics (e.g., which phases of risk management to perform) can vary based on the type of project and the contract arrangement. It includes individual risk management processes and how their outputs will be linked to overall project risk management. For example, in an engineering, procurement, construction, and management (EPCM) project, the engineering and construction phases may have individual risk management processes, while the procurement and management phases can be treated together. Methods also address how safety and environmental risk management plans interact with the overall construction risk management plan and how the subcontractors’ risk management plans will fit into the overall project risk management plan.

11.2.3Budgeting

A budget should be established for risk management for the project, based on assigned resources such as internal employees, consultants (including the risk manager), equipment, and workshop rental space. The cost baseline should include estimated funds needed. Protocols should be established for the application of contingency and management reserves.

11.2.4Scoring and Interpretation

The PMBOK® Guide considers strategic risk scoring sheets as a tool for providing a high-level assessment of the risk exposure of the project based on the overall project context. For safety and environmental planning, there may be local standards, norms, and laws regulating scoring and interpretation methods.

11.2.5Project Risk Management Planning Under Collaborative Construction Project Arrangements

A recent trend in construction regarding the assessment of risk is to collaborate with companies of various capabilities to deliver the project. A joint evaluation and understanding of one another's risks can help improve performance and reduce risk.

A shared or joint risk register may be used to ensure that parties share the project risk identification process and provide the basis for a collaborative assessment of risks. A shared risk register helps to avoid different perspectives on shared project risks and offers the collaborative parties or integrated project team an opportunity to agree on risk ownership allocation, responsibilities, responses, unified terminology and language, and a definition of risk metrics to measure the effectiveness of collaborative project risk management.

Project communications between project stakeholders throughout the project life cycle are of major consideration and critical to minimize the impact of risks.

The resources needed to develop and manage collaborative project arrangement relationships can be high. Opportunity costs should be considered for establishing benchmarks; expected outcomes should justify the resources to be invested.

Additional considerations that should be given when performing project risk management under collaborative construction project arrangements include:

• Complexity added to decision making, such as cognitive biases of groups and individuals;
• Conflicts of interest;
• Implementation challenges;
• Loss of autonomy and control;
• Stakeholder confusion;
• Lack of consistency and clarity on roles and responsibilities;
• Dilution of brand;
• Loss of intellectual property, know-how, and confidentiality;
• Damages to company reputation;
• Loss of awareness of legal obligations; and
• Increased difficulty in the contract change order process.

Potential opportunities include:

• Financial savings;
• Benefits from sharing knowledge and information and replicating successful practices;
• Access to new markets ensuring local knowledge;
• Better use of existing resources, technology, labor, and networks; and
• Enhanced professional skills and competences in the workforce.

11.2.6Project Risk Management Planning in Public-Private Partnership (PPP)

Establishing public-private partnership projects in contractual arrangements is a long process involving private and public organizations within complex project funding and finance solutions. One of the key features is the risk allocation between the various organizations performing on the project.

Project risks are transferred to the party best able to manage them at the lowest cost on an agreed-upon basis, taking public interest into account.

Figure 11-1 shows commonly used PPP contract types. PPP lies between a full public sector provision design-build contract and a full private sector participation privatization. Private sector risk taking increases from left to right in the figure.

A risk matrix may be useful for public and private parties to establish an organizing framework for the allocation of risks.

The early involvement of the parties on the project in a collaborative relationship provides advantages in planning and can reduce overall project risk. Multiparty involvement promotes value engineering and risk management approaches to achieve agreed-upon objectives and reduce overall risks.

Other than typical construction risks described later in this section, key risks may need to be identified at the pre-contract phase based on strategic analysis; these include revenue risks, financial risks, and operating risks.

Expert risk analysis is required for a successful design of contractual arrangements made prior to competitive tendering and that allocate risk burdens appropriately.

11.2.7Project Risk Management Planning in International Projects

When undertaking major project work in an international environment, careful understanding of the complex domestic risk environment is crucial.

PESTLE analysis (political, economic, social, technological, legal, and environmental analysis) is a marketing tool that facilitates the tracking of the new project environment and by which these factors are examined to determine specific risks associated with the project location.

The proposed classification of potential risks is described in Appendix X3. In addition to the most common causes of risks in construction projects, international projects bear additional potential sources of risks, including but not limited to:

• Custom procedures, import duties, and import and export restrictions;
• Cultural and religious practices effects on working patterns, cultural differences, and language barriers;
• Time zone and legal working days differences between site and central office;
• Local labor union practices;
• Local weather patterns (e.g., monsoon season);
• Local regulations;
• Safety and security concerns (e.g., terrorism);
• Constraints on employment of expatriate staff and/or work visa procedures;
• Regulated professional services granted to locals, government pressures to use local suppliers, and investment requirements involving the use of local employees; and
• Currency convertibility (exchange rate fluctuations) and/or restrictions on repatriation of funds.

11.2.8Risk Identification in Construction Projects

Identifying risks is an iterative process. Construction projects develop and evolve through successive project phases. Previously identified risks may change and new risks may appear throughout the project life cycle.

For better planning and identification of risks in construction projects, risks may be grouped under a same risk category or trigger event that might allow several risks to be realized. Practice Standard for Project Risk Management states, “Identifying common root causes of a group of risks, for example, may reveal both the magnitude of the risk event for the group as a whole along with effective strategies that might address several risks simultaneously” (e.g., identifying risks that can occur at the same time or risks using the same resources for recovery).

Risks can be classified according to many different approaches, among other options commonly used as classification systems:

• Depending upon the source, within or outside the organization (e.g., internal and external risks);
• According to the type of project (e.g., local or international project);
• Depending on the parties who will be responsible for managing the risks or the different agents involved in the whole construction process;
• Following the work breakdown structure;
• According to the sources of risk; and
• According to the project life cycle, or phase.

Regardless of the categorization system adopted, it should stimulate risk identification; enable a better understanding about the project's risks; and help risk identification, allocation, and management.

Even though each construction project's characteristics and project risks are unique, most construction projects share common key root causes of risk regardless of the project singularity. Key risks may be grouped or categorized under a heading guide or prompt list that can be used as a reference or framework for risk identification techniques such as brainstorming, expert consulting, workshops, or risk interviews.

An example of a generic categorization by sources of risk that a construction project may be exposed to is summarized in Figure 11-2. There are many other ways to classify risks for identification purposes; organizations should tailor their own lists appropriately for their projects.

Refer to Appendix X3 for examples of common risks in construction projects that follow the suggested categories in Figure 11-2.

11.2.8.1Resource Plan

Resource productivity estimates are a key input to risk identification. Activity duration and cost estimates are based on those rates, particularly for engineering and construction phases.

11.2.8.2Documentation Reviews

In construction projects, in addition to documents described in the PMBOK® Guide, reviews should include other documents such as layout drawings, plant location and access diagrams, equipment erection specifications, geotechnical reports, construction occupational health and safety study (HSE study), fire safety study, environmental management plan, and emergency response plan. Permits, licenses, and agreements with labor unions and/or communities may also include requirements that add risk to the project.

11.2.8.3Checklist Analysis

Checklists for construction projects may include such items as type of contract, unfavorable clauses, site and area factors, weather, regulatory and labor factors, knowledge of client, etc., as well as the usual appraisal of construction equipment requirements, techniques needed, and special materials.

11.2.8.4Assumption Analysis

For construction projects, all assumptions made during the bidding phase are based on a set of hypotheses and scenarios and should be reviewed periodically to verify their validity, accuracy, consistency, or completeness.

11.2.8.5Lessons Learned and Learning from Others’ Experiences

Studying previous similar projects provides valuable information for more complete risk identification, including construction methods and solutions, materials, and suppliers. Project evaluation reports present findings, conclusions, and recommendations from previous experience and evidence.

11.2.8.6Local Expert Judgment

Experts can provide significant knowledge of similar projects and project environment. Interviewing local experienced project managers, industry professionals, construction managers, and subject matter experts can help identify specific local risks.

11.2.8.7Concept Hazard Analysis

Performed during the concept design and feasibility study, concept hazard analysis focuses on identifying potential hazards in the concept design and may be used to minimize future changes to the project's fundamental concepts.

11.2.8.8Preliminary Hazard Analysis (PHA)

Preliminary hazard analysis identifies potential hazardous and accidental events (e.g., job hazard analysis).

11.2.8.9Hazard and Operational Studies (HAZOP)

This is a systematic and structured approach used to analyze a process and its parts to identify potential hazards, operability problems, and deviations from design.

11.2.8.10 Constructability Review and Checklist

A formal constructability review process provides a good discussion for risk identification. Checklists of constructability historical issues may serve as a means for risk identification.

11.2.8.11 Value Analysis Study

Value analysis provides an organized approach to analyzing a project and may be used as a source of information for risk identification.

11.2.8.12 Failure Modes and Effects Analysis (FMEA)

Failure modes and effects analysis (FMEA) systematically examines and determines how an item may fail and identifies the consequences of a failure.

11.2.9Qualitative Risk Analysis in Construction Projects

Qualitative risk analysis provides a rapid initial review of project risks with a quick assessment of the risk's importance to the project, and establishes priorities for planning risk responses. Qualitative risk analysis is convenient for any type and size of construction project where a robust or costly quantitative analysis may not be required or may not be possible to execute. Independent reviewers are persons outside the project who have significant experience in similar projects and specifically on the local context of the project location. Local experts can provide significant knowledge of similar projects and the project environment. Assigning values for probability and impact of risks relies on the experience and professional judgment of local experts.

11.2.10Quantitative Risk Analysis in Construction Projects

Once risks are identified and prioritized by the qualitative risk analysis, a deep analysis of the effects of those risks can be performed by quantitative risk analysis. It is used mostly to evaluate the aggregate effect of all risks affecting the project.

Quantitative risk analysis is mostly used on large and complex construction projects in support of significant project management and financial decisions. The need for, and the viability of, developing a quantitative risk analysis should be assessed through expert judgment and may depend on the project size, the project team level of experience in risk management, the information and data available to develop appropriate models, and the resources assigned to risk management activities.

Quantitative risk analysis uses techniques such as stochastic simulation and decision analysis to determine many project assumptions, for example:

• Determining the probability of achieving a specific project objective. A probability distribution of project cost and schedule is generated based on uncertainty and risk effects. When bidding, if the final project date is not determined by the client, the project team can offer a date based on the risk level it is willing to accept.
• Identifying realistic and achievable cost, schedule, or scope targets. Acceleration plans benefit from this analysis and aggressive targets can be negotiated with a lower degree of uncertainty.
• Performing risk assessment. General and vaguely defined contingency reserves can be replaced by an assessment of explicitly defined risk events.
• Analyzing the cost of a risk response. The cost of a risk response is analyzed in comparison to the cost of a risk.

The additional tools and techniques listed below should also be considered as alternative quantitative techniques.

• Monte Carlo analysis. Monte Carlo analysis is a form of stochastic simulation that approaches the uncertainty in the input data and, through a number of iterations, reflects the probability of project outcome. When possible, project uncertainty is modeled as a dynamic process along the complete project life cycle. A Monte Carlo simulation produces valuable information supporting contingency and management reserve analysis.
• Fault tree analysis/failure modes and effects analysis (FMEA). FTA is a deductive, top-down method aimed at analyzing the effects of initiating faults and events on a complex system. This contrasts with FMEA, which is an inductive, bottom-up analysis method aimed at analyzing the effects of single component or function failures on equipment or subsystems.
• Failure modes, effects, and criticality analysis (FMECA). FMECA extends FMEA by including a criticality analysis, which is used to chart the probability of failure modes against the severity of their consequences.

11.2.11Plan Risk Responses in Construction Projects

The involvement of subcontractors in construction projects makes risk response planning more complex. Risk responses may result in additional costs incurred by one party, and those costs may also impact another party. Risk costs and risk response costs should be quantified, discussed, negotiated, and justified. Given the complexity of risk response planning and the need for carefully planned timing, it is critical that triggers be identified, planned for, monitored, and controlled throughout the project.

11.2.11.1 Strategies for Negative Risks or Threats and Positive Risks or Opportunities

Four strategies to mitigate negative risks, as discussed in the PMBOK® Guide and in the Practice Standard for Project Risk Management, are avoid, transfer, mitigate, and accept:

• Avoid. Risk avoidance is more effective during early project phases and contract negotiation. After a contract is signed, some of the major risks regarding plant performance and penalties cannot be avoided. An exemption clause can be included in the contract to avoid those risks.
• Transfer. Transferring the risk simply gives another party responsibility for its management; it does not eliminate the risk. Risk should be transferred to the party best able to manage it, for example, to subcontractors or insurance companies. See Section 11.2.12 on Insurance in Construction Projects.
• Mitigate. Risk mitigation is a risk response strategy whereby the project team acts to reduce the probability of occurrence or impact of a risk (PMBOK® Guide); for example, the risk of losing key personnel in the late stages of construction projects can be mitigated by providing completion bonuses. Another way to reduce risk impact is by sharing it with other parties that may have the appropriate knowledge and resources to manage it.
• Accept. Acceptance implies potential time and cost impacts, which should be included in the contingency reserve. For example, an ambiguity in a contract clause about who is responsible for providing water for hydrostatic tests could be accepted if the volume (and cost) is small and the availability is high.

A strategy to share the benefits of a positive risk or opportunity among the project participants should be included in the construction project contract. Identifying and analyzing project opportunities in a proactive manner and defining appropriate strategies to exploit them are effective ways to obtain additional benefits and improve project outcomes.

11.2.12Insurance in Construction Projects

The various parties involved in a construction project (i.e., owner, project designer, contractors, construction management, public administration, and financiers) confront risks that could result in potential economic loss to persons and entities involved and to third parties.

Under such circumstances, one option that construction companies have, when insurance is not required by law and regulation or by project contractual arrangements, is to start a reserve fund in order to assume the multiple risks that may arise during the construction process. This practice is called self-insurance. Sometimes this means assuming expensive extra costs to absorb all the unforeseen risks. Contracting with an insurance company is an option that can be used to avoid starting a reserve fund. Government entities, in some cases, assume risks without obtaining insurance, counting on their financial capacity to cover losses.

Sharing a risk with other parties by means of an insurance policy contributes to construction costs in the form of insurance premiums and provides financial protection to the interested parties.

Insurance companies are an important stakeholder in construction projects that should be addressed. In some cases, insurers may require a third-party technical, quality, environmental, or health and safety inspection, or control of the project and works in course. These issues are considered as insurance costs in the cost estimation.

11.2.12.1 Types of Insurance

The construction industry uses a variety of insurance products as a principal risk transfer instrument to handle some of its liabilities, for example, contract works insurance, builder's/contractor's all risks, property/material damage, business interruption, professional indemnity, public and product liabilities, workers’ compensation, umbrella policies, contract guarantee, decennial liability insurance, and other on-demand special types of insurance covering environmental risks, currency risks, or damages by acts of terrorism (see Figure 11-3).

Each organization, individual, or party directly or indirectly involved with the project should evaluate and decide upon appropriate insurance policies for their circumstances. Expert guidance is necessary considering that overinsuring is a practice that can be very expensive for the project and underinsuring could be very expensive in the event of claims or uninsured losses.

In the construction industry, insurance policies applied mainly depend on the project location and its regulatory and jurisdictional laws. These insurance policies vary widely from country to country both in their characteristics and their designation. Nevertheless, construction projects share the same kind of risks regardless of the project location.

Some of the most common insurance practices are listed below. For further description with considerations for local variations according to regulations, jurisdictional legislation, and specific local designation refer to the Glossary.

• Construction all risks insurance, contractor's all risk (CAR), erection all risks (EAR), contract works insurance, builder's risk insurance, and general liability (GL) insurance;
• Insurance coverage for construction defects and defects liability bond;
• Civil liability insurance, public liability insurance, and employer's liability insurance;
• Industrial special risk and business interruption insurance;
• Wrap-up insurance policies: owner- and contractor-controlled insurance programs (OCIP and CCIP);
• Professional indemnity insurance and professional liability insurance;
• Integrated project insurance;
• Latent defects insurance and inherent defects insurance (IDI);
• Collateral warranty;
• Surety bonds including performance, payment and bid bonds, contract bond, contract performance guarantee, tender bond, and retention bond;
• Decennial insurance;
• Joint venture coverage and insuring design-build risks; and
• Advanced loss of profits, delayed completion cover, and delay in start-up cover (DSU).

11.3Project Risk Management Monitoring and Controlling

Risk management is a dynamic process. Risk identification, analysis, response planning, and risk monitoring and controlling should be a proactive process performed continually along the project life cycle, particularly for large construction projects or those in dynamic environments. As the project evolves, project risks may change, the probability and impact of identified risks may change, new triggers may emerge, identified risks may disappear, secondary and residual risks may arise, and new risks may emerge. The risk register should be periodically reviewed, identified risks should be reassessed, project risk information should be updated, and the effectiveness of risk response actions and control measures should be monitored and evaluated.

Special considerations should be taken regarding project communications and reporting, as project success relies heavily on communication throughout the project life cycle. Risk meetings should be held regularly to perform risk reviews; to update the status of risks in the risk register; and to repeat the process of identification, analysis, and response planning. Some risks may need to be escalated to program and portfolio level.

Communication with project stakeholders is important in order to periodically assess the acceptable level of risk on the project. Standard templates for risk status reports may be a helpful tool for project risk reporting.