PURPOSE
In addition to the pre-design report for major projects exceeding $10 million construction cost, there needs to be developed a formal risk assessment and risk management plan that will then be followed for the life of the project. It should be understood that a risk assessment can be undertaken at any stage of a project. The intent of risk management is to identify the unknowns and define the appropriate tactics to reduce the impact or severity of the risks. The plan will identify what risks are to be analyzed and when the analysis should take place. The purpose of this procedure is to develop a policy and provide definitions, guidelines and methods for assessing risk, reducing cost overruns and outlining the components of a risk management plan for projects where the construction cost estimate exceeds $10 million.
REFERENCES
N/A
RESPONSIBILITIES
Project Manager (PM): The PM is responsible for organizing and performing the risk analysis. The PM should identify and monitor the risks, their mitigation strategies, the responsible parties, any applicable deadlines, and any impact or change in impact that could result.
Project Engineer (PE): The PE is responsible for informing the PM of any changing factors or decisions that could impact the project’s risk level from the Pre-Design through Bid and Award phases.
Construction Manager (CM): The CM is responsible for informing the PM of any changing factors or decisions that could impact the project’s risk level during the Construction Phase.
PROCEDURE
Background
Risk assessment is the process of identifying and determining the impact that a possible risk might have on a project. There is an inherent risk in almost everything and an efficient risk assessment will only concentrate on the factors that are of significant consequence.
Risk management is the act or practice of dealing with risk. It includes planning for risk, assessing risk issues, developing risk handling options, and monitoring risks to determine how the risks have changed. Proper risk management is proactive rather than reactive and will attempt to reduce the likelihood of an event occurring and/or the magnitude of its impact.
Risk is a measure of the probability and consequences of not achieving a defined project goal. There are two primary components of risk for a given event:
A probability of occurrence of that event; and,
Impact of the event occurring (amount at stake).
Risk can also be defined as a function of these two components.
Risk assessment and risk management can be implemented at any stage of a project. Usually, it is done during the pre-design phase. For long term projects it may be advisable to perform assessments at various stages along the way to determine changes in the probability and impact of identified risks. The approach risk management and the timing of risk assessments are defined in the risk management plan.
Traditional methods of coping with project risks and uncertainties mainly consist of establishing a contingency budget which is estimated as a percentage of the various project components. This method of calculating contingencies for risk has a low level of confidence and reliability. Probabilistic risk assessment techniques can provide an analytical basis for establishing contingency budgets by modeling the impact of risk factors using data ranges.
The goal of risk assessment and risk management is to minimize cost overruns and scheduling problems. It has been shown that cost overruns are positively related to project size, engineering uncertainty, inflation, accuracy of contract documents, project scope increase, differing site conditions, the length of time between planning and completion of a project and delays.
Risk Management
Risk management involves the following processes:
Planning – defining what processes the project team will execute to identify, communicate and avert risks in the project.
Identification – defining the risks specific to the project.
Quantification – assessing the likelihood and impact of each risk, as well as testing the project assumptions.
Qualification – prioritizing and mathematically assessing which risks require a response.
Response planning – defining the tactical strategies required to reduce or eliminate the risk.
Monitoring and control – reviewing risks to ensure that agreed upon tactics have been implemented; ensuring that no new risks have arisen; and, that risk likelihood and impact have not changed.
Risk Management Plan
Once it has been determined that a project falls into a category where a risk management plan is needed, it is necessary to formulate the needs and goals of the proposed plan. The plan should include the following:
The objectives of the specific risk management plan.
A prioritized listing and description of the risks targeted for monitoring and possible mitigation.
The technical and other requirements needed to mitigate risks.
The costs and benefits of risk mitigation measures.
A description of the risk management responsibilities including the owner’s, contractor’s, and others.
A description of actions to be implemented by each responsible party.
A monitoring program and process for follow up or additional corrective actions. This program should also ensure information is obtained to evaluate the actual benefits of implemented mitigation.
An implementation schedule including the overall time and cost impact of the risk mitigation plan.
Risk Assessment and Risk Analysis
Risk assessment starts with a thorough review of the project’s scope, cost and schedule. The purpose is to determine whether these are accurate representations of the project. This review establishes base project conditions with cost and schedule stripped of all contingencies. A risk management team will then identify all the potential risks and opportunities (ways to reduce costs) that may affect the project. A “risk catalog” should be developed that can be used as a checklist for the identification process (Attachment 4.2-1). For each major risk factor, an action with its associated cost, should be devised and incorporated into the project’s Risk Management Plan.
The form of analysis can vary depending on the complexity of the project. Sometimes a single individual with expertise in risk modeling helps and coaches the project cost estimating team to come up with a ranked list of risk factors and ranges of possible likely values for various cost items. A more costly but effective approach is to use a workshop as a venue where project participants can identify and assess risks. Some of the more common methods of workshop risk analysis are brainstorming, the Delphi Method, and the nominal group technique.
Brainstorming
Brainstorming is one of the most effective risk identification techniques and is relatively inexpensive. The PM acts as facilitator and gathers the project team and outside industry experts together to create a comprehensive list of risks that can be quantitatively or qualitatively evaluated later. The key output of this process is to develop a list of preliminary risks and get a sense of the relative risk or safety of the project. Team members draw on their prior experience within the organization as well as other projects to develop ideas about potential risk events.
The Delphi Method
The Delphi method relies on expert judgement and follows these general steps:
A panel of experts is selected from both inside and outside the organization. The experts do not interact on a face-to-face basis and may not even know who else sits on the panel.
Each expert is asked to make an anonymous prediction on a particular subject.
Each expert receives a composite feedback of the entire panel’s answers and is asked to make new predictions based upon the feedback. The process is then repeated as necessary.
The Nominal Group Technique
Closely related to the Delphi method is the nominal group technique, which allows for face-to-face contact and direct communication. The steps in the nominal communication technique are as follows:
A panel is convened and asked to generate ideas in writing.
The ideas are listed on a board or flip chart. Each idea is discussed among the panelists.
Each panelist prioritizes the ideas, which are then ranked mathematically. Steps 2 and 3 may be repeated as necessary.
Workshop Attendees
Assuming that a project is sufficiently large enough ($100 million) to justify a significant risk analysis effort, it is important to include representatives of various disciplines in the process (workshop), depending on the timing of the analysis. If the analysis is done during planning and pre-design, expertise in the overall project implementation, cost/benefit analysis, and funding environmental and conceptual design issues would be appropriate. For projects with completed designs, expertise should include project and construction management, cost estimating, scheduling, real estate (if right-of-way or property acquisition is necessary) and the involved engineering disciplines.
During the analysis, the “client” should remain fully involved although technical details should be coordinated and managed by the PM. The PM oversees the entire process, ensures that various key disciplines are present, and that appropriate information is available during the workshop. The PM should set the agenda and keep the process on time. The PM will also be the facilitator unless it is determined that outside expertise is needed. The workshop facilitator should begin the workshop by explaining the objectives and providing an overview of the approach that is to be taken.
Risk Quantification
After the risks have been identified using some of the methods explained above, it is time to quantify the effect of each risk factor. The risk register is a product of the risk identification process. This register is a list of all risk or opportunities identified along with their probability versus their impact or severity. The probability and severity can be divided into five categories: very low, low, medium, high, and very high. The level of risk the PM or the client is willing to accept is then compared against where the identified risk falls into the matrix. This will in turn help to direct the action to be used in the risk response. In highly involved complicated projects with multiple risk factors, it may be necessary to work with an independent risk analysis expert. The PM shall reach out to BOE’s assigned Risk Manager, Scott Goldstein from the City Administrative Office at (213) 978-7662 to obtain advice and determining insurance limits.
Risk Response Strategies
There are four possible responses to identified risks that can help reduce the impact or severity of a risk event to a project:
Avoidance – Change the project plan to eliminate the risk or condition or to protect the objectives from impact. This could mean eliminating an operating feature with high technical risk or modifying the task plan to use outside resources at a higher operating cost.
Transference – Shift the consequences of a risk to a third party altogether. Transferring the risk does not eliminate it but gives the responsibility for the risk to a third party.
Mitigation – Reduce the probability and/or consequence of an adverse risk event to an acceptable threshold. This involves evaluating the various risk conditions leading up to the risk event and reducing the impact.
Acceptance – This occurs when the project team decides not to modify the project plan or is unable to identify any suitable response strategy. Active acceptance may include developing a contingency plan to activate should the risk occur. Passive acceptance requires no action, thus leaving the project team to deal with the risks as they occur.
Contingency Planning
Contingency Planning can be used in two ways. The first way is at the start of the project when there are the most unknowns and any estimate is inherently risky. Use the estimating contingency to mitigate the impact of the estimate. Secondly, after the project has been thoroughly analyzed there is a need for a reserve fund known as the budget contingency to offset the cost of changes or unidentified work either for new features or to offset the cost of risk events. The amount to be used for either the estimating or budget contingency can be set by a traditional percentage formula or more accurately by assessing the actual risk involved. The latter is the preferred method.
Risk Monitoring
If the PM does not carefully monitor the identified risks, he/she might not be able to answer the likely weekly questions that may be asked about them. Every risk should be recorded, quantified, qualified, and the results should be assigned to the risk. The top risks, prioritized based on a combination of impact and likelihood, should be actively managed with formal mitigation or avoidance plans. It is important to record every risk on a spreadsheet or risk register that contains the following information:
Risk description
Date identified
Likelihood
Severity
Date resolution required
Person risk assigned to
Impact (budget, schedule or scope)
Area affected
Cause
Mitigation strategy
It is recommended that the PM hold a weekly review meeting with the owner providing an update on risk status. Monthly, the top risks should be compiled in a formal status report for management review. This would include any new risks that would require any additional funding, time, or project scope impact. Management should know the issues and approve the mitigation strategy.
RELATED PROCEDURES
LINKS / ATTACHMENTS
Links
N/A
Comments