Chapter 1
Projects and Risk
This book seeks to explain the nature of risk management and also to clarify the practical procedures for undertaking and utilising decisions. Risk management is beset by a dark cloak of technology, definitions and methodologies, often maintained by analysts and specialist consultants, which contributes to the unnecessary mystique and lack of understanding of the approach.
This book offers for the first timeāin the opinion of the authorsāthe distilled knowledge of over a hundred man-years of project experience in working on aspects of project risk management and contains information which most of us would have liked to have hadāhad it been available and collated. To all students and practitioners using this book, follow known procedures as outlined in the book, avoid short-cuts and remember to keep records of everything you model, simulate or assume.
This chapter discusses a number of general concepts including projects, project phases and risk attitude before introducing a number of risk management strategies. The book concludes with some brief references to project planning.
1.1 Construction projects
Change is inherent in construction work. For years, industry has had a very poor reputation for coping with the adverse effects of change, with many projects failing to meet deadlines and cost and quality targets. This is not too surprising considering that there are no known perfect engineers, anymore than there are perfect designs or that the forces of nature behave in a perfectly predictable way. Change cannot be eliminated, but by applying the principles of risk management, engineers are able to improve the effective management of this change.
Change is normally regarded in terms of its adverse effects on project cost estimates and programmes. In extreme cases, the risk of these time and cost overruns can invalidate the economic case for a project, turning a potentially profitable investment into a loss-making venture. A risk event implies that there is a range of outcomes for that event which could be both more and less favourable than the most likely outcome, and that each outcome within the range has a probability of occurrence. The accumulation or combinations of risks can be termed project risk. This will usually be calculated using a simulation model (see Chapter 7). It is important to try to identify all the potential risks to the project even if they are not strictly events or a calculation of project risk. It is not possible to identify all risks and even at the end of a project you will only know the risks that actually occurred. However, risk management is concerned with identifying as many as is practicable of the sources and causes of risk because if a risk is not identified it cannot be considered in any part of the risk management process.
In construction projects each of the three primary targets of cost, time and quality will be likely to be subject to risk and uncertainty. It follows that a realistic estimate is one which makes appropriate allowances for all those risks and uncertainties which can be anticipated from experience and foresight. Project managers should undertake or propose actions which eliminate the risks before they occur, or reduce the effects of risk or uncertainty and make provision for them if they occur when this is possible and cost effective. It is vital to recognise the root causes of risks, and not to consider risks as events that occur almost at random. Risks can frequently be avoided if their root causes are identified and managed before the adverse consequenceāthe risk eventāoccurs. They should also ensure that the remaining risks are allocated to the parties in a manner which is likely to optimise project performance.
To achieve these aims it is suggested that a systematic approach is followed: to identify the risk sources; to quantify their effects (risk assessment and analysis); to develop management responses to risk; and finally to provide for residual risk in the project estimates. These four stages comprise the core of the process of risk management. Risk management can be one of the most creative tasks of project management.
The benefits of risk management can be summarised as follows:
- project issues are clarified, understood and considered from the start;
- decisions are supported by thorough analysis;
- the definition and structure of the project are continually monitored;
- clearer understanding of specific risks associated with a project;
- build-up of historical data to assist future risk management procedures.
1.2 Decision making
Risk management is a particular form of decision making within project management, which is itself the topic of many textbooks and papers. Risk management is not about predicting the future. It is about understanding your project and making a better decision with regard to the management of your project, tomorrow. Sometimes that decision may be to abandon the project. If that is the correct outcome saving various parties from wasting time, money and skilled human resources, then the need for a rational, repeatable, justifiable risk methodology and risk interpretation is paramount. Nevertheless, the precise boundaries between decision making and the aspects of other problem-solving methodologies have always been difficult to establish.
In essence, decisions are made against a predetermined set of objectives, rules and/or priorities based upon knowledge, data and information relevant to the issue although too often this is not the case. Frequently decisions are ill-founded, not based on a logical assessment of project-specific criteria and lead to difficulties later. It is not always possible to have conditions of total certainty; indeed in risk management it is most likely that a considerable amount of uncertainty about the construction project exists at this stage.
The terms risk and uncertainty can be used in different ways. The word risk originated from the French word risquƩ, and began to appear in England, in its anglicised form, around 1830, when it was used in insurance transactions. Risk can be, and has been, defined in many ways and assessed in terms of fatalities and injuries, in terms of probability of reliability, in terms of a sample of a population or in terms of the likely effects on a project. All these methodologies are valid and particular industries or sectors have chosen to adopt particular measures as their standard approach. As this book concentrates on engineering projects, risk is defined in the project context, and broadly follows the guidelines and terminology adopted by the British Standard on Project Management BS 6079, The Association for Project Management Body of Knowledge, The Association for Project Management Project Risk Analysis and Management Guide, the Institution of Civil Engineers and the Faculty of Actuaries Risk Analysis and Management for Projects Guide and the HM Treasury, Central Unit on Procurement Guide on Risk Assessment.
A number of authors state that uncertainty should be considered as separate from risk because the two terms are distinctly different. Uncertainty can be regarded as the chance occurrence of some event where the probability distribution is genuinely not known. This means that uncertainty relates to the occurrence of an event about which little is known, except the fact that it may occur. Those who distinguish uncertainty from risk define risk as being where the outcome of an event, or each set of possible outcomes, can be predicted on the basis of statistical probability. This understanding of risk implies that there is some knowledge about a risk as a discrete event or a combination of circumstances, as opposed to an uncertainty about which there is no knowledge. In most cases, project risks can be identified from experience gained by working on similar projects.
Risks fall into three categories; namely known risks, known unknowns and unknown unknowns. Known risks include minor variations in productivity and swings in material costs. These occur frequently and are an inevitable feature of all construction projects. Known unknowns are the risk events whose occurrence is predictable or foreseeable. Either their probability of occurrence or their likely effect is known. Unknown unknowns are those events whose probabilities of occurrence and effect are not foreseeable by even the most experienced staff. These are usually considered as force majeure. Some texts classify risks as āepistemicā and āaleotericā; epistemic risks being those due to a lack of knowledge and aleoteric risks being due to natural variability. Unknown unknowns are clearly epistemic.
In some situations the term risk does not necessarily refer to the chance of bad consequences, it can also refer to the possibility of good consequences; therefore, it is important that a definition of risk must include some reference to this point. Risk and uncertainty have been defined as:
- risk exists when a decision is expressed in terms of a range of possible outcomes and when known probabilities can be attached to the outcomes;
- uncertainty exists when there is more than one possible outcome of a course of action but the probability of each outcome is not known (frequently termed estimating uncertainty).
A particular type of decision making is needed in risk management. Consider Figure 1.1 which compares the probability of occurrence of an event compared with its impact on the construction project. Events with a low impact are not serious and can be divided into the elements of trivial and expected. For the high impact and low probability, these events are a hazard which could arise but are too remote to be considered. For example, there is a finite probability that parts from an old satellite might re-enter the atmosphere and crash on any building project in the UK, but very few buildings need to be designed to withstand that event. In project management however, high impact risks should not be ignored even if their probability is low. Fallback and response plans should be put in place even if the financial impact is too large to be covered by contingencies. The use of risk management is to identify, assess and manage those events with both a high input and a high probability of occurrence.
1.3 Risk management strategy
Most commonly, the client, the project owner (e.g. companies, organisations, etc.) has an overall risk management strategy and policy included in the strategic documents and quality management system, see Figure 1.2. Main issues concerning project owner risk strategy are risk ownership (which party owns the risk; risk exposure and transfer) and risk financing (how to include and use budget risk allowance or contingency). The client's risk management policy includes the risk management procedures or guidelines, responsibilities and reporting.
Both client (employer, promoter) and contractor are concerned with the magnitude and pattern of their investment and the associated risk. They desire to exert control over the activities which contribute to their investment. This type of risk is now covered by the term corporate and project governance (see Chapter 11).
There are two significant axioms of control: (1) control can be exercised only over future events; and (2) effective control necessitates prediction of the effects of change. The past is relevant only so far as past performance or events can influence our predictions of the future. The scope for control diminishes as the project proceeds. There are two key events at which control can be exercised: (1) sanction commitment to a project of particular characteristics; and (2) contract award commitment to contractors and major cost expenditure. It should be noted that there will also be opportunity to influence even if direct control cannot be exercised.
It follows that prior to these two commitments clients have great opportunity for control. They make decisions to define the organisation and procedures required for the execution of a project. These decisions affect the responsibilities of the parties; they influence the control of design, construction, commissioning, change and risk; hence they affect cost, time and quality.
Responsibility for uncontrollable risk should remain with the client, as risk should not be transferred to a party who cannot control or manage the risk and ultimately the client will only have to take action if the risk occurs.
1.4 Project planning
The control of time cannot be effected in isolation from resources and costs. Project planning methods should be utilised to communicate to all parties in a project, to identify sequences of activities and to draw attention to potential problem areas. The successful realisation of a project will depend greatly on careful planning and continuous monitoring and updating. The activities of designers, manufacturers, suppliers, contractors and all their resources must be organised and integrated to meet the objectives set by the client and/or the contractor. In most cases the programme will form the basis of the plan.
Sequences of activities will be defined and linked on a timescale to ensure that priorities are identified and that efficient use is made of expensive and/or scarce resources. Remember, however, that because of the uncertainty it should be expected that the plan will change. It must therefore be updated quickly and regularly if it is to remain as a guide to the most efficient way of completing the project. The programme should therefore be simple, so that updating is straightforward and does not demand the feedback of large amounts of data, and flexible, so that all alternative courses of action are obvious.
The purposes of planning are therefore to persuade people to perform tasks before they delay the operations of other groups of people, and in such a sequence that the best use is made of available resources and to provide a framework for decision making in the event of change. It is difficult to enforce a plan whic...