Chapter 1

Projects and Risk

This book seeks to explain the nature of risk management and also to clarify the practical procedures for undertaking and utilising decisions. Risk management is beset by a dark cloak of technology, definitions and methodologies, often maintained by analysts and specialist consultants, which contributes to the unnecessary mystique and lack of understanding of the approach.

This book offers for the first time—in the opinion of the authors—the distilled knowledge of over a hundred man-years of project experience in working on aspects of project risk management and contains information which most of us would have liked to have had—had it been available and collated. To all students and practitioners using this book, follow known procedures as outlined in the book, avoid short-cuts and remember to keep records of everything you model, simulate or assume.

This chapter discusses a number of general concepts including projects, project phases and risk attitude before introducing a number of risk management strategies. The book concludes with some brief references to project planning.

1.1 Construction projects

Change is inherent in construction work. For years, industry has had a very poor reputation for coping with the adverse effects of change, with many projects failing to meet deadlines and cost and quality targets. This is not too surprising considering that there are no known perfect engineers, anymore than there are perfect designs or that the forces of nature behave in a perfectly predictable way. Change cannot be eliminated, but by applying the principles of risk management, engineers are able to improve the effective management of this change.

Change is normally regarded in terms of its adverse effects on project cost estimates and programmes. In extreme cases, the risk of these time and cost overruns can invalidate the economic case for a project, turning a potentially profitable investment into a loss-making venture. A risk event implies that there is a range of outcomes for that event which could be both more and less favourable than the most likely outcome, and that each outcome within the range has a probability of occurrence. The accumulation or combinations of risks can be termed project risk. This will usually be calculated using a simulation model (see Chapter 7). It is important to try to identify all the potential risks to the project even if they are not strictly events or a calculation of project risk. It is not possible to identify all risks and even at the end of a project you will only know the risks that actually occurred. However, risk management is concerned with identifying as many as is practicable of the sources and causes of risk because if a risk is not identified it cannot be considered in any part of the risk management process.

In construction projects each of the three primary targets of cost, time and quality will be likely to be subject to risk and uncertainty. It follows that a realistic estimate is one which makes appropriate allowances for all those risks and uncertainties which can be anticipated from experience and foresight. Project managers should undertake or propose actions which eliminate the risks before they occur, or reduce the effects of risk or uncertainty and make provision for them if they occur when this is possible and cost effective. It is vital to recognise the root causes of risks, and not to consider risks as events that occur almost at random. Risks can frequently be avoided if their root causes are identified and managed before the adverse consequence—the risk event—occurs. They should also ensure that the remaining risks are allocated to the parties in a manner which is likely to optimise project performance.

To achieve these aims it is suggested that a systematic approach is followed: to identify the risk sources; to quantify their effects (risk assessment and analysis); to develop management responses to risk; and finally to provide for residual risk in the project estimates. These four stages comprise the core of the process of risk management. Risk management can be one of the most creative tasks of project management.

The benefits of risk management can be summarised as follows:

• project issues are clarified, understood and considered from the start;
• decisions are supported by thorough analysis;
• the definition and structure of the project are continually monitored;
• clearer understanding of specific risks associated with a project;
• build-up of historical data to assist future risk management procedures.

1.2 Decision making

Risk management is a particular form of decision making within project management, which is itself the topic of many textbooks and papers. Risk management is not about predicting the future. It is about understanding your project and making a better decision with regard to the management of your project, tomorrow. Sometimes that decision may be to abandon the project. If that is the correct outcome saving various parties from wasting time, money and skilled human resources, then the need for a rational, repeatable, justifiable risk methodology and risk interpretation is paramount. Nevertheless, the precise boundaries between decision making and the aspects of other problem-solving methodologies have always been difficult to establish.

In essence, decisions are made against a predetermined set of objectives, rules and/or priorities based upon knowledge, data and information relevant to the issue although too often this is not the case. Frequently decisions are ill-founded, not based on a logical assessment of project-specific criteria and lead to difficulties later. It is not always possible to have conditions of total certainty; indeed in risk management it is most likely that a considerable amount of uncertainty about the construction project exists at this stage.

The terms risk and uncertainty can be used in different ways. The word risk originated from the French word risqué, and began to appear in England, in its anglicised form, around 1830, when it was used in insurance transactions. Risk can be, and has been, defined in many ways and assessed in terms of fatalities and injuries, in terms of probability of reliability, in terms of a sample of a population or in terms of the likely effects on a project. All these methodologies are valid and particular industries or sectors have chosen to adopt particular measures as their standard approach. As this book concentrates on engineering projects, risk is defined in the project context, and broadly follows the guidelines and terminology adopted by the British Standard on Project Management BS 6079, The Association for Project Management Body of Knowledge, The Association for Project Management Project Risk Analysis and Management Guide, the Institution of Civil Engineers and the Faculty of Actuaries Risk Analysis and Management for Projects Guide and the HM Treasury, Central Unit on Procurement Guide on Risk Assessment.

A number of authors state that uncertainty should be considered as separate from risk because the two terms are distinctly different. Uncertainty can be regarded as the chance occurrence of some event where the probability distribution is genuinely not known. This means that uncertainty relates to the occurrence of an event about which little is known, except the fact that it may occur. Those who distinguish uncertainty from risk define risk as being where the outcome of an event, or each set of possible outcomes, can be predicted on the basis of statistical probability. This understanding of risk implies that there is some knowledge about a risk as a discrete event or a combination of circumstances, as opposed to an uncertainty about which there is no knowledge. In most cases, project risks can be identified from experience gained by working on similar projects.

Risks fall into three categories; namely known risks, known unknowns and unknown unknowns. Known risks include minor variations in productivity and swings in material costs. These occur frequently and are an inevitable feature of all construction projects. Known unknowns are the risk events whose occurrence is predictable or foreseeable. Either their probability of occurrence or their likely effect is known. Unknown unknowns are those events whose probabilities of occurrence and effect are not foreseeable by even the most experienced staff. These are usually considered as force majeure. Some texts classify risks as ‘epistemic’ and ‘aleoteric’; epistemic risks being those due to a lack of knowledge and aleoteric risks being due to natural variability. Unknown unknowns are clearly epistemic.

In some situations the term risk does not necessarily refer to the chance of bad consequences, it can also refer to the possibility of good consequences; therefore, it is important that a definition of risk must include some reference to this point. Risk and uncertainty have been defined as:

• risk exists when a decision is expressed in terms of a range of possible outcomes and when known probabilities can be attached to the outcomes;
• uncertainty exists when there is more than one possible outcome of a course of action but the probability of each outcome is not known (frequently termed estimating uncertainty).

A particular type of decision making is needed in risk management. Consider Figure 1.1 which compares the probability of occurrence of an event compared with its impact on the construction project. Events with a low impact are not serious and can be divided into the elements of trivial and expected. For the high...