Risk types and sources; rectify via risk management

Risk

Risk is an uncertain event or condition which, if it occurs, has a positive or negative effect on the project objectives (scope, time, cost, quality). It is measured by the probability of the event and the size of its impact: Risk = Probability x Impact.

Types of risk

• By nature: pure risk (only loss is possible, e.g. fire, accident, flood) and speculative / business risk (gain or loss is possible, e.g. price change, market demand).
• By source: internal risk (within the control of the project team: estimate, design, management, labour, equipment) and external risk (outside its control: government policy, weather, inflation, market, law).
• By effect: negative risk (threat) and positive risk (opportunity).
• By knowledge: known risks (identified, so responses can be planned and covered by a contingency reserve) and unknown risks (cannot be foreseen, so they are covered by a management reserve).

Main categories: technical, schedule, cost, financial, management, legal, political, environmental, safety and market risk.

Sources of risk

1. Technical sources: incomplete or wrong design and drawings, inadequate survey and investigation, difficult geology, new technology, quality of materials and workmanship.
2. Estimating and planning sources: unrealistic cost estimate and schedule, missing activities, over-optimistic productivity, poor risk allowance.
3. Management sources: weak project manager, poor coordination between client, consultant and contractor, lack of skilled manpower, poor monitoring and decision making.
4. Financial sources: shortage of funds, delay in release of budget or payment, inflation, interest and exchange rate changes.
5. Contractual and legal sources: vague contract documents, variation orders, claims and disputes, change in laws, land acquisition and compensation problems.
6. Political and social sources: change of government and policy, bandh and strikes, local community demands, corruption, security situation.
7. Natural and environmental sources: flood, landslide, earthquake, heavy rain, climate change, environmental impact and clearance requirements.
8. Resource and market sources: shortage or price rise of material, fuel, labour and equipment; supplier delay; transport problems (especially in remote areas of Nepal).
9. Human and safety sources: accidents, labour disputes, health problems, errors and negligence.

Rectifying the risks as project manager

I would apply the full risk management process:

1. Risk management planning: decide the approach, team, roles, budget, tools, risk categories, probability-impact scales and reporting. The output is the risk management plan.
2. Risk identification: find the risks which may affect the project and document them in a risk register (brainstorming, checklists, Delphi, SWOT, interviews, experience).
3. Qualitative risk analysis: rank the risks by probability and impact using a probability-impact matrix (below) to find the priority risks.
4. Quantitative risk analysis: estimate the numerical effect of the main risks on cost and time (expected monetary value, decision tree, sensitivity analysis, Monte Carlo simulation).
5. Risk response planning: select the strategy for each risk (avoid, transfer, mitigate/reduce, accept) and prepare contingency plans and reserves.
6. Risk monitoring and control: track the identified risks, watch for new risks, check that the responses are working, update the risk register and report.

 Probability-impact matrix

 Impact ->   Low      Medium     High
 Prob.
 High       Medium     High      High
 Medium      Low      Medium     High
 Low         Low       Low      Medium

Practical actions: keep a risk register with owners, take insurance and performance guarantees (transfer), do extra investigation and early procurement (reduce), change the design or site for severe risks (avoid), keep a contingency reserve of 5 to 10% (accept), and hold monthly risk meetings to update the register.