Project Risk Analysis and Management

Risk response planning

Risk response planning is the process of developing options and actions to improve opportunities and reduce threats to the project objectives, after the risks are identified and analysed. It assigns an owner for each response and puts the cost and time for it into the plan.

Strategies for risk response planning

• For negative risks (threats): avoid, transfer, mitigate (reduce), accept.
• For positive risks (opportunities): exploit, share, enhance, accept.
• Contingent response: a plan used only if a trigger event occurs.

Why it is important

1. Gives a planned action before the risk happens, so loss is smaller.
2. Reduces the probability and impact of threats and increases opportunities.
3. Sets responsibility (risk owner), time and budget (contingency reserve).
4. Protects cost, schedule and quality objectives.
5. Helps decisions on insurance, contract type and reserves.
6. Gives confidence to the client, lenders and the team.

Response strategies for negative risks

The best strategy is chosen by comparing the cost of the response with the expected loss. High-probability, high-impact risks are avoided or reduced; low-probability, high-impact risks are transferred (insurance); small risks are accepted.

Definition

Risk is an uncertain event or condition which, if it occurs, has a positive or negative effect on the project objectives (scope, time, cost, quality). It is measured by the probability of the event and the size of its impact: Risk = Probability x Impact.

Types (categories) of project risk

Other classification

• By nature: pure risk (only loss is possible, e.g. fire, accident, flood) and speculative / business risk (gain or loss is possible, e.g. price change, market demand).
• By source: internal risk (inside the control of the project team: estimate, design, management, labour, equipment) and external risk (outside control: government policy, weather, inflation, market, law).
• By effect: negative risk (threat) and positive risk (opportunity).
• By knowledge: known risks (identified and can be planned) and unknown risks (cannot be foreseen, handled by contingency reserve).

Definition

Project risk management is the systematic process of planning, identifying, analysing, responding to, and monitoring and controlling risks in a project, so that the chance and effect of negative events are reduced and the chance of positive events is increased.

Steps of risk management

1. Risk management planning: decide the approach, team, roles, budget, tools, risk categories, probability-impact scales and reporting. The output is the risk management plan.
2. Risk identification: find the risks which may affect the project and document them in a risk register (brainstorming, checklist, Delphi, SWOT, interviews, experience).
3. Qualitative risk analysis: rank the risks by probability and impact using a probability-impact matrix to find priority risks.
4. Quantitative risk analysis: estimate the numerical effect of the main risks on cost and time (expected monetary value, decision tree, sensitivity analysis, Monte Carlo simulation).
5. Risk response planning: select the strategy for each risk (avoid, transfer, mitigate/reduce, accept) and prepare contingency plans and reserves.
6. Risk monitoring and control: track identified risks, watch for new risks, check the response is working, update the risk register and report.

Managing risk in my project as project manager

1. Prepare a risk management plan at the start and assign a risk owner to each risk.
2. Identify risks with the team and stakeholders; keep a risk register.
3. Prioritise by a probability-impact matrix; calculate EMV of the top risks.
4. Choose responses: avoid (change design or site), transfer (insurance, performance bond, fixed-price contract), mitigate (testing, early procurement, training), accept with contingency reserve (usually 5 to 10% of cost and time).
5. Include the response actions in the schedule and budget.
6. Hold regular risk review meetings, track triggers, update the register and report to the client.
7. Keep records of lessons learned for future projects.

Risk identification is the process of finding and documenting the risks that may affect the project. It is done at the start and repeated during the project. The output is the risk register.

Tools and techniques

1. Documentation review: study the project plan, drawings, contracts, assumptions, previous reports to find inconsistencies and weak points.
2. Information gathering techniques:
   • Brainstorming: a team (engineers, client, contractor) freely lists possible risks.
   • Delphi technique: experts give anonymous opinions in rounds until they agree.
   • Interviews: talking with experienced people and stakeholders.
   • Root cause analysis: find the basic cause behind a risk and then more risks from it.
3. Checklist analysis: a list prepared from past similar projects (e.g. hydropower or road projects) is checked item by item.
4. Assumption analysis: test whether the assumptions (e.g. availability of land, material price) are valid and complete.
5. Diagramming techniques: cause-and-effect (fishbone) diagram, flow charts, influence diagrams.
6. SWOT analysis: strengths, weaknesses, opportunities and threats of the project are used to find risks and opportunities.
7. Expert judgement and lessons learned: use experts and records of earlier projects.
8. Prompt list / PESTLE: political, economic, social, technological, legal and environmental categories used as prompts.

The best result comes when several techniques are combined and the project team, experts and stakeholders are all involved.

Risk response planning selects the action for each analysed risk. The main strategies for threats are avoid, transfer, reduce (mitigate) and accept. Risk transfer and risk reduction are both response techniques because each one plans an action, owner and cost before the risk occurs, and each one lowers the final effect on project objectives.

Risk transfer

Transfer means shifting the negative impact and ownership of the risk to another party, usually with a payment (premium or higher contract price). The risk does not disappear, but the loss is paid by the other party.

• Insurance (contractor's all risk, workmen compensation, third party)
• Performance bond / bank guarantee, advance payment guarantee
• Fixed-price (lump-sum) contract, which transfers cost risk to the contractor
• Subcontracting special works, warranties and indemnity clauses

Justification: it is planned in advance, has a cost, and it reduces the owner's exposure to a major loss (e.g. flood damage to a bridge is paid by the insurer). It is best for low-probability, high-impact risks.

Risk reduction (mitigation)

Reduction means taking action to lower the probability or the impact of the risk to an acceptable level.

• More soil investigation to reduce design risk
• Early ordering of cement and steel to reduce price and delay risk
• Training, safety measures, quality control, prototypes, backup equipment
• Splitting the work into packages and parallel suppliers

Justification: it attacks the cause of the risk, it is planned with a budget in the schedule, and it is usually cheaper than the loss. It is best for high-probability risks that are inside the control of the team.

Conclusion on both

As both are planned, resourced and assigned before the event, both are risk response planning techniques. In a hydropower project, floods are transferred by insurance and geological risk is reduced by detailed investigation.

Risk transfer in risk response planning

Risk transfer is a response strategy in which the project owner shifts the negative impact and responsibility of a risk to a third party, who accepts it for a fee. The risk still exists, but the loss is borne by the other party. It is chosen after analysis, mainly for risks with low probability and very high impact, or for risks the other party can manage better.

Example: construction of a highway bridge

Risk: flood or earthquake damage during construction, and contractor delay or failure.

1. Insurance: the contractor takes a Contractor's All Risk (CAR) policy; if flood damages the work, the insurer pays for repair.
2. Performance bond: a bank guarantee (usually 5 to 10% of contract price) is taken so that the bank pays if the contractor fails.
3. Fixed-price (lump sum) contract: the cost overrun risk is transferred to the contractor.
4. Liquidated damages: delay risk is transferred by a clause charging the contractor per day of delay.

The owner pays a premium or a higher price, but is protected from a very large loss.

Methods used after identifying a major risk

• Avoid the risk (change plan, design or site)
• Transfer it (insurance, contract, guarantee)
• Mitigate / reduce it (preventive action, extra investigation)
• Accept it (with a contingency reserve)
• Monitor it and prepare a contingency plan with triggers

Definition

Risk is an uncertain event or condition which, if it occurs, has a positive or negative effect on the project objectives (scope, time, cost, quality). It is measured by the probability of the event and the size of its impact: Risk = Probability x Impact.

Sources of project risk

1. Technical sources: incomplete or wrong design and drawings, inadequate survey and investigation, difficult geology, new technology, quality of materials and workmanship.
2. Estimating and planning sources: unrealistic cost estimate and schedule, missing activities, over-optimistic productivity, poor risk allowance.
3. Management sources: weak project manager, poor coordination between client, consultant and contractor, lack of skilled manpower, poor monitoring and decision making.
4. Financial sources: shortage of funds, delay in release of budget or payment, inflation, interest and exchange rate changes.
5. Contractual and legal sources: vague contract documents, variation orders, claims and disputes, change in laws, land acquisition and compensation problems.
6. Political and social sources: government change and policy change, bandh and strikes, local community demand, corruption, security situation.
7. Natural and environmental sources: flood, landslide, earthquake, heavy rain, climate change, environmental impact and clearance requirements.
8. Resource and market sources: shortage or price rise of material, fuel, labour and equipment; supplier delay; transport problem (especially in remote areas of Nepal).
9. Human and safety sources: accidents, labour dispute, health problems, errors and negligence.

Steps of risk management

1. Risk management planning: decide the approach, team, roles, budget, tools, risk categories, probability-impact scales and reporting. The output is the risk management plan.
2. Risk identification: find the risks which may affect the project and document them in a risk register (brainstorming, checklist, Delphi, SWOT, interviews, experience).
3. Qualitative risk analysis: rank the risks by probability and impact using a probability-impact matrix to find priority risks.
4. Quantitative risk analysis: estimate the numerical effect of the main risks on cost and time (expected monetary value, decision tree, sensitivity analysis, Monte Carlo simulation).
5. Risk response planning: select the strategy for each risk (avoid, transfer, mitigate/reduce, accept) and prepare contingency plans and reserves.
6. Risk monitoring and control: track identified risks, watch for new risks, check the response is working, update the risk register and report.

 Plan -> Identify -> Qualitative -> Quantitative
   ^                                     |
   |                                     v
 Monitor and control  <-----------  Response planning

Definition

Risk is an uncertain event or condition which, if it occurs, has a positive or negative effect on the project objectives (scope, time, cost, quality). It is measured by the probability of the event and the size of its impact: Risk = Probability x Impact.

Sources of project risk

1. Technical sources: incomplete or wrong design and drawings, inadequate survey and investigation, difficult geology, new technology, quality of materials and workmanship.
2. Estimating and planning sources: unrealistic cost estimate and schedule, missing activities, over-optimistic productivity, poor risk allowance.
3. Management sources: weak project manager, poor coordination between client, consultant and contractor, lack of skilled manpower, poor monitoring and decision making.
4. Financial sources: shortage of funds, delay in release of budget or payment, inflation, interest and exchange rate changes.
5. Contractual and legal sources: vague contract documents, variation orders, claims and disputes, change in laws, land acquisition and compensation problems.
6. Political and social sources: government change and policy change, bandh and strikes, local community demand, corruption, security situation.
7. Natural and environmental sources: flood, landslide, earthquake, heavy rain, climate change, environmental impact and clearance requirements.
8. Resource and market sources: shortage or price rise of material, fuel, labour and equipment; supplier delay; transport problem (especially in remote areas of Nepal).
9. Human and safety sources: accidents, labour dispute, health problems, errors and negligence.

Risk response planning

Risk response planning develops options and actions to reduce threats and increase opportunities, using the results of risk analysis. Each response has an owner, a cost, a time and a trigger.

Strategies for negative risks (threats)

Strategies for positive risks (opportunities)

Output: risk register update, risk-related contracts (insurance, bonds), contingency reserve for time and cost, fall-back plans and the project plan updates. The response should cost less than the expected loss and should not create new risks.

Project risk comes from the many uncertain conditions in and around a project. The main sources are:

1. Technical sources: incomplete or wrong design and drawings, inadequate survey and investigation, difficult geology, new technology, quality of materials and workmanship.
2. Estimating and planning sources: unrealistic cost estimate and schedule, missing activities, over-optimistic productivity, poor risk allowance.
3. Management sources: weak project manager, poor coordination between client, consultant and contractor, lack of skilled manpower, poor monitoring and decision making.
4. Financial sources: shortage of funds, delay in release of budget or payment, inflation, interest and exchange rate changes.
5. Contractual and legal sources: vague contract documents, variation orders, claims and disputes, change in laws, land acquisition and compensation problems.
6. Political and social sources: government change and policy change, bandh and strikes, local community demand, corruption, security situation.
7. Natural and environmental sources: flood, landslide, earthquake, heavy rain, climate change, environmental impact and clearance requirements.
8. Resource and market sources: shortage or price rise of material, fuel, labour and equipment; supplier delay; transport problem (especially in remote areas of Nepal).
9. Human and safety sources: accidents, labour dispute, health problems, errors and negligence.

These sources are grouped as internal (technical, estimating, management, human) and external (political, natural, market, legal). Knowing the sources lets the team look for risk systematically using checklists.

Many Nepali projects (roads, hydropower, buildings, irrigation) finish late and over budget. The main sources of risk are:

1. Weak planning and design: incomplete survey, drawings and cost estimate; lack of detailed investigation; unrealistic schedule; many design changes in construction.
2. Land acquisition and compensation: delay in getting site, right of way, forest clearance, tree cutting and utility shifting.
3. Procurement and contractor problems: lowest-bid award to weak contractors, abandoning of work, poor capacity, slow bid process, contract termination.
4. Funding and payment delays: late release of budget, payment delay, shortage of counterpart fund, dependence on donors.
5. Political and administrative factors: frequent change of government and officials, delay in approvals, bandh, local interference, corruption.
6. Natural and geographic factors: monsoon floods, landslides, earthquake, difficult terrain, remote access and short working season.
7. Shortage of material and labour: price rise of cement, steel and fuel; transport cost; shortage of skilled labour due to migration abroad; blockade.
8. Weak management and supervision: poor monitoring, lack of coordination between agencies, weak project management skill.
9. Contract and dispute issues: variation orders, claims, arbitration, unclear contract.
10. Environmental and social issues: EIA and IEE delay, public opposition, protests by affected people.

Most of these risks are not analysed or planned in advance in Nepali projects, which explains the cost and time overrun.

Definition and types

Risk is an uncertain event or condition which, if it occurs, has a positive or negative effect on the project objectives (scope, time, cost, quality). It is measured by the probability of the event and the size of its impact: Risk = Probability x Impact.

• By nature: pure risk (only loss is possible, e.g. fire, accident, flood) and speculative / business risk (gain or loss is possible, e.g. price change, market demand).
• By source: internal risk (inside the control of the project team: estimate, design, management, labour, equipment) and external risk (outside control: government policy, weather, inflation, market, law).
• By effect: negative risk (threat) and positive risk (opportunity).
• By knowledge: known risks (identified and can be planned) and unknown risks (cannot be foreseen, handled by contingency reserve).

Managing risk effectively: the risk management cycle

   +-------------------+
   |  Risk planning    |
   +---------+---------+
             v
   +-------------------+      +--------------------+
   | Risk identification| --> | Risk analysis      |
   +-------------------+      | (qualitative and   |
             ^                |  quantitative)     |
             |                +---------+----------+
   +---------+---------+                v
   | Monitoring and    | <-- +--------------------+
   | control           |     | Risk response      |
   +-------------------+     | planning           |
                             +--------------------+

The cycle is repeated through the project life, because new risks appear and old ones change as the project moves from planning to implementation.

Steps and how they manage risk

1. Risk management planning: decide the approach, team, roles, budget, tools, risk categories, probability-impact scales and reporting. The output is the risk management plan.
2. Risk identification: find the risks which may affect the project and document them in a risk register (brainstorming, checklist, Delphi, SWOT, interviews, experience).
3. Qualitative risk analysis: rank the risks by probability and impact using a probability-impact matrix to find priority risks.
4. Quantitative risk analysis: estimate the numerical effect of the main risks on cost and time (expected monetary value, decision tree, sensitivity analysis, Monte Carlo simulation).
5. Risk response planning: select the strategy for each risk (avoid, transfer, mitigate/reduce, accept) and prepare contingency plans and reserves.
6. Risk monitoring and control: track identified risks, watch for new risks, check the response is working, update the risk register and report.

Justification

The cycle is justified because risk management is continuous: planning sets rules, identification and analysis find and rank risks, response planning decides actions, and monitoring checks and feeds new information back to identification. Doing it in cycle makes sure no new risk is left unmanaged and responses stay effective as the project changes.

Risk

Risk is an uncertain event or condition which, if it occurs, has a positive or negative effect on the project objectives (scope, time, cost, quality). It is measured by the probability of the event and the size of its impact: Risk = Probability x Impact.

Types of risk

• By nature: pure risk (only loss is possible, e.g. fire, accident, flood) and speculative / business risk (gain or loss is possible, e.g. price change, market demand).
• By source: internal risk (inside the control of the project team: estimate, design, management, labour, equipment) and external risk (outside control: government policy, weather, inflation, market, law).
• By effect: negative risk (threat) and positive risk (opportunity).
• By knowledge: known risks (identified and can be planned) and unknown risks (cannot be foreseen, handled by contingency reserve).

Main categories: technical, schedule, cost, financial, management, legal, political, environmental, safety and market risk.

Sources of risk

1. Technical sources: incomplete or wrong design and drawings, inadequate survey and investigation, difficult geology, new technology, quality of materials and workmanship.
2. Estimating and planning sources: unrealistic cost estimate and schedule, missing activities, over-optimistic productivity, poor risk allowance.
3. Management sources: weak project manager, poor coordination between client, consultant and contractor, lack of skilled manpower, poor monitoring and decision making.
4. Financial sources: shortage of funds, delay in release of budget or payment, inflation, interest and exchange rate changes.
5. Contractual and legal sources: vague contract documents, variation orders, claims and disputes, change in laws, land acquisition and compensation problems.
6. Political and social sources: government change and policy change, bandh and strikes, local community demand, corruption, security situation.
7. Natural and environmental sources: flood, landslide, earthquake, heavy rain, climate change, environmental impact and clearance requirements.
8. Resource and market sources: shortage or price rise of material, fuel, labour and equipment; supplier delay; transport problem (especially in remote areas of Nepal).
9. Human and safety sources: accidents, labour dispute, health problems, errors and negligence.

Rectifying the risks as project manager

I would apply the full risk management process:

1. Risk management planning: decide the approach, team, roles, budget, tools, risk categories, probability-impact scales and reporting. The output is the risk management plan.
2. Risk identification: find the risks which may affect the project and document them in a risk register (brainstorming, checklist, Delphi, SWOT, interviews, experience).
3. Qualitative risk analysis: rank the risks by probability and impact using a probability-impact matrix to find priority risks.
4. Quantitative risk analysis: estimate the numerical effect of the main risks on cost and time (expected monetary value, decision tree, sensitivity analysis, Monte Carlo simulation).
5. Risk response planning: select the strategy for each risk (avoid, transfer, mitigate/reduce, accept) and prepare contingency plans and reserves.
6. Risk monitoring and control: track identified risks, watch for new risks, check the response is working, update the risk register and report.

 Impact ->   Low      Medium     High
 Prob.
 High       Medium     High      High
 Medium      Low      Medium     High
 Low         Low       Low      Medium

Practical actions: keep a risk register with owners, take insurance and performance guarantees (transfer), do extra investigation and early procurement (reduce), change the design or site for severe risks (avoid), keep a contingency reserve of 5 to 10% (accept), hold monthly risk meetings and update the register.

Risk management cycle

   +-------------------+
   |  Risk planning    |
   +---------+---------+
             v
   +-------------------+      +--------------------+
   | Risk identification| --> | Risk analysis      |
   +-------------------+      | (qualitative and   |
             ^                |  quantitative)     |
             |                +---------+----------+
   +---------+---------+                v
   | Monitoring and    | <-- +--------------------+
   | control           |     | Risk response      |
   +-------------------+     | planning           |
                             +--------------------+

The cycle is repeated through the project life, because new risks appear and old ones change as the project moves from planning to implementation.

1. Plan: decide approach, roles, tools and scales.
2. Identify: list risks by brainstorming, checklists, Delphi, SWOT.
3. Analyse: qualitative ranking, then quantitative effect on cost and time.
4. Respond: avoid, transfer, reduce or accept; prepare contingency.
5. Monitor and control: track risks, review, update and report.

Managing risk effectively

• Start risk management early, in the planning stage, and keep it through all phases.
• Involve all stakeholders and experts in the identification.
• Keep a live risk register with owner, trigger and response for each risk.
• Focus on the top risks by priority (probability x impact, EMV).
• Put the response in the schedule and budget, with contingency reserve.
• Use contracts, insurance and guarantees to transfer risk.
• Review regularly, learn from past projects, and communicate the risk status to the client.

Managing risk effectively

1. Plan the risk process and assign responsibility.
2. Identify risks early with the team and stakeholders; keep a risk register.
3. Analyse and rank the risks (qualitative, then quantitative).
4. Plan responses: avoid, transfer, reduce, accept; add contingency reserve.
5. Monitor, control and update the risks through the project life.

Qualitative risk analysis

It assesses each risk by probability and impact on a descriptive scale to set priority. It is quick and needs no detailed data.

 Impact ->   Low      Medium     High
 Prob.
 High       Medium     High      High
 Medium      Low      Medium     High
 Low         Low       Low      Medium

Tools: probability-impact matrix, risk categorisation, urgency assessment, expert judgement.

Quantitative risk analysis

It gives a numerical estimate of the effect of the priority risks on cost and time.

• Expected monetary value: EMV = probability x impact (money)
• Decision tree: compares choices with probability and money outcomes
• Sensitivity analysis: which variable (e.g. cement price) most affects the result
• Monte Carlo simulation: repeated random runs to get the probability of finishing within a given cost or time
• PERT: three-point estimates for duration

Qualitative risk analysis methods

Qualitative analysis ranks risks by probability and impact using ordinal scales (low, medium, high).

1. Probability and impact assessment: each risk is given a rating.
2. Probability-impact matrix: combines the two to give priority.

 Impact ->   Low      Medium     High
 Prob.
 High       Medium     High      High
 Medium      Low      Medium     High
 Low         Low       Low      Medium

3. Risk categorisation: grouping by source (technical, financial, etc.) to find the problem areas.
4. Risk urgency assessment: risks needing early response are made first.
5. Expert judgement and interviews.

Quantitative risk analysis methods

Quantitative analysis puts numbers to the effect of the risk.

1. Expected monetary value (EMV): EMV = P x I. Example: P = 20%, loss = Rs 10 lakh gives EMV = Rs 2 lakh.
2. Decision tree analysis: branches show decisions and chance outcomes; the branch with the best expected value is chosen.
3. Sensitivity analysis: change one variable at a time; the tornado diagram shows the most sensitive one.
4. Simulation (Monte Carlo): many random runs of the cost or schedule model give a distribution and the probability of meeting the target.
5. PERT three-point estimate: $t_e = (a + 4m + b)/6$ and variance $((b-a)/6)^2$.
6. Interviewing and probability distributions from experts.

Qualitative is quick and used for all risks; quantitative is slower and used for the high-priority risks.

Project risk management

Project risk management is the systematic process of planning, identifying, analysing, responding to, and monitoring and controlling risks in a project, so that the chance and effect of negative events are reduced and the chance of positive events is increased.

Qualitative and quantitative risk analysis

Qualitative analysis ranks risks by their probability and impact using descriptive scales (very low to very high). It is fast, cheap and used first. Tools: probability-impact matrix, risk categorisation, risk urgency assessment, expert judgement, risk data quality assessment.

Quantitative analysis gives numerical values of the effect of risk on the project objectives. It is applied to the high-priority risks. Tools: expected monetary value (EMV = probability x impact), decision tree analysis, sensitivity analysis (tornado diagram), simulation (Monte Carlo) and PERT three-point estimation.

 Impact ->   Low      Medium     High
 Prob.
 High       Medium     High      High
 Medium      Low      Medium     High
 Low         Low       Low      Medium

Major steps in managing risks

1. Risk management planning: decide the approach, team, roles, budget, tools, risk categories, probability-impact scales and reporting. The output is the risk management plan.
2. Risk identification: find the risks which may affect the project and document them in a risk register (brainstorming, checklist, Delphi, SWOT, interviews, experience).
3. Qualitative risk analysis: rank the risks by probability and impact using a probability-impact matrix to find priority risks.
4. Quantitative risk analysis: estimate the numerical effect of the main risks on cost and time (expected monetary value, decision tree, sensitivity analysis, Monte Carlo simulation).
5. Risk response planning: select the strategy for each risk (avoid, transfer, mitigate/reduce, accept) and prepare contingency plans and reserves.
6. Risk monitoring and control: track identified risks, watch for new risks, check the response is working, update the risk register and report.

Risk management planning

Risk management planning is the process of deciding how to carry out risk management for a project. It defines the approach, methodology, roles and responsibilities, budget and time for risk activities, risk categories, definition of probability and impact scales, risk thresholds, reporting formats and tracking. The output is the risk management plan, which guides all other risk processes.

Internal and external risks

Internal risks:

1. Inaccurate cost estimate, schedule and unrealistic bid.
2. Incomplete and poor design, drawings and surveys.
3. Weak planning, coordination and project management.
4. Shortage of skilled labour, engineers and equipment.
5. Poor financial management and cash-flow problems.
6. Poor quality control and lack of safety culture.
7. Delay in decisions, approvals and payments by the client.
8. Weak contract management and disputes with subcontractors.
9. Frequent change of design or scope (variations).

External risks:

1. Political: change of government or policy, bandh, instability.
2. Economic: inflation, interest and exchange rate changes, material price rise.
3. Legal: change in tax, law or regulation; court cases.
4. Natural: flood, earthquake, landslide, extreme weather.
5. Social: local opposition, land and compensation conflict.
6. Market: change in demand, tariff or competition.

Risk reduction as risk response planning

Risk reduction (mitigation) is a response strategy that lowers the probability and/or impact of a threat to an acceptable level. It is planned before the risk occurs, with an owner, budget and time, and is part of the risk response plan, so it is risk response planning.

Example (hydropower tunnel project): risk of poor rock condition causing delay and cost overrun. Reduction actions: extra geological drilling and seismic survey before design, a design with flexible support systems, keeping rock support materials in stock and employing an experienced tunnelling contractor. The probability of surprise and the delay are reduced to an acceptable level, so the response was planned and budgeted in advance.

Why project risk management is necessary

1. Projects are one-time and uncertain; many things can go wrong.
2. Hydropower and large projects need big investment, so a loss is very costly.
3. It prevents or reduces cost and time overrun.
4. It helps to take better decisions and to use resources properly.
5. It is required by lenders and investors to approve loan.
6. It improves safety, quality and the chance of success.
7. It converts problems into planned actions with reserves.

Different natures of risk

• Pure (insurable) risk: only loss possible (fire, flood, accident).
• Speculative (business) risk: gain or loss (market price, demand).
• Internal / external, known / unknown, negative (threat) / positive (opportunity).

Major risks in planning and implementing a hydropower project

Other main risks are geological and hydrological risk, construction delay, cost overrun, financial and exchange rate risk, political and regulatory risk, environmental and social risk, market and PPA risk (the Nepal Electricity Authority is the main buyer), and natural hazards. These are managed with detailed investigation, insurance, careful contracts, community engagement and contingency reserve.

Project risk

Risk is an uncertain event or condition which, if it occurs, has a positive or negative effect on the project objectives (scope, time, cost, quality). It is measured by the probability of the event and the size of its impact: Risk = Probability x Impact.

How risk is analysed

Risk analysis is done in two stages after identification.

1. Qualitative analysis: give each risk a probability and an impact rating and place it on the matrix.

 Impact ->   Low      Medium     High
 Prob.
 High       Medium     High      High
 Medium      Low      Medium     High
 Low         Low       Low      Medium

2. Quantitative analysis: for high-priority risks calculate EMV = probability x impact, and use sensitivity analysis or simulation for the cost and schedule effect.

Example: a 20 MW run-of-river hydropower project (assumed)

The total EMV is 30 + 40 + 20 + 9 + 15 = Rs 114 million, which is used to set the contingency reserve. Rock condition and flood are first priority, so they get detailed responses (more drilling, insurance and flood-resistant design).

Risk is managed by identification, analysis, response planning and monitoring. For a hydropower project, three main risks are managed as follows.

Each risk gets a risk owner, a trigger (e.g. unexpected rock fall, river level rise), a budget in the contingency reserve, and is reviewed in monthly meetings.

Risk identification for a rural road project

1. Review documents: DPR, survey, drawings, geotechnical report, estimate.
2. Site visit and checklist: use a checklist from past rural road projects.
3. Brainstorming and interviews with the local people, user committee, engineers and contractors.
4. SWOT and assumption analysis.

Typical risks found: landslide and slope failure, monsoon damage and washout, land and right-of-way dispute, local opposition, material shortage and price rise, contractor with low capacity, late budget release, poor quality of earthwork and drainage, and lack of maintenance.

Risk analysis procedure

1. Prepare a risk register with description, cause and effect.
2. Qualitative: rate probability and impact (1 to 5) and score = P x I.

 Impact ->   Low      Medium     High
 Prob.
 High       Medium     High      High
 Medium      Low      Medium     High
 Low         Low       Low      Medium

3. Quantitative: for top risks, calculate EMV, e.g. landslide with P = 0.3 and cost Rs 20 lakh gives EMV = Rs 6 lakh.
4. Rank the risks and give priority to high-score risks.
5. Plan responses (retaining wall and drainage, early land agreement, community participation, inspection), assign owners, and monitor.

Impact of unmanaged risk

1. Cost overrun: unexpected loss is paid from the project budget.
2. Time overrun: delay in completion and handover.
3. Poor quality: failure to meet the standards, defects and rework.
4. Scope reduction or project failure: the project may be stopped or abandoned.
5. Safety problems: accidents, injury and environmental damage.
6. Disputes, claims and legal cases between parties.
7. Loss of reputation and confidence of client, donors and lenders.
8. Financial problems: loan repayment trouble and low return.
9. Stress and low morale in the team, as the project moves from one crisis to another.

Risks in different phases of the project life cycle

Risk

Risk is an uncertain event or condition which, if it occurs, has a positive or negative effect on the project objectives (scope, time, cost, quality). It is measured by the probability of the event and the size of its impact: Risk = Probability x Impact.

Why construction projects have more chance of risk

1. Every project is unique, with new site, design and conditions.
2. Long duration, so more time for change in price, law and weather.
3. Outdoor work exposed to rain, flood, earthquake and ground conditions that are not fully known.
4. Many parties (owner, designer, contractor, subcontractors, suppliers) with different interests.
5. Large amount of money, labour and equipment at one time.
6. Dependence on approvals, land and utilities.
7. Frequent design change and variations.
8. Hazardous activities, so higher accident risk.
9. Difficult access and logistics in Nepal.
10. Use of the lowest-bid system and thin profit margins.

Managing the different types of risk

Process followed: plan -> identify -> analyse (qualitative and quantitative) -> respond (avoid, transfer, reduce, accept) -> monitor and control. A risk register with owner, trigger and contingency is kept, and the process is repeated through the project.

Importance of risk analysis in project planning

Risk analysis estimates the probability and effect of risks, so planning can use realistic information.

1. Gives a realistic cost estimate and schedule with proper contingency.
2. Ranks the risks, so effort and money go to the most serious ones.
3. Helps to select suitable response strategies (avoid, transfer, reduce, accept).
4. Supports decision making on go/no-go, design options and contract type.
5. Reduces surprises, delays and cost overrun during implementation.
6. Helps lenders and investors to judge viability.
7. Improves communication on uncertainty among stakeholders.

Types of risk in a project

Project risk

Risk is an uncertain event or condition which, if it occurs, has a positive or negative effect on the project objectives (scope, time, cost, quality). It is measured by the probability of the event and the size of its impact: Risk = Probability x Impact.

Internal and external risks

Sources of internal risk in Nepal at present

1. Inaccurate cost estimate, schedule and unrealistic bid.
2. Incomplete and poor design, drawings and surveys.
3. Weak planning, coordination and project management.
4. Shortage of skilled labour, engineers and equipment.
5. Poor financial management and cash-flow problems.
6. Poor quality control and lack of safety culture.
7. Delay in decisions, approvals and payments by the client.
8. Weak contract management and disputes with subcontractors.
9. Frequent change of design or scope (variations).
10. Weak procurement and contract management in public agencies, and low capacity of local contractors.
11. Migration of skilled workers abroad, causing labour shortage.

Internal risks in implementing a hydropower project in Nepal

1. Estimating and design: inadequate hydrology and geology data, which gives wrong capacity, cost and schedule.
2. Project management: weak management, late decisions and poor coordination between the developer, EPC contractor and consultants.
3. Financial: difficulty in financial closure, equity shortage, cost overrun, delay in loan release.
4. Contract: unclear scope, variation claims, disputes with civil, hydromechanical and electromechanical contractors.
5. Technical and quality: poor construction of tunnel/headworks, delay in equipment supply, sediment-handling design faults.
6. Resources: shortage of skilled labour and equipment at remote sites.
7. Safety: accidents in tunnels and river works.
8. Interface: the transmission line and power house not ready at the same time.

Risk and risk management

Risk is an uncertain event or condition which, if it occurs, has a positive or negative effect on the project objectives (scope, time, cost, quality). It is measured by the probability of the event and the size of its impact: Risk = Probability x Impact.

Project risk management is the systematic process of planning, identifying, analysing, responding to, and monitoring and controlling risks in a project, so that the chance and effect of negative events are reduced and the chance of positive events is increased.

Internal risks faced by a Nepalese construction company

Internal risks arise inside the company or project and can be controlled by management.

1. Estimating and bidding risk: very low bids to win the contract (lowest-bid system), wrong quantity or rate analysis, so loss on the work.
2. Financial risk: cash-flow shortage because of late payment from the client, high bank interest, working capital and bank guarantee limits.
3. Management and planning risk: poor planning and scheduling, weak site management, lack of professional managers, family-based decisions.
4. Human resource risk: shortage of skilled workers, engineers and operators due to foreign migration; low productivity; labour disputes.
5. Equipment and material risk: old equipment, breakdown, shortage of cement and steel, poor purchase planning, high stock cost.
6. Quality risk: weak quality control, rework, penalties and loss of reputation.
7. Safety risk: accidents because of low safety practice; injury claims.
8. Contractual risk: misunderstanding contract terms, claims not made on time, penalty (liquidated damages) for delay, disputes with subcontractors.
9. Technology risk: low use of modern methods and software.
10. Ethical and legal risk: tax, VAT and labour act non-compliance, corruption allegations, blacklisting.
11. Subcontractor and supplier risk: default or delay.

Management of these internal risks

Improve estimate accuracy, keep cash-flow forecasts, train workers and engineers, maintain equipment, set up a quality and safety system, read contracts carefully, keep documentation for claims, and maintain a risk register reviewed monthly.