Best practice: Risk management

Although risk is normally associated with adverse happenings, upside prediction in business forecasting plays a major part in planning. Understanding the basic principles allows the application of risk management within everyday decision making.

It is particularly apt for building services, as the failure of designed systems can have devastating commercial and human consequences. Sophisticated computer modelling can eliminate these events. By analysing the probability of failure, product design and installation can be modified to decrease this.

Setting clear objectives for any project is a fundamental requirement. Poorly managed risk will adversely affect the ability to achieve these objectives. Like all decision making, dramatic changes can be made in the early stages without cost penalties. The initial appraisal of the intended project should be done using all known or possible risks. The developed risk register should continue through the project, updated when risks are identified.

The principal behind risk management systems is to measure all risks as identified and understood. Those retained must only be so when an appropriate management system for their control exists, together with adequate contingencies. The final aim must be to ensure the project objectives are met and value for money is delivered.

Risk management is not about trying to predict the impossible or the future – both of those are deemed uncertainties. Instead it is about quantifying the outcome of alternative decisions, ensuring that the choices made provide a satisfactory basis for future actions.

Business forecasting works in a similar way by allowing commercial decisions to be made to increase financial results. Excessive concentration on the negative leads to conservative and irrational decision making. Taking measured risks is required in all aspects of business. Growth and business development all requires decisions on risk and uncertainty.

These concepts can be defined as:

• uncertainty: an event where the outcome or its consequences cannot be foreseen (termed force majeure in insurance policies);

• risk: a quantifiable measurement of the chances an event will occur, multiplied by the magnitude of the loss or gain. As risk can be quantified it can be insured against;

• business forecasting: the use of risk-based quantitative forecasting methods to determine commercial gains or losses.

To separate risks from consequences, two parts must exist: probability and impacts. This gives four generic risks types as illustrated above.

The process begins at the earliest possible project stage. Experienced developers use scenario planning to determine the suitability of developing a project. This normally consists of a brainstorming session with various advisors to identify as many risks as possible. For issues such as interest rates, a sensitivity analysis gives a spectrum of results for use.

Analysis and measurement

Value management and whole life costing are risk analysis techniques. Both question appropriate responses to a given objective and try to define the best possible combination of factors to achieve this.

Risk measurement and analysis techniques have a large application range. They are widely used to examine decision making in property investment and development strategies. Used within business forecasting they can enhance the reliability of estimating installation costs, whole life costs, finance rates or future economic performance of business units.

Risk management begins with an analysis of the project to determine specific risks and their sources. Impacts on time, cost or human issues can then be measured and appropriate responses to risks can be given. Finally, a feedback system can be implemented, allowing gained knowledge to be used in the further identification of responses to risks. Properly executed, the system allows managers to concentrate on the critical success factors of a project.

Responses can be one of five options:

• Transfer. This is either through sub-contracting, insurances or delegation. This minimises commercial impacts and may reduce the consequences. Risks should only be transferred to a party that is better placed to exercise more effective control over it;

• Reduction. Minimisation of outcomes should be the immediate response, whether used singularly or prior to transferring or retaining;

• Retention. Once a risk is identified, a positive management system can be implemented to ensure that risk is minimised or that adequate contingencies are in place;

• Elimination. This is the preferred option. Eliminating risk through either controls or design is always preferred (but may cause new or consequential risks to arise);

• Sharing. Retained risks can be jointly shared. Characterised by joint venture agreements, these normally occur when a retained risk is too large for a single company. For share of the rewards, partnerships are formed that are joint and severally liable for risks.

  Measurement techniques can be split into two main groups: quantitive and qualitative. quantitative techniques include:

• Sensitivity analysis. A mathematical model used to simulate a change in one variable, such as capital cost or interest rates;

• World state scenario analysis uses a band of three opinions to measure the gap between consequences arising. Optimistic, realistic and pessimistic appraisals are used;

• Probability analysis. Both the positive and negative consequences are calculated;

• Monte Carlo analysis is a sophisticated computer-based model that uses gaming probability to determine the consequences of an event occurring.

Qualitative techniques include interviews, expert opinion and brainstorming sessions.

Problems and benefits

The benefits of using risk management result from explicit highlighting, analysis and evaluation of issues that are fundamental to a project. Difficulties in using the techniques extend from problems in predicting future events or the conditions of outcomes. These can be counteracted by using adequate and reliable data. The fundamental problem with future prediction techniques is that they rely on the belief that the past will present a suitable model for the future.

A risk analysis is a formal review of retained risks. Its main objectives are to:

• identify retained risks;

• identify new risks as the project develops;

• assess any unusual risk characteristics;

• find maximum and most likely outcomes;

Risk and contract strategy is interrelated, as is procurement strategy. Selecting the appropriate contract enables the responses strategy to be implemented and understood by all parties. Standard contracts should be preferred, as their principles and robustness have been tried through previous court rulings.

All contracts, as procurement strategies, allocate risk to the various contract parties in different manners. With allocation of risk goes the authority and responsibility for controlling it, as does the right to seek compensation. Transferring risk through a contract is fair as long as it's understood and parties are given the opportunity to price for its responsibility.

Procurement strategies have recently been developed for maximum transfer of risk to the contractor. Government has recognised that private industry is more equipped and knowledgeable of risk and therefore more commercially effective in their management. Coupled with partnering agreements, contractors are given the opportunity to fully understand the risks involved and price for them.

The MOD's prime contracting arrangement requires pricing of life cycle costs with assurances of their accuracy. Risks of capital and running costs are fully transferred to the private sector. Value management is introduced to ensure these are realised and the most cost-effective solution for all parties is developed.

Finally, risk management and analysis should always be viewed as a dynamic tool within the overall running of a project.