Risk Management in Construction Projects

From apppm
Jump to: navigation, search

Developed by Mint Rasmussen

Uncertainty is a fundamental factor of projects. We know that we cannot predict the future with certainty. Uncertainty converse all of the environmental conditions in which a project has to operate, e.g. costs of people or materials, etc. [1]

There are two types of uncertainty; uncertain effectiveness and uncertain efficiency. These uncertainties have different effects on a project. Uncertain effectiveness can affect the quality of the project, such as the understanding of requirements, prioritization of conflicting requirements or reasonableness of requirements. While uncertain efficiency can affect the quality of process performance against the plan, such as the availability of resources, quality of the planning process, technological capabilities, the ability and drive of the people.[2]

Risk is an uncertain event or condition which can have a positive or negative effect on one or more objectives in a construction project, such as; scope, schedule, cost, performance and quality. One or more of these can be of impact on the project, and have both positive and negative outcomes. Positive- and negative-outcome risks are referred to as opportunities and threats for the project, and it is the management of all these that constitute the Risk Management in Construction Projects.

Risks are present already from the time a project starts. Therefore it is important to prioritize risk management, since it will likely lead to more problems if handling the risks is procrastinated.

The goal of risk management is to increase the likelihood and impact of positive events and meanwhile decrease the likelihood and impact of negative events in construction projects. [3]

For understanding risk, we have to look at the four fundamental elements, which are defined as risk management process:

  1. Identify
  2. Assess
  3. Respond
  4. Control

Risk management is a learning process through time and through the whole project life cycle. [4]


Risk Timeline

Risk Timeline (adapted from Managing Construction Projects) [4]

A risk time-based framework helps understanding risk and uncertainty, as illustrated on the figure to the right. The timeline shows the risk processing through time.

”The risk source is the underlying condition that can generate a possible risk event at some time forward from the point of decision-making."

"Graham M. Winch" [4]

The first box shows the risk source, which consists of the problem or the issue that can form into a risk event along a project life cycle. When the decision-maker knows the risk source, they have to respond to prevent the risk event to occur.

As mentioned, the risk event, illustrated by the third box in the figure, will occur if the risk source is not prevented or solved in the beginning of the process.

An example of a risk event could be; a delayed delivery of a certain concrete element; permission to do a certain type of task; an accident on the construction site.

The decision-maker need to evaluate and respond to these risk events. This will lead us back to the third box, risk event: “how was the situation handled?”, and then back to the first box, risk source: “how can we prevent it from occurring again?”[4].

Risk Management Process

Risk Management Process (adapted from Managing Construction Projects) [4]

Managing risks is a continuing process throughout the construction project’s life cycle. The figure to the right illustrates the four main topics of the project risk management process. The circle indicates that the risk management process is a continuing process that the contractors have to manage throughout their project’s life cycle[4].

”Risk management is, in essence, a learning process through time.”'

’’Graham M. Winch’’[4]

These four topics and their relevant tools will be discussed below.


Identification of risks is the first step through the risk management process. This process is essential part of doing risk management and is usually influenced by experience from previous projects or experienced people, and information gathered by brainstorming sessions with the team when starting a construction project [4].

Risk identification is a repeated process due to the fact that new risks may arise or get discovered through a construction project’s life cycle. Each risk should be understood clearly in order to handle them effectively. [3]

The identification process helps determine potential risk events that might either have a positive (opportunities) or negative (threats) impact on the construction project’s goals [5].

There are many approaches to identify risks, some of them are listed below. While identifying the risks, a risk register can be convenient. Risk register is a “library” in which the result of risk analysis and risk response that have been treated before are registered. It is essential that the scope is as clear as possible so those risks can be minimized or have the opportunities to become recognized before the construction project begins. [3]

Risk Checklist

Risk identification checklists are developed based on older information, experiences from previous similar projects and from other types of information. The risk checklist is a helpful tool that can ensure that risks identified in previous similar projects will aid to identify risks in future projects. When a project team receives a risk checklist from a previous and similar project, the team should furthermore investigate which new elements are present in the ongoing project and update the list accordingly. Moreover, the checklist should be updated before the closure of the construction project, to improve the list for future use on other similar projects[3].

Information Gathering by Brainstorming

Brainstorming is a good technique to use as information gathering because group thinking is more effective than individual thinking. Group thinking will include relevant people to brainstorm a list of potential risks. Risks will be identified and categorized by type[3].

Rumsfeld’s known knowns concept

Rumsfeld known-known concept (adapted from How to DO projects) [2]

Donald Rumsfeld’s known knowns concept helps categorize types of risks associated with a project.

The known-knowns refer to things that are known to be known; risks that already are identified/assessed. The known-unknowns refer to things that we know we don’t know yet [2], an example could be a need for extra employees in the construction processes due to a schedule delay; if the construction project has to be put on hold due to bad weather conditions. The unknown-knowns refer to things that are considered to be known but is known wrongly, or not known at all [2]; Examples of these are risks that someone already knows about but is keeping private[4]. Lastly, the unknown-unknowns refer to things that are unknown to be unknown [2], also referred to as “black swans”. These are risks that have not been identified and therefore are not known of[4].

Assessment and Analysis

The second phase of the risk management process is to assess and analyze the risks that have been identified. The fundamental benefit of this phase is that it allows project managers to reduce the level of uncertainty and to focus on high-priority risks.[3] There are many tools for assessing these risks, one of them is the Probability/Impact Matrix [4].

Probability/Impact Matrix

Probability/Impact Matrix (adapted from How to DO projects)[2]

The most common tool to assess theses risks is Probability/Impact Matrix. Each risk identified are rated on its probability of occurrence and impact on the construction project. The risk can be classified as low, moderate and high as seen on the figure on the right. This matrix gives an overview of how much each risk have of a negative impact or threat to the construction project.

The impact factor on the x-axis is defined as how large of a negative impact the risk has on the construction project. The probability factor on the y-axis is defined as probability of the risk occurring.

A risk with a low impact and a low probability, bottom left corner, can often be ignored or accepted.

A risk with a low impact and a high probability, upper left corner, is of moderate priority and can be confronted or managed by transferring the risk to a third party.

A risk with a high impact and a low probability, bottom right corner, is of high priority but is unlikely to happen. An example might be a rare natural catastrophe or a fire on site.

A risk with a high impact and a high probability, upper right corner, is of critical priority. Such a risk should be first priority and must be paid close attention to. [3]


Having assessed the risk with the Probability/Impact Matrix, the next phase of the risk management process can be initiated; the response phase. This is a phase where the project team determines how to meet and resolve upcoming risk related impacts. This is not only about reducing the amount of risks, but by deciding whether to avoid, reduce, transfer or accept the risks, also known as the ARTA strategy. ARTA strategy should match the risks from the probability/impact matrix. It is up to the project team to select which of the mentioned strategies they want to apply, depending on the risk source and its impact.

ARTA strategy

ARTA grid (adapted from How to DO projects)[2]

ARTA strategy are defined by four main strategies:

  • Avoid
  • Reduce
  • Transfer
  • Accept

If the risk is of high impact and high probability, the correct corresponding action would be to avoid the risk altogether. In such an event the project team acts to eliminate the threat or protect the construction project from the risk’s impacts. This typically involves changing the strategy or reducing the scope. Some risks can already be identified in the beginning of the construction projects, which means that these can be avoided by clarifying requirements, obtaining relevant information and expertise or improving communication.

If the risk is of high impact and low probability, the correct corresponding action would be to reduce the risk. In the case of such an event the project team acts to reduce the probability of occurrence or impact of a risk. Taking early action of reducing risks in a construction project is often far more effective than trying to adjust for the resulting impact later on.

If the risk is of low impact and high probability, the correct corresponding action would be to transfer the risk to a third party. This means that a third party would take over responsibility for the potential impact of a specific risk, such as a subcontractor, consulting firm and so on. A proper third party to transfer the risk to, would be one who holds expertise concerning that specific risk.

If the risk is of low impact and low probability, the proper decision would be to accept the risk. Then the project team decides to acknowledge the risk and not take any action unless the risk occurs [3] . An example would be if the contractor has to accept weather conditions that result in a delay in the schedule; there is nothing they can do about delays in the schedule due to weather conditions, and the impact of this is usually not catastrophic anyway.


The last phase of the risk management process is to monitor or control risks throughout the construction project’s life cycle. This phase is as important as the other phases and during this phase the unknown-unknown events will grow [4]. Monitoring and controlling risks can be achieved by tracking the identified risks, monitoring continuing risks, identifying new risks, and evaluating effectiveness of risk related processes [3] throughout the construction project life cycle. Additionally, monitoring and controlling is assisted by gathering relevant people on the construction project for routine meetings on the construction site and communicate with the subcontractors to see how the task is going. This will give an insight of where the contractor and subcontractor need to focus on. Furthermore, this activity can identify both positive and negative effects on the construction project [4].


Risk management will improve numerous tasks of a construction project, but of course there are limitations. As mentioned earlier:

”The objectives of project risk management are to increase the likelihood and impact of positive events, and decrease the likelihood and impact of negative events in the project.”

’’Project Management Institute’’ [3]

Risk management is not about removing all risks from construction projects, as this is impossible. But rather, it is to reduce the amount of negative impacts. Risk management is therefore only limited to the extent that it is possible to identify and assess risks, known or unknown. Furthermore, risk management can both be limited in its ability to decrease impact and likelihood of negative impacts, as well as in its ability to increase likelihood and impact of positive impacts.

A common tendency amongst risk managers is that the majority of their focus is on decreasing negative impact associated risks. Ideally equal importance should be given to increasing positive impact associated risks. Limitations to the benefit of doing risk management therefore arise when an imbalanced prioritization is given to these [3].

Annotated bibliography

  • Project Management Institute "A Guide to Project Management Body of Knowledge" (2013), 5th Edition: Project Risk Management (ch. 11)
This book accommodates many aspects of guidelines for project management. Furthermore, this book provides many beneficial tools and approaches such as Risk Management as this article is about.
  • Winch, Graham M. "Managing Construction Projects" An Information Processing Approach, (2010), 2nd Edition: Managing Uncertainty and Risk on the Project (ch. 13)
This book addresses valuable sources for both practitioners and students as it covers many topics within the management of construction projects. Moreover, this book provides many interesting subjects from defining the project mission, managing the budget and schedule; ‘’uncertainty and risk on the project ‘’and much more.


  1. Taylor, Harvey | 2010 | Project Management | (4th Edition)
  2. 2.0 2.1 2.2 2.3 2.4 2.5 2.6 Geraldi, Joana | Thuesen, Christian | Oehmen, Josef | 2016 | "How to DO projects" | Uncertainty |(Version 0.5)
  3. 3.00 3.01 3.02 3.03 3.04 3.05 3.06 3.07 3.08 3.09 3.10 Project Management Institute | 2013 | "A Guide to Project Management Body of Knowledge" | (5th Edition)
  4. 4.00 4.01 4.02 4.03 4.04 4.05 4.06 4.07 4.08 4.09 4.10 4.11 4.12 Winch, Graham M. | 2010 | "Managing Construction Projects" | An Information Processing Approach | (2nd Edition)
  5. Dansk Standard | 2013 | "Guidance on project management" | DS/ISO 21500 | (2nd version)
Personal tools