Risk Management on Megaprojects: Lessons from the Leviathan Project

Episode Overview

Most major projects manage risk in Excel, when they manage it at all. Matt Mitchell got there the other way around: from IT and software development, through Enron’s formal risk training and a global risk platform he rolled out to customers, to the customer itself, Noble Energy, where he became risk lead on some of its very largest projects, including Leviathan, the offshore gas platform in the Mediterranean sanctioned at roughly $3.9 billion. In 56 published minutes with Orion Matthews he delivers the most practical risk 101 the show has run: what risk actually is (a deviation from your objectives, in either direction), how to split a register so the project team can breathe, how to run a workshop that never starts from a blank screen, and why, in risk culture, one is greater than zero.

Episode Timeline

The conversation as it actually unfolded: twelve chapters, following the show’s four-act arc. The strip below maps each chapter’s share of the recorded conversation; timestamps are approximate. Click any block to jump to its chapter.

Who carried the mic

The Guest · Matt Mitchell

Matt Mitchell

Risk Management Professional (PMI-RMP) · Director of Customer Success, Electrical Grid Monitoring

Houston, Texas, United States

Project Risk ManagementRisk WorkshopsMonte Carlo & PERTOwner-Side ControlsEnergy · Industrial

Matt started on the technical side: system administration at Deloitte’s consulting group, a trading-desk engineering seat at Enron Broadband (where he got his first formal risk training), then a decade across energy and enterprise software. The turn came at a software company with a serious risk management platform: rolling it out to customers taught him the ISO and PMI frameworks from the inside, and one of those customers, Noble Energy, hired him to run the system it had just bought. Eight years later he had been risk lead on some of the company’s largest capital projects, including Leviathan, and had built a risk champions program that carried the discipline across a global portfolio. Today he is building Electrical Grid Monitoring, a venture focused on innovative power line sensors.

“Risk is the effect of uncertainty on our objectives, where that uncertainty is a deviation from what we expected.”Matt Mitchell · the ISO definition, on the show, ~10:30

Career journey

Roles and years from Matt’s public LinkedIn profile. The software-to-risk turn is how he tells it on air (~1:10): a software company with “a really strong risk management platform,” then a move to one of its customers; Dyadem International is the risk-software stop his LinkedIn lists immediately before Noble Energy.

The Host · Orion Matthews

Orion Matthews

Founder, Queryon · Host, The Major Project Podcast · PMO data & analytics

Eugene, Oregon, United States

Project Controls ReportingPMO Data AnalyticsCapital PortfoliosAI in ProjectsPower BI

Orion is an award-winning programmer, entrepreneur and technology executive who has spent the last decade in the engine room of major capital projects. He founded Queryon in Washington, D.C. in 2015 with a focus on data analytics and software for the construction industry, starting with bellwether client BP, whose project-controls solutions his team deployed globally, from the North Sea to Azerbaijan to Houston. Today he's a recognized expert in PMO data analytics and project-controls reporting, serving billion-dollar portfolios for owners including BP, Santos, Balfour Beatty and Turner & Townsend, a regular speaker at major industry conferences on AI and analytics in capital projects, and the host of this show.

1. The Excel observation that frames the whole hour: “risk is probably the one area that I’ve seen more often than not managed, from small to really large enterprises, in Excel.” ~2:05
2. The time-machine playback: “if we’re at time T zero and you pick a point out here at T 10… risk is saying, what is the actual deviation from expected.” ~13:20
3. The witch-hunt question nobody asks out loud: “sometimes risk turns into a witch hunt, and people don’t wanna be the one to kick off the hunt.” ~30:50
4. The super Monte Carlo: an LLM “running it against trillions of connected points to suss out probabilistic outcomes.” ~53:40

From Software to Risk Lead

Orion opens with the show’s standing frame and the guest’s résumé in one breath: a certified risk management professional, over a decade in risk and project controls across energy and industrial sectors, Noble Energy, and now a grid-sensor venture. Then the origin story, and it’s an unusual one: risk found Matt through software.

“As we rolled out this global risk management system, they realized they didn’t have anybody to manage it, and so that became my role… took on the role of risk lead and ended up with some of the very large projects that they had.”Matt Mitchell · ~1:40

1. The first exposure: “First, I worked at Enron, and we had some formal training around risk management.” ~1:15
2. The software company with “a really strong risk management platform,” rolled out to customers, prospecting what a global risk management system would do. ~1:25
3. The verdict on the path: “Yes, it’s very much a niche, but it was kind of a natural fit.” ~2:55

Leviathan & the Two Registers

Public information only, by agreement: Leviathan, the giant natural gas field far offshore Israel, one of the largest offshore gas developments in the Mediterranean. Matt walks the concept history (a floating production vessel batted around for years, then a very large platform closer in, after Tamar proved the model), the sanction he intersected, and the register decision that made a megaproject’s risk manageable: split the commercial from the execution.

“This was such a large project, it had so many aspects of it. We eventually ended up running two different risk registers, because we had so much that was on the commercial side of things, and then there was the project execution… The overlap of those kind of muddies the water a little too much for the project team.”Matt Mitchell · ~8:35

1. The concept arc: “It started off as a floating production, FPSO, basically a ship… then ultimately, based on some of the successes of the other two platforms that had been put in, it became a very large platform a little closer in. And that was the final investment decision.” ~5:30
2. Where he intersected it: “I got into that project around the 2015 timeframe, ’15 or ’16… right around the time that they made final investment decision and sanctioned that project as that large platform. Massive platform, in fact.” ~6:30
3. Inheriting the register: “Let’s take that risk register and we’ll repurpose it… Some of these apply, some of these don’t.” The more mature the process, the easier the handoff. ~8:10
4. The commercial side, illustrated: “It’s public information that they’re selling gas to Egypt, right?… that was one of the things we had to consider as part of all the commercial risk, but that’s not a project execution item.” ~9:30
5. Orion’s read: geopolitical risk is almost a different discipline than engineering risk, “which maybe is a little bit more quantitative.” Matt: “Yes.” ~9:50

Risk 101: Deviation from Expected

Orion asks for the 101, “a refresher even for the advanced project people.” Matt gives the textbook definition, boils a project’s objectives down to cost and schedule, defends the COSO view that overshooting your target is a risk too, and then spends the back half on calibration: the valve test, and the line that separates a real risk from a black swan.

“Risk is the effect of uncertainty on our objectives, where that uncertainty is a deviation from what we expected… identify what things could happen to prevent us from achieving those objectives. Or if something bad were to happen, what would we do to get it back on track.”Matt Mitchell · the ISO definition · ~10:30

1. Focus the objectives: “it’s most effective to boil those things down into what’s the effect on the schedule, what’s the effect on the cost,” because HSE-style objectives, while real, “muddy the water.” ~11:20
2. Orion’s playback: risk always has a time horizon and an observer’s frame: T zero, a point out at T 10, and a mechanism that says “this should be here.” ~13:20
3. The two biases you meet in every room: “Oh, yeah, that’ll never happen, we’ve never seen that,” and “we need to order 12 extra valves because we’re gonna have so many fail.” ~14:20
4. Black swans have a Latin name: “de minimis… it’s so outrageous that we shouldn’t even consider it, because there’s nothing we could do about it if it occurred.” ~15:55
5. The economics in one word: “You have to focus on what you can control and what reasonably will impact the project… otherwise we’re gonna waste a lot of money and waste a lot of time thinking about things like planes crashing.” ~16:10

Making Risk Economical

Orion plays the skeptical executive: the risks will probably occur anyhow, so what stops risk management from spending millions to prevent the one-in-a-million? Matt’s answer has two parts: a matrix denominated in this project’s money and time, and a training program that scales one risk manager across an entire portfolio.

“The company might have a global risk matrix or a corporate risk matrix, but the project has to have its own.”Matt Mitchell · ~17:45

1. Scale the matrix to the budget: does a 100% impact mean 10%, 25%, 50% of this project’s cost? “That lets you frame that project in terms of its biggest risks and compare it to other projects of similar sizes.” ~18:00
2. Why champions work: “It’s hard to do it all as a single individual, and risk management is all about everybody understanding how the whole process works. So we just tried to teach everyone that we could.” The audience: project controls, engineers, a lot of coordinators. ~20:10
3. Orion’s safety-culture parallel: you don’t get safe execution by hiring one great safety manager; you build a culture. Matt’s version for risk: just start. ~20:45

Inside the Risk Workshop

Asked for the story of Leviathan’s first risk workshop, Matt grins: “I’d rather tell you the best way to do it… but I’ll tell you what we did instead.” The first one was awkward, because first ones always are. What follows is the real craft: managing personalities, eliciting risk from the quiet experts, respecting the field’s time, and never, ever starting from a blank screen.

“The leader of the entire group said, ‘You guys are here today to tell me why X is our biggest risk.’ Conducted the workshop. Everybody had their input, and X came out as the third-biggest risk from that group.”Matt Mitchell · ~24:50

1. Half the job is the room: “you have a lot of vocal voices… yes, let’s put that in the parking lot, we’ll take that offline… It’s a lot of personality management, especially initially.” ~22:20
2. The field experts “are necessarily there, but they don’t wanna be there… you have to be considerate of their time, do as much homework and upfront work as you can to make that meeting valuable the whole time they’re there.” ~24:10
3. The prep stack: a lessons-learned review, similar projects’ registers, and drive-by interviews (“hey, we’re doing a risk workshop, was wanting to get your perspective”), so you “come with something to show them.” ~26:20
4. The doctrine behind it: “The PMI guidance is that a lesson learned is a future project risk.” ~27:20
5. Never delete: “don’t delete a risk just because it’s mitigated or it’s no longer applicable, leave it in there and just say that it’s closed out, because somebody’s gonna need to review that sometime in the future.” ~27:50

The Flywheel & the Politics of Risk

How does a new risk manager on a billion-dollar job get the flywheel spinning? Piggyback the reviews that already exist, says Matt. Then Orion asks the harder question, the one that keeps registers empty: what do you do when raising a risk creates political problems for the person who raises it?

“The easiest way to dovetail a risk review in is to kind of piggyback on a cost or schedule review… They’re all related. And if you can listen in on a cost review, listen in on a schedule review, that will feed a lot of information into what goes into the risk register.”Matt Mitchell · ~29:15

1. The cadence: “typically it’s gonna be about a monthly type activity, just depending on the timeline of the project.” ~29:35
2. Orion names the failure mode: it’s often easier to let a risk ride and shrug “hey, this happened” than to be the one who kicks off the witch hunt. ~30:50
3. The private channel: “if you can have a one-on-one with somebody, you’re more likely to get something like that, and say, well, here’s how we’re gonna address it in the big group session.” ~31:50
4. When the miss wasn’t on the register: “Those do happen, right? It’s the known unknowns versus the unknown unknowns… you do as much work upfront as you can to try to identify what types of those things might occur.” ~32:25
5. The objectives filter, again: a piece of equipment a week late that doesn’t move the start-up date “might not be as big of a risk as it sounds.” ~33:45

Monte Carlo & the P-Numbers

“I always thought Monte Carlo was like a casino,” Orion offers, and gets the cleanest plain-language walkthrough of quantitative risk you’ll hear: compounding probabilities, a thousand iterations, and a company-level choice about how confident it wants to be. Plus the operating rhythm on Leviathan, and how risk crosses the corporate boundary to contractors.

“If you have an activity and you have a 50% chance of finishing on a day, and there’s a dependent activity that you have a 50% chance of finishing on time, you only have a 25% chance of meeting that schedule… that’s kind of what Monte Carlo is.”Matt Mitchell · ~34:40

1. Right-size the method: “Monte Carlo is most effective on large to very large projects… for smaller projects, we have the PERT method, the Program Evaluation Review Technique. That’s what I recommend for smaller projects.” ~36:30
2. Who owns it: “The project manager, project director, they ultimately own all the risks… the risks should be individually owned by the people who are working to mitigate or close them out. But the project manager has final say.” ~38:30
3. The risk lead’s quiet job: prepare the documentation the PM presents up the chain, and chase every risk owner for updates so the PM is never out of alignment. ~38:45
4. Crossing the corporate boundary: “We would go directly to them, meet them at their office… could they bring whatever they were working from, whatever their risk registers were. And if we found deficiencies, we would just coach them.” ~39:40
5. The good news about big contractors: “most of our big contractors like that did have a risk management function, and they were willing to meet with us.” ~40:10

The Social Animal

“So the risk manager is kind of a social animal, would you say?” “Right. Lots of meetings.” Orion’s three buckets (is this person helping me, draining my time, or going to get me?) set up the disarm move, the soft-skill path the ISO documents never mention, and the two personalities you learn to manage first.

“My favorite icebreaker is, you show up for a first meeting and say, ‘I’m from corporate. I’m here to help.’ And you always get a bunch of laughter… I acknowledge that you guys don’t wanna be here and you don’t wanna hear from me, but let’s get through this, and hopefully we’ll see that we’re adding some value.”Matt Mitchell · ~41:10

1. Orion’s taxonomy of how people receive a risk manager: helping me, draining my time, or going to get me. The whole chapter is about landing in bucket one. ~40:45
2. The coaching script for extremists: “you have to kinda talk them off the ledge… it’s not just about you, it’s about future projects, and the project manager wants this.” ~43:10
3. Handle outliers offline: “those two are the ones that it’s sometimes better to go meet with them in person, out of the workshop, and try to head off any of those types of outcomes.” ~43:45

Process Before Tool

Orion’s standing rule is “process before tool,” and Matt, the man who sold risk software for a living, agrees in the strongest possible form: the tool is far down the list; the register is the list. Excel is fine. The fancy platform earns its keep only if it can produce a view simple enough for the room.

“To go back to one is greater than zero: having a risk register is infinitely better than not having one at all… somewhere far down the list is the what tool do you use? But the top of the list is create a risk register. That’s it.”Matt Mitchell · ~44:45

1. What a project register is not: “failure mode effects analysis, security vulnerability analysis, pick one, HAZOPs, HAZIDs. Those are very specific and very detailed and very engineering-oriented, and they are not suited for project risk registers.” ~45:55
2. The category definition: “The project risk register is the simplest form of risk review that exists. It’s very basic, focused on project objectives.” ~46:20
3. Export or die: “if you choose too complex of a tool and it’s too difficult to do that export and review… it just won’t get done, and it won’t get updated, and you’ll have bad data in there.” ~47:30
4. The enterprise reality: “could we get an entire project team to go into a tool and put risks in? No, absolutely not. But having those point contacts, risk champions, people who understood the process out in the field, that was very valuable.” ~48:20

The History & Future of Risk

Zoom all the way out: humans have been managing risk for tens of thousands of years, animal sacrifice included, and the discipline’s best book is a history. Then all the way forward: Matt’s bet that AI reads today’s risk data tomorrow, Orion’s “super Monte Carlo” frame, and the honest caveats about what the models can’t replace.

“One of the things that I say is that the AI that we’re using in 5 years or 10 years is going to be reading the data from today… where risk management is going is leaning on AI to help us figure out what we need to be doing to avoid risks, not only in the project world, but broadly.”Matt Mitchell · ~51:45

1. The bookshelf headline: Against the Gods: The Remarkable Story of Risk: “the early philosophers… loved to gamble because they understood what the odds were.” ~50:45
2. Risk mitigation, Bronze Age edition: “in early civilizations, the sacrifice of animals was what was perceived to be a risk mitigation of fertility or crops or who knows what.” ~51:10
3. Why AI beats the classic engine: “Monte Carlo is very dependent on the quality of the inputs, whereas with AI I feel like you can be a little softer on that quality and still have a good outcome… it’s easier to look across other projects with an LLM.” ~54:30
4. The caveat for the haters’ row: “I still think for a lot of project scope you have to have the expert opinions. AI can do a lot, but you need people who have the experience and have been through it.” ~55:10
5. Asked if robots are 50 to 100 years out, he shrugs: “who knows what the future holds… just the last couple of years of technology, seems like we’ve made some pretty big leaps.” ~55:50

The Advice Playbook

Orion runs the wrap-up as a role-play, one seat at a time: the project director who just hired a risk manager, the VP trying to smell trouble from the top, the scheduler who wants to be useful, and the org deciding whether to insource the function at all. Matt’s answers all rhyme: relationships early, plain language always.

“One of the main things that I encourage people to do is to describe risk in a way that it can be understood by someone who has nothing to do with the project.”Matt Mitchell · ~57:50

1. The VP’s smoke test, in Orion’s playback: if the register is so technical you couldn’t hand it to an investor, “that’s probably a flag that you wanna take a harder look at risk.” Matt: “Correct… absolutely.” ~58:30
2. Not just a number: “not just $10 million. We have to say what that risk is, and it has to be described in a way that is meaningful for outside parties.” ~58:15
3. Insource or outsource: “I found it to be pretty effective to be insourced… certainly I have a little bit of a bias that I can recognize there.” If the org doesn’t understand risk yet, outsourcing can work, if the outsider still meets the key people. ~1:00:15
4. The floor, either way: regular meetings, regular updates, “describing risk in a way that your organization can understand it, not just the risk manager… you can have success either way.” ~1:00:45

The Big Ideas

Three ideas carry the episode. Sketched here the way a risk lead would whiteboard them.

Takeaways, the Bookshelf & the Links

The close runs from a Navy training slide to the philosophy of gambling Greeks, through the standards shelf (PMI, ISO 31000, ISO Guide 73, COSO), and out on how a student actually gets the job. Every recommendation from the episode, in his own words, plus all the links.

“Another one that I found in an old Navy training slide deck was: change is the mother of all risk… a lot of times when you have bad outcomes, it can be traced back to some kind of a change or a decision or something that we did differently than we had originally planned… anytime there’s any talk of change, that should be a risk conversation.”Matt Mitchell · ~1:02:30

1. The jobs exist: “there are jobs open currently for project risk managers… typically it’s within like an EPC-type company, and they’re working across multiple projects.” ~1:04:15
2. The usual door is sideways: “it’s sometime easier to move into that role once you’re within a company and are working on a project… it’s kind of how I found myself there.” ~1:04:40
3. The profile that fits: “the very curious. Someone who’s very curious and loves to always be learning, because every project is different… What is different about this project? What risks might I have? What have I not thought of yet?” ~1:05:40
4. The scale of the seat: “a project manager might work on three projects in their career… a risk manager, you are likely going to work on dozens of projects.” ~1:06:30
5. The last tip: settle the language. “Settle on a set of definitions… like severity or impact, those kind of mean the same thing in risk management terminology. But just define what all those terms are for your project and for your program.” ~1:09:25

Highlights at a glance

Quote Bank

The best on-the-record lines, gathered in one filterable place. “Highlight” marks the lines most worth scrubbing back for; quotes are lightly condensed and timestamps are approximate.