Risk Management on Major Projects

101: understand what you are managing

Start with an objective that matters: achieving first production, opening a transport service, staying within an approved funding envelope, or meeting a permit condition. A useful risk describes an uncertain event or condition that could affect that objective. An issue has already happened. An assumption is something the plan currently treats as true. Each needs an owner, but they need different conversations.

Write the causal chain instead of a topic label. In a hypothetical equipment package, incomplete ground data may require a foundation redesign, which could delay installation and require additional engineering. Ground conditions alone is too vague. Record what remains uncertain, the exposed activity, and the consequence. Treat favorable uncertainty as an opportunity when someone can take a practical action to realize it.

Keep three concepts separate. Exposure describes what could happen. The response describes what you will do about it. Contingency is an allowance for uncertainty under an agreed estimating and governance approach. A contingency balance does not complete a mitigation action, and a large risk register does not demonstrate control.

Implementation: frame the next decision

Before arranging a workshop, name the decision the results should inform. A funding gate, package award and construction readiness review need different detail. State the alternatives, decision date, decision owner and evidence threshold. If nobody can say how the assessment might change the decision, narrow the scope before collecting more risks.

• Define the scope boundary and the interfaces that cross it: design, procurement, construction, commissioning and operations.
• Collect the current schedule, estimate basis, assumptions, commercial allocation and known constraints. Record the version used.
• Agree the consequence dimensions and escalation thresholds before scoring. Use the project's approved safety and environmental processes for those specialist exposures.
• Invite people who hold evidence and people who will own responses, including contractors and the receiving operations team where relevant.

A workshop produces a candidate view, not a final verdict. Give quieter participants a way to submit concerns before group discussion. Ask what would make the current plan wrong. Separate evidence from confidence in a persuasive speaker, and retain dissent when the team has not resolved it.

Implementation: build a register people can act on

Give each risk a stable identifier and connect it to a package, milestone or decision. Record its cause, uncertain event, consequence, current controls, evidence and assumptions. Name an accountable risk owner who can coordinate the response. Name separate action owners when delivery sits elsewhere. A department name is not enough to resolve a missed action.

Describe the response in observable terms. For the hypothetical ground example, an action might be to commission targeted investigation before foundation design is frozen. Specify the deliverable, due date, expected decision benefit and resources. If investigation cannot finish before the decision, show the remaining uncertainty and the alternative response instead of marking the action effectively complete.

• The event is uncertain and its consequence connects to a project objective.
• The assessment names its evidence, assumptions and remaining information gaps.
• The risk owner has accepted ownership and the action owner has accepted the due date.
• The response has a resource requirement and a measurable completion condition.
• A trigger, review date and escalation route are recorded.
• Residual exposure is assessed after the response, without assuming uncompleted work has succeeded.

Implementation: make the review a decision meeting

Organize the review around changes since the previous assessment. Which trigger fired? Which action is late? Which assumption has new evidence? Which exposure now needs authority beyond the team? Show the decision requested, the latest date it remains useful and the consequence of waiting. Keep the register available as the record, rather than reading every row aloud.

Close the loop with the schedule and estimate owners. An accepted response may add investigation, redesign, procurement or testing work. Put that work into the delivery plan, with its funding and dependencies. When a risk becomes an issue, preserve its history and link the issue record. When it closes, state why exposure has ended and keep the evidence.

Advanced practices: challenge the model and the system

Use quantitative analysis when the decision needs a view of the range of possible outcomes. First review the underlying schedule logic, estimate structure and input basis. A sophisticated simulation cannot repair a missing work package or an impossible sequence. Document the question, model boundary and limitations before presenting a probability curve.

Distinguish variation in normal execution from discrete risk events. Check whether the same effect appears in a duration range, a separate risk event and an allowance. Review shared causes and dependencies, such as labor availability across several packages. Record why variables are related; do not choose correlation simply to obtain a preferred result.

Compare response options against the same basis. Look at what drives the result and whether an action changes the outcome enough to justify its cost and timing. Stress-test assumptions that the team finds uncomfortable. Ask what happens if a critical supplier, access route or regulatory decision fails at the same time as another constraint. A scenario is an exploration, not a prediction.

For a portfolio, examine competition for common resources and correlated exposure across projects. An individual project may look protected while every project relies on the same scarce specialist or supplier. Keep the model proportionate: show which conclusions are robust, which depend on weak assumptions and what additional evidence would improve the next decision.

Lessons from the field: turn insight into a local test

Identify why a field lesson worked and which conditions your project shares. Contract authority, project phase and team capability can change how you put it into practice.

A useful learning record connects the original assumption, the decision taken, the outcome and what the team would change. Review risks that never materialized as well as those that did: the response may have worked, the exposure may have disappeared, or the original assessment may have been wrong. Do not infer success merely from the absence of a visible failure.

• Bring one unresolved interface to the next review and identify the people on both sides of it.
• Trace one high-priority response from the register into the schedule, funding approval and completion evidence.
• Check one decision that was delayed: what information was missing, and what would an earlier trigger have changed?
• Record the result as a local lesson, including what changed and what the next team should check.