Skip to content

Guidebook for Risk Assessment in Public Private Partnerships

December 2013
Table of Contents

Tables

Figures

« PreviousNext »

4 Risk Management

Figure 4-1 . Risk Management

Figure 4-1 . Risk Management

4.1 Purpose and principles of risk response planning

The purpose of risk management (see Figure 4-1) is to minimize the negative effects of risks on project goals. Whereas a valuation produces an expected value of all risks, risk management actively influences risks in order to reduce their value.

4.2 Risk management generally focuses on three major steps

4.2.1 The first step is to decide on which risks to manage

The risk identification step described in chapter 3 is the first step for risk management. It is useful to structure the risks in risk management according to: (1) the relation to project goals (time, money, quality, or safety); and (2) an indication of value. Ideally the risk valuation outputs are used for the indication of value. If these are not available, it is also possible to use a qualitative indication.

This qualitative indication typically scores all risks on the basis of probability and effect, using a five-point scale. Multiplying chance and effect returns a score between 0 and 25 for each risk on the list. The top 10 (or more) of this list-in terms of total score-provide guidance on which risks to focus on. In addition, it can be useful to scan the list for risks that are managed easily and at a low cost. For risks that are not actively managed, the default strategy is to accept or-depending on the type of P3 contract-transfer the risk to the private party.

4.2.2 The second step is to define risk management measures

Just as risks are identified in a brainstorming session, risk management measures can also be inventoried this way. To challenge practitioners to think creatively about control measures, different perspectives should be used. These different perspectives are:

Preventive or Corrective: A preventive measure is one that attempts to decrease the probability of a risk's occurrence. A corrective measure tries to minimize the damage once the risk has already occurred. These two types of measures are often complementary. If a preventive measure is not 100 percent effective, then a corrective measure should also be defined.

Differentiate types of control measures - allocate, avoid, adapt, accept: Allocation of risks in terms of P3 contracts, such as between a public and private party, is covered in the next chapter. There are other forms of allocation, such as insurance of risks or specific financial products that cover price or interest rate risk (futures, forwards, interest rate swaps, etc.). The art of avoiding and adapting risks is related to optimizing the scope of the project and the planning process. Typical measures for this include avoiding innovation and complexity if the benefit does not outweigh the cost, choosing a realistic delivery date, or planning crucial building activities during the summer so there is less risk of weather-related delays. Another possibility is to just accept the risk. This is rational when the cost of the control measure outweighs the value of the risk, or when there is no other measure available. If a risk is accepted, then it is logical to include the potential impact as a buffer in project planning (risk of delay) or in the financial model (risk of additional cost).

Textbox 2: Project adaption as a mitigation measure (or real options in construction)

"Adaptation" refers to the potential to change, in order to be prepared for changing circumstances. One documented application of adaptation to a transportation project is described by Gesner and Jardim (1988) and considers the Tagus River Bridge in Lisbon, Portugal. The original design of the bridge, constructed in 1966, constituted of a single deck four-lane road. In the original construction future expansion was made possible by utilizing a stronger-than-necessary structure. In 1993, traffic rates had increased to the point where it was attractive to exercise the option to expand. The bridge was expanded with two road lanes and a railroad deck.

Adaptation as a mitigation measure will typically be very project specific. However, there are some general steps that can be followed:

  1. Identify the main risks that might require scope changes (demand risk, interaction with other projects such as urban development, parallel or crossing infrastructure).
  2. Identify the consequences if the project is not flexible in adapting to these risks.
  3. Develop design or scope alternatives that allow for adaptation to the risk. General categories are:
    1. Growth option: Phased development; for instance constructing a 4-lane road now, while reserving land and designing growth options for future expansion.
    2. Timing option: Delay the project until crucial information becomes available.
    3. Switching option: An example is developing a bus transit lane now, but designing the infrastructure in such a way that scaling up to light rail in the future is possible.
  4. Evaluate whether the cost of the option (for instance constructing a stronger bridge) is worth the potential benefits (risk reduction).
4.2.3 The third step is to select and implement risk management strategies

In this final step, the best risk management measures are selected and combined in a risk management strategy. Step two provided a long list of risk management measures to choose from. For a single risk, a set of measures can be selected that form an effective and efficient risk management strategy in combination with one another. Development of the best strategy not only takes into account the effectiveness and cost of implementing individual risk measures, but also considers effectiveness of the combination of risk measures (and to what extent the probability or the impact is mitigated).

4.3 Process, timing, information, and expertise needed

Just as for risk identification, conducting multiple risk control measure identification workshops with key participants is the most effective way to identify risk management measures.

Purpose: Identify or update the risk management measures. Typically, the initiator of the risk assessment is the project manager, the risk manager, or the financial controller of a project . The person executing the risk assessment should be knowledgeable about risk management and workshop facilitation.

Timing: Ideally, risk management is a dynamic process. The first risk assessment is carried out in the early stages of a project and is then repeated on a regular basis to continually update the risk identification. The execution of risk management is usually most intense during the construction phase of the project.

Information: A simple risk control measure identification workshop can be carried out with nothing more than paper and pencils. The workshop takes a three-step approach, in line with the methodology. First, the facilitator asks all of the participants to write down the risk control measures for several of the risks on the list. It is important to conduct this exercise before starting a group brainstorming to avoid the potential problems of tunnel vision and group think. The facilitator then collects the risk control measures. This is very similar to the risk identification workshop as described above.

Second, the group can discuss which control measures are considered most efficient. Third, implementation actions are added to each combination of risk and control measures. These actions include the person responsible for implementation, the timing of the control measure, and the status of the control measure. After the workshop is completed, the risk control measures and implementation variables are transferred into the risk register.

As discussed previously, it is also possible to use various software tools during the risk management workshop. These can be very useful for more elaborate risk management in large and/or highly complex projects. The tools come in either standardized versions, or may be customized for the project upon request of the customer.

After the timing and responsible people are added into this risk register-including all contact information-the risk register can serve as a tool to manage the implementation of risk mitigation measures.

Expertise: It is useful to include professionals with different types of expertise because it will lead to more variety in the control measures. The same rules for selection of participants apply as for the risk identification workshops discussed in chapter 3.

4.4 Output: Risk management updates of the risk register

The update of the risk register is the practical outcome of the risk management process. Each priority risk now includes information for the control measures.

When building the risk register, each control measure will ideally include:

  • Timing of control measure-this can be different from the timing of the risk
  • Responsible person(s) for executing the control measure
  • Where the control measure is implemented
  • Status of the control measure (none, planned, executed)

I-13: Each manageable risk is matched with one or more risk control measure.

The workshop results in identification of control measures for each risk. Those identified for Risks 14-21 are listed below.

  Risk Control measure
14 Toll authorization procedure delayed. Avoid risk by optimizing planning: start as early as possible with procedures to mitigate the effects of delays in procedures.
15 Governor decides to change scope because of local interests. Gain early agreement with local governments to prevent unexpected demands.
16 Costs increase because of rising oil prices. Buy a hedging product.
17 A concrete truck hits a construction worker. Preventive strategy: Prepare a construction traffic control safety plan and educate workers to reduce the likelihood of construction accidents.

Accept (remaining) risk and include a reserve for the insurance premium in project cost.
18 Vandalism during operational period. Preventive strategy: the highway is secured with measures to discourage vandalism.

Corrective strategy: clean up as soon as possible after vandalism incident. Include cleaning costs in project cost.
19 Leakage in building excavation for tunnel during construction. Preventive strategy: choose design and construction methods to avoid occurrence of leakage as much as possible.

Accept (remaining) risk and include a reserve for insurance premium in project cost.
20 Decision makers unavailable during election period. Preventive strategy: Risk is avoided by planning important decision-making meetings outside of the election period, optimizing planning.

Corrective strategy: Project team flexibility after occurrence to speed up the process to make up for lost time.

Accept (remaining) risk as an unavoidable delay in the project.
21 Uncertainty in cost estimates due to preliminary stage of design. Include an allowance in cost estimates, based on a probability analysis. Adjust this estimate as the design becomes more detailed.

Specific risk measures are also documented in plans, such as in the contract, financial model, project planning, and insurance policy. It is important to control and update the status of risks and add new risks as they arise. After the risk register is completed, it should be continually updated throughout the risk management process as the project progresses. In addition, management of the overall risk control strategy is facilitated by regular reports on the most prominent risks.

I-13: A review of the risk register is performed during the procurement process

The VfM assessment that was carried out by the team reveals that a P3 toll concession is the favorable option. Procurement is about to start. After intense discussions with an environmental group, an agreement is reached. The agreement provides that the group will abstain from any demonstrations on the construction site in return for including specific environmental mitigation measures that exceed the requirements in the environmental impact statement. This changes the risk register entry. In order to prepare the bidders with the latest risk register for the tender documents, the risk register is updated.

« PreviousNext »

back to top