Risk affects every aspect of human life; we live with it every day and learn to manage its influence on our lives. In most cases this is done as an unstructured activity, based on common sense, relevant knowledge, experience and instinct.

Uncertainty affects all investments. However, uncertainty can often be considered in terms of probability provided sufficient information is known about the uncertainty. Probability is based on the occurrence of any event and thus must have an effect on the outcome of that event. The effect can be determined on the basis of the cause and description of an occurrence. For example, the cause, description and effect can be illustrated by the following:

Figure 2.1 illustrates the concept of risk in terms of uncertainty, probability, effect and outcome.

Figure 2.1 The concept of risk (Merna and Smith 1996) (Reproduced by permission of A. Merna)

According to Chapman and Ward (1997):

Risk and uncertainty are distinguished by both Bussey (1978) and Merrett and Sykes (1983) as:

In today’s business, nearly all decisions are taken purely on a financial consequences basis. Business leaders need to understand and know whether the returns on a project justify taking risks, and the extent of these consequences (losses) if the risks do materialise. Investors, on the other hand, need some indication of whether the returns on an investment meet their minimum returns if the investment is fully exposed to the risks identified. (Merna 2002) suggests:

Therefore identifying risks and quantifying them in relation to the returns of a project is important. By knowing the full extent of their gains and/or losses, business leaders and investors can then decide whether to sanction or cancel an investment or project.

The origin of the word ‘risk’ is thought to be either the Arabic word risq or the Latin word riscum (Kedar 1970). The Arabic risq signifies ‘anything that has been given to you [by God] and from which you draw profit’ and has connotations of a fortuitous and favourable outcome. The Latin riscum, however, originally referred to the challenge that a barrier reef presents to a sailor and clearly has connotations of an equally fortuitous but unfavourable event.

Figure 2.2 Typical risk parameters (Adapted from Allen 1995)

Models provide a backup for our unreliable intuition. A model can be thought of as having two roles:

Models provide a mechanism by which risks can be communicated through the system. A risk management system is a model, it provides a means for identification, classification and analysis and then a response to risk.

A common definition of risk – the likelihood of something undesirable happening in a given time – is conceptually simple but difficult to apply. It provides no clues to the overall context and how risks might be perceived. Most people think of risk in terms of three components: something bad happening, the chances of it happening, and the consequences if it does happen. These three components of risk can be used as the basis of a structure for risk assessment. Kaplan and Gerrick (1981) proposed a triplet for recording risks which includes a set of scenarios or similar occurrences (something bad happens), the probabilities that the occurrences take place (the chances something bad happens), and the consequence measures associated with the occurrences.

The severity or magnitude of consequences is measured by a value function that provides the common denominator. The severity can be measured in common units across all the dimensions of risk by translating the impact into a common unit of value. This can be a dimensionless unit such as the utility functions used in economics and decision analysis or some common economic term (Kolluru et al. 1996).

Risk and uncertainty as distinguished by both Bussey (1978) and Merrett and Sykes (1973) were discussed earlier in this chapter. The authors Vernon (1981) and Diekmann et al. (1988), however, consider that the terms risk and uncertainty may be used interchangeably but have somewhat different meanings, where risk refers to statistically predictable occurrences and uncertainty to an unknown of generally unpredictable variability.

Uncertainty is used to describe the situation when it is not possible to attach a probability to the likelihood of occurrence of an event. Uncertainty causes a rift between good decision and good outcome. The distinguishing factor between risk and uncertainty is that risk is taken to have quantifiable attributes, and a place in the calculus of probabilities, whereas uncertainty does not (Finkel 1990).

Smith et al. (2006) suggest that risks fall in to three categories: known risks, known unknowns and unknown unknowns.

A potential felon can deduce from this sign that there is a 3/7 chance of being confronted by the dogs, and possibly being mauleds and a 4/7 chance of success. Therefore there is a better chance of not being caught than being caught, however, without any data regarding the respective nights – you guess the nights.

Many of the above factors have been encountered in private finance initiative (PFI) types of investments where risk assessments are required to consider events over long operation periods once a project has been commissioned, in some cases 25 years or more. Rowe (1977) distinguished uncertainty within the decision-making process as descriptive uncertainty and measurement uncertainty. Descriptive uncertainties represent an absence of information and this prevents the full identification of the variables that explicitly define a system. As a result, the decision-maker is unable to describe fully the degrees of freedom of a system, for example problem identification and structuring, solution identification, degree of clarity in the specification of objectives and constraints.

Table 2.1 Risk-uncertainty continuum (Adapted from Rafferty 1994)

This definition highlights the one-off, change-inducing nature of projects, the need to organise a variety of resources under significant constraints, and the central role of objectives in project definition. It also suggests inherent uncertainty which requires attention as part of an effective project management process.

There are many sources of risk that an organisation must take into account before a decision is made. It is therefore important that these sources of risk are available, thus allowing the necessary identification, analysis and response to take place. Many of the sources of risk summarised in Table 2.2 occur at different times over an investment. Risks may be specific to the corporate level, such as political, financial and legal risks. At the strategic business level, economic, natural and market risks may need to be assessed before a project is sanctioned. Project risks may be specific to a project, such as technical, health and safety, operational and quality risks. At the project level, however, the project manager should be confident that risks associated with corporate and strategic business functions are fully assessed and managed. In many business cases risks assessed initially at corporate and strategic business levels have to be reassessed as the project progresses, since the risks may affect the ongoing project.

Table 2.2 Typical sources of risk to business from projects (Merna and Smith 1996)

The requirement is not only to manage the physical risks of the project, but also to make sure that other parties in the project manage their own risks. For example, the International Finance Corporation (IFC) division of the World Bank has a project team which travels round the locations in which the IFC has an interest and ensures not only that risks are controlled effectively, but that responsibilities are allocated and risks transferred by contract or insurance as appropriate. In this example the IFC would be similar to the corporate entity checking on its various projects undertaken by SBUs.

The most severe risks affecting projects are summarised by Thompson and Perry (1992) in project management terms as:

Many project management practitioners suggest the following influence the risk associated with projects:

In effect the larger the project the greater the risk. Increase in size usually means an increase in complexity, including the complexity of administration, management, communication amongst participants and so on; for example, inaccurate forecasts, late deliveries (supply chain), equipment break downs and the like.

Figure 2.3 Financial risk timeline

Global risks originate from sources external to the project environment and although they are usually predictable their effect on the outcome may not always be controllable within the elements of the project. The four major global risks are political, legal, commercial and environmental risks (Merna and Smith 1996). These types of risk are often referred to as uncontrollable risks since the corporate entity cannot control such risks even though there is a high probability of occurrence. Normally these risks are dealt with at corporate level and often determine whether a project will be sanctioned.

Elemental risks originate from sources within the project environment and are usually controllable within the elements of the project. The four main elemental risks are construction/manufacture, operational, financial and revenue risks (Merna and Smith 1996). These types of risk are usually considered as controllable risks and are often related to the different phases of a project and mainly assessed at SBU and project levels.

Many organisations have developed risk management mechanisms to deal with the overt and insurable risks associated with projects. In most cases risk identification, analysis and response are seen to be the most important elements to satisfy clients and other project stakeholders.

This relates only to potential losses where people are concerned with minimising losses by risk aversion (Flanagan and Norman 1993). A typical example would be the risk of losing markets for a particular product or brand of goods by not risking the introduction of new products or goods onto the same market. Many established organisations have tried to mitigate this risk by entering into joint ventures with more dynamic companies, often from booming economies.

This is concerned with maximising opportunities. Dynamic risk means that there will be potential gains as well as potential losses. For example, Marconi tried to gain by changing from a well-established market in the defence industry to new uncertain markets in the telecom industry. Dynamic risk is risking the loss of something certain for the gain of something uncertain. Every management decision has the element of dynamic risk governed only by the practical rules of risk taking. During a project, losses and gains resulting from risk can be plotted against each other and compared (Flanagan and Norman 1993).

The way in which risk is handled depends on the nature of the business and the way that business is organised internally. For example, energy companies are engaged in an inherently risky business – the threat of fire and explosion is always present, as is the risk of environmental impairment. Financial institutions on the other hand have an inherently lower risk of fire and explosion than an oil company, but they are exposed to different sorts of risk. However, the level of attention given to managing risk in an industry is as important as the actual risk inherent in the operations which necessarily must be performed in that industry activity. For example, until very recently repetitive strain injury (RSI) was not considered to be a problem, but it is now affecting employers’ liability insurance (International Journal of Project and Business Risk Management 1998).

Figure 2.4 The effective bid process

This occurs when an organisation is affected directly by an event in an area beyond its direct control but on which it has a dependency, such as weak suppliers (International Journal of Project and Business Risk Management 1998). Normally a percentage of the overall project value is put aside to cover costs of meeting such risks should they occur.

The risk envelope can be used by clients to identify worst case scenarios and help in realising a realistic budget. The cost of managing each risk identified by bidders can be compared by the client in a similar way to that for other items identified in the bid such as the cost of concrete, falsework, excavation and the like. Hussain (2005) suggests that the risk envelope should form an essential part of the bid award process.

Dependency on one client creates vulnerability because that client can take its business away, or be taken over by a rival. The risk can be managed by creating a larger customer base (International Journal of Project and Business Risk Management 1998).

Only by keeping abreast of potential changes in the environment can a business expect to manage these risks. Recent examples in the UK include awards to women for discrimination in the armed forces, RSI and windfall profits tax in exceptional years (International Journal of Project Business Risk Management 1998). In October 2001, Railtrack Plc, a company listed on the London Stock Exchange, was put into administration by the UK Transport Secretary without any consultation with its lenders or shareholders. Shareholders taking the usual risks of rises and falls in stock market value were quickly made aware of this risk.

Purchasing risk is a vital part of modern commercial reality but recently the subject has gained prominence in the work of leading academics and management theoreticians. Many businesses are designing and implementing new performance measurement systems and finding a particular challenge in developing measures for some key elements of purchasing contribution which are now regarded as strategic but which have not been historically analysed and measured in any serious way. The area of commercial risk is a prominent example of such a challenge. In the past, effective risk management has been cited as one of the key contributions that effective purchasing can make to a business, but its treatment has been largely a negative one; the emphasis has been on ensuring minimum standards from suppliers to ensure a contract would not be frustrated. The issues now being addressed by leading-edge practitioners in the risk area are much broader and are perhaps more correctly identified using terminology such as management of uncertainty (International Journal of Project Business Risk Management 1998).

This is not a risk in its own right but rather the consequence of another risk, such as fraud, a building destroyed, failure to attend to complaints, lack of respect for others. It is the absence of control which causes much of the damage rather than the event itself. In a post-disaster situation a company can come out positively if the media are well handled (International Journal of Project Business Risk Management 1998).

A poor infrastructure can result in weak controls and poor communications with a variety of impacts on the business. Good commu-nication links will lead to effective risk management. This can only be performed if members of teams and departments are fully aware of their responsibilities and reporting hierarchy, especially between different organisational levels.

This occurs where management and staff in the same organisation cannot communicate effectively because of their own professional language (jargon). Engineers, academics, chemists and bankers all have their own terms, and insurers are probably the worst culprits, using words with common meanings but in a specialised way. Even the same words in the same profession can have different meanings in the UK and the USA.

The IT industry is one of the fastest growing industries at present. Huge amounts of money continue to be invested in the IT industry. Owing to pressures to maintain a competitive edge in a dynamic environment, an organisation’s success depends on effectively developing and adopting IT. IT projects, however, still suffer high failure rates (Ellis et al. 2002).

OPEC was founded at the Baghdad Conference on September 1960, by Iran, Iraq, Kuwait, Saudi Arabia and Venezuela. The five founding members were later joined by nine other members: Qatar, Indonesia, Socialist Peoples Libyan Arab Jamahiriya, United Arab Emirates, Algeria, Nigeria, Ecuador, Gabon and Angola. OPEC’s member countries hold about two-thirds of the world’s oil reserves. In 2005, OPEC accounted for c. 41.75% of the world’s oil production, compared with 23.8% by Organisation for Economic Co-operation and Development (OECD) members and 14.8% by the former Soviet Union. OPEC member countries have, on a number of occasions, tried to adjust their crude oil supplies to improve the balance between supply and demand. OPEC’s mission is to coordinate and unify the petroleum policies of member countries and ensure stabilisation of oil prices. OPEC has, however, had mixed success at controlling prices.

This arises from the project management process itself. Process risks arise when the fundamental requirements for running a project are established. The management and decision-making process for operating the project, including the communication methods and documentation standards to be adopted, will also be areas of risk.

Regardless of the industry, type of organisation or style of management, the control of risks associated with human factors will affect project and portfolio success. The human contribution to project success, or failure, encompasses the actions of all those involved in the planning, design and implementation of a project. Obviously there is potential for human failure at each stage of the project life cycle. Managing the risks associated with human failure remains a challenge for successful project management.

The purpose of decommissioning is often to return a former operational plant back to brown- or greenfield site status. Over the course of operations, many industries (mining, quarrying, chemical industries, nuclear) have to plan for the end of lifetime costs for their plants, whether dismantling or reconditioning the sites. These characteristics of the project have financial consequences in regard to cost estimating and financing, for which there does not exist one single answer to date, and thus by definition creates risk. In today’s economic climate it is essential that these risks are taken into account before a project is sanctioned.

The term ‘institutional’ is used to summarise risks caused by organisational structure and behaviour. These risks occur in organisations and state bodies and affect projects both large and small (Kahkonen and Artto 1997). Typically dogma, beauracracy, culture and poor practice can lead to increased risks, usually pure risks.

The extent to which a person feels threatened by a particular risk, regardless of the probability of the risk occurring, is subjective risk. Subjective risk may, amongst other things, be affected by an individual’s personal level of risk aversion or risk preference. The severity of the consequences of the individual should the risk occur, the psychological factors and familiarity of the risk will all contribute to subjective risk.

Pure risks are those risks which only offer the probability of loss and not profit. Pure risks only present the possibility of undesirable consequences. The majority of pure risks, but not all pure risks, can be insured against.

Fundamental risks are risks such as natural disasters that affect whole or significant proportions of society which organisations and individuals have little or no control over. Management of these risks often only permits reducing the effects of such risks.

These are actions taken that may themselves generate further risks. An example would be increasing car security systems for unoccupied cars which may result in car jacking as a consequence of mitigating the risk of theft. Basically the consequences of managing a risk can lead to further risks that may have a greater impact than the initial risk.

The authors define destructive technology as the possibility of new advanced technology completely taking over the old technology, which would make the old technology become prematurely obsolete. There are now more ‘destructive technologies’ around than at anytime in the past 10 years, especially in industries associated with IT and electronic development. The authors believe that destructive technologies present great threats to established businesses but can also create rewarding new opportunities.

A contract may provide liability to be excluded for any disruption to business continuity because something abnormal and unforeseeable by the parties to the contract is beyond their control. This is known as force majeure.

No party shall be liable for any failure to perform its obligations where such failure is as a result of acts of nature (including flood, fire, earthquake, storm, hurricane or other natural disaster), war, invasion, act of foreign enemies, hostilities (whether war is declared or not), civil war, rebellion, revolution, insurrection, military or usurped power or confiscation, terrorist activities, nationalisation, government sanction, blockage, embargo, labour dispute, strike, lockout or interruption or failure of electricity or telephone service and no other party will have the right to terminate this agreement under a certain termination clause.

Events of force majeure shall mean and be limited to the circumstances set forth in Contract article relating to events of force majeure but only if and to the extent that:

Subject to the provisions of contract article relating to events of force majeure shall mean the following:

According to MacCrimmon and Wehrung (1986), different people will respond to seemingly similar risky situations in very different ways. Furthermore they state that there is no reason to believe that a person who takes risks in one specific situation will necessarily take risks in all situations: a trapeze performer (characterised as a risk taker) might not be cautious in financial matters, whereas a commodity broker (also characterised as a risk taker) might not be physically cautious. Although there is no standard way to assess a person’s willingness to take risks, the general classification of managers into categories such as risk taking, risk neutral and risk averse can often be made.

All investments have stakeholders, whether internal or external to an investment. It is important that all stakeholders are aware of the potential risks that could occur over an investment’s life. Shareholders, for example, who provide funds in the form of equity should be made aware of the risks a corporation is taking on their behalf.

It is therefore important to include external stakeholders who often have an adverse impact on a project, for example environmentalist groups and conservationists.

Table 2.3 Internal and external stakeholders (Adapted from Winch 2002)

At the individual level, identification of the people or groups who influence an investment or project process or its outcome is crucial. It begins the process of eliciting information about the potential contribution to the business risks during and beyond the investment’s life cycle and is the first step in dealing with human factors in risk management. Key information will be gained concerning stakeholders’ abilities, perceptions, values and motivation. However, even in today’s risk business environment project managers are only aware of a minority of stakeholders within a project and dismiss many of those which are external as unimportant and beyond their control. Therefore, many ‘contributors’ to the project and the risks they import may not be covered by the risk analysis process.

The stakeholders’ perspectives are of particular importance to risk management as they concern the way each stakeholder ‘sees’ and interprets, for example, the project, its objectives, other stakeholders, potential gains and losses, and the relationship with the investment or project. Diverse perspectives and perceptions of the stakeholders concerning their tasks, roles and objectives have been recognised as important factors in risk (Sawacha and Langford 1984, Pidgion et al. 1992, Pinkley and Northcroft 1994).

How risk is defined determines the response of an individual stakeholder to risk. Risk is often conceptualised as a hazard, a breakdown, or a failure to deliver to time and budget, rather than in wider terms of uncertainty about precise outcomes of planned actions and project processes (March and Shapira 1992). As with other stakeholders, what managers consider as risk depends, amongst other factors, on their perceptions, which may be based on flawed notions of control. Many key risk elements may be excluded from the risk management plan if they are not viewed as risks but as routine tasks for management. Areas of ambiguity cause psychological discomfort for project managers and encourage them to avoid in-depth exploration of the problem, preferring instead to focus on more tangible areas of management tasks. Cultural factors also contribute to misconceptions and misunderstanding (Hugenholtz 1992). Individual stakeholder perspectives can be regarded as ‘lenses’ through which issues are assessed (Pinkley and Northcroft 1994). Perceptions of stakeholders are largely social and subjective processes, which cannot be easily reduced to elements of mathematical models of risk (Pidgion et al. 1992). The stress placed on quantification processes, such as quantitative risk analysis, often fails to prompt a manager to take account of other areas that are more difficult or impossible to quantify. Thus a large element of potential risk is excluded and may even go unrecognised.

Risk is an unavoidable feature of human existence and over time humans have developed procedures for survival in a constantly changing environment. The same philosophy is seen to form modern risk management practices.