Probably the first insurance against misfortune was within a policy to cover the loss of cargo by shipwreck that had its origin in the Hummurabi Code. In the framework of that code the ship owner could obtain a loan to finance the freight, but it was not necessary to pay back the loan if the ship was wrecked.

The eighteenth century saw the rise of insurance companies as we currently know them. In 1752 Benjamin Franklin founded, in the USA, a fire insurance company called First American. The Society of Lloyd’s in London was established in 1771 when several English businessmen combined their resources to insure potential losses of their clients involved in sea transportation, now known as marine insurance.

The twentieth century witnessed the development of probability in ‘management science’ and the birth of formal risk management. This method was further developed by Chapman (1998) and applied by Chapman and others (Jia and Jobbling 1998).

Project risk management developed rapidly throughout the 1970s, firstly in relation to quantitative assessment and then to methodologies and processes. At the end of the decade project management academics and professionals saw the need for a project management function devoted to risk analysis and management, and several authors published papers on the subject.

The main project risk management applications were essentially focused on time and cost objectives, and also on project evaluation (feasibility). Software using probability distributions to analyse cost and time risk was frequently used on large projects. Significant use of risk analysis and management was made on large process plant projects. Companies like BP and Norwegian Petroleum Consultants pioneered project risk management methods in that decade, in both the development and application of risk management methodology and of risk analysis techniques. BP developed the CATRAP (Cost and Time Risk Analysis Program) software for internal use. It allowed risk modelling with several subjective probability distributions and was used on offshore oil platform projects in the North Sea. Norwegian Petroleum Consultants developed NPC for the same types of project. NPC, like CATRAP, allowed risk quantification and modelling using subjective probability distributions. It also had the capacity to calculate objective distributions from real-life cost and time data and included the ability to combine subjective and objective distributions. NPC was also able to integrate cost and time risk in its modelling. In the late 1980s CASPAR (Computer-Aided Software for Project Risk Appraisal) was further developed at UMIST to provide risk analysis outputs for businesses as well as projects (Jia and Jobbling 1998).

The use of methods based on risk and response diagrams began in the 1980s. These methods are based on the notion that it is not possible to model a risk situation realistically without taking into account the possible responses. There are four reasons why risk response should be considered as part of risk analysis:

The end of the 1980s was also the starting point for the use of influence diagrams combined with probability theory and for the first applications of systems dynamics. These techniques have been developed to a higher level and today there is commercial software available for both methods.

Some important principles established in the 1980s in relation to the contractual allocation of risk have continued in the 1990s. The foundations of partnering and ‘alliancing’ strategies have been laid to avoid traditional contractual rivalry and promote a risk and reward sharing approach, particularly in the case of capital projects.

It is important to note that there has been a shift from a concentration on quantitative risk analysis to the current emphasis on understanding and improving risk management processes. Whereas in the 1980s project risk management software was used as an analysis tool, today the trend is to use risk quantification and modelling as a tool to promote communication and response planning teamwork rather than simply for analysis (capture and response). Currently risk quantification and modelling techniques are seen as a way to increase both insight and knowledge about a project and as a way to communicate that information to the project team members and interested parties (stakeholders).

The period since 1990 has seen a variety of proposals for risk management processes, all of which include a prescriptive approach, such as:

Historically, many organisations have looked at risk management in a somewhat fragmented way. However, for a growing number of organisations, this no longer makes sense and they are adopting a much more holistic approach. For example, organisations at the forefront of risk management now have risk committees, which are often chaired by a main board member or a risk facilitator and which have overall responsibility for risk management across their organisation. The point is that a fragmented approach no longer works. In addition, risk management has clearly moved up the agenda for the board or management committee.

Risk management continues to evolve in many ways:

Meulbroek (2002) identifies that the goal of risk management is to:

Handy (1999) summarises risk management as:

Smith (1995) states that risk management is an essential part of the project and business planning cycle which:

According to Smith (1995), the process of risk management involves:

Risk analysis and risk management have been carried out in many fields for a number of decades and are being increasingly used as integral parts of the overall business management approach and on most major projects; in some cases they have become a mandatory requirement for financial planning and regulatory approval. Many client organisations now require contractors to identify potential risks in an investment and to state how these risks would be managed should they occur.

Despite risk analysis being a growing element of major projects, there is no standard to which reference may be made for techniques, factors and approaches. To overcome this a number of organisations and research authorities have identified ways to describe the risk management process. Typically there are a number of phases associated with this process. Merna (2002) took three processes, namely risk identification, analysis and response, and implemented a 15-step sequence to account for risk management. However, four processes had been identified by Boswick’s 1987 paper (PMBOK 1996), Eloff et al. (1995) and the British Standard BS 8444 (BSI, 1996). The Project Management Institute’s (PMIs) Guide to the Project Management Body of Knowledge (PMBOK 1996) also identifies four processes associated with project risk management.

Chapman and Ward (1997) believe that there are eight phases in the risk management process. Each phase is associated with broadly defined deliverables (may be targets not achieved initially), and each deliverable is discussed in terms of its purpose and the tasks required to produce it. Below is a summary of these phases and deliverable structures:

For the purpose of outlining the risk management process, the PMBOK (1996) system has been used to give a brief description of the necessary processes, namely:

The identification of risks using both historical and current information is a necessary step in the early stage of project appraisal and should occur before detailed analysis and allocation of risks can take place. It is also essential for risk analysis to be performed on a regular basis throughout all stages of the project. Risk identification should be carried out in a similar manner at both corporate and strategic business levels.

Figure 3.1 illustrates the risk identification process with its outputs leading to the inputs in Figure 3.2 for risk analysis. The outputs of Figure 3.2 are then input into Figure 3.3 for risk response.

The major output from risk quantification and analysis is a list of opportunities that should be pursued and threats that require attention. The risk quantification and analysis process should also document the sources of risk and risk events that the management team has consciously decided to accept or ignore, as well as the individual who made the decision to do so.

Dawson et al. (1995) believe that objectives in risk management are an important part of risk analysis. The purpose of risk management is to determine the balance which exists between risk and opportunities in order to assist management responses to tilt the balance in favour of the opportunities and away from risks. These risks and opportunities might appear different when viewed from a company perspective as opposed to the more usual ‘project’ perspective. The identification of risks and opportunities for a project should be based on the objectives for undertaking the venture, and for a company should be based on the objectives of the company. These two sets of objectives are different but inextricably linked; the objectives of a company might include, in the short term, more experience in a particular type of work, whilst the risks to a project enabling this to happen might be seen to affect the profitability of the project and the esteem in which the manager is held. Hence, in order to perform risk management the objectives must be clearly defined at each level of an organisation.

There are mainly two types of methods used in the risk quantification and analysis process. These are qualitative risk analysis and quantitative risk analysis.

Qualitative risk analysis consists of compiling a list of risks and a description of their likely outcomes. Qualitative risk analysis involves evaluations that do not result in a numerical value. Instead, this analysis describes the nature of the risk and helps to improve the understanding of the risk. In this way, analysts are able to concentrate their time and efforts on areas that are most sensitive to the risk.

Quantitative risk analysis often involves the use of computer models employing statistical data to conduct risk analysis. Qualitative and quantitative techniques are discussed in Chapter 4.

Figure 3.2 illustrates the risk quantification and analysis process.

Al-Bahar and Crandell (1990) illustrate the latter avoidance option with the example of a contractor wishing to avoid the potential liability losses associated with asbestos, and so never acquiring any project that involves operations with this material. The same scenario, but this time considered from the client’s perspective, also lends itself as an example of eliminating a source of risk within a project if the risk is avoided by redesigning the facility so that it uses an alternative material to asbestos.

The example of the time frame in a construction contract can illustrate this. The party with the greatest control over the completion date is the contractor and, as such, is in the best position to manage this risk. The client stands to lose revenue if the facility is not built by a certain date and, to mitigate any such loss, includes a liquidated damages clause in the contract so that, if construction overruns this date, the contractor compensates the client for the loss. The contractor will consider this risk in its tender and can expect that the contract price will be higher than it would be in the absence of the clause; that is, the transferee imposes a premium on accepting the risk. However, if the revenue loss is likely to be too great for the contractor to compensate for, there is little sense in transferring the risk in this way.

Insurance is a popular technique for risk transfer in which only the potential financial consequences of a risk are transferred and not the responsibility for managing the risk.

Financial markets provide numerous instruments for risk transfer in the form of ‘hedging’. This is best illustrated by way of example: the fluctuation in the price of an input may be ‘hedged’ through the purchase of futures options so that in the event of a future price rise, the (lower than current market value) options soften the effect. Consequently, the benefits of a price decrease are lessened by the cost of the futures options. Options, futures, futures options, swaps, caps, collars and floors are only some of the instruments available to cover such risk.

Basically, risk transfer is the process of transferring risk to another participant in the project. Transferring risk does not eliminate or reduce the criticality of the risk, but merely leaves it for others to bear the risk. Flanagan and Norman (1993) state:

In the case of planned risk retention, this involves the complete or partial assumption of the potential impact of a risk. As suggested above, a relationship between risk and return exists such that, with no risk exposure, an enterprise cannot expect reward. Ideally, retained risk should be that with which the organisation’s core value-adding activities are associated (risk which the organisation is most able to manage) as well as those risks which may be dealt with more costeffectively by the organisation than external entities (since risk transfer and avoidance must necessarily come at a premium). Finally, risk reduction may only be cost effective up to a point, thereafter becoming more costly than beneficial.

Chapman (1998) also addresses the issue of the application of a risk management process earlier or later in the project life cycle. He suggests that while earlier implementation will yield greater benefits, the lack of a project definition at this stage will make implementing a risk management process more difficult, less quantitative, less formal, less tactical and more strategic. Conversely, at a stage of more accurate project definition, where implementation is easier, it is less beneficial.

In light of the above, this initial implementation of the risk management process should not only facilitate appraisal decision making, but also be seen as the first cycle of the risk management process within the project life cycle.

Chapman and Ward ( 1997) believe risk management has the following benefits:

The potential benefits of implementing risk management can be categorised into two types:

These are listed in Table 3.1.

Table 3.2 illustrates the differing views of academics and practising managers with respect to risk and risk management. Typically risk has been considered as a threat to industry whereas the academic view is that risk can have both threats and opportunities and should be considered in greater detail from which strategies can be developed and risk management constantly applied.

Any organisation that is complacent about managing the significant risks it faces will surely fail. The Turnbull Report (1999) is a reminder of this and is also an opportunity to review what an organisation has in place and to make the appropriate changes. Risk management can be considered as the sustainability of a business within its particular environment. In the past large corporate failures have occurred because risk assessment has been wrong or never even considered. Reichmann (1999) states:

To manage risk effectively organisations need to have prevention and response strategies in place. Prevention strategies are there to help organisations understand the significant risks that they may face and to manage these risks down to acceptable levels. Response strategies need to be developed to enable organisations to respond, despite their efforts, to any risks that do crystallise, so as to reduce their impact as far as possible.

The Turnbull Report is not just about avoidance of risk. It is about effective risk management: determining the appropriate level of risk, being conscious of the risks you are taking and then deciding how you need to manage them. Risk is both positive and negative in nature. Effective risk management is as much about looking to make sure that you are not missing opportunities as it is about ensuring that you are not taking inappropriate risks. Some companies will seek to be more risk averse than others. However, all should be seeking to achieve a balance between encouraging entrepreneurialism within their business and managing risks effectively.

In order for a company to be able to identify what risks it is taking and those it is not prepared to take, it must first identify its long-term objectives. Some companies have been much better than others in identifying in a concise but operational way what their business is about. Having identified their objectives, companies should not seek to identify, say, 1001 risks. Boards of directors at both corporate and strategic business levels should focus on what they believe to be their main business risks. The authors believe a reasonable number to manage and concern yourself about is 15-25. These risks will depend on the industry and the particular circumstances of the company and its projects at any given time.

When assessing the risks an organisation faces it is important to have the full support of the relevant board and that they appreciate the importance and understand the benefits of risk management. The board should receive regular reports from management so that they are fully conversant with the risks identified and those which appear as more information becomes more apparent. There is a danger that if risk is not addressed in a holistic manner by the board, larger risks which are hard to define, such as corporate reputation, will not be properly addressed. They may be partially considered in each of the organisation’s decisions, but gaps will be left, or they may not be addressed at all. Recent evidence (Merna 2002) shows that in the past some companies viewed risk management in too narrow a way. Then risk management simply meant ‘insurance’. However, companies should stop and ask themselves:

The authors suggest that there are a number of benefits to project professionals of building a simple decision-making support package and integrating risk assessment into the frameworks or standards they need to adhere to in their respective industries, which include:

This chapter has discussed risk management, not only at the project level but at corporate and SBU levels. To ensure that risks are assessed effectively at all these levels it is paramount that a risk management process is developed so that all stakeholders are made aware of the risks associated with an investment.