Monitoring and reporting risk, and capstone: a risk management plan

Risk management fails most often not in identification or analysis but in follow-through. A well-built register at the start of the project is worth little if nobody checks whether responses were carried out, whether new risks have appeared, or whether contingency is draining faster than risks are expiring. This final lesson covers how risks are monitored and reported during a project and across a contractor's business, and then brings the whole course together in a capstone: a risk management plan for the Kingfisher Wharf Community Centre.

What to monitor

Monitoring has three parts: tracking the risks already in the register, watching for new risks, and checking that the risk process itself is working. Each part has its own measures.

Triggers deserve attention because they turn monitoring from a monthly ritual into early warning. For the late dehumidifier risk at Kingfisher Wharf the triggers might be a missed factory test date or a request to change shipping method; for subcontractor default, slow payment of the subcontractor's own suppliers, reduced crews or requests for advance payment (CON-330 lesson 11). Assigning each trigger to someone who will actually see it, such as the expediter or the superintendent, is what makes it useful.

Risk dashboards and reports

Monthly risk reporting should be short, visual and focused on decisions. A one-page dashboard typically shows the heat map, the top risks with their owners and trends, the contingency position, overdue actions and any decisions needed from senior management or the owner.

# Monthly risk indicators for Kingfisher Wharf (illustrative)
months = ["M6", "M7", "M8", "M9", "M10"]
contingency_left = [1_180_000, 1_050_000, 910_000, 700_000, 640_000]
exposure_left   = [1_020_000,   960_000, 870_000, 760_000, 590_000]   # open EMV plus allowance for unknowns
actions_due     = [14, 16, 12, 15, 11]
actions_overdue = [ 1,  2,  2,  5,  3]
for m, c, e, d, o in zip(months, contingency_left, exposure_left, actions_due, actions_overdue):
    cover = c / e
    flag = "OK" if cover >= 1.1 else "WATCH" if cover >= 0.95 else "ACT"
    print(f"{m}: cover ratio {cover:4.2f} ({flag})   overdue actions {o / d:5.1%}")

M6: cover ratio 1.16 (OK)   overdue actions  7.1%
M7: cover ratio 1.09 (WATCH)   overdue actions 12.5%
M8: cover ratio 1.05 (WATCH)   overdue actions 16.7%
M9: cover ratio 0.92 (ACT)   overdue actions 33.3%
M10: cover ratio 1.08 (WATCH)   overdue actions 27.3%

A cover ratio, remaining contingency divided by remaining exposure, is a simple headline measure. Above about 1.1 the project has a cushion; near 1.0 it is tight; below 1.0 it is underfunded for the risks it knows about, before allowing for surprises. In the illustration, cover slipped to WATCH in months 7 and 8 and fell below 1.0 to ACT in month 9, with a third of due actions overdue at the same time, a combination that should prompt a focused review rather than waiting for the next monthly cycle.

Different audiences need different reports. Site teams need the actions and triggers. Project executives need the top risks, contingency and decisions. Owners need the risks they carry and any requests for time or money. Sureties and lenders need assurance that the contractor's projects are under control (CON-320 lesson 11). Insurers need loss prevention information, incident reports and prompt notice of potential claims. Tailoring the same underlying register to each audience avoids the common problem of reports that are too detailed for executives and too vague for site staff.

Enterprise risk for contractors

A contractor manages risk across its whole business as well as on each project. Enterprise risks include concentration of backlog in one client, sector or region; bonding capacity and working capital (CON-320); key people; safety performance, which affects insurance costs, prequalification and reputation (HSE-401); cyber and fraud (lesson 8); and claims exposure across all projects. A bid committee that reviews each major pursuit against the firm's risk appetite, and a quarterly enterprise risk review by senior management, connect project risk management to the health of the company.

Lessons learned

Every completed project is a source of data for the next one. A lessons-learned review compares the risks identified at the start with what actually happened: which risks occurred, what they cost, which responses worked, and which surprises were never in the register. Recording these results, especially the cost of occurred risks against their estimates, builds the reference data that improves future ranges and probabilities and counters optimism bias (lesson 1). Organizations that skip this step make the same mistakes on every project.

Capstone: a risk management plan for Kingfisher Wharf

The capstone brings the course together. Tallgrass Builders has just signed the $48 million stipulated price contract for the Kingfisher Wharf Community Centre. The schedule is 24 months, liquidated damages are $8,000 per day, and the city wants the building open for the summer festival. The base estimate before contingency is $46.2 million. You are preparing Tallgrass's risk management plan for the project. The sections below set out what the plan contains, using the analyses from earlier lessons.

Capstone: key analyses

The plan draws on numbers developed through the course. Bringing them together shows how the pieces fit.

# Capstone: top risks after responses, with residual exposure (illustrative)
risks = [  # (risk, probability before, impact before, response cost, probability after, impact after)
    ("Excavation flooding",            0.35, 480_000, 85_000, 0.35,  25_000),
    ("Late dehumidifiers",             0.35, 520_000, 18_000, 0.15, 400_000),
    ("Shoring subcontractor failure",  0.10, 900_000, 22_000, 0.10, 350_000),
    ("Pool tile rework",               0.20, 250_000, 12_000, 0.12, 200_000),
    ("Steel escalation over band",     0.40, 180_000,      0, 0.40,  65_000),
]
before = after = spend = 0
for name, p0, c0, cost, p1, c1 in risks:
    before += p0 * c0; after += p1 * c1; spend += cost
    print(f"{name:<30} EMV {p0 * c0:>9,.0f} -> {p1 * c1:>9,.0f}   response {cost:>7,}")
print(f"Total EMV before {before:,.0f}, after {after:,.0f}; response spend {spend:,}; net benefit {before - after - spend:,.0f}")

Excavation flooding            EMV   168,000 ->     8,750   response  85,000
Late dehumidifiers             EMV   182,000 ->    60,000   response  18,000
Shoring subcontractor failure  EMV    90,000 ->    35,000   response  22,000
Pool tile rework               EMV    50,000 ->    24,000   response  12,000
Steel escalation over band     EMV    72,000 ->    26,000   response       0
Total EMV before 562,000, after 153,750; response spend 137,000; net benefit 271,250

The table shows the value of the response plan: about $562,000 of expected loss reduced to about $154,000 for $137,000 of response spending, a net expected benefit of about $271,000 before counting the reduced chance of a large single loss. The remaining exposure is carried in contingency and monitored through the dashboard. The figures are illustrative, but the method is the one used on real projects.

Capstone: risks the owner carries

Tallgrass's plan also lists the risks the City of Larkspur carries under the contract, because Tallgrass must give notice and keep records to recover their cost. At Kingfisher Wharf these include contaminated soil (paid at the unit rate), concealed conditions beyond the site report (lesson 6), owner changes, late owner decisions on library fit-out, and permits the city committed to obtain. For each, the plan names the notice requirement, the person responsible for spotting the event and the cost code for tracking it. Sharing this part of the register with the city at the start-up meeting, and agreeing how such events will be handled, is a practical step toward avoiding disputes later.

Capstone: making the plan work

A plan earns its value through use. Tallgrass schedules a joint risk workshop with the city in the first month, reviews the top ten risks at every weekly site meeting, runs a full register review and dashboard monthly, updates the Monte Carlo model at enclosure and at the start of commissioning, and holds a lessons-learned review within two months of substantial completion. Each of these is a line in the schedule with an owner, not an aspiration. If the plan is followed, the project still will not be free of surprises, but the team will see most of them coming, will have money set aside for them, and will know who pays.