Risk register and contingency

By week nine of the capstone, the team's shared folder held a file called 'worries.txt'. Everyone added to it: Owen's note about rock in the deepest sump, Tomas's doubts about the overhead door lead time, Aaliyah's concern about winter masonry, Farah's question about what happened if the alerting vendor and the exhaust vendor blamed each other. Ruth read it and laughed. 'This is the most honest document you have written,' she said. 'Now turn it into a risk register, decide what you will do about each line, and tell me how much money and time you need to hold back.'

This lesson covers the eleventh deliverable: the risk register and contingency. It draws on risk management, insurance and bonding (CON-350) and on changes, claims and dispute resolution (CON-420). A capstone risk chapter should show that the team has identified the real risks of its project, assessed them sensibly, decided how to respond to each, and set cost and time contingencies with reasons that a reviewer can follow.

Identifying risks

A risk is an uncertain event or condition that, if it happens, affects the project's objectives. Most risks are threats, but some are opportunities. Risks are best identified by several people working together, using several sources: the contract, the scope statement and assumptions log from lesson 2, the procurement schedule from lesson 3, the takeoff's uncertain quantities from lesson 4, the schedule's critical path from lesson 6, the hazard assessment from lesson 9 and the company's lessons learned from past projects.

The Tamarack team held a two-hour risk workshop with Ruth, Marcel and Tamarack's chief estimator. They used a simple prompt list to make sure no category was missed.

A well-written risk has three parts: a cause, the uncertain event and its effect. 'Steel' is not a risk. 'Because the steel subcontract is priced with a mill escalation clause, steel prices may rise before the mill order is placed, increasing the subcontract price' is a risk that someone can assess and act on. The team rewrote every line of the worries file in that form.

Who carries the risk?

Before assessing a risk, the team asked who would carry it under the contract. This step is often missed in capstone plans, and it changes the answer completely. Rock in excavations, for example, was a concealed condition. Under the contract's concealed conditions clause and the unit price in the bid form, rock would be paid for by the town, provided Tamarack gave prompt notice. Rock therefore left Tamarack's cost risk register and went onto a list of owner risks to be managed, with a note to record quantities carefully. Groundwater and wet excavation, on the other hand, were shown in the geotechnical report and were Tamarack's to deal with. Getting this right stopped the team from double-counting risks the owner already carried, and from overlooking risks it had assumed someone else would carry.

Qualitative assessment

The first assessment is qualitative. Each risk is rated for probability and impact on a simple scale, often one to five, and the product gives a score that ranks the risks. A probability-impact matrix shows the whole register at a glance and draws attention to the top-right corner, where likely and serious risks sit.

Qualitative scores are quick and useful for ranking, but they cannot be added up to give a contingency. For that, risks with cost or time effects need numbers.

Responding to risks

Every significant risk needs a response and an owner. There are four basic responses to threats. Avoid the risk by changing the plan so it cannot happen. Transfer it to someone better able to carry it, through a subcontract, insurance or a bond. Mitigate it by reducing its probability or impact. Or accept it, with or without a contingency. Opportunities have matching responses: exploit, share, enhance or accept.

Insurance and bonds are transfer tools, but each has limits. Builder's risk insurance covers physical loss or damage to the work, such as fire or storm, subject to its deductible and exclusions. It does not cover delay costs unless specifically added, and it never covers poor workmanship. Subcontractor performance bonds help when a subcontractor defaults, but claims take time, and the general contractor must still keep the job moving. The plan therefore treated transfer as one layer of protection, not as a reason to stop managing the risk.

Quantitative analysis and Monte Carlo simulation

For the risks Tamarack carried, the team estimated a probability and a range of cost impacts: a low, most likely and high value. Multiplying probability by the average impact gives each risk's expected value, and adding them gives the expected value of the register. But the expected value hides the spread. Some years nothing goes wrong; occasionally several things go wrong at once. Monte Carlo simulation shows the spread by running the risks thousands of times, each time drawing whether each risk happens and, if it does, how much it costs.

# Monte Carlo of the Pembrook risk register: cost contingency at P50 and P80
import random
rng = random.Random(499)          # fixed seed so the results repeat
risks = [  # name, probability, (low, most likely, high) cost in $000
    ('Wet excavation and dewatering', 0.30, (60, 150, 400)),
    ('Steel price escalation', 0.40, (40, 110, 260)),
    ('Overhead door lead time slips', 0.35, (20, 60, 150)),
    ('Utility connection delay', 0.25, (30, 80, 220)),
    ('Winter heat beyond the allowance', 0.50, (40, 90, 180)),
    ('Station alerting integration issues', 0.20, (20, 50, 140)),
    ('Subcontractor default', 0.10, (100, 250, 600)),
]
expected = sum(p * (lo + ml + hi) / 3 for _, p, (lo, ml, hi) in risks)
runs = 20000
totals = []
for _ in range(runs):
    t = 0.0
    for _, p, (lo, ml, hi) in risks:
        if rng.random() < p:
            t += rng.triangular(lo, hi, ml)
    totals.append(t)
totals.sort()
p50, p80, p90 = (totals[int(runs * q)] for q in (0.50, 0.80, 0.90))
print(f'Expected value of risks: ${expected:,.0f}k')
print(f'P50 ${p50:,.0f}k   P80 ${p80:,.0f}k   P90 ${p90:,.0f}k')
print(f'Chance that no risk occurs: {sum(1 for t in totals if t == 0) / runs:.1%}')
print(f'P80 contingency as a share of the $13,812k bid: {p80 / 13812:.1%}')

Expected value of risks: $267k
P50 $236k   P80 $409k   P90 $515k
Chance that no risk occurs: 7.4%
P80 contingency as a share of the $13,812k bid: 3.0%

The simulation gave an expected value of about $267,000, a median (P50) of about $236,000 and a P80 of about $409,000: an 80 % chance that the risks would cost no more than that. The pricing contingency in the bid was $314,300, which the simulation suggested would be enough about two times in three. Ruth had to choose: raise the bid's contingency to the P80 and risk losing the job on price, or keep it and accept a one-in-three chance of using part of the fee to cover risk costs.

She kept the bid contingency and made two other decisions. Buyout savings, as lesson 7 described, would go into contingency until the steel and envelope were complete. And the project team would report the remaining risk exposure against remaining contingency every month, so that management would see early if the gap was growing. The capstone plan recorded the decision and the reasons. A reviewer does not need to agree with a decision of this kind, but should be able to see that it was made knowingly.

Time contingency and schedule risk

Cost is only half of the picture. Several of Pembrook's risks affected time: door lead times, utility delays, winter weather. Lesson 6 left four weeks of visible time contingency at the end of the 56-week plan. The team checked whether that was enough by estimating, for each schedule risk, how many weeks it could delay the critical path and how likely it was. The overhead door risk, for example, could delay commissioning by up to four weeks, because the doors had to be tested with the alerting system. But the doors had 22 weeks of float in the base network, so a late delivery would delay the project only if it ran past that float, which was unlikely. The serious time risks were those on the critical path: steel delivery, roofing in a wet autumn and the generator for permanent power.

Liquidated damages make time risk easy to price: each week of delay past the contract date costs $17,500 in damages, plus about $11,000 a week in extended general conditions. A week of schedule contingency is therefore worth about $28,500 to Tamarack, a useful number when deciding whether to spend money on acceleration or mitigation.

Keeping the register alive

A risk register written for a proposal and never opened again has no value. The plan set out a monthly risk review, chaired by the project manager, at which each risk owner reported on their risks, closed those that had passed, added new ones and updated the remaining exposure. The register would also be reviewed at key points: buyout, the start of steel, building enclosed and before commissioning. Lessons learned at closeout would feed Tamarack's prompt list for the next project.

Your capstone deliverable

• A risk register with cause-event-effect descriptions, categories and owners.
• A risk allocation review showing who carries each risk under the contract.
• A probability-impact matrix ranking the risks.
• Responses for every significant risk, including the limits of insurance and bonds.
• A quantitative analysis of cost risks, such as a seeded Monte Carlo simulation, and the cost contingency you recommend.
• A time contingency linked to the schedule's critical-path risks, and a plan for monthly risk reviews.