8.2 Risk Identification & Assessment

Once the project's risk management framework is established, the Construction Manager (CM) must lead the systematic process of identifying and evaluating the specific uncertainties that could impact the project. This phase—Risk Identification and Assessment—serves as the analytical engine of the entire risk management lifecycle.

Risk Identification Techniques

Risk identification must be a collaborative, cross-functional effort. Relying on a single individual or a siloed team will lead to blind spots. Under CMAA guidelines, the CM facilitates workshops using several proven techniques:

1. Structured Brainstorming Workshops: These workshops gather the Owner, Architect, Engineer, General Contractor, and key trade subcontractors (e.g., MEP, excavation) to discuss potential project threats. The CM facilitates these sessions, encouraging open dialogue and leveraging collective historical experience.
2. The Delphi Technique: A method where a panel of independent experts responds to questionnaires and provides feedback anonymously. This prevents strong personalities from dominating the risk identification process.
3. Failure Modes and Effects Analysis (FMEA): A systematic technique for identifying potential design or process failures. FMEA evaluates the severity, probability of occurrence, and detectability of each failure mode to calculate a Risk Priority Number (RPN).
4. Document and Contract Reviews: A detailed examination of project documents (geotechnical reports, environmental impact statements, hazardous material surveys, and contract drawings). Ambiguities or contradictions in these documents are primary sources of risk.
5. Checklists and Historical Data: Utilizing data from previous similar projects to ensure that common risks (e.g., labor shortages, permitting delays, material lead times) are not overlooked.

The Risk Register

The output of the identification process is the Risk Register (or Risk Log). This is the central repository for tracking all project risks. Under CMAA standards, the Risk Register is a living document that must be updated regularly throughout the project lifecycle.

A comprehensive Risk Register contains the following elements:

• Risk ID: A unique alphanumeric identifier.
• Risk Description: A clear statement of the cause, event, and effect (e.g., "Due to winter weather, concrete pours may be delayed, causing a delay in the structural completion").
• Risk Category: Classification (e.g., Design, Construction, Financial, Environmental, External).
• Risk Owner: A named individual responsible for monitoring the risk and executing response actions.
• Probability (P) and Impact (I): Qualitative or quantitative scores.
• Mitigation Strategy: The selected response action.
• Status: Current state of the risk (e.g., Active, Mitigated, Retired, Realized).

Sample Risk Register Extract

Qualitative Risk Assessment (QRA)

Qualitative assessment is a subjective evaluation that ranks risks based on their likelihood of occurrence and the severity of their impact. This prioritization is crucial because project teams have limited resources and cannot mitigate every risk.

The primary tool for qualitative assessment is the Probability and Impact Matrix. Risks are assessed on a scale (typically 1 to 5 or Low to High). The Risk Score is calculated as: $\text{Risk Score} = \text{Probability} \times \text{Impact}$

Based on this score, risks are categorized into action zones:

• High-Risk Zone (Red): Requires immediate response planning, active mitigation, and frequent monitoring.
• Medium-Risk Zone (Yellow): Requires mitigation if budget allows; otherwise, they are placed on a watch list with defined triggers.
• Low-Risk Zone (Green): Monitored periodically to ensure their status does not change.

Quantitative Risk Assessment (QuRA)

For complex, high-value, or high-risk projects, CMAA recommends supplementing qualitative assessment with quantitative analysis. This applies numerical values to risk exposure, providing a data-driven basis for budgeting contingency and scheduling project duration.

1. Expected Monetary Value (EMV)

EMV is a statistical concept that calculates the average outcome of future scenarios. The formula is: $\text{EMV} = \text{Probability (\%)} \times \text{Financial Impact (\$)}$

By calculating the EMV of each identified risk and summing them, the CM can estimate the total cost contingency required to cover the project's risk exposure.

Step-by-Step EMV Calculation Example

Let's calculate the EMV for three key risks on a library project:

In this scenario, the calculated risk-based contingency required for these three risks is $65,000.

2. Monte Carlo Simulation

A Monte Carlo simulation is a computerized mathematical technique that allows the CM to account for risk in quantitative analysis and decision-making. The simulation runs the project schedule or cost model thousands of times using random inputs selected from probability distributions (e.g., triangular, beta, or normal distributions) for each task.

The output of a Monte Carlo simulation is a cumulative probability distribution curve (often called an S-curve). This S-curve shows the probability of completing the project at or below a certain cost or duration:

• P50 Value: The budget or schedule duration at which there is a 50% probability of success. This is typically too risky for most public owners.
• P75/P80 Value: The budget or duration with a 75% or 80% probability of success. CMAA guidelines often recommend targeting the P75 to P85 range for establishing the baseline budget and contingency.
• P90 Value: A conservative target with a 90% probability of success, indicating a low risk tolerance.

3. Sensitivity Analysis and Tornado Diagrams

Sensitivity analysis helps determine which risks have the most potential impact on the project. The CM holds all other variables constant and varies a single risk input to see its effect. The results are typically displayed in a Tornado Diagram, which ranks risks horizontally from the most critical (widest bar at the top) to the least critical (narrowest bar at the bottom). This visual tool shows at a glance where the CM must focus mitigation resources.