8.3 Risk Response & Mitigation Planning

Identifying and prioritizing risks is meaningless without actionable strategies to address them. Risk Response Planning is the process of developing options and determining actions to enhance opportunities and reduce threats to the project’s objectives. The Construction Manager plays a key role in guiding the team to select the most appropriate and cost-effective response for each identified risk.

The Four Threat Response Strategies

For negative risks (threats), the CM must guide the team in selecting the most cost-effective and appropriate strategy. The four primary strategies are Avoid, Transfer, Mitigate, and Accept.

1. Avoidance (Eliminate the Risk)

Risk avoidance involves changing the project plan to eliminate the threat entirely or to protect the project objectives from its impact. This is a highly effective strategy, but it often requires altering the project scope, schedule, or design.

• Example in Construction: An environmental assessment reveals that a planned road alignment passes through a nesting ground for an endangered bird species. To avoid regulatory fines and lengthy construction shutdowns, the design team shifts the road alignment by 500 feet. While the redesign incurs additional engineering fees, the risk of project stoppage is completely eliminated.
• Example in CMAA: Selecting a standard, widely used mechanical HVAC system instead of a cutting-edge, unproven geothermal system to eliminate the risk of performance failure and warranty disputes.

2. Transfer (Shift the Financial Burden)

Risk transfer involves shifting the financial consequences of a risk, along with the responsibility for its response, to a third party. It is important to note that transfer does not eliminate the risk; it simply shifts the liability. This strategy almost always involves paying a premium to the party assuming the risk.

• Example in Construction: The Owner requires the General Contractor to secure a Performance Bond and a Payment Bond. If the contractor defaults, the financial burden of completing the work and paying subcontractors is transferred to the Surety company.
• Example in CMAA: Utilizing contract clauses such as Indemnification (where one party agrees to hold another harmless against losses) or purchasing Builder's Risk Insurance to transfer the risk of fire or storm damage to an insurance company. The CM must ensure that the contract allocates the risk to the party best positioned to manage it.

3. Mitigation (Reduce Probability or Impact)

Risk mitigation involves taking proactive, early actions to reduce the probability of a risk occurring and/or the severity of its impact on the project. Mitigation is the most common strategy for risks that cannot be avoided or transferred.

• Example in Construction: To mitigate the risk of falling from heights—a primary OSHA "Focus Four" hazard—the contractor implements a mandatory 100% tie-off policy for workers above six feet, conducts daily safety stand-downs, and installs perimeter safety netting. This reduces the probability of a fall and mitigates the physical impact if one occurs.
• Example in CMAA: The CM recommends conducting supplementary geotechnical soil borings (reducing probability of unforeseen conditions) and pre-purchasing long-lead HVAC equipment to store in a local bonded warehouse (reducing the schedule impact of supply chain delays).

4. Acceptance (Acknowledge and Prepare)

Risk acceptance indicates that the project team has decided not to change the project plan to deal with a risk, or is unable to identify any other suitable response strategy.

• Passive Acceptance: Acknowledging the risk but taking no proactive action. The team will deal with the consequences if they occur (typically reserved for low-probability, low-impact risks).
• Active Acceptance: Establishing a contingency reserve (budget or schedule float) to handle the risk if it occurs. This is the foundation of contingency planning.

Developing Action Plans and Risk Ownership

A risk response is only effective if it is actionable and assignable. The CM must ensure that every risk in the Risk Register has a designated Risk Owner.

• The Role of the Risk Owner: The Risk Owner must be a specific, named individual (e.g., "John Doe, Structural Superintendent"), not an organization or department. This individual is responsible for monitoring the risk, tracking the trigger conditions, and executing the pre-approved response actions.
• Risk Triggers: Triggers are warning signs or indicators that a risk is about to occur or has occurred (e.g., "three consecutive days of rainfall exceeding 1 inch" is a trigger for activating the site dewatering plan).
• Response Timelines: The action plan must specify when the response must be initiated. Delaying a response can render it ineffective (e.g., if a material order is not placed by a specific date, the schedule delay becomes unavoidable).

Secondary and Residual Risks

The CM must recognize that risk response strategies do not exist in a vacuum. They often introduce new variables:

• Secondary Risks: These are new risks that arise as a direct result of implementing a risk response strategy.
  • Scenario: To mitigate the risk of local labor shortages, the CMAR decides to use precast concrete panels instead of cast-in-place concrete. This successfully mitigates the labor risk but introduces secondary risks: the need for a larger crane (crane safety and site access risks), transportation permits for oversized loads, and the risk of panels being damaged during transit. The CM must add these secondary risks to the Risk Register and assess them.
• Residual Risks: These are the risks that remain after risk response strategies have been implemented, as well as risks that have been deliberately accepted. No mitigation plan is 100% effective. The CM must evaluate the total residual risk on the project to ensure it aligns with the Owner’s risk tolerance.

CMAA Standards on Contractual Risk Allocation

The CM plays a vital role in drafting and reviewing contract documents to ensure balanced risk allocation. CMAA recommends the use of standard contract documents (such as CMAA, AIA, or ConsensusDocs forms) because they represent a negotiated consensus on industry risk sharing. The CM should advise the owner against modifying these documents with overly aggressive, one-sided clauses.

Key contractual risk-sharing clauses include:

• Mutual Waiver of Consequential Damages: Both parties agree to waive claims for indirect damages (such as lost profits or loss of use), limiting recovery to direct damages. This significantly reduces the financial risk exposure for both the Owner and the CM/Contractor.
• Liquidated Damages (LDs): Pre-agreed daily damage amounts paid by the Contractor to the Owner if the project is not completed on schedule. LDs must represent a reasonable forecast of actual damages; otherwise, courts may rule them to be unenforceable penalties.
• Force Majeure: Clauses that excuse performance delays due to unforeseeable events beyond either party's control (e.g., severe weather, pandemics, labor strikes).