Managing Risk on Large-Scale Construction Projects

Managing risk on a large construction project comes down to one discipline: name every threat to programme, cost and safety before it happens, put a named owner and a number against each one, and work that list every month until it is closed. A risk nobody has written down is a risk you have already agreed to carry. On a scheme worth several million pounds, that is where the overruns quietly begin.

We have carried risk on funded projects across Greater Manchester since 1992, from town-centre refurbishments to new-build under a lender's monitoring surveyor. The tools are not exotic. A register, a matrix, a monthly meeting where someone senior has to answer for each open item. What separates a project that lands on budget from one that finds its trouble at the final account is whether that process is real or a spreadsheet nobody opens between valuations.

What does managing construction risk actually mean?

It means running a live risk register, not a one-off risk assessment filed at the start and forgotten. A risk assessment is a snapshot. A register is a document that changes every month as risks open, get mitigated, land, or close out. The recognised framework for it is ISO 31000, and on larger schemes the NEC4 suite of contracts builds it straight into the job through the Early Warning Register, a shared list the client and contractor both have a contractual duty to keep current.

Each risk gets scored the same way: how likely it is, and how much it would hurt if it happened. Multiply the two on a 5x5 matrix and you get a red, amber or green rating that tells you where to spend your attention. The reds get a mitigation plan and an owner with a date. The greens get watched. Precision is not the goal here. The score exists to make a room full of optimists rank their problems honestly.

What are the biggest risks on a large project?

They fall into a handful of categories, and on almost every scheme the same two or three dominate the list. Here is how we group them, and the line each one usually hits.

Notice that safety is not one line among equals. Construction records the highest number of worker fatalities of any industry sector in Great Britain, year after year, in the HSE's figures. Under CDM 2015 the duty to design risk out sits with the client and the principal designer long before anyone is on site, which is why our CDM and health and safety people work from the design stage rather than turning up when the build is already priced.

How do you actually run a risk register?

You hold a monthly risk review, and you make it uncomfortable. Every open red is read out, its owner reports what has moved, and the score is challenged. If nothing has changed on a risk for three months, either it is not really a risk or nobody is managing it, and both of those answers matter.

A register is only as good as the meeting behind it.

On a scheme of any size we go a step further and put a number on the whole thing. Quantitative risk analysis runs the register through a model that samples every risk's likelihood and cost thousands of times and gives you a range instead of a single guess. That is where a P80 figure comes from, the cost the project has an 80% chance of coming in under. A lender wants the P80, not the optimistic base case. It is also how you size the contingency out of real exposure rather than sticking a round 5% on the bottom of the cost plan and hoping. Our cost management team builds the contingency from the actual risk picture, which usually sits between 3 and 5% of construction cost early on and falls as the drawings firm up and risks close.

Who should carry each risk, you or the contractor?

You should only pass a risk to the contractor when they can genuinely control it, and you should expect to pay a premium every time you do. A fixed-price lump sum contract feels like risk transfer. It is really risk pricing. The contractor looks at everything you have handed them, adds a number for the unknowns, and you pay that number whether the risk happens or not.

Here is the view some people in the industry will argue with. On a complex refurbishment, an old building where nobody truly knows what is behind the walls, I would rather hold the ground and existing-structure risk myself under an NEC4 target-cost option than pay a contractor a fat contingency to take a risk they cannot price any better than I can. You share the pain and the gain, you see the real cost as it lands, and you are not funding a premium for a problem that may never appear. On a clean new-build with good ground information the opposite is true, and a lump sum is the right call. The contract should follow the risk, not habit.

Getting that allocation wrong is expensive in both directions, which is why an independent read matters. Our project monitoring and auditing work exists partly to catch a risk sitting with the wrong party before the contract is signed.

What risks are specific to building in Stockport?

Stockport punishes anyone who treats a site as a blank sheet. Much of the borough sits on the old industrial footprint of the cotton and hatting trades, so a town-centre plot often means made ground, buried mill foundations and the odd forgotten culvert rather than clean subsoil. Parts of Greater Manchester also fall inside the Coal Authority's Development High Risk Area, which means a coal mining risk assessment before you build, not a question you get to answer later. And the River Mersey is formed in the middle of Stockport where the Goyt and the Tame meet, with watercourses culverted under the town centre, so Environment Agency flood zones and the sequential test are live issues on low-lying sites. None of this is unusual here. All of it needs to be a named, priced line on the register at feasibility, not a surprise in the first month on site.

The other local pressure is heritage. A lot of the live development sits inside Town Centre West under the Mayoral Development Corporation, where the setting of the Underbanks and the listed railway viaduct raises the design and planning bar. That is a programme risk more than a cost one, and it belongs on the register scored as such. Our project management team prices these local factors in from the first appraisal, because we build here.

Where risk management usually fails

The failure is almost never the register itself. It is trusting someone else's optimistic survey and fixing a price on top of it.

We learned that on a mill refurbishment a few years back. The contractor's asbestos survey came back reassuringly thin, we were under time pressure to agree a price, and we let the number be fixed against it. During strip-out the team found asbestos insulation board running through a floor the survey had never opened up. That is licensed, HSE-notifiable removal, and it stopped that zone of the job for weeks while the cost sat in a contingency that had not been built to absorb it. The project came good in the end. It came good the hard and expensive way. We do not let a price be fixed against a management-level asbestos survey on an old building now, ever. A full refurbishment and demolition survey, intrusive, goes in first.

That is the whole discipline in one story. The cheapest place to deal with a risk is on paper, months before it can reach the programme or the final account.

Talk to us before the risk lands

If you are appraising a large scheme, or you are partway through one where the risk register has gone quiet, that is the moment to get an independent read on it. Tell us where the project is and we will give you an honest view of what is really threatening the time, the cost and the outcome, and what it should take to manage it.