A RISK IS AN UNCERTAIN EVENT OR CONDITION THAT, IF IT OCCURS, HAS AN EFFECT ON AT LEAST ONE PROJECT OBJECTIVE. THE DEFINITION CARRIES TWO POINTS WORTH STATING EXPLICITLY: · A RISK HAS NOT HAPPENED YET. Once it occurs it is an ISSUE, and issues are managed differently — reactively, from the issue log rather than the risk register. · A RISK MAY BE POSITIVE. An OPPORTUNITY is a risk with a favourable effect, and modern practice manages both. The exam-safe phrasing is "risks may be threats or opportunities". RISK VERSUS UNCERTAINTY — a distinction examiners like: RISK — the possible outcomes AND their probabilities are known or estimable. Insurable, quantifiable. UNCERTAINTY — the outcomes may be known but the probabilities are not, or the outcomes themselves are unknown. NOT QUANTIFIABLE, and therefore not amenable to expected-value arithmetic. THE PRACTICAL CONSEQUENCE: TECHNIQUES LIKE EMV APPLY TO RISK AND ARE MISLEADING WHEN APPLIED TO GENUINE UNCERTAINTY, because they produce a precise-looking number from a probability that was invented. ── THE RISK MANAGEMENT PROCESS — six steps ───────────────── 1. RISK MANAGEMENT PLANNING — how risk will be managed on this project: methodology, roles, tolerance thresholds, the scales to be used, reporting frequency. 2. RISK IDENTIFICATION — what could go wrong. TECHNIQUES: brainstorming; the DELPHI method (anonymous expert rounds, which avoids the loudest voice dominating); checklists from past projects; interviews; SWOT analysis; assumption analysis (every assumption is a risk if wrong); root cause analysis; document review. THE OUTPUT IS THE RISK REGISTER, which should record for each risk: an ID, a description in CAUSE–EVENT–EFFECT form, the category, probability, impact, score, response, OWNER, and status. WRITE RISKS AS "IF <cause> THEN <event> WHICH WOULD <effect>". A register entry reading merely "weather" is useless; "if monsoon arrives early, then the river diversion cannot be completed, which would delay the dam by one season" can actually be managed. 3. QUALITATIVE ANALYSIS — prioritising by judgement. Rate PROBABILITY and IMPACT on a scale (typically 1–5) and multiply for a RISK SCORE, plotted on a PROBABILITY-IMPACT MATRIX: IMPACT → 1 2 3 4 5 P 5 (v.high) 5 10 15 20 25 R 4 4 8 12 16 20 O 3 3 6 9 12 15 B 2 2 4 6 8 10 ↓ 1 (v.low) 1 2 3 4 5 RED (15–25) — urgent action required AMBER (6–12) — active management GREEN (1–5) — monitor only THE TRAP TO AVOID: A SCORE OF 25 (certain, catastrophic) AND A SCORE OF 25 REACHED AS 5×5 ARE NOT THE SAME AS A LOW- PROBABILITY CATASTROPHE. A 1-in-1000 event that would kill people is not adequately handled by a low score, which is why safety-critical risks are treated separately from the matrix and assessed against absolute criteria. 4. QUANTITATIVE ANALYSIS — putting numbers on it. EXPECTED MONETARY VALUE (EMV) = PROBABILITY × IMPACT A worked register: RISK P IMPACT (Rs) EMV ──────────────────────────────────────────────────────── Landslide blocks access 0.30 5,000,000 1,500,000 Permit delayed 0.50 1,200,000 600,000 Cement price rise 0.60 800,000 480,000 Late design error found 0.15 3,000,000 450,000 ──────────────────────────────────────────────────────── TOTAL EMV = Rs 3,030,000 THAT TOTAL IS THE RATIONAL BASIS FOR THE CONTINGENCY SUM — far better than the customary "add 10%", which is a number with no reasoning behind it. THE CAVEAT: EMV IS AN AVERAGE OVER MANY REPETITIONS, AND A PROJECT HAPPENS ONCE. The landslide either blocks the road or it does not; it never costs Rs 1,500,000. EMV sizes the contingency across a PORTFOLIO of risks, which is why it works better for an organisation with many projects than for a single one. DECISION TREE ANALYSIS, for choices under uncertainty: Build now: 0.6(+8,000,000) + 0.4(−3,000,000) = 4,800,000 − 1,200,000 = Rs 3,600,000 Commission a study first (cost 500,000), which resolves the uncertainty and avoids the bad outcome: 0.6(+7,000,000) + 0.4(0) − 500,000 = 4,200,000 − 500,000 = Rs 3,700,000 WAITING WINS BY Rs 100,000 DESPITE COSTING 500,000, because it avoids the 40% chance of a 3,000,000 loss. THE VALUE OF INFORMATION IS THE LOSS IT LETS YOU AVOID, and this is the standard demonstration of why feasibility studies are worth paying for. MONTE CARLO SIMULATION — sample every uncertain variable thousands of times to produce a DISTRIBUTION of outcomes rather than a single figure. It answers "what is the probability of finishing within budget?", and unlike PERT it accounts for near-critical paths. SENSITIVITY ANALYSIS — vary one input at a time to find which matters most; displayed as a TORNADO DIAGRAM. 5. RISK RESPONSE PLANNING — the four (or five) strategies. FOR THREATS: AVOID — change the plan so the risk cannot occur. Reroute the road away from the unstable slope. THE ONLY STRATEGY THAT REDUCES PROBABILITY TO ZERO, and usually the most expensive. TRANSFER — move the financial consequence to another party: INSURANCE, PERFORMANCE BONDS, fixed-price contracts, warranties. NOTE CAREFULLY: TRANSFER DOES NOT REDUCE THE PROBABILITY OR THE PHYSICAL IMPACT. The landslide still happens; only who pays changes. It also always costs a premium, since the other party prices the risk plus a margin. MITIGATE — reduce the probability, the impact, or both. Slope stabilisation, early procurement, prototyping, additional testing. THE MOST COMMON STRATEGY. ACCEPT — take no action, either actively (set aside a contingency) or passively (deal with it if it happens). APPROPRIATE FOR LOW-SCORE RISKS, where the cost of response exceeds the expected loss. FOR OPPORTUNITIES: EXPLOIT, SHARE, ENHANCE, ACCEPT. EVERY RISK MUST HAVE A NAMED OWNER. A risk owned by "the project team" is owned by nobody. 6. RISK MONITORING AND CONTROL — the register is reviewed at every progress meeting, risks are re-scored, closed risks are removed, NEW ONES ARE ADDED, and the effectiveness of responses is checked. A RISK REGISTER WRITTEN ONCE AT THE START AND NEVER UPDATED IS THE COMMONEST FAILURE OF THIS ENTIRE DISCIPLINE, and it is worth saying so in an exam answer.

RISK CATEGORIES — a checklist structure, often drawn as a RISK BREAKDOWN STRUCTURE (RBS) mirroring the WBS: TECHNICAL — design errors, technology unproven, quality failures, interface problems EXTERNAL — regulatory change, political instability, currency movement, market conditions, ACTS OF GOD ORGANISATIONAL — resource shortage, funding interruption, competing priorities, key person dependency PROJECT MANAGEMENT — poor estimating, inadequate planning, weak communication, unclear scope ENVIRONMENTAL AND SOCIAL — land acquisition, resettlement, local opposition, environmental clearance FINANCIAL — cost escalation, exchange rate, interest rate, client's ability to pay ── THE RISKS THAT DOMINATE NEPALI PROJECTS ───────────────── · SEISMIC — the whole country lies on an active collision boundary. Design for earthquake is not optional. · MONSOON — a construction season effectively shortened; flooding; landslides; access roads cut. · GEOLOGICAL — young, weak Himalayan rock; tunnelling risk is exceptionally high, and unforeseen ground conditions are the classic source of hydropower cost overruns. · GLACIAL LAKE OUTBURST FLOODS (GLOFs) — a real design case for anything in a high valley. · LAND ACQUISITION AND RESETTLEMENT — a leading cause of delay, and frequently underestimated at appraisal. · POLITICAL AND POLICY instability; local disruption · SUPPLY CHAIN — a landlocked country dependent on a small number of border crossings, so a border disruption halts cement and steel deliveries nationwide. · SKILLED LABOUR availability, given large-scale outward migration. ── CONTINGENCY AND MANAGEMENT RESERVE ────────────────────── A distinction very frequently examined: CONTINGENCY RESERVE — for IDENTIFIED risks ("known unknowns"). Sized from the EMV analysis, held WITHIN the cost baseline, and released by the PROJECT MANAGER. MANAGEMENT RESERVE — for UNIDENTIFIED risks ("unknown unknowns"). A percentage of the budget held OUTSIDE the baseline, released only by SENIOR MANAGEMENT, and its use constitutes a formal change to the baseline. THE LOGIC OF THE SPLIT: the project manager should be able to handle the risks they identified without asking permission, and should have to ask when something nobody anticipated occurs — because that is exactly the situation in which senior judgement is needed. ── RESIDUAL AND SECONDARY RISKS ──────────────────────────── RESIDUAL RISK — what remains after the response is implemented. Mitigation reduces; it rarely eliminates. SECONDARY RISK — A NEW RISK CREATED BY THE RESPONSE ITSELF. Accelerating work to recover schedule raises the accident rate; transferring risk to a contractor raises the risk of that contractor's insolvency. THE RESPONSE MUST ITSELF BE ASSESSED, and forgetting this is a subtle and common error. RISK TRIGGER — an observable early warning sign that a risk is about to materialise, which is what makes a CONTINGENCY PLAN actionable rather than theoretical. THE UNDERLYING PRINCIPLE OF THE WHOLE TOPIC: RISK MANAGEMENT DOES NOT ELIMINATE RISK — IT REPLACES SURPRISE WITH PREPARATION. The landslide may still block the road; the difference is whether there is a plan, a reserve and an owner, or a crisis meeting.