National Academies Press: OpenBook

The Owner's Role in Project Risk Management (2005)

Chapter: 2 Owners’ Roles and Responsibilities

« Previous: 1 Introduction
Suggested Citation:"2 Owners’ Roles and Responsibilities." National Research Council. 2005. The Owner's Role in Project Risk Management. Washington, DC: The National Academies Press. doi: 10.17226/11183.
×

2
Owners’ Roles and Responsibilities

INTRODUCTION

Managing risk is one of an owner’s most important functions in making any major project successful. In general, the owner is initially responsible for all of the project risks, as it is usually the owner’s decision to execute the project or not. (Of course, the owner may not have a completely risk-free strategy, because not executing the project may entail risks to the successful implementation of the owner’s mission or business plan.) The owner has the ultimate responsibility for identifying, analyzing, mitigating, and controlling project risks, including acceptance of the project risks, or modification, or termination of the project—all of which are project risk management activities. This is true whether the project execution is managed directly by the owner or by contractors under the owner’s supervision.

Effective risk management begins with risk assessment. There are two primary purposes for a preproject risk assessment: (1) to decide whether to execute the project and accept the risks, or terminate it as unacceptably risky and (2) to identify the highest-priority risk factors that should receive the most attention by management.

One form of risk mitigation for the owner is to transfer some of the project risks by contract to others, presumably at a mutually acceptable price. For example, under a cost-plus-fee contract, the owner retains the cost risk; however, under a fixed-price contract, the owner seeks to transfer the cost risk to the contractor. Whether the fixed-price or cost-plus-fee approach is more beneficial to the owner depends on circumstances, such as whether the owner or the contractor is better able to manage the risks.

Suggested Citation:"2 Owners’ Roles and Responsibilities." National Research Council. 2005. The Owner's Role in Project Risk Management. Washington, DC: The National Academies Press. doi: 10.17226/11183.
×

If the owner is going to have a cooperative, integrated project team, the entire team has to share the objective of risk reduction for every member of the project, rather than delegating the responsibility to one participant who may have incentives to impose risks on the other project members. Contractors and consultants may play major roles in identifying, analyzing, mitigating, and controlling project risks, but project risk management is not a function that the owner can completely delegate to contractors or to consultants with impunity. There are no paradigms for assigning responsibility for specific risk management activities to the members of the project team. The optimal delegation of responsibilities needs to be determined by the owner, then tracked and managed using the tools described in Chapter 7. There remains an essential role for the owner that cannot be delegated—the responsibility for the management of the owner’s interests and the owner’s risks.

OWNER’S ROLE

Senior Executives

The Department of Energy’s (DOE’s) senior management has the responsibility for developing risk consciousness among all owner, contractor, and supplier personnel by educating them about the importance of explicit consideration of risks. Risk consciousness is the development of a viewpoint that continually examines how risks may occur and what their impact might be. It is analogous to the mindset of an experienced safety professional entering a construction work site; such a person would have developed a trained eye for risky situations and could automatically assess what could go wrong. In former years, some people opposed the introduction of integrated safety management on the basis that it would stop construction projects in their tracks or make them prohibitively expensive. These objections turned out to be false, and the value of safety programs is now unquestioned. Similarly, project risk management can be effectively carried out without stopping projects dead in their tracks or even slowing them down. Risk consciousness, like safety consciousness, has to flow from the top throughout the enterprise; in order to develop it in an organization, senior management must have it and they must constantly communicate the need for it to all program managers and project teams.

Program Managers

DOE program managers oversee the management of risks for multiple projects and should have the authority to ensure that the policies

Suggested Citation:"2 Owners’ Roles and Responsibilities." National Research Council. 2005. The Owner's Role in Project Risk Management. Washington, DC: The National Academies Press. doi: 10.17226/11183.
×

and procedures established by senior owner executives are followed. They have the responsibility to transfer the risk consciousness established by senior executives to line project directors and managers. They also have the opportunity to manage risks across projects and to transfer lessons learned from one project to another. (See Chapter 8 regarding management of project portfolio risks.)

Project Directors

DOE project directors are the owner’s representatives responsible for implementing risk management policies and procedures. They have direct involvement and oversight of efforts to identify, analyze, mitigate, and control project risks from inception through completion. Project directors should have a thorough knowledge of project risks as well as of risk management tools and their implementation. They are responsible for leadership of the project management team, oversight of contractors and consultants, notification of senior management when significant risks arise, and management of risks during project execution.

Integrated Project Team

Risk identification is one of the most important functions of the project management team, and is one major reason the team should be formed early in the project (or even before) and should meet face-to-face as soon as possible. Members of the project management team should be selected on the basis of their breadth of experience and diverse viewpoints to make sure that all significant project risks are identified. Even if contractors execute the project, the owner’s project representative should be informed and actively involved in risk management.

Contractors and Consultants

In an environment where ongoing program and project management is delegated to contractors, the owner nonetheless retains the responsibility to ensure that the contractors employ qualified personnel and apply appropriate risk management practices. Because the owner maintains the burden of many irreducible project risks, it is essential that the owner’s representatives take an active role in all phases of risk management, including knowledgeable oversight and review of tasks undertaken by contractors and consultants.

Successful project execution begins with selection of the right contractor. Contractor proposals should demonstrate successful experience in

Suggested Citation:"2 Owners’ Roles and Responsibilities." National Research Council. 2005. The Owner's Role in Project Risk Management. Washington, DC: The National Academies Press. doi: 10.17226/11183.
×

employing risk management methods in past performance on comparable projects. The weight given to risk management as a factor in contractor selection is one way for the owner to show a commitment to improving project performance through effective risk management.

As DOE relies more and more on performance-based approaches for acquiring services, in keeping with the President’s management objectives, it becomes critical that both contractor and government work in partnership to achieve the outcomes sought. With effective acquisition planning and a well-defined risk mitigation plan developed at the front end of the project, DOE and the contractor together are well positioned to deal with problems in execution as they arise. However, for these plans to be effective there has to be continuing communication between the department and the contractor once the work is under way. Both parties must be willing to adjust approaches as necessary to keep the project on track. Success depends on a flexible, coordinated approach for managing risks well before they have a significant negative impact on the project.

One way for owners to augment their ability to manage risk is to seek consulting support and technical assistance from firms that specialize in project risk management. This approach enables the owner to take advantage of the expertise of individuals who regularly deal with these types of problems and can help ensure that risk management concerns are fully addressed in the development of acquisition plans and work plans.

Reviewers

Objective and impartial external consultants and advisors can provide essential input on risk management. Evaluation of risk management functions, responsibilities, and plans should be specified as one of the major components of external independent reviews (EIRs) (NRC, 1999, 2001, 2003) and is a major reason why EIRs should be implemented. EIRs are typically performed prior to approval of the performance baseline (CD-2) and in some cases prior to approval of alternative selection and cost range (CD-1). Outside independent reviewers may identify potential risks that project personnel miss, so it is entirely in the owner’s interest to obtain these independent opinions for the reassurance they can provide. DOE managers should determine when EIRs should be used, the depth and breadth of coverage of the reviews, specific risks to be examined, and other issues relevant to the owner’s interests. Project management should be required to address all risks identified in EIRs in the same way as risks identified by the project team.

Suggested Citation:"2 Owners’ Roles and Responsibilities." National Research Council. 2005. The Owner's Role in Project Risk Management. Washington, DC: The National Academies Press. doi: 10.17226/11183.
×

DEVELOPMENT OF RISK MANAGEMENT EXCELLENCE

All projects experience some degree of uncertainty, and some uncertainties can create risks to achieving the project objectives. The successful management of these risks is therefore critical to project success. Further-more, traditional project management tools, methods, and practices that are satisfactory for typical, conventional projects may be inadequate for project success on unusual or first-of-a-kind projects.

Risk management that follows typical industry good practices that have been developed on conventional projects, and that may be perceived as low-risk simply because they have been done many times, is not enough for projects that have more than the usual level of risk. Improved risk management abilities are needed if future projects are to be managed more successfully than those in the past. It is not sufficient to apply business-as-usual risk management techniques and expect to get good results. Even supposedly low-risk projects may be susceptible to unanticipated risks, just as many conventional projects were recently surprised by the run-up in steel prices, perhaps indicating that the lessons of the mid-1970s have been forgotten.

Improved risk management tools and methods are being actively developed by a number of organizations and can form the basis for the development of risk management excellence by DOE and contractors. Thus the intellectual, theoretical, computational, and other resources necessary to produce significant improvements in project risk management are available, but they need to be actively sought out and applied by managers at all levels. Owners’ representatives need to draw on these resources to develop expertise and excellence in actively managing project risks, and they need to ensure that this excellence is carried through by their contractors. Knowledgeable owners ensure that both their own personnel and their contractors are using the most appropriate risk management methods and that risk analysis is neither excessive nor too little. Owners with ongoing programs of multiple projects especially need to develop their own risk management expertise and excellence and should not expect contractors to look out for the owner’s risks unless they are specifically and properly directed to do so.

Project managers are inherently motivated to achieve the intended project goals and are therefore motivated to manage project risks effectively. Although this is generally the case, Flyvbjerg (2002) has argued that there are times, especially in large projects, when project managers are motivated to obscure or hide the risks inherent in a project. It is the responsibility of senior managers to ensure that project teams thoroughly identify, analyze, mitigate, and manage all project risks. Because the outcome of projects is influenced by many factors beyond the control of risk

Suggested Citation:"2 Owners’ Roles and Responsibilities." National Research Council. 2005. The Owner's Role in Project Risk Management. Washington, DC: The National Academies Press. doi: 10.17226/11183.
×

management, the quality of project risk management is difficult to assess. Senior managers need to establish policies and procedures as well as a thorough understanding of risk management to ensure that all risks have been considered and properly addressed before allowing projects to proceed past critical decision points.

MANAGERIAL ATTITUDES TOWARD RISK AND UNCERTAINTY

Project risk may be defined simply as the possibility of an unintended future event with potential undesirable consequences. For precisely this reason, project risks are difficult to manage, because they relate to events that may or may not occur. Risk is a concept that encompasses things, forces, or circumstances that pose a threat to people or what they value (NRC, 1996). In the context of project management, risk has several dimensions, such as mission-related risk, cost or schedule risk, or risks to the environment, safety, or health. The development of effective and efficient project-specific risk management strategies requires the use of risk assessment, a decision technique that systematically incorporates consideration of adverse events, event probabilities, event consequences, and vulnerabilities.

Uncertainty, as it relates to project performance, cost, quality, and duration, comes from a lack of knowledge about the future. It is neither objective nor measurable but rather based on subjective assessments, which can differ between observers. Managers must therefore make decisions in an uncertain world and, in the absence of good historical databases, subjective probability estimates are the only available measures of uncertainty.

Decision Theory and Managerial Perspective

Projects continually face new risks, which must be identified, analyzed, and understood in order to develop a framework both for selecting the right projects to execute and for successfully executing them. Thus project owners, sponsors, and managers are increasingly concerned with ways to analyze risks and to mitigate them.

However, the term “risk” has different meanings to different people. In decision theory, risk is defined as variation in the distribution of possible outcomes, a definition that allows the risks of alternatives to be quantified, calculated, expressed numerically, and compared. But most project managers do not use the decision-theory definition of risk. That is, they do not evaluate it on the basis of uncertainty or probability distributions, as used in decision theory, but rather, as March and Shapira (1987) observed, on the basis of the following general characteristics:

Suggested Citation:"2 Owners’ Roles and Responsibilities." National Research Council. 2005. The Owner's Role in Project Risk Management. Washington, DC: The National Academies Press. doi: 10.17226/11183.
×
  • Managers typically define risk as their exposure to loss.

  • Managers aren’t necessarily interested in reducing project risks to a single number. Instead, risks are considered multidimensional, with the maximum exposure considered for each risk dimension.

  • Managers are more likely to take risky actions when their jobs are threatened than when they feel safe. The risks taken on a project are relative to the alternative options and opportunities available. For example, contractors will take more risks (such as submitting very low bids to buy jobs) when business is bad and their survival is under threat than they are willing to take when they have ample backlogs.

Managers do not act as if risks were immutable properties of the physical world. Successful managers believe that they can control risks through their expertise; that is, they act as if risks are manageable. And the more successful managers have developed proven methods by which they can in fact more predictably control risks. Conversely, project managers may be unwilling to accept risks if they have not had experience successfully managing projects under similar conditions of technological challenges, public scrutiny, regulatory constraints, outside stakeholder influence, tight budgets, tight schedules, unusual quality requirements, fixed-price contracts, adversarial relations with contractors, and other factors that add risks to projects. But even successful project managers may not always be correct in their assumption that they can control risks, and making mistakes in this regard can have serious consequences. Therefore, even successful project managers need to know about risk management methodology in order to support the self-confidence they need to control risks.

In summary, the empirical, managerial approach to risk is as follows:

  • Break down the total risk into its components.

  • Analyze the risk for each component, in terms of its maximum exposure for loss.

  • If any risk is unacceptable, take steps to reduce it, mitigate it, or otherwise manage it.

  • Revise the project until the risks are acceptable or a plan is in place to actively reduce the risks to acceptable levels.

The decision-theory and managerial approaches to risk are compared in Table 2-1.

Suggested Citation:"2 Owners’ Roles and Responsibilities." National Research Council. 2005. The Owner's Role in Project Risk Management. Washington, DC: The National Academies Press. doi: 10.17226/11183.
×

TABLE 2-1 Two Complementary Approaches to Risk Management

Decision Theory

Managerial

Sees risks as probability distributions

Sees risks as maximum exposures

Synthesizes individual risks into one risk factor

Breaks out risks into individual components

Quantifies risks numerically

Characterizes risks verbally and qualitatively

Looks at probability distributions over all conceivable outcomes

Looks at relatively few critical outcomes

Sees risks as uncontrollable random events

Sees risks as avoidable and controllable

Integrating Two Approaches to Risk

Although decision-theory and managerial viewpoints on risk are different, they are not mutually exclusive. Managers are better equipped to take risks when they have both effective tools to assess the nature of the risks involved and the information necessary to control and manage these risks. Experience shows that many projects have not been successful in containing risks because project managers used inappropriate methods and did not see the need to apply risk management methodologies. Learning risk management on the job can be an educational experience that is very expensive for the project’s owner.

A better solution lies in integrating the two approaches to risk described above. By identifying, objectifying, quantifying, and estimating risks, and by assessing individual risks through simulation, scenario analysis, decision analysis, and other techniques, project managers can do what engineers do—that is, compensate for lack of direct experimental evidence by means of thorough analysis and appropriate safety factors. By synthesizing the managerial approach to risk with analytical methods, project managers are better able to manage risks, because the analytical approach requires the risks to be quantified and allows the systematic evaluation of the best methods to control them.

Suggested Citation:"2 Owners’ Roles and Responsibilities." National Research Council. 2005. The Owner's Role in Project Risk Management. Washington, DC: The National Academies Press. doi: 10.17226/11183.
×
Page 8
Suggested Citation:"2 Owners’ Roles and Responsibilities." National Research Council. 2005. The Owner's Role in Project Risk Management. Washington, DC: The National Academies Press. doi: 10.17226/11183.
×
Page 9
Suggested Citation:"2 Owners’ Roles and Responsibilities." National Research Council. 2005. The Owner's Role in Project Risk Management. Washington, DC: The National Academies Press. doi: 10.17226/11183.
×
Page 10
Suggested Citation:"2 Owners’ Roles and Responsibilities." National Research Council. 2005. The Owner's Role in Project Risk Management. Washington, DC: The National Academies Press. doi: 10.17226/11183.
×
Page 11
Suggested Citation:"2 Owners’ Roles and Responsibilities." National Research Council. 2005. The Owner's Role in Project Risk Management. Washington, DC: The National Academies Press. doi: 10.17226/11183.
×
Page 12
Suggested Citation:"2 Owners’ Roles and Responsibilities." National Research Council. 2005. The Owner's Role in Project Risk Management. Washington, DC: The National Academies Press. doi: 10.17226/11183.
×
Page 13
Suggested Citation:"2 Owners’ Roles and Responsibilities." National Research Council. 2005. The Owner's Role in Project Risk Management. Washington, DC: The National Academies Press. doi: 10.17226/11183.
×
Page 14
Suggested Citation:"2 Owners’ Roles and Responsibilities." National Research Council. 2005. The Owner's Role in Project Risk Management. Washington, DC: The National Academies Press. doi: 10.17226/11183.
×
Page 15
Next: 3 Properties of Project Risks »
The Owner's Role in Project Risk Management Get This Book
×
Buy Paperback | $38.00 Buy Ebook | $30.99
MyNAP members save 10% online.
Login or Register to save!
Download Free PDF

Effective risk management is essential for the success of large projects built and operated by the Department of Energy (DOE), particularly for the one-of-a-kind projects that characterize much of its mission. To enhance DOE’s risk management efforts, the department asked the NRC to prepare a summary of the most effective practices used by leading owner organizations. The study’s primary objective was to provide DOE project managers with a basic understanding of both the project owner’s risk management role and effective oversight of those risk management activities delegated to contractors.

  1. ×

    Welcome to OpenBook!

    You're looking at OpenBook, NAP.edu's online reading room since 1999. Based on feedback from you, our users, we've made some improvements that make it easier than ever to read thousands of publications on our website.

    Do you want to take a quick tour of the OpenBook's features?

    No Thanks Take a Tour »
  2. ×

    Show this book's table of contents, where you can jump to any chapter by name.

    « Back Next »
  3. ×

    ...or use these buttons to go back to the previous chapter or skip to the next one.

    « Back Next »
  4. ×

    Jump up to the previous page or down to the next one. Also, you can type in a page number and press Enter to go directly to that page in the book.

    « Back Next »
  5. ×

    Switch between the Original Pages, where you can read the report as it appeared in print, and Text Pages for the web version, where you can highlight and search the text.

    « Back Next »
  6. ×

    To search the entire text of this book, type in your search term here and press Enter.

    « Back Next »
  7. ×

    Share a link to this book page on your preferred social network or via email.

    « Back Next »
  8. ×

    View our suggested citation for this chapter.

    « Back Next »
  9. ×

    Ready to take your reading offline? Click here to buy this book in print or download it as a free PDF, if available.

    « Back Next »
Stay Connected!