RISK MANAGEMENT PLAN
PROJECT - DESIGN, CONSTRUCTION & PARTIAL FINANCING OF 300 HOUSING UNITS AT
WILGODA, KURUNAGALA
Purpose
This document is an annexure to the Programme Management Plan (PMP) which has been prepared to
provide a management framework for the delivery of the Design, Construction & Partially Financing of 300
Housing Units at Wilgoda Kurunegala for Urban Development Authority project.
The purpose of this Risk Management Plan is to describe how the risk management process will be
implemented in the Design, Construction & Partially Financing of 300 Housing Units at Wilgoda Kurunegala
for Urban Development Authority and will be executed by the Programme Management and Construction
Management (PMCM). This plan communicates the processes the PMCM will use and provides the roles
and responsibilities of all stakeholders and parties involved.
Risk Management Plan
This plan aims to formulate a proactive and collaborative approach for Risk Management Planning &
Implementation within Design, Construction & Partially Financing of 300 Housing Units programme.
The scope of the Risk Management Plan is to standardise the risk management approach within the Design,
Construction & Partially Financing of 300 Housing Units. It includes managing all cost, schedule, technical,
quality risks and any other risk impacting delivery of expected benefits from this programme.
It is essential to improve understanding of risk among the project team and stakeholders, to understand
the benefits of risk management and the value it will bring in better mitigating risks and executing the
project within schedule and within budget.
This plan provides proactive programme risk management activities for the early identification of
uncertainty, analysis, and management of risks and opportunities over the lifecycle of the entire Design,
Construction & Partially Financing of 300 Housing Units programme and at various levels. It is structured,
so all areas of Design, Construction & Partially Financing of 300 Housing Units Program meet the objective
of minimising the negative impacts of risk and maximising any benefit from opportunities identified.
Risk Management Processes
Risk Management is the process of identifying, assessing, and planning responses to risks, as well as
monitoring these throughout the Design, Construction & Partially Financing of 300 Housing Units
Programme lifecycle. The risk management process intends to aid in the effective management of risks to
improve project execution and reduce the overall risk exposure.
Figure Error! No text of specified style in document.-1 - Risk Management Process
Establishing the Programme Context and background
One of the critical characteristics of a programme is complexity and risk management addresses this aspect.
Risk Management practices within a programme use opportunities to reduce complexity and address risks
that occur due to complexity.
The aim of risk management at the programme level is to determine the overall risk exposure of the Design,
Construction & Partially Financing of 300 Housing Units programme. Project Manager shall update or
modify this section as and when there are any changes to the information provided underneath.
Context and background of projects
Design, Construction & Partially Financing of 300 Housing Units programme to be executed in few different
packages with an overall Master Timeline of 30 months. Project Risk Management focuses on risks
impacting project objectives. It enables projects to develop more realistic risk-based plans, thereby
increasing the likelihood of projects achieving their targets. The objectives, scope, context, background,
and risk drivers of the project will differ for each construction package. Risk Managers & Project Managers
of Individual projects shall complete the Project Risk Management Plan.
Risk Identification
Risk identification is a process of examining the various project areas and each critical process to identify
and document any associated potential risks. During the life cycle of the project, the project team shall
continuously strive to identify risks.
The project team shall start risk identification as early as possible because the cost of managing the risk
earlier is low and there will be more possible ways to address the risk. For effective risk management for
the Design, Construction & Partially Financing of 300 Housing Units programme, the project team needs to
effectively and efficiently identify the risks that directly influence goals and objectives by focusing on the
suitable risks. With more emphasis on the initial stages, the potential risks to the Design, Construction &
Partially Financing of 300 Housing Units programme are identified and assessed at every stage, in
consultation with principal stakeholders and subject matter experts.
Risk identification is not a one-time event; it is an iterative process. New risks may appear at any time, and
continued risk identification is performed jointly via regularly scheduled meetings or other forms of
communications throughout the lifecycle of the Design, Construction & Partially Financing of 300 Housing
Units programme.
Risk Analysis
Risk Analysis involves considering the causes and sources of risk, their positive and negative consequences,
and the likelihood that those consequences can occur. Factors that affect consequences and likelihood
should be identified. Risk is analysed by determining consequences and their likelihood. Risk Analysis is
done in two steps:
1. Qualitative Risk Analysis
Qualitative risk analysis evaluates the probability and the impact of the identified risks to prioritise them
according to their potential impact on the Design, Construction & Partially Financing of 300 Housing Units
programme objectives. Qualitative risk assessment exercises are performed throughout the life cycle of the
Design, Construction & Partially Financing of 300 Housing Units programme to identify any changes in the
previously identified risks or any new risks that may have arisen. Qualitative risk analysis requires each risk
to be analysed based on:
First, its expected impact on the project objectives – if it occurs
Then, the probability of its occurrence – with such an expected impact – needs to be assessed.
The risk is evaluated by joint agreement between all stakeholders on the consequence of loss/impact and
the likelihood of occurrence/probability to arrive at a risk rating that defines the ranking of each risk relative
to other risks. Risks should be analysed using a most likely scenario, not optimistic or pessimistic. In cases
where a risk has multiple impacts on the project objectives (e.g., cost, schedule, and safety), then the
highest impact is selected as representative of the impact level.
Risk prioritisation is an essential method of qualitative assessment. Risks are prioritised for further
quantitative analysis based on their risk score in the heat map assessed based on the probability and impact
of the risk.
This information is captured in the risk register and is calculated based on the following scales and rating
tables:
Table 3-1 - Qualitative Probability Scales
Table 3-2 – Qualitative Impact Scales
Table 3-3 - Qualitative Risk Rating Matrix for risks & Opportunities.
Scales Probability Description
Issue 100% A Fact or Certain Event
5 –Very High 76% - 99% Almost certain to occur
4 – High 51% - 75% More likely to occur than not
3 – Medium 26% - 50% Fairly likely to occur
2 – Low 6% - 25% Unlikely to occur
1 – Very Low 0% - 5% Extremely unlikely
Table Error! No text of specified style in document.-1 - Qualitative Probability Scales
Impact Risk Type 1- Very 2-Low 3-Moderate 4-High 5-Very High
Low
Risk 0.01M >
< 0.01M 0.02M > 0.05M >
(Downsid 0.02M > 0.07M SAR
SAR 0.05M SAR 0.07M SAR
Cost e) SAR
(Small PMC) Opportun < 0.01M 0.01M > 0.02M > 0.05M > > 0.07M SAR
ity SAR 0.02M 0.05M SAR 0.07M SAR
(Upside) SAR
Risk < 0.1M 0.1M > 0.2M > 0.5M 0.5M > 1.0M > 1.0M SAR
(Downsid SAR 0.2M SAR SAR SAR
Cost e)
(Large PMC) Opportun < 0.1M 0.1M > 0.2M > 0.5M 0.5M > 1.0M > 1.0M SAR
ity SAR 0.2M SAR SAR SAR
(Upside)
Risk < 5M SAR 5M > 10M > 20M 20M > 30M > 30M SAR
(Downsid 10M SAR SAR SAR
Cost e)
(PMO) Opportun < 5M SAR 5M > 10M > 20M 20M > 30M > 30M SAR
ity 10M SAR SAR SAR
(Upside)
Risk
(Downsid 0 - 1 Day 2 - 4 Days 5 - 9 Days 10 - 14 Days 15 Days & Above
Schedule e)
(Small PMC) Opportun
ity 0 - 1 Day 2 - 4 Days 5 - 9 Days 10 - 14 Days 15 Days & Above
(Upside)
Risk
6 - 10
(Downsid 0 - 5 Day 11 - 15 Days 16 - 25 Days 25 Days & Above
Days
Schedule e)
(Large PMC) Opportun
6 - 10
ity 0 - 5 Day 11 - 15 Days 16 - 25 Days 25 Days & Above
Days
(Upside)
Risk
11 - 25
(Downsid 0 - 10 Day 26 - 40 Days 41 - 59 Days 60 Days & Above
Days
Schedule e)
(PMO) Opportun
11 - 25
ity 0 - 10 Day 26 - 40 Days 41 - 59 Days 60 Days & Above
Days
(Upside)
Scope Risk Scope
Minor Scope
(Downsid Decrease Major Areas of End Product / End
Areas of Reduction
e) Barely Scope Item is Effectively
Scope Unacceptable
Noticeabl Affected Useless
Affected to Sponsor
e
Quality Risk Quality Only Very Quality End Product / End
(Downsid Quality Item is Effectively
Degradati Demandi Reduction
e) Reduction Useless
on Barely ng Requires
Noticeabl Applicatio Sponsor Unacceptable
e ns are Approval to Sponsor
Affected
Health & Risk Life
Safety (Downsid Injuries or Minor Serious injury threatening
e) ailments injury or causing injury or
Death or multiple
not single hospitalisation multiple
life-threatening
requiring first aid or multiple serious
injuries
medical treatment medical injuries
treatment case treatment causing
hospitalisation
Reputational Risk Internal Reputatio Reputation Reputation International
(Downsid Reputatio n damage damage damage that Reputation
e) n damage within outside the attracts the damage.
- Staff region or region or with attention of
affected. with small big businesses. the
businesse Government.
s.
Environmenta Risk No Low risk Moderate risk High risk of Very high risk of
l (Downsid environm of very of environmental environmental
e) ental localised environmental damage that damage to
impact/ environm damage could lead to neighbouring
damage ental ill-health and regions on a scale
damage wildlife that would take
damage months for
nature to recover
Security Risk Loss of Confidentiality, Loss of C, I, or Loss of Confidentiality, Integrity, or
(Downsid Integrity, or A expected to Availability expected to have a
e) Availability expected have a Serious Severe or Catastrophic Adverse
to have a Limited Adverse Effect Effect
Adverse Effect
Table Error! No text of specified style in document.-2 - Qualitative Impact Scales
IMPACT
1 2 3 4 5
Very Low Low Moderate High Very High
5
11 16 20 23 25
Very High
4
7 12 17 21 24
LIKELIHOOD
High
3
4 8 13 18 22
Medium
2
2 5 9 14 19
Low
1
1 3 6 10 15
Very Low
OPPORTUNITY
1 2 3 4 5
Very Low Low Moderate High Very High
5
-11 -16 -20 -23 -25
Very High
4
-7 -12 -17 -21 -24
LIKELIHOOD
High
3
-4 -8 -13 -18 -22
Medium
2
-2 -5 -9 -14 -19
Low
1
-1 -3 -6 -10 -15
Very Low
Table Error! No text of specified style in document.-3 - Qualitative Risk Rating Matrix for Risks &
Opportunities
Quantitative Risk Analysis
Quantitative risk analysis provides insight into the combined effect of identified risks on the desired
outcome. It indicates the degree of overall risk faced by the programme or project by providing a numerical
estimate of the overall effect of risk on the objectives. Quantitative risk analysis considers the probabilistic
or component-wide effects, such as the correlation between risks and interdependencies. It provides a
numerical estimate of the overall impact of risk on the objectives. Results from this analysis are used to
evaluate the likelihood of achieving objectives and estimate any contingency reserves. Risks that are critical,
significant, or moderate and with a probability of more than 25% are only considered for quantitative risk
analysis. Low threats, opportunities, and risks with a probability of 25% and less are not included in the
quantitative risk analysis. Issues are captured in the risk register and the response actions are developed;
however, issues must be dealt with now and therefore not included in the determination of risk
contingencies.
Quantitative risk analysis uses different techniques, including modelling and statistical analysis, allowing
greater insight into following:
• Determination of the expected project finish dates and costs, when all the sources of uncertainty
are combined.
• Determination of likelihood of the project meeting its objectives and the probability of exceeding
a target as a function of the value of the target.
• Determination of the relative significance of individual sources of uncertainty and the sensitivity of
the uncertainty in the output to uncertainty in the input, how much the inputs contribute to the
spread in the output, highlighting the major risk drivers.
• A project schedule and cost contingency can be established, based on the degree of confidence.
Risk Evaluation
The purpose of risk evaluation is to assist in making decisions, based on the outcomes of risk analysis, about
which risks need treatment and the priority for treatment implementation.
Risk evaluation involves comparing the severity of risk found during the risk analysis process with the
established risk criteria. The risks that are:
• Critical are with a risk score of 19 and above, falling under the red cell,
• Risks that are Significant falling under amber cell are with a risk score between 15 and 18, both
inclusive and.
• The Moderate risks are with a risk score between 10 and 14, both inclusive, falling under yellow
cell are mandatory to be treated.
• The treatment for Low risks with a risk score 9 and below, falling under green cells are discretionary.
In some cases, the project may decide to just accept the risks. In some circumstances, the risk evaluation
can lead to a decision to undertake further analysis. The risk evaluation can also lead to a decision not to
treat the risk in any way than maintaining existing controls and considering the cost involved for risk
treatment. Table 3-4 shows the Heat Map colour coding definition, corresponding risk scores, risk severity
and the risk treatment requirements.
Colour Risk Score Risk Severity Risk Treatment
15 ≥ 25 High Mandatory
5 ≥ 14 Medium Mandatory
1≥4 Low Discretionary
Table Error! No text of specified style in document.-4 – Heat Map Colour coding definition
Risk Treatment
The purpose of risk treatment is to develop risk response plans to address the identified risks. It determines
the effective response actions that are appropriate for the priority of the individual risks and for the overall
risk. Following response strategies may be considered for dealing with risks:
• Escalate: Escalation is appropriate when a risk is outside of the project or programme scope or
when the proposed response exceeds a given manager’s authority.
Escalated risks are managed either at the enterprise domain, programme domain, or other relevant
part of the organisation. Ownership of escalated risks is accepted by the relevant party in the
organisation. A risk is usually escalated to the appropriate level that matched the objective that
would be affected if the risk occurred.
• Avoid: Risk avoidance is when the programme or project team acts to eliminate a risk or protect
activity from risk impact. It may be appropriate for a high-priority risk with a high probability of
occurrence and a large negative impact.
Avoidance may involve changing some aspect of the management plan or changing the objective
that is in jeopardy to eliminate the risk impact entirely. Should the risk materialise, it would have
no effect with respect to the objective. The risk owner may also take action to isolate the objective
from the risk’s impact if it were to occur.
• Transfer: Transfer involves shifting responsibility of a risk to a third party to manage the risk and to
bear the impact if the risk occurs.
Risk transfer often involves payment of a risk premium to the party taking on the risk.
• Mitigate: In risk mitigation, actions are taken to reduce the probability of occurrence and/or impact
of a risk.
Early mitigation action is often more effective than trying to repair the damage after the risk has
occurred. Where it is not possible to reduce probability, a mitigation response might reduce the
impact by targeting factors that drive the severity.
• Accept: Risk acceptance acknowledges the existence of a risk, but no proactive action is taken.
This strategy may be appropriate for low-priority risks, and it may also be used where it is not
possible or cost effective to address a risk in any other way.
Acceptance can be either active or passive.
o Passive acceptance - involves no proactive action apart from periodic review of risk.
o Active acceptance - to establish a contingency reserve (time & money) to handle the risk.
Risk Register