Project Risk

Management Plan
 Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE1/21
Project Risk Management Plan Bid Document
REV. 02

Code Version: A0

Language: English

PROJECT RISK MANAGEMENT PLAN

A0 202012 Wang Shunbo

REV. DATE PREPARED REVIEWED APPROVED NOTE

This document is the property of Powerchina Huadong Engineering Corporation Limited. It is

forbidden to be reproduced or transmitted by any means without permission.

1
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE2/21
Project Risk Management Plan Bid Document
REV. 02

Content
1. Purpose.....................................................................................................................................
2. Scope and principles.................................................................................................................
3. Definitions and Abbreviation.....................................................................................................
4. Responsibilities..........................................................................................................................
5. Risk Management......................................................................................................................
5.1 Risk Management Framework....................................................................................................
5.2 Risk management activities........................................................................................................
5.2.1 Establish the Context.....................................................................................................
5.2.2 Risk Identification...........................................................................................................
5.2.3 Risk Analysis / Assessment / Evaluation.........................................................................
5.2.4 Risk Treatment / Response.............................................................................................
5.2.5 Risk Register..................................................................................................................
6 Risk Control and Review................................................................................ 16
6.1 Monitoring and Control..............................................................................................................
6.2 Risk Reviews...........................................................................................................................
7 Risk management implementation................................................................17
8 Appendices.................................................................................................... 18
Appendix B RBS............................................................................................................................
Appendix C Risk Register...............................................................................................................

2
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE3/21
Project Risk Management Plan Bid Document
REV. 02

1. Purpose

The Purpose of this Project Risk Management Plan is to introduce and guide the Project Team to
identify, analyze, quantify, prevent, avoid, cure, mitigate and transfer the Project’s inherent risks
on the Project. This Plan sets out the approach, management components and resources to be
applied to the management of the Project’s risks.

This Project Risk Management Plan (RMP) is a dynamic process by which the Project’s risks are
identified, analyzed, evaluated, monitored, and possibly closed throughout the duration of the
project.

On the Project, the Contractor will continuously evaluate positive (opportunities) and negative
(threats) factors impacting the assumptions made at tender stage and to its activities. The
Contractor will estimate the probability that those events could occur by considering the options
involving a balance between cost and efforts to overcome these events for the benefit of the
Project.

2. Scope and principles

The Contractor is committed to implement the principles of risk management on this project in
line with the contract requirements throughout the execution of this project, and committed to
working towards effective risk management integrated into all project activities by:

a) Decision making management.

b) Assigning authority and responsibility at appropriate levels within the project team.

c) Ensuring that the necessary resources are allocated to manage risk.

d) Establishing and implementing standardized processes for risk identification, analysis,

mitigation, monitoring, evaluating and reporting.

e) Communicating the value of risk management, risk management policy and procedure
to project stakeholders

f) Strive towards continual improvement of the suitability, adequacy and effectiveness of

risk management and the way the risk management process is integrated.

3
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE4/21
Project Risk Management Plan Bid Document
REV. 02

Risk management adheres to the comprehensive principle, that is, throughout the entire project
life cycle, comprehensive risk identification and analysis, and comprehensive management and
control implementation. Therefore, this document is a reference available to the Team to control
the process of:

a) Identifying Risks affecting the Project’s resources and deliverables.

b) Quantifying the Probability of Risk occurring.

c) Quantifying the Impact by building a scale measuring estimated impact.

d) Prioritize resolution of Issues according to the magnitude of their impact.

e) Communicate Risks to Stakeholders.

f) Risk Treatment / Response

3. Definitions and Abbreviation

RMP Risk Management Plan

Risk A negative effect of uncertainty

Opportunity A positive effect of uncertainty

Uncertainty A deficiency of information related to understanding or knowledge of an

event, its consequence, or likelihood.

Risk A systematic investigation and analysis of risks combined with the

Analysis/Risk assignment of severities of probabilities and consequences. These are
Assessment used to rate risks in order to prioritize the mitigation of high risks.

Risk Mitigation A plan developed with the intent of addressing all known or possible risks
and preventing their occurrence, mainly includes reduction/mitigation,
avoidance, transfer and acceptance.

RBS Risk Breakdown Structure, the dividend and explanation of risk in details
from the basis structure for comprehensive identification of risk, according
to the characteristics of risks as defined in Overseas Project Risk
Management Regulation (QL/HDY-OBM-PS-2020), including international
political risks, social environmental risks, economic and financial risks,
market fluctuation risks, schedule and cost risks, legal and regulatory risks,
standards and regulatory risks , HSE risk, owner risk, engineering risk,
contract risk, subcontractor risk, supplier risk, project damage risk, project

4
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE5/21
Project Risk Management Plan Bid Document
REV. 02

management risk, etc.

4. Responsibilities

The Contractor’s Risk Management organization chart will be established at the Project, which is
shown as Appendix A.

Generally speaking, key staff is all responsible for the successful delivery of the Project.
However, the management responsibility has been defined in detailed as under,

4.1 Project Manager

The Project Manager is the owner and primary individual in charge of the Risk Management Plan
who will actively supports the risk management actions required for the project ensuring that all
project stakeholders or participants support those actions. The responsibilities of Project
Manager in risk management shall be as follows:

• ensure adequate resources are available to manage the risks with active participation in the
risk management process by a wide cross section of stakeholders.

• ensures that risks that affect the project from internally or externally are managed,
monitored and reported during the progress with effective treatment of risks.

• In an endeavour to timely treat all the potential risk in an efficient way, it will be
requested to the Owner to nominate his representative to whom all the risk related
issues be shared, discussed and resolved.

4.2 Project Control Manager / Contract Manager - Risk Manager

The Risk Manager is the owner of the Risk Register and has the overall responsibility;
accountability and authority for ensuring that the risk management process is applied effectively.
For the subject project, the Project Control Engineer & the Contract Engineer are responsible to
status the Risk Register.

The Project Control and Contract Manager have the concerted overall responsibility,
accountability and authority for ensuring that the risk management process is applied effectively
to the benefit of the Project. Their tasks include:

a) Perform quantitative risk analysis (if and as necessary)

b) Develop and administer the RMP.

c) Develop and maintain manuals, processes, forms, guidance and tools related to this

5
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE6/21
Project Risk Management Plan Bid Document
REV. 02

RMP.

d) Prepare, update and maintain Risk Register for new, closed and revised Risk events.

e) Develop and maintain communication between all Stakeholders with regard to the
development and quantification of a Risk;

f) Obtain timely input from Project team staff to facilitate classification, identification and
assessment of potential new risks.

g) Facilitate risk workshops / meetings.

h) Act as a facilitator and support risk owners and others to develop the cause and
effect sections of the risk identification process.

4.3 Project Control Engineer / Contract Engineer – Risk Engineers / Assistants

Project Control Engineer and/or Contract Engineer shall also be Risk Engineers/ Assistants, who
reports to the Risk Manager and has the following responsibilities

a) act as a facilitator and support to Risk Owners and others to develop the cause and
effect sections of the risk identification process

b) act as a facilitator and support to Risk Owners and others to score and prioritize risks
and assess residual risk

c) act as a facilitator and support to Risk Owners and others to develop the risk response
plans

d) update and maintain the project's Risk Register for new, closed and revised risk records

e) in conjunction with Project Controls, conduct QSRA activities using quantitative

assessment methods and tools

f) monitor the progress of risks and risk response plans

g) Prepare reports for the Risk Manager to submit to the Project Manager , Project
Management Team, and the Employer.

4.4 Risk Owners

Each individual in the Project team is a risk owner in that he/she is responsible to identify within
his/her scope of duty risk factors which may have an impact on the Project. The individual will
communicate all the risks to the head of his department and each Department’s Manager will
then be responsible to communicate Risks to the Risk Managers. The Risk Owner shall be
responsible for:

a) Operate within the established risk management plan, and processes, procedures,

6
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE7/21
Project Risk Management Plan Bid Document
REV. 02

tools and systems;

b) Where required provide subject matter expertise for assigned risks to the project risk
engineer;

c) Provide input on standard tools, methods, methods for managing, treating, monitoring
and reporting assigned risks;

d) Set direction and monitor the effectiveness processes for assigned risks;

e) Monitor and report;

f) Serve as risk authority for highly specialized risks.

It is imperative to mention that risk owner’s definition, responsibilities and duties have been
defined above for identification, analysis and cope up with the risk internally / within the
organisation.

The risk owner in global terms i.e. the EPC Contractor or the Owner, can only be defined by
examining the nature and type of the risk and responsibilities, obligations and duties specified in
the Contract for each of the party to address the risk event. Once all the relevant information,
identification, analysis, review, evaluation of the risk event will be executed, then the ownership,
responsible party for taking the mitigation measures and cost of risk can possibly be defined
accordingly. In order to define subject ownership, a column has been included in the risk register
and be ensure to update during the maintenance of the risk register and be shared accordingly
with the Owner after not more than one month time period.

4.5 Project Team Members

Project team member shall generically be responsible for:

g) assisting with the identification, analysis and evaluation of risks;

h) assisting with the development of risk treatments;

i) risk management activities as set out in the risk treatments

5. Risk Management

5.1 Risk Management Framework

Risk management is a forward-looking, systematic process to deal with potential risks with the
goal of obtaining maximum protection at the lowest cost. The Risk management process is

7
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE8/21
Project Risk Management Plan Bid Document
REV. 02

graphically represented below:

Figure 1 - Risk Management Framework

Upon making regular discussions and brainstorming session by all the nominated member of the
project team and come up with the proper identification, analysis, evaluation (scoring or ranking
of the risk) and also risk response plan. These Risks evaluation and response plan will then be
communicated to all the management and stakeholders and closely monitored who shall then be
responsible for control and management of the risk and will be authorize to take all such steps
necessary to avoid, transfer, share and reduce the risk.

5.2 Risk management activities

As indicated in Section 5.1 above, Risk management shall be carried out through multiple
phases of the project management process, starting with establishment of the context, an
identification and initial risk assessment as part of project selection, continuing with a
comprehensive risk analysis, as part of project definition, sizing of risk management practices as
part of project governance, tracking risks through project oversight, and evaluating risk

8
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE9/21
Project Risk Management Plan Bid Document
REV. 02

management results as part of project review activities.

Experienced experts may be consulted in addition to the project team at this stage, especially
regarding to technology, country-specific features, customer knowledge, project size, etc.

In the project execution phase, project risks should be updated on a regular basis, risk
contingencies are adapted to the modified situation and both aspects are to be reported during
project meetings.

5.2.1 Establish the Context

The identification of Risk factors in the Project must start with the establishment of the Project
within a geographical and socio-political context.

Building an understanding of the context within which the risk management process will take
place is critical to the development of an effective and appropriate risk management plan. To
establish the context means that the Contractor must define the external and internal parameters
that may affect the Project within that specific context. The aim is to facilitate a clear
understanding of the key risks issues and promote an environment for their management or
elimination.

a) The external context has related risks such as:

 Local market,

 Project area community expectations,

 Local government policy,

 Local personnel procurement process,

 State Legislation not accounted for;

 Local Economy;

 Reputation;

 Relationship management;

 Local content achievement;

 Local/land occupiers’ reaction to Project;

 Transportation rules

 Procurement process related risks due to both coordination of local

9
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE10/21
Project Risk Management Plan Bid Document
REV. 02

Entities, regulations and international factors;

 Taxation;

 Permitting.

b) The Internal context has related risks such as:

 Internal policy management and enforcement;

 Suitability and Implementation of organizational processes,

 Systems,

 Technology,

 Records management,

 Budget allocation,

 Internal staff culture,

 General internal relationships.

The above-mentioned internal and external context are the important factors which may cause
arising of certain / probable risks before and after the commencement and execution of the
construction works in fulfillment of the following Owner’, Contractor’s and lender’s obligations /
deliverables for completion of the project.

In addition to above-mentioned internal and external contexts, the Contractor’s and Owner’s
contractual obligations shall also be considered, such as:

• Obtaining of requisite insurances specified in the Contract

• Obtaining of requisite permits specified in the Contract

• Provision of security bonds

• Provision of legal opinion

• Contractor Entity's constitutional documents

• Provision of HSSE Management Plan, Construction Plan, etc

• Interfaces / Connections

• Others

10
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE11/21
Project Risk Management Plan Bid Document
REV. 02

5.2.2 Risk Identification

Through the risk workshops participated by all the relevant team members, the Contractor,
should identify all identifiable risks and opportunities by detecting risks and opportunities from all
potential sources according to the Risk Breakdown Structure, experiences from the past and
expert knowledge can also be utilized.

The process of identifying the potential risks shall be commenced through meetings, workshops,
brainstorming sessions and Project group discussions and all the relevant information including,
but not limited to, Risk ID, Risk categorization, cause of Risk event and its probable impact
thereof (which will be summarized as “Risk Description” using the Cause-Effect-Effect-Result
method) will be recorded into the risk register (the first 3 columns of Appendix A).

This process will also foresee the initial exploration by the management individuals of the Project
area so as to start identifying available resources, existing regulations, valuable support system
and available staffing resources. In this process local professionals will be retained to obtain
guidance on important risk issues such as taxation and local permitting regulations.

5.2.3 Risk Analysis / Assessment / Evaluation

The risk analysis and evaluation process seeks to priorities risks for treatment by evaluating
them against pre-established criteria. Lessons learned from previous projects will be used to
improve Project procedures so as to minimize impacts of unavoidable risks.

Assess the potential by performing a detail analysis, both qualitative and quantitative, and
evaluating the financial impact, reflected in adequate risk contingencies. Both qualitative analysis
and quantitative analysis should be considered.

i. the identified risks should be classified from the possibility of risk occurrence and the
severity of the hazard. From low to high, the judgment score is given from 1-5, and the
product of the two is used as the comprehensive risk score. The evaluation results should
be recorded in Appendix A-Risk Qualitative Analysis Form. The risk is further quantitatively
analyzed in combination with the project classification according to Overseas Project Risk
Management Regulation (QL/HDY-OBM-PS-2020).

ii. The quantitative analysis of risk is the process of quantifying the risk based on the detailed
description of the risk in the process of risk identification and the impact of the risk on the

11
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE12/21
Project Risk Management Plan Bid Document
REV. 02

project. Quantitative analysis needs to be established on the basis of accurate risk

descriptions, and on the basis of a full understanding of project costs. Quantitative risk
analysis should be carried out from two aspects: the possibility of risk occurrence
probability and the impact of risk on cost. The identified risks shall be quantified and
calculated in detail according to the two situations before and after the measures are
taken, and the cost of the formulated response measures shall be estimated. The
remaining risk estimates shall include the estimated response and the cost of the measure.
The evaluation result should be recorded in Appendix B-Risk Quantitative Analysis Form.
The probability of the occurrence of the risk and the impact of the risk on the cost should
be calculated based on the actual expected value, and empirical data can also be used.
The results of the qualitative analysis can be re-checked according to the quantitative
analysis, and the qualitative analysis results can be adjusted according to the actual
situation.

5.2.4 Risk Treatment / Response

The risk treatment process seeks to identify, assess and implement treatment options to alter the
outcome expected from a risk so as to reduce potential harm thus maximizing potential benefit.

This process also delivers qualitative and quantitative information about residual risk to enable
the Project to make informed strategic decisions about how to allocate resources.

An established risk can be addressed in five possible ways being:

a) Mitigate during the course of the Project by:

i. The Process of developing options and eventually taking measures to enhance

opportunities and reducing risk;

ii. Allocating a risk treatment owner to carry out monitoring and mitigation measures;

b) Transfer by mutual agreement to another Party where the other Party can action the
requirements related to the risk in a more efficient manner;

c) Take measures to reduce the overall effects of the potential risks.

d) Changing of the plans completely to avoid the risk.

e) Acceptance of the small risk which do not have much potential to affect the project
deliverables

12
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE13/21
Project Risk Management Plan Bid Document
REV. 02

Actions of treatment will either reduce the risk’s probability or impact or both. Preparation of
treatments usually requires inputs from project team and coordination with project Contract/
Control and Risk Manager and often communication and development of mitigation measures
involving stakeholders including Owner.

Persons should also be allocated to take charge of each response action. The remaining risk
potential after these actions should be incorporated as risk contingency in the project
calculations. Actions aimed at positively influencing the probability of occurrence and impact are
investigated in case of opportunities.

5.2.5 Risk Register

Through the above process, risks identified will be recorded in the Risk Register (see Appendix
B) which records the details of all the risks identified at the beginning and during the course of
the Project. This is a live document.

The Risk Register includes:

a) A unique identification number for each Risk

b) Risk breakdown structure to facilitate in categorizing and tracking according to the break
down as attached in Appendix B.

c) The assessment of the probability related to the risk occurrence and of the possible impact if
it occurs.

d) Party/Individual responsible for managing the risk;

e) The list of proposed key mitigation or enhanced actions with due dates;

f) Exposure in terms of money

This Risk Register shall be maintained throughout the Project duration and shall be updated
regularly to reflect the effectiveness of the mitigation strategies and to capture newly identified
risks. The risk register must be included in the Monthly Report, and discussed in the Monthly
Meeting and in any other circumstance in which a predicament requires.

6. Risk Control and Review

6.1 Monitoring and Control

This process will help the Contractor to ensure that the management tools and control

13
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE14/21
Project Risk Management Plan Bid Document
REV. 02

instruments are being effective and efficient and provide suggestions to improve the process
when the intended purpose is clearly not being properly and or timely achieved.

The Risk Meetings to be held regularly every month are instrumental in the successful
implementation of the Risk management Plan.

The involvement and participation in meetings of key representatives of the stakeholders will be
necessary to evaluate the effectiveness and success of measures taken and to explore
alternative resolutions and immediate measures that are necessary.

6.2 Risk management implementation

This RMP shall be coordinated with all the Project’s Plans and shall be read in conjunction with
such plans to allow for it to be regularly reviewed for suitability whilst incorporating changes as
they occur during the progress of the Project. The present RMP will be revised if there are
changes that are required to be reflected in the procedures set up. Any update will be properly
recorded and properly circulated and filed.

When the preliminary project management plan is established in the project execution phase, the
risk qualitative analysis form and the risk quantitative analysis form done by the biding team need
to be updated with the assistance of RBS and evaluation of experience from comparable projects
carried out in the past.

During the project execution, the described process above must be carried out on a regular basis
for project reporting purposes and to identify any new risks and opportunities which may arise.
RBS are recommended to be used to identify potential risks.

Implementation of the RMP shall be achieved through the following measures by:

a) Distribution of this RMP to all Project team members.

b) Meeting and Training personnel in the use and purpose of this RMP.

c) Workshops for all relevant Project team members to identify and assess the risk and
make response actions

d) Monitoring conformity with this RMP.

e) Operational supervision of the execution of the response actions.

f) Monthly update of the Risk Management Activities.

14
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE15/21
Project Risk Management Plan Bid Document
REV. 02

7. Communication

A proper Risk Management must include efficient and clear communication amongst the
stakeholders so that the interests of all stakeholders are met ultimately for the success of the
Project.

Such an exchange between the different parties will allow managing the risk in a more reliable,
truthful and accurate way than simply keeping the process within only one stakeholder. This
consideration stands particularly true when the risks are not within the Contractor’s control to
manage.

The communication process is governed by other procedures. However, in simple terms to the
effect of communicating for Risk Management purposes, the Contractor has established the
following guidelines:

Action Output
Update the Risk Register
Prioritized list of risks
Monitor the emergence of new or changing risks
Workshop / Meeting within
Status and progress of main attention in top risks
Project Team and
Stakeholders Change requests
Results and interpretation of analysis
Update risk treatments

8. Appendices

Appendix A-Risk Qualitative Analysis Form

15
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE16/21
Project Risk Management Plan Bid Document
REV. 02

Appendix B-RBS

Appendix C-Risk Register

16
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE17/21
Project Risk Management Plan Bid Document
REV. 02

Appendix A Risk Qualitative Analysis Form

No Risk Description of Possibility of risk Severity of the Risk

. Catalogue Risk occurrence hazard score

17
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE18/21
Project Risk Management Plan Bid Document
REV. 02

Appendix B RBS

SN. Category
1 Social and Political Environment Risk
2 Natural / Environmental Risk
3 Legal and Law Risk
4 Financial and Taxation Risk
5 Contractual Risk
6 Owner Risk
7 Joint Venture Risk
8 Supply Chain Risk
9 Technology Risk
10 Time Risk
11 Cost Estimation Risk
12 Management Risk
13 HSE Risk
14 Compliance Risk
15 Other Risk

18
 Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE19/21
Project Risk Management Plan Bid Document
REV. 02

Appendix C Risk Register

Assessment before taking Assessment after taking response

Risk Response/Treatment
response activities activities
Detail
No. Name Description Estimated Remarks
Affected Possibility Estimated Affected Possibility Detailed Personal Estimated
of risk outstanding Estimated
value of risk value of value of response in completion
value of cost
on cost occurrence risk on cost occurrence activities charge date
risk

19
Logo of Logo of consortium
member (if any) Middle East PV IPP Project
Client

PAGE20/21
Project Risk Management Plan Bid Document
REV. 02

20