pro

mrga07

1H-011_RiskManagementPlanCrossrail.pdf

Home >Business & Finance homework help >Operations Management homework help >pro

Le arn

ing Le

ga cy

D oc

um en

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

PROGRAMME CONTROLS

RISK MANAGEMENT PLAN

Document Number: CR-XRL-Z9-GPR-CR001-00014

(Supersedes: CR/QMS/COM/S/0811)

Document History:

Revision Prepared Date: Author: Reviewed by: Approved by: Reason for Issue 1.0 13-04-10 First Issue

2.0 23-06-11 Second Issue, to reflect re-

organisation

3.0 15-06-2015 Update to reflect org changes

Business Owner (if different to Author):

This document contains proprietary information. No part of this document may be reproduced without prior written consent from the chief executive of Crossrail Ltd.

This document is shared for the purposes of learning legacy. It is a snapshot in time and hence many of the links within the document will become obsolete over time. Some links/document references will refer to a document storage location that isn't accessible. Users should refer to the learning legacy website where these documents may be published separately.

karen elson

Typewritten Text

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan

CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 2 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

Contents 1 Introduction ............................................................................................................... 4

2 Purpose: ..................................................................................................................... 4

2.1 Objectives: ................................................................................................................ 4

3 Scope ......................................................................................................................... 5

3.1 Scope of Risk Management: .................................................................................... 5

4 Key Definitions .......................................................................................................... 7

5 Responsibilities and Accountabilities ..................................................................... 8

5.1 Role of the Accountable Manager ........................................................................... 8

5.2 Risk Management Organisation .............................................................................. 8

5.3 The Role of Crossrail ............................................................................................... 9

5.4 The Roles of Individuals within Crossrail ............................................................... 9

5.5 The Roles of Crossrail’s Industry Partners .......................................................... 10

5.6 The Roles of Contractor’s working for Crossrail ................................................. 11

6 Governance .............................................................................................................. 11

6.1 Audit Committee ..................................................................................................... 12

6.2 Risk Sub Committee ............................................................................................... 12

6.3 Programme Risk Panel .......................................................................................... 12

6.4 Area/ Function Governance ................................................................................... 13

7 Risk Management Process ..................................................................................... 13

7.1 Generic Process Description ................................................................................. 13

8 Interface with Other Processes .............................................................................. 15

8.1 Health and Safety ................................................................................................... 15

8.2 Issue Management ................................................................................................. 16

8.3 Trend Management and Change Control .............................................................. 16

8.4 Investment Authority Process ............................................................................... 17

8.5 Procurement Process ............................................................................................ 17

8.6 Cost Management .................................................................................................. 17

8.7 Contingency Management ..................................................................................... 17

9 Quantitative Risk Assessment ............................................................................... 18

10 Risk Appetite and Escalation ................................................................................. 19

10.1 Risk Appetite .......................................................................................................... 19

10.2 Risk Escalation ....................................................................................................... 19

11 Risk Reporting ......................................................................................................... 20

11.1 QRA Report ............................................................................................................. 21

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan

CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 3 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

12 Awareness and Training ......................................................................................... 21

13 Risk Management Systems .................................................................................... 21

14 Reference Documents ............................................................................................ 22

15 Standard Forms / Templates .................................................................................. 22

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan

CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 4 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

1 Introduction

Managing risk and uncertainty is vital to the successful delivery of Crossrail. This Risk Management Plan describes the activities, governance, roles, responsibilities and process which are required to ensure that Crossrail manages its risks effectively. It forms part of a consistent suite of documentation which describes Crossrail’s risk management approach.

2 Purpose:

The purpose of this document is to provide a high level overview and description of the Crossrail’s approach to risk management. This Risk Management Plan includes:

 High level overview and description of the Crossrail risk management process;

 Description of the high level roles, responsibilities and accountabilities for managing risk;

 Description of Crossrail’s risk management governance arrangements;

 Description of risk management interfaces;

 Summary of Crossrail’s risk appetite and the escalation procedure; and

Description of the purpose, frequency and scope of risk reporting.

2.1 Objectives:

Managing risk and uncertainty is vital to the successful delivery of Crossrail. Crossrail is accountable for delivering a new world class, affordable railway safely through effective partnerships. Crossrail must do this with incomplete knowledge of future events, in a complex environment and within known funding and timing constraints.

Crossrail’s risk management process provides a structured approach to the identification, assessment and treatment of risks to ensure project success by minimising threats and maximising opportunities.

The objectives of Risk Management are to:

 Support the delivery of Crossrail by reducing the likelihood and potential consequences of events that could have a negative effect on the project and increasing the likelihood and potential consequences of events that could have a positive effect on the project;

 Provide assurance to internal and external stakeholders that the project understands its significant risks and is actively managing them;

 Improve decision making, planning and prioritisation by improving understanding of uncertainty and risk.

This Risk Management Plan forms part of a consistent suite of documentation to describe Crossrail’s risk management approach and has been developed with reference to ISO31000:2009 Risk management – Principles and guidelines and the Joint Code of Practice for Risk Management of Tunnel Works in the UK.

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 5 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

3 Scope

The scope of this plan includes the management of all categories of risk during design and construction and during commissioning and handover to operation. Crossrail has established a structured hierarchy of risk information defining Strategic, Programme, Area, Project and Contract risk levels.

The plan describes the responsibilities and accountabilities for managing risk for individuals within Crossrail and between Crossrail and its Delivery and Industry Partners.

The key elements of risk management governance within Crossrail are Audit Committee (a committee of the Crossrail Board), the Risk Sub-Committee (a sub-committee of ExComm) and the Programme Risk Panel (made up of members of the Programme Executive or their delegates).

This plan describes the standard risk management process for Crossrail. This provides a systematic approach to managing risks and represents a generic process to be applied throughout the programme. The plan also describes some key areas of interface including Health and Safety, Change Control and Contingency Management.

The plan describes the purpose and contents of the key reports which will be produced as part of the process.

The plan also defines the principles by which Crossrail will establish its Risk Appetite and the mechanisms by which risks will be escalated

3.1 Scope of Risk Management: The Risk Management Plan forms part of a consistent suite of documentation to describe Crossrail’s risk management policy and process, which is shown below.

Risk Management framework of documentation

This Risk Management Plan will apply to Crossrail and to all Crossrail’s Industry Partners. It will be used as information for the wider Crossrail supply chain. This plan sets out the activities which will deliver an appropriate programme of Risk Management to ensure that the Crossrail project and programme risks are effectively managed and controlled.

Le arn

ing Le

ga cy

Le arn

ing Le

ga cy

Risk Management

Plan

Le ga

Risk Management

Policy

Risk Management

Procedure

Le arn

ing

Le arn

ing

Risk Management

Agreement LU

LU Risk Management

Pan

Contractor Risk Management

Pan

Contractor Risk Management

Pan

Contractor Risk Management

Pan

QRA Procedure

Opportunity Management

Procedure

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan

CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 6 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

Crossrail will reflect Health and Safety risks which could affect project objectives in its overall risk management process, however the identification, assessment and management of safety risk is not covered within the scope of this plan. Guidance is given in the Health and Safety Manual.

The scope of the plan includes the management of all categories of risk, both during design and construction and during commissioning and operation. This includes:

 Business Risks (including Funding and Delivery risks);

 Engineering and Design risks;

 Interface and Logistics risks;

 Environmental risks;

 Quality risks;

 Business Continuity risks;

 Security risks;

 Fraud risks.

Crossrail has established a clear hierarchy to manage risk information at the correct level within the programme. The hierarchy defines five levels:

 Strategic;

 Programme;

 Area;

 Project; and

 Contractor.

Establishing a hierarchy for risk information ensures that risks are managed at the most appropriate level in the organisation. Although the principles of risk management at Crossrail will be common, the mechanisms for managing risks in each level of the hierarchy may be different. (Note that the level at which a risk is managed may differ to the contingency level from which it is funded.)

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 7 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

Crossrail hierarchy of risks

Risks may be escalated or delegated between levels to ensure that they are managed by the party best placed to manage the risk and at the most appropriate level in the organisation.

Risks will be managed through a tiered system of risk registers which closely reflects the organisation and accountability breakdown structure.

4 Key Definitions

Risk: An uncertain event or set of circumstances that, should it occur, will affect the project’s objectives. Note that risks could have negative effects (threats) or positive effects (opportunities).

Risk Exposure: Potential exposure over and above the estimate (e.g. cost or time) which could arise as a result of the impact of one or more risks.

Contingency: A budgetary allowance made specifically to cover the cost of change, risk or unforeseen event. To be allocated and expended in accordance with the governance procedure.

Issue: A currently occurring event that is already impacting achievement of the programme objectives (sometimes referred to as ‘Critical Issue’).

Strategic Risks

 Externally-driven relating to funding, market and economic factors, industry and stakeholder relations;

 Summarise key areas of risk within the programme for reporting to the Crossrail Board and Sponsors.

Area Risks

 Risks associated with delivery of Area scope and coordination, interfacing and integration of projects

Contractor Risks

• Risks which the Contractor is best placed to manage

Programme Risks

 Associated with coordination, interfacing and integration of Areas;

 Significant risks which cannot be resolved within Areas; or

 Risks to Crossrail’s functional requirements.

Project Risks

 Risks associated with delivery of Project scope

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan

CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 8 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

5 Responsibilities and Accountabilities

5.1 Role of the Accountable Manager

The Risk Management Plan recognises the role of Accountable Manager. The Accountable Manager is the person accountable for delivery of an element of work and who is accountable for managing the risks associated with delivering that work. Typically this will include the Chief Executive Officer, Programme Director, Delivery Director, Area Directors and Project & Functional Managers. The risk management organisation provides support and guidance to the Accountable Manager in managing their risks.

The Accountable Manager’s risk management responsibilities include:

 Maintaining a risk register in accordance with the Risk Management Procedure, for the scope and project objectives for which they are accountable;

 Ensuring that the Risk Management Procedure operates fully within their teams, and make adequate competent resource available to ensure that risk management obligations are met; and

 Ensuring that all other relevant parties and perspectives (Area Managers (Delivery and Functional), Project Managers, Contractors, stakeholders and specialists) are appropriately engaged in the identification, assessment and management of risks in their area.

5.2 Risk Management Organisation

The risk management organisation is made up of Risk Managers and Analysts who support Accountable Managers by:

 Facilitating the identification of risks through facilitated workshops, data analysis etc.;

 Informing management priorities by assessing risks impacts;

 Supporting the development of effective response plans to mitigate risks;

 Helping, where possible, to expedite those response plans;

 Monitoring performance on identified response actions; and

 Informing decisions by providing qualitative and quantitative analysis of cost and schedule risks

The risk management organisation comprises a core risk management team operating within the Programme Controls directorate which acts as the owner of the risk management processes and procedures. The risk management organisation is shown below.

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 9 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

5.3 The Role of Crossrail Under the terms of the Project Development Agreement, Crossrail is the programme manager, systems integrator and delivery agent for the Central Section and bears the majority of risk associated with the delivery of Crossrail. As a result, Crossrail must:

 Develop and implement a risk management policy and plan for Crossrail;

 Develop and implement processes and procedures for managing risk;

 Actively manage the risks for which Crossrail is responsible;

 Provide assurance that risk management carried out by the Industry and Delivery Partners is competent and effective;

 Maintain a useful, accurate and up-to-date Crossrail risk database, ARM;

 Carry out a programme-wide cost and schedule Quantitative Risk Assessment (QRA) to inform reporting of Anticipated Final Cost (AFC) and schedule confidence.

5.4 The Roles of Individuals within Crossrail Risk management is an essential part of good project management and is a central responsibility of all those working on the programme. Risks should be managed by the party best placed to manage the risk and at the most appropriate level in the organisation.

The following individuals have specific accountabilities and responsibilities for managing risk.

Finance Director

Chief Executive

Area Director

Programme Controls Director

Area Director

Programme Director

Area Commercial and Controls Director

Delivery Director

Head of Risk Management

Area Risk Manager

Doc um

en t

Doc um

en t

Area Risk Manager

Core Risk Management

Function

Doc um

en t

Doc um

en t

Doc um

en t

Doc um

en t

Area Risk Team

Doc um

en t

Area Risk Team

Le ga

cy D

oc um

en t

Risk Management Organisation (Indicative)Doc um

en t

Doc um

en t

etc

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan

CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 10 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

5.4.1 Head of Risk Management

The Head of Risk Management’s responsibilities include:

 Providing functional leadership in Risk Management across the programme;

 Developing and implementing Crossrail’s Risk Management Plan;

 Determining competency standards for those involved in risk management and ensuring that training is available;

 Ensuring that risk management activity on Crossrail is of an appropriate standard;

 Ensuring that risk management complies with the requirements of TfL;

 Leading assurance activities in the area of Risk Management;

 Reporting on risk to the Crossrail Executive and Board;

 Reporting on risk to the Sponsors and other external stakeholders; and

 Conducting the Crossrail programme-wide QRA.

5.4.2 Area Risk Manager

Area Risk Managers are embedded in delivery teams with line management reporting to Area Commercial and Controls Directors (or Area Business Managers, depending on the Area) and functional reporting to the Head of Risk Management.

Risk management responsibilities include:

 Ensuring that all teams within the Area (including their respective Contractors) follow the risk management procedure, and alert non-compliances;

 Ensuring that all teams within the Area (including their respective Contractors) use the designated tools to maintain up-to-date data which is of suitable quality in accordance with the process, and alert significant errors;

 Ensuring that records are held to demonstrate risk management practices follow the risk management procedure (e.g. records of meetings, approvals); and

 Liaising with the Crossrail Head of Risk Management to ensure continued alignment in approach with requirements.

5.5 The Roles of Crossrail’s Industry Partners

Crossrail has a number of Industry Partners. The roles of the key industry Partners are discussed in Crossrail’s Management Plan Volume 1 Ref 1

The roles and obligations in relation to risk management will be addressed in specific arrangements with Crossrail and will address the following:

 Roles and Responsibilities in relation to Risk;

 Risk Management governance arrangements;

 Reporting requirements and information handling protocols; and

 Arrangements for Crossrail’s audit and assurance of Industry Partners’ risk management functions.

Under these arrangements, all Industry Partners will be required to:

 Develop and implement a risk management plan and process, which aligns with the principles laid out in this plan;

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan

CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 11 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

 Actively manage the risks for which they are responsible;

 Take measures to inform Crossrail immediately about any emerging risks that they are not best placed to managed;

 Report to Crossrail their key risks and risk management performance on a regular basis;

 Support Crossrail in carrying out the Crossrail cost and schedule QRA;

 Manage the interface risks between Crossrail and Industry Partners and report their status to Crossrail on a regular basis.

In addition, Industry Partners may be required to record risk information on the Crossrail Risk database where appropriate.

5.6 The Roles of Contractor’s working for Crossrail

Crossrail will engage a large number of contractors in delivering the Works. The role and obligations of the contractors in relation to risk management will be detailed within the works information of the contract which will place emphasis on the contractor to manage its risks consistent with Crossrail’s Risk Management Policy and Plan.

6 Governance

Risks and issues should be considered as agenda items at all of the main committees and meetings throughout the programme. The Crossrail Board has overall responsibility for risk management on Crossrail and is responsible for setting Crossrail’s risk appetite.

In order to develop and oversee the functioning of the risk management process, Crossrail’s Risk Management Governance has a number of key elements (as highlighted in the diagram below).

Risk Management Governance meetings

High Level Risk Meetings

Review Area and Project RisksPeriodicLine Management Review

Report Key Area and Project RisksPeriodicArea Performance Review

Report Strategic Risks in detailPeriodicExComm

Review Strategic, Programme Risks in detailQuarterlyAudit Committee

Review Strategic, Programme Risks

and Risk Management Performance

PeriodicRisk Sub-Committee

Periodic

Quarterly

Frequency

Report Summary of Strategic RisksCrossrail Board

Forum Agenda

Programme Executive Report Programme Risks in PDR

Programme Risk Panel Review Specific Risks, Responses in detail

2. Risk Management Process

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan

CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 12 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

6.1 Audit Committee

The Crossrail Audit Committee is a sub-committee of the Board and meets four times a year or at such other frequency as determined from time to time by the Chair. The duties and responsibilities related to Risk Management are:

 To obtain assurance as to the adequacy of the systems of internal control in place throughout the Company. Internal control is not restricted to financial control but includes, amongst other things the arrangements that management has put in place for:

o the systematic identification of business risks and mitigating controls and procedures for ensuring these are properly implemented and effective; and

o ensuring a systematic approach to minimise the risk of fraud.

 To consider and report to the Board matters relating to risk management.

The Audit Committee should on an annual basis review the suitability and effectiveness of Crossrail’s arrangements for managing risk.

6.2 Risk Sub Committee

The Risk Sub-committee will advise on, assist, make recommendations and report, as the context requires, to the Executive and Investment Committee in order to facilitate its and the Board’s:

(i) Understanding of Crossrail’s key Strategic, Programme and Project risks and the controls that are put in place to manage them;

(ii) Understanding the performance of Crossrail’s risk management, the risk profile of the programme and its movement over time;

(iii) Understanding, reviewing and monitoring of the Quantitative Risk Assessment and the level of Risk Exposure relative to the Contingency Provision; and

(iv) Understanding, reviewing and monitoring any other risk areas the Sub-committee considers appropriate.

The Risk Sub-committee shall develop and establish appropriate policies and procedures to ensure that there is proper assessment and management of risk throughout the Programme.

On an annual basis, the Risk Sub-committee will conduct a review of the suitability of the Risk Management Plan and the capability and competence of the programme to deliver it and will report their findings to the Audit Committee.

6.3 Programme Risk Panel

The Programme Risk Panel is chaired by the Programme Controls Director, is attended by the Programme Leadership Team or their delegates and has the following Terms of Reference relating to risk management:

 Review the high priority Programme Risks.

 Review the risk responses and evaluate their effectiveness.

 Endorse the high priority Programme Risks for inclusion in the periodic reporting.

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 13 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

6.4 Area/ Function Governance Each delivery Area / Function will put in place appropriate mechanisms to review risk management performance. Areas / Functions will be required to report risk for review within the Area / Function performance review as required by the Programme Controls Director.

7 Risk Management Process

7.1 Generic Process Description The standard risk management process for Crossrail is shown below. This provides a systematic approach to managing risks and represents a generic process to be applied throughout the programme. The risk management process is iterative and continuous, although formal reporting of risk will be on a regular basis as defined later in this document.

Standard risk management process based on BS31100.

All risk information generated by Crossrail will be recorded on the Crossrail risk database. Risk information will be integrated into the programme data model and subject to quality control and performance measurement.

7.1.1 Plan

Risks should be identified with reference to the objectives of the work under consideration. Objectives for the Area / Function, teams and individuals should be clearly defined and communicated in the Delivery Strategy and Management Plan. A useful first stage in the risk management process is to review those objectives to ensure that they remain comprehensive, up to date and relevant to the wider objectives of the programme.

7.1.2 Identify

Risk identification should be approached methodically to ensure that all significant sources of risk are identified and recorded. Risks will be recorded within the appropriate risk register within the Risk Management database.

7.1.3 Assess

Risk Assessment involves the analysis of individual risks and their aggregate effect, and evaluation against a defined level of Risk Appetite.

Assessment of the severity of a risk drives management attention and supports planning for risk mitigation. A risk assessment scheme consisting of qualitative probability and impact scales and a Probability Impact Diagram (PID) is used to assess the severity of a risk.

Identify Assess Respond

ReviewReportMonitorPlan

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan

CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 14 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

The Accountable Manager will be responsible for ensuring that all risks are analysed qualitatively and the level of management and monitoring a risk should receive is based on its Severity.

Risks should be assessed on the basis of probability and ‘average’ impact should the risk occur. Impacts should not be ‘worst case’ but should be a reasonable.

The main Impact Categories considered in Crossrail are:

Impact Category Metric

Health and Safety Lost Time Injuries, RIDDOR Reportable events, Fatalities

Environment Environmental impact, Environmental harm

Capital Cost Annual cost impact, Anticipated Final cost impact

Time Critical path delays

Reputation Local/National Media reporting levels

Quality Non conformance

Crossrail Railway Operations

Annual cost or revenue, loss or disruption to service, Impact on customers

3rd Party Impacts Impacts on third party services

Table of Impact Categories

Risks exposure should be assessed at Current (pre-mitigation) and – once a response has been identified – at Forecast (post-mitigation) levels. As part of establishing Current risk exposure, Existing Controls should be reviewed.

Crossrail will employ Quantitative Risk Assessment (QRA) to evaluate the aggregate impact of the identified risks on the cost and schedule (see section 7).

7.1.4 Respond

For each risk, the risk owner must establish an appropriate level of mitigation. Control measures in addition to the existing controls may be needed to achieve this level of mitigation. Risk responses may include measures to Tolerate (Accept), Terminate (Avoid), Transfer or Treat (Reduce) the level of risk exposure to the programme.

Responses should be allocated to a Response Owner, who is the person responsible for implementing the response. The Response Owner should develop and implement an appropriate response and report to the Risk Owner on its status. Note that the Response Owner and Risk Owner may or may not be the same person.

7.1.5 Review

The Accountable Manager should regularly review the output from the risk management process to ensure that risks are being appropriately managed, and that the risk data remains accurate and reliable. Specifically this should cover the risk profile and the key risks identified and how these are changing in time, the progress of actions to treat key risks, whether risks are being managed within the target.

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan

CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 15 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

7.1.6 Report

Key outputs from the risk management process are reported on a regular basis in order to inform management and support decision making.

All risk reports should be produced from a single set of risk information and will have a consistent format and vocabulary.

The information reported should include:

 Significant risks;

 The aggregate effect of risks (risk profile);

 Progress on risk management actions.

 The trend in exposure over time; and

 Performance against target;

Risk information should form a key part of all standard reports but in addition, dedicated risk reports will be produced. Section 9 includes further information on reporting.

7.1.7 Monitor

Continuous systematic and formal monitoring of implementation of the risk process and outputs need to take place against appropriate performance indicators to ensure process compliance and effectiveness. Monitoring may take a variety of forms and range from self-assessment and internal audit to detailed reviews by independent external experts. Risk Managers will work with Accountable Managers to develop and establish suitable performance indicators to provide an efficient monitoring method.

8 Interface with Other Processes

8.1 Health and Safety

Crossrail's Target Zero philosophy and improvement initiatives target the behaviours that are precursors to risk.

The identification and management of health and safety risk is the responsibility of the relevant duty holder as defined in UK law. There is no common process for the identification, assessment, elimination and mitigation of health and safety risk, or collation of all risks, for all parts of the Crossrail family (Crossrail, its partners, designers and contractors etc) and nor would this be appropriate. Crossrail does however facilitate processes for the sharing of information on health and safety risk with those that need it. These processes are numerous and include:

 Designers risk registers;

 Interface Design Review Meetings;

 Discipline Design Review Meetings;

 Pre-construction information packs ;

 SHE notes on drawings;

 Project Manager Contractor Meetings;

 Project Wide Hazard Record (dealing with future operations risk).

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan

CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 16 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

Crossrail monitors these processes to provide assurance that they are effective. Significant risk can be elevated from designers and constructors and industry partners into the Project, Programme and Strategic risk registers in ARM, particularly where it is identified that Crossrail needs to take a lead.

8.2 Issue Management

An Issue is defined as a currently occurring event that is already impacting achievement of the programme objectives. The relationship between Risks, Issues and Trends is illustrated below.

Key Issues are reported as part of regular performance reporting at the Contract, Project, Area and Programme levels. Where issues are reported, the subsequent report should contain an explanation of how the issue has been resolved.

Relationship with Trends/ Issues etc

8.3 Trend Management and Change Control

The Trend Management and Change Control process provides early identification and authorisation of all potential changes to the agreed programme and project baselines. The Change Control is a formal process used to change the Programme Baseline and to ensure that changes to the programme are introduced in a controlled and coordinated manner.

Change proposals should be reviewed against the programme’s overall risk exposure to check:

 Reduction in the programme’s overall risk exposure as a result of risks crystallising into changes;

 Changes in risk exposure as a result of changed approach - increase or decrease in risk;

 Uncertainty and risk associated with the revised estimates as part of the Impact Assessment.

Changes to the programme risk exposure should only be made once the change has been formally approved and it has been accepted into cost.

Relationship with Trends/ Issues etc

Management Information

(QUALITATIVE)

Cost Forecasting (QUANTITATIVE)

Issues

‘are happening’‘may happen’

Unresolved Resolved

‘knowns’

time

‘unknowns’

Trends

Risks

Risks (QRA)

2. Risk Management Process

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan

CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 17 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

For all assessments of risk exposure, an understanding of relevant approved and unapproved trends and/or changes is required.

8.4 Investment Authority Process

The Investment Authority Process requires an assessment of risk exposure for contracts at PTBA and IA stages. Risk Managers will work with the Project Manager to identify and quantify the risks associated with the contract concerned. Risk Managers will facilitate quantitative risk assessment of the identified risks.

8.5 Procurement Process

The procurement process requires that the allocation of risks between Crossrail and the Contractor is understood. Risk Managers will work with the Procurement lead to identify and correctly allocate the risks within the Risk Allocation Summary template included in the full procurement plan template. Risk allocation will be monitored and updated during the procurement process.

8.6 Cost Management

Cost management will use the forecast risk exposure calculated from Project QRAs as part of the forecasting of Anticipated Final Cost (AFC). Project QRAs will be run on a quarterly basis with the results provided to the cost management team to be included in the Periodic Cost Report.

8.7 Contingency Management

Contingency will be managed at two levels:

Delivery Contingency – a fund allocated to the Project Manager to allow them to manage risks relating to their work scope in an effective and efficient way within delegated authority limits.

Programme Contingency – a fund held by the Crossrail organisation, outside of the control of the individual Project Managers, to cover programme-wide or unforeseen risks.

The Programme Wide Contingency has been established with reference to an assessment of the Programme-wide risk exposure derived through the Crossrail Risk Model. From this, Delivery Contingency will be allocated to the relevant Project as each contract within the project is granted Investment Authority. Contingency will not be allocated to individual risks.

Risk exposure will be reassessed by re-running the Crossrail Risk Model on a regular basis and a comparison made with the remaining contingency to ensure funding sufficiency. This comparison will be carried out at the Investment and Change Sub Committee and through other reporting mechanisms.

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 18 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

9 Quantitative Risk Assessment

Crossrail will conduct Quantitative Risk Assessment (QRA) to evaluate the aggregate exposure of the identified risks on the cost and schedule and to prioritise risks and inform the risk management process.

QRA should:

 Make a robust and accurate assessment of Crossrail’s risk exposure using representative models that accurately reflects the nature of the risk.

 Identify the key risks which affect the cost and schedule;

 Create a transparent record of the assessment which supports the published outputs and facilitates subsequent phases of the risk management process.

QRA will be carried out for Projects, Areas and Programme-wide elements and combined into a comprehensive assessment – the Crossrail Risk Model (CRM).

The programme-wide QRA will be conducted on a quarterly basis or more frequently as required. This will consider risks to both cost and schedule. Risks at all levels (i.e. Strategic, Programme, Area and Project) will be reviewed with a view to establishing the quantified impact on cost estimate and baseline schedule. The QRA will assess risk exposure at the Forecast i.e. post mitigation level.

Both cost and schedule QRA will be undertaken on a project basis to support investment decisions, project change and options appraisals where risk may be a factor and to understand changes in risk exposure during the project lifecycle.

As part of the procurement process, cost and schedule QRA should also be conducted on significant contracts prior to contract award in order to ensure that risk transfer through contracts is well understood and cost effective.

For more details refer to Quantitative Risk Assessment Procedure Ref 2.

Le ga

cy D

oc um

en t

Le ga

cy D

oc um

en t

Programme-wide elements QRA

Le ga

Project QRAs

Le ga

Area QRAs

Doc um

en t

Doc um

en t

Crossrail Risk Model (CRM)

- Sum of programme-wide, sub-programme elements and project QRAs

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan

CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 19 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

10 Risk Appetite and Escalation

10.1 Risk Appetite

In its capacity as programme manager, systems integrator and delivery agent (for the Central Core Area) Crossrail bears the majority of risk associated with delivery of Crossrail with limited opportunity to transfer risk to third parties. Crossrail has no right of relief offered by the Project Development Agreement.

Defining a risk appetite determines the way that the organisation chooses to prioritise risks. The figure below shows the risk assessment criteria that are used at Strategic and Programme level within Crossrail.

Each Severity Status carries a Risk Appetite Statement which gives guidance as to the level of response that is required.

Probability Impact Diagram

Severity Status

Risk Appetite Statement

High

This level of risk is generally unacceptable and priority should be given to develop action plans to reduce risk to a lower level wherever possible and practicable. Risks at this level can only be tolerated where all reasonable measures have been taken to mitigate the risk.

Medium This level of risk is undesirable and action plans should be developed to reduce risk to a lower level wherever prudent.

Low

As a general principle, risks should be mitigated to as low a level as possible (towards the bottom left of the map) - but only as far as the benefits gained from risk reduction outweigh the costs of mitigating the risk.

Risk Appetite Table

10.2 Risk Escalation

Risks should be managed by the party best placed to manage the risk and at the most appropriate level in the organisation. Risks may need to be escalated up the management chain – either within or between the levels of hierarchy (i.e. Strategic, Programme, Project or Contractor).

Accountable Managers, with the assistance of Risk Managers, should identify any risks which are to be considered for escalation in their regular reporting cycle. These will then be reviewed with line management at risk review meetings, as specified within the Programme Controls

Impact

1 3 20 100 1000 Threats Insignificant Minor Moderate Major Severe

16 Very High 16 48 320 1600 16000

12 High 12 36 240 1200 12000

8 Medium 8 24 160 800 8000

4 Low 4 12 80 400 4000 Pr

ob ab

ili ty

2 Very Low 2 6 40 200 2000

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan

CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 20 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

Governance structure, in order to review and approve the escalation of the risk. This cycle of review is repeated up the organisation structure.

When selecting risks to escalate, these factors should be considered:

 Is any single risk so significant that it should be escalated to the next level?

 Are there any common causes of risk that should be escalated?

 Do any of the identified risks have consequential effects to the wider programme which are significant enough for that risk to be escalated to the next level?

 Do any risks require responses which can only be implemented by the next level of management?

Note that escalating risk does not transfer the ownership of risk, but allows the Accountable Manager at the higher level to understand the risks within their responsibility.

11 Risk Reporting

Reporting on key risks and risk management performance should be a standard part of performance reporting.

A standard format for risk reporting within the Crossrail organisation is shown below.

The Accountable Manager has discretion to select Top 5. Their selection should not be limited to the most severe risks and should consider:

 Severity;

 Proximity; and

 Decision Required.

Schematic of Risk Reporting

Information on key Risks and Risk Management performance should be included in Area Directors Report, Programme Directors Report, Board Report and Sponsors Dashboard.

Significant Risks

What are the significant risks?

Selected by:

- Severity - Proximity - Decision Required -

Risk Profile

How risky is this project?

Progress with Actions

Are Risk Management actions completed and effective?

Performance

Is the risk exposure reducing?

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan

CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 21 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

11.1 QRA Report

The purpose of the programme-wide QRA report is to summarise the latest programme wide cost and schedule risk assessment. The report includes a description of the inputs and results and identifies the key drivers to change in risk exposure. The report is submitted to Risk Sub Committee on a six monthly basis in line with the Semi Annual Construction Report.

12 Awareness and Training

Risk Management has been recognised as a key component of Crossrail’s culture. The intention is that the pro-active management of risk is accepted and adopted as a behaviour across the programme to support the Vision and Values. To this end, risk management is one of five key skill areas identified by the Organisational Development Plan.

The key elements of the Organisational Development Plan which relate to risk management are:

1. Developing Crossrail culture:

 Develop a coordinated plan to communicate the benefits of risk management and clear accountability for managing risk;

 Engaging Industry and Delivery partners in developing risk management approach;

2. Developing organisational capability:

 Develop a competence framework for risk management and provide training to support this;

 Risk Management included job descriptions where appropriate;

 Establish an appropriate risk management organisation;

3. Establish performance indicators for risk management.

13 Risk Management Systems

Crossrail will use the Active Risk Manager software (ARM) to record and update all risk information within Crossrail. Access to ARM will be given to all Crossrail Staff who require and will have write access to individual registers within the database as agreed by the Accountable Manager responsible for that register.

Contractor’s staff will be expected to input the high-level risks into ARM for their contract in accordance with the Works Information.

Le arn

ing Le

ga cy

D oc

um en

Risk Management Plan

CR-XRL-Z9-GPR-CR001-00014 Rev3.0

Page 22 of 22

Valid only if viewed through the CRL Management System Portal on Crossrail Connect

CRL RESTRICTED

14 Reference Documents

Ref: Document Title Document Number:

1. Crossrail’s Management Plan Volume 1 CR-XRL-O4-GPG-CR001-00001

2. Quantitative Risk Assessment Procedure CR-XRL-Z9-GPD-CR001-50004

15 Standard Forms / Templates

Ref: Document Title Document Number:

A. None