overall objective is to recognise which risks to address and which risks to accept and to confidently
select the best value response.
As part of this process, examine risks at the project or program level to develop wider decision rules
for controlling and managing risk at a strategic level. Identify common risks and general responses
that occur in more than one circumstance or that have wide potential effects.
Selecting the most appropriate option involves balancing the cost of implementing each option against
the benefits it offers. Generally the cost of managing the risk needs to be commensurate with the
benefits derived.
Develop management measures and risk action schedules
For moderate risks, management measures should be prepared. These are simple action statements
that specify the activities necessary to meet the risk event.
For major risks, risk action schedules should be developed to enable successful Risk Management in
practice and over time.
Appendix C provides the outline of a typical risk action schedule. The risk action schedule should
assign individual responsibilities and time frames and identify those who are responsible for follow-up.
Risk action schedules may be applied by the agencies responsibile for undertaking or overseeing
large procurements or for managing assets.
Alternatively, or in addition, agencies might require them to be developed and implemented by
contractors providing products or services to the public sector, as part of their control and oversight
procedures.
4.4 Formal reporting
Formal reporting is an important phase of the Risk Management process, particularly given what may
be long project lead times, complex procurements and lengthy operational life cycles.
For formal reporting of designated or major undertakings, a Risk Management Plan summarises the
results of the Risk Management process, action strategies and implementation framework. In
particular, it describes the Risk Management measures and action schedules to be implemented to
reduce and control risks.
The Plan includes provision for implementation and ongoing reporting. Appendix A provides a typical
format for a Risk Management Plan.
For projects that are not designated, collation and summary of action schedules and management
measures provides an adequate basis for reporting.
For a summary of reporting requirements see
Table 1 Policy requirements summary, (Page 7).
Reporting
4.5 Risk Management implementation
The most important task in Risk Management is implementing the action schedules and management
measures and allocating management resources. This should be followed by monitoring the
effectiveness of these measures over time. Planning for implementation requires particular attention
to resources required, management responsibilities and timing of tasks.
Monitoring of risks and Risk Management effectiveness should be a routine and recognised activity.
The frequency of monitoring, and the responsibility for it, should be specified in either the Risk
Management Plan or summary documentation.
Review and evaluation
Ongoing review of the proposal or project and the evaluation of risks is essential to ensure a Risk
Management Plan or action schedules remain relevant. As the proposal or project proceeds and the
focus changes from strategic concerns to more operational ones, different forms of risk analysis and
Risk Management may be needed. The review process should be specified in the Risk Management
Plan or summary documentation.
4.6 Advanced techniques and software
Many specialised techniques have been developed to assist managers undertaking risk analyses and
Risk Management. Some have wide application, while others are specific to particular kinds of assets
or risks. The table below summarises a few of them.
These techniques and tools enhance the role of the manager. They provide assistance in analysis and
evaluation tasks, but do not substitute for good judgement and management experience.
Table 3 Risk Management: specialist techniques
Techniques
Applications
Sensitivity analysis
Very wide application, from economic appraisal and financial
feasibility to operations and maintenance models
Scenario analysis
Economic appraisals and feasibility studies
Decision analysis
Choice amongst uncertain alternatives
Risk engineering
Wide application to proposals, projects and budgets, through all
stages in the life of an asset
Failure modes, effects and criticality analysis
Analysis of designs and operating plants; may be directed to
safety, plant integrity or ensuring production is maintained
Fault tree analysis
Identifies the causal factors that may lead to a risk arising
Event tree analysis
Identifies the consequences of an initiating event
Hazard analysis, HAZOP
Safety analysis for operating plant
Probability assessment
Quantification of risk probabilities and consequence distributions
Implementation
Risk surveys
Continuing monitoring of risk in a project or a pool of assets, to
identify high-risk areas
5 Checklist for Risk Management
Stage 1 Initiation
Assemble Risk Management resources
Appoint the team leader and ensure a breadth of skills/experience within the team
Assign Risk Management responsibilities appropriate to task
Stage 2 Proposal familiarisation
Specify objectives and criteria
Familiarise the team with the proposal, assemble documentation and define the key
objectives
Assess the proposal in relation to the Agency’s objectives and strategies
Determine assessment criteria for proposal
Define key elements
Define key elements (target 20-50 elements, items or activities) to structure risk analysis
Stage 3 Risk analysis
Identify risks
Prepare a comprehensive schedule of risks for each element
Describe each risk and list the main assumptions
Assess risk likelihoods and consequences
Assemble data on risk and their consequences
Assess risk likelihoods Assess risk impacts
Identify significant risks
Rank risks to reflect impacts and likelihoods
Where applicable, estimate risk factors
Discard/accept minor risks
Identify moderate risks for management measures
Identify major risks for detailed risk action planning
Stage 4 Risk response planning
Identify feasible responses
For each moderate and major risk, identify the feasible responses Responses may
include:
• risk prevention
• impact mitigation
• risk transfer and insurance
• risk acceptance
Describe each feasible response and list main assumptions
Select the best response
Evaluate the benefits and costs for each response
Select the preferred response
Develop management measures and action schedules
