Risk management theory tends to break down risks at two levels. At the detailed level, there are unforeseen events or circumstances that can disrupt a particular outcome or sub-project. Above this, there are broader risks to important stakeholder objectives that can arise from combinations of unforeseen events.
In the case of infrastructure, different types of risk and different levels of risk are often deeply interconnected. As a simple example, a quality risk on one project can be magnified into significant budget or even safety risks over the lifetime of the asset.
Because everything is so connected, risk management has to involve the entire supply chain if it is to be effective. Within a framework of clear accountabilities there needs to be the following:
- Common risk management processes at all levels
- Open sharing of information
- Allocation of individual risks to whoever is best placed to manage them
- Common ownership of business objectives and outcomes
Formal reviews and updating of risk registers are clearly essential. But active risk management demands more. There has to be an awareness of low and high level risks within each project team. KPIs have to incorporate specific measures linked to relevant project and business risks.
Assembling a robust risk management structure isn’t easy. It involves culture as well as competence.
Osborne has invested significantly in the risk management skills of our project managers and teams. This has given us a consistency of approach and a commitment to openness and information sharing throughout the organisation. We also create and operate our STOP Think! programme, which uses a strategic approach to incorporate practical engagement at all levels of influence to deliver performance improvement and achieve zero harm.
Just as important there is a commitment to using data and evidence when it comes to quantifying risk – steering clear of the perilous rocks of optimism bias. Our managers also fully understand the influence of process maturity in our capacity to predict and quantify risks accurately.
By building a learning culture we are also able to use lessons learned and innovation to improve our understanding of potential risks and their effective mitigation. Beyond this, there is a common culture that never loses sight of our client’s strategic objectives and risks as we plan and execute individual projects.
We firmly believe that top-down approaches don’t work. Our team and our subcontractors are very much part of our healthy quality and risk management culture.