Risk Management

Risk Management Skill

Overview

The risk-management skill provides proactive risk identification and management for construction superintendents and project managers. Most construction management tools track problems after they happen -- this skill identifies risks before they materialize, enabling the project team to avoid, transfer, reduce, or accept risks through deliberate strategy rather than reactive firefighting.

Construction projects are inherently risk-laden: site conditions are uncertain, weather is unpredictable, supply chains are fragile, labor markets fluctuate, and regulatory requirements evolve. A superintendent who manages risk proactively can prevent schedule slippage, cost overruns, safety incidents, and quality failures before they occur.

This skill provides:

• Systematic risk identification using multiple methods (brainstorming, checklists, SWOT, historical review, site walk-through)
• Quantitative risk assessment using a 5x5 Probability x Impact matrix
• Construction-specific risk categories with common triggers and recommended mitigations
• A structured risk register data model for tracking risks from identification through resolution
• Mitigation strategy selection framework (avoid, transfer, reduce, accept)
• Contingency budget allocation and drawdown tracking
• Weather contingency planning with activity-specific thresholds
• Force majeure management with notice and documentation requirements
• Monthly risk review meeting structure with reporting templates
• Integration with other ForemanOS skills for holistic project management

Key Principle: Risk management is not a one-time exercise. The risk register is a living document reviewed monthly (at minimum) and updated whenever project conditions change. Risks are dynamic -- new risks emerge as the project progresses, and existing risks change in probability and impact as work advances.

Risk Identification Methods

Effective risk management begins with thorough identification. No single method captures all risks; use multiple approaches throughout the project lifecycle.

1. Brainstorming (Project Kickoff Risk Workshop)

Conduct a structured brainstorming session at project kickoff with the full project team:

Participants: Project Manager, Superintendent, Project Engineer, Key Subcontractors (structural, MEP, civil), Owner's Representative (if willing)

Format:

• 60-90 minute facilitated session
• Round-robin format: each participant identifies one risk per round
• No filtering during brainstorming -- capture everything
• Categorize risks after brainstorming is complete
• Assign initial probability/impact ratings as a group
• Identify risk owners for each risk

Timing: Within first two weeks of project mobilization; repeat at each major phase transition

Output: Initial risk register populated with 20-50 risks (typical for mid-size commercial project)

2. Checklist-Based Identification (Construction-Specific Risk Checklist)

Walk through a structured checklist organized by risk category. This ensures common construction risks are not overlooked:

Checklist Categories (detailed in Construction-Specific Risk Categories section):

• Site Conditions
• Weather
• Labor
• Supply Chain
• Regulatory/Permitting
• Design Completeness
• Subcontractor Performance
• Financial
• Force Majeure
• Safety

For each category, review the common risk items and assess whether they apply to the current project. Mark each as "applicable" or "not applicable" with justification.

3. SWOT Analysis (Project-Level)

Perform a project-level SWOT analysis to identify risks from a strategic perspective:

• Strengths: What advantages does the project team have? (experienced crew, familiar building type, strong sub relationships)
• Weaknesses: What limitations exist? (first project in this jurisdiction, compressed schedule, tight budget, new building type)
• Opportunities: What external factors could benefit the project? (favorable weather season, strong labor market, owner flexibility)
• Threats: What external factors could harm the project? (supply chain disruptions, regulatory changes, adjacent construction, economic downturn)

Threats and Weaknesses translate directly into risk register entries.

4. Historical Data Review (Similar Project Lessons Learned)

Review lessons learned from similar completed projects:

• What risks materialized on past projects of similar scope, size, and type?
• What risks were underestimated or missed entirely?
• What mitigation strategies worked well and which failed?
• What schedule/cost overruns occurred and what were root causes?

Sources:

• Company lessons-learned database
• Post-project review reports
• Superintendent personal experience log
• Industry publications and case studies for the building type

5. Site Walk-Through Identification

Conduct a deliberate risk-focused site walk-through (distinct from daily quality/safety walks):

Physical Observations:

• Access constraints (narrow roads, limited staging, adjacent occupied buildings)
• Topography and drainage patterns (flooding risk areas)
• Existing utilities (overhead power lines, underground utilities, active services)
• Adjacent structures (settlement risk, party wall conditions, shared access)
• Soil conditions visible at surface (rock outcrops, standing water, fill areas)
• Environmental indicators (wetlands, protected species habitat, contamination signs)

Logistical Observations:

• Material delivery access and staging areas
• Crane placement options and swing radius constraints
• Temporary power/water availability
• Laydown area capacity vs. project needs
• Traffic patterns affecting deliveries and crew access

Risk Assessment Framework

5x5 Probability x Impact Matrix

All risks are assessed using a standardized 5x5 matrix that quantifies both the likelihood of occurrence and the severity of impact if the risk materializes.

Probability Scale

Impact Scale

Risk Score Calculation

Risk Score = Probability x Impact

Risk Priority Categories

Visual Risk Matrix

                          I M P A C T
                 1          2          3          4          5
              Negligible   Minor    Moderate    Major    Critical
         +----------+----------+----------+----------+----------+
    5    |    5     |    10    |    15    |    20    |    25    |
 Almost  |  MEDIUM  |   HIGH   |   HIGH   | CRITICAL | CRITICAL |
 Certain |          |          |          |          |          |
         +----------+----------+----------+----------+----------+
    4    |    4     |    8     |    12    |    16    |    20    |
 Likely  |   LOW    |  MEDIUM  |   HIGH   | CRITICAL | CRITICAL |
         |          |          |          |          |          |
P        +----------+----------+----------+----------+----------+
R   3    |    3     |    6     |    9     |    12    |    15    |
O Poss-  |   LOW    |  MEDIUM  |  MEDIUM  |   HIGH   |   HIGH   |
B ible   |          |          |          |          |          |
A        +----------+----------+----------+----------+----------+
B   2    |    2     |    4     |    6     |    8     |    10    |
I Unlikely|  LOW    |   LOW    |  MEDIUM  |  MEDIUM  |   HIGH   |
L        |          |          |          |          |          |
I        +----------+----------+----------+----------+----------+
T   1    |    1     |    2     |    3     |    4     |    5     |
Y Rare   |   LOW    |   LOW    |   LOW    |   LOW    |  MEDIUM  |
         |          |          |          |          |          |
         +----------+----------+----------+----------+----------+

Assessment Guidelines

When rating probability:

• Consider project-specific conditions, not just general industry statistics
• Account for current project phase (early = more uncertainty = higher probability for unknowns)
• Factor in team experience with this risk type
• Review historical data from similar projects

When rating impact:

• Assess both schedule AND cost impact; use the higher rating
• Consider cascading effects (one delay triggering downstream delays)
• Account for critical path sensitivity (critical path activities have amplified impact)
• Factor in contractual penalties (liquidated damages amplify schedule impact)
• Consider reputational and relationship impact (harder to quantify but real)

Re-assessment frequency:

• Critical risks (16-25): Weekly
• High risks (10-15): Bi-weekly
• Medium risks (5-9): Monthly
• Low risks (1-4): Monthly or at phase transitions

Construction-Specific Risk Categories

Each category below lists common risk items with typical triggers, probability/impact ranges, and recommended mitigations. Use these as a starting checklist during risk identification.

1. Site Conditions

Risks related to physical site conditions that differ from expectations or create construction challenges.

Common Risk Items:

2. Weather

Risks related to weather conditions affecting construction operations.

Common Risk Items:

3. Labor

Risks related to workforce availability, capability, and productivity.

Common Risk Items:

4. Supply Chain

Risks related to materials, equipment, and procurement.

Common Risk Items:

5. Regulatory

Risks related to permits, inspections, code compliance, and authority-having-jurisdiction (AHJ) decisions.

Common Risk Items:

6. Design Completeness

Risks related to the quality and completeness of construction documents.

Common Risk Items:

7. Subcontractor Performance

Risks related to subcontractor capability, reliability, and quality.

Common Risk Items:

8. Financial

Risks related to project funding, cash flow, and cost management.

Common Risk Items:

9. Force Majeure

Risks related to extraordinary events beyond any party's control.

Common Risk Items:

10. Safety

Risks related to worker safety, health, and regulatory compliance.

Common Risk Items:

Project Intelligence Integration

When project intelligence is loaded, auto-populate risk register entries with data-driven evidence from project files instead of relying solely on manual assessment.

Schedule Risk Identification

Auto-flag schedule-driven risks from critical path analysis:

• Read schedule.json → critical_path[] → identify activities with zero or low float as schedule risk items
• Flag activities where float < 5 days as "near-critical" schedule risks
• Auto-populate risk register entries with activity name, planned dates, and float available
• Example: "MEP Rough-In" has 3 days float → auto-create risk item: "MEP rough-in schedule risk — 3 days float, any delay extends critical path"

Weather Risk Thresholds

Pre-populate weather-sensitive activity risks with contractual limits:

• Read specs-quality.json → weather_thresholds[] → for each threshold (concrete min temp, roofing wind limit, etc.), create risk register entries with specific trigger conditions
• Cross-reference schedule.json → identify when weather-sensitive activities are scheduled → assess seasonal risk
• Example: Concrete pours scheduled March → weather_thresholds show min 40F → auto-create risk: "Cold weather concrete risk, P=4, I=3, Score=12"

Subcontractor Performance Risk

Assess sub-specific risks from directory and performance data:

• Read directory.json → subcontractors[] → pull EMR (Experience Modification Rate) and safety record for risk assessment
• Read quality-data.json → FPIR per trade → flag subs with quality performance below 85% as quality risk items
• Read labor-tracking.json → productivity_ratios[] → flag subs with productivity below benchmark as schedule risk
• Example: Sub with EMR 1.3 and FPIR 78% → auto-create risk: "Sub quality/safety performance risk, P=4, I=3, Score=12"

Cost/Contingency Context

Show risk exposure relative to available contingency:

• Read cost-data.json → contingency.available_contingency → calculate total risk exposure as percentage of remaining contingency
• Auto-populate risk report summary with contingency drawdown projections
• Flag when cumulative high/critical risk cost exposure exceeds 75% of available contingency
• Example: 5 active high risks with combined exposure $180,000, contingency remaining $200,000 → flag: "90% contingency at risk"

Historical Delay Patterns

Seed risk register with evidence-based risks from delay history:

• Read delay-log.json → delay_events[] → identify recurring delay types (weather, sub performance, material) and their frequency
• Auto-create risk register entries for delay categories that have occurred 2+ times
• Include historical average duration and cost impact in the risk description
• Example: 3 weather delays averaging 4 days each → auto-create risk: "Recurring weather delay pattern, avg 4 days, P=4 based on history"

Procurement Risk

Flag supply chain risks from procurement status:

• Read procurement-log.json → filter items with category = "long_lead" or delivery_status = "delayed" → auto-create procurement risk entries
• Read submittal-log.json → filter items with status = "revise_and_resubmit" or overdue → flag as procurement delay risks
• Example: PEMB steel delivery delayed 2 weeks → auto-create risk: "PEMB delivery delay risk, critical path impact, P=5, I=4, Score=20"

Extended reference: Detailed examples, templates, scoring rubrics, and best practices are in references/skill-detail.md.