Project Risk Management

1. Introduction to risk management

In a project there are numbers of uncertain events or conditions. Risk is the possibility of the
occurrence of those events. (Dictionary definition). A risk can be negative or positive
depending on the situation and the result it produces. Positive risks result in benefits and growth
of the project and can be seen as opportunities while negative risks lack the project progress and
causes loss. The objective of project risk management is to minimize the negative risks and
maximize the positive risks.
Project risk management is the systematic process that includes risk management planning,
identification, analysis, responding and monitoring & control of the risks that can impact the
project. It can help to meet the project objective addressing the potential challenges in the project
and focusing on opportunities. (Definition)

Advantages of project risk management

 Reduce the need to constantly manage crises
 Promote a forward-thinking and planned approach to management
 Avoid unexpected issues and setbacks
 Gain an edge over competitors through better project control
 Lower the chances of delays or cost overruns
 Improve the likelihood of completing the project successfully
 Boost overall project profitability
 Ensure the right product is delivered correctly the first time
 Stop problems before they happen—or keep them from getting worse if they do occur
Process of risk management
It is the series of plan, execution and control. The processes of risk management go on
throughout the project life. It includes the following measures:
i. risk management planning
Risk management planning is the first step for project risk management that consists the
process of deciding how to plan and execute the activities for risk management in a project.
Many organizations in construction fail to embed formal risk planning into daily practice,
often neglecting its strategic importance (Alfreahat & Sebestyén, 2021, p. 2668). A risk
planning meeting is carried out among the stakeholders to prepare the risk management plan
(RMP) based on scope, objective and factors affecting the project.
Rmp is a document that includes methodology used, roles and responsibilities of
stakeholders, scheduling, risk categories, probability and impact, reporting and tracking of
the issues and activities.
ii. Identify the risks
risk identification is a repetitive process that involves various participants like project team,
risk management team, stakeholders and related experts to determine the risks associated
with the project. It is based on risk management plan, risk break down structure, scope and
objective of project. Risks originating from flawed design or organizational issues may not
be visible until late stages, highlighting the need for early identification and cross-functional
collaboration (Petronijevic et al., 2023, p. 3).
Risk Identification Techniques;
 Brainstorming: Jot down thoughts
 Wideband Delphi Technique: Discuss between experts without biasing
 Nominal Group Technique: Expert reviewing different ideas
 SWOT Analysis (Strength, Weakness, Oppurtunites, Threats)
 Interviewing
As an outcome, a Risk Register (RR) is prepared to record the results of risk management
process.
iii. qualitative analysis
It is the process for prioritizing risks for further analysis based on their probability of
occurrence and impact to the project. The RMP and RR are required to carry out qualitative
analysis. The result is presented as probability-impact matrix and the risk register is updated.
Visual tools like probability-impact matrices and hierarchical risk charts help project teams
focus on the most critical risks (Alfreahat & Sebestyén, 2021, p. 2669).
iv. quantitative analysis
It is the process of numerically analyzing the effect of identified risk on overall project
objectives. It uses tools and techniques like sensitivity analysis, decision tree analysis,
simulation and modeling techniques like Monte carlo. Afterward, the risk register is again
updated. Quantitative techniques like simulations and decision trees enable deeper insights
into the cost and time impacts of risks (Alfreahat & Sebestyén, 2021, p. 2670).

v. risk response
After identifying and quantifying the risks, we should decide how to deal with risks when it
occurs. The Process of developing options to enhance opportunities and reduce threats to
projects objectives, ultimately reducing overall risk.’ Projects that fail to integrate risk
responses across stakeholders often suffer from fragmented action and weak accountability
(Petronijevic et al., 2023, pp. 3–4).
 Strategies for Threats
 Risk avoidance: remove the risk entirely by staying away from its source
 Risk transference: pass the impact and responsibility of the risk to another party, such
as through outsourcing
 Risk mitigation: if the risk happens, take steps to lessen its negative effects
 Also focus on preventing the risk from happening in the first place to reduce how
often it occurs
Strategies for Opportunities

Exploit

 Strengthen the project plan to make sure the opportunity is fully taken advantage of
 Remove any uncertainty so the opportunity is guaranteed to happen

Share

 Bring in a third party who is better positioned to capture the opportunity

Enhance

 Increase the chances of the opportunity happening by boosting the factors that create
a positive impact

vi. Monitoring and control

Monitoring risks refers to keeping record of their status and Controlling risks refers to
executing the risk management plan as risks occur.
It is the final process for risk management that involves tracking identified risks, monitoring
residual risks, identifying new risks and executing risk response plans.
It should be carried out regularly to ensure effectiveness of the risk management plan.
Effective risk monitoring may require revising the execution plan or restarting risk
management efforts when new threats appear (Alfreahat & Sebestyén, 2021, p. 2672)
The Boston Big Dig Project, one of the largest and most complex transportation
infrastructure projects in the United States, became notorious for its severe cost overruns,
delays, safety failures, and structural issues. These problems can be attributed to the
inadequate application of risk management processes.
2. Project Overview
One of Bostons biggest transportation projects in the United States was the Boston Big Dig. The
Central Artery/Tunnel Project is its official name (CATP). By replacing a portion of the elevated
Central Artery (I-93) with an underground highway the projects’ main goal was to improve
Bostons infrastructure and lessen traffic congestion. A harbor tunnel a new Charles River bridge
and an extension of I-90 to Logan International Airport were also part of the project. Even
though the project modernized the Boston area and greatly reduced traffic it gained notoriety for
major cost overruns structural flaws and safety incidents. The highway project became the
biggest and most intricate in the United States. S. The Big Dig project was designed in the early
1970s and formally started in the 1990s with the goal of rerouting Interstate 93 into a 5–6 km
tunnel beneath the city to alleviate Bostons extreme traffic congestion. Transforming Bostons
clogged roads into a contemporary effective system was one of the projects lofty objectives.
According to preliminary estimates the project will cost $2. 06 billion and be completed in 1998.
The Big Dig however was not finished until 2007 almost ten years behind schedule and its
ultimate cost skyrocketed to over $14. 06 billion (GAO 2001). Over the course of the project the
Big Dig encountered unanticipated problems like water intrusion construction delays inflation in
the budget subpar contractor performance and safety incidents. The I-90 Connector Tunnel
ceiling collapse in 2006 which killed a driver and revealed significant shortcomings in the
projects management and supervision was one of the most tragic incidents (ASCE 2008). The
projects failures were ultimately caused by the insufficient risk management which exacerbated
these problems.

4. Application of PMBOK Risk Management Processes

4.1 Plan Risk Management

In general, the Big Dig projects risk management planning was unsuccessful. The project
planning stage ought to have included risk management as a crucial component to guarantee that
a centralized consistent approach was used right away. However, there was no unified risk
management strategy for the Big Dig and different contractors and agencies were divided up in
who was responsible for identifying and resolving risks (Dapris 2010). Critical risks were not
identified at the beginning of the project due to this lack of centralized coordination which
ultimately caused major delays and budget overruns. The PMBOK states that establishing the
framework and procedures for recognizing evaluating and reacting to risks at every stage of the
project lifecycle requires a well-defined risk management plan (PMI 2008).

4.2 Identify Risks

Early identification is the first step towards effective risk management and this usually entails
classifying possible risks and utilizing structured checklists—practices that are frequently
disregarded in unsuccessful projects (Osei-Kyei et al. 2022 p. 14. Due to the complexity of the
project the Big Dig was inherently risky. These risks included the possibility of environmental
effects like water leakage working under heavy traffic loads and tunneling in a dense urban area.
Nevertheless, the projects risk identification procedure was inadequate and many of these risks
were not sufficiently evaluated or dealt with at an early stage (Pickrell 1992). Water intrusion
and settlement risks were not adequately taken into account during the planning stage. In the
absence of a cohesive framework for risk planning oversight organizations frequently functioned
independently resulting in uneven tactics and oversight deficiencies (Greiman 2013 p. (106).
Early risk identification is crucial for anticipating issues and allocating the right resources for
mitigation techniques according to the PMBOK framework (PMI 2008).

4.3 Perform Qualitative and Quantitative Risk Analysis

Both qualitative and quantitative risk analysis was either based on unrealistic assumptions or was
not carried out in a thorough manner. Big Dig officials purposefully falsified financial estimates
to make the project appear more feasible from an economic standpoint hiding the projects actual
cost (Haynes 2008 p. Number 5. Early risk analyses were extremely basic and did not take the
projects complexity into consideration. Due to inadequate risk analysis the projects true costs
were estimated to be lower than anticipated and there were not enough contingency funds to
cover unforeseen costs.

4.4 Plan Risk Responses

During the Big Dig project there were no effective risk response strategies. According to
PMBOK guidelines risk responses—such as avoidance mitigation transfer or acceptance
strategies—should be created for every risk that has been identified (PMI 2008). In a similar vein
there were not many backup plans in place to deal with delays brought on by unanticipated
circumstances like difficulties during construction or contractor errors. Decisions were
frequently made reactively rather than proactively due to the absence of a clear risk response
plan which contributed to the project’s failures. Unneeded design modifications like reexamining
bridge options resulted in expensive delays without appreciable advancements (Salvucci 2003 p.
(38).

4.5 Implement Risk Responses

Uncontrolled risk and poorly informed policy decisions resulted from an over-reliance on private
contractors and the removal of public oversight (Salvucci 2003 pp. 38 to 39). The Big Dig
project had uneven application of risk response techniques. Even though some responses were
prearranged they were frequently poorly coordinated or executed late. For instance, insufficient
structural monitoring and disregard for known hazards were directly responsible for the deadly
ceiling collapse in the I-90 Connector Tunnel in 2006 which claimed a tragic number of lives
(ASCE 2008). There were disastrous results because risk mitigation strategies like routine
structural integrity inspections were either improperly implemented or improperly enforced.
Following through on planned actions is crucial to ensuring that risks are appropriately managed
throughout the project lifecycle according to the PMBOK process for implementing risk
responses (PMI 2008).

4.6 Monitor Risks

Additionally, there was insufficient risk monitoring during the Big Dig project. According to
Mahalingam and Levitt (2007) the project lacked an efficient system for monitoring the risks
evolution over time and evaluating the success of mitigation techniques. Frequently there were
infrequent updates to the risk register a crucial instrument for monitoring and recording hazards.
Additionally various stakeholders were working independently and failing to exchange vital risk
information due to the fragmented nature of the risk monitoring and communication systems.
Though they can be somewhat helpful traditional tools like risk registers and scheduled reviews
are not flexible enough to handle complex interdependencies that arise during large-scale
projects like the Big Dig (Al Fardan 2022 p. 19).

5. Key Challenges and Their Impact on the Project

A number of significant obstacles that the Big Dig faced made it difficult for it to put in place
efficient risk management. Financial and political pressures were one of the main problems. In
essence public officials combined three different projects to obtain an advantage during the
funding process which resulted in underfunding and exacerbated cost overruns (Haynes 2008
p.5). Controlling the budget became even more difficult due to financial constraints. A
significant problem was the numerous contractors and subcontractors lack of coordination.
Confusion and inefficiencies resulted from the lack of clear coordination among such a complex
network of stakeholders. An inappropriate distribution of risk responsibilities exacerbated this
which is a frequent cause of project failure particularly in projects with poor coordination (Osei-
Kyei et al. in 2022 p. 2). Inadequate communication with the public and other interested parties
also resulted in legal issues and a decline in public confidence. Key project phases were
eventually delayed due to institutional memory loss and progress disruption caused by frequent
leadership turnover and decreased public sector capacity (Salvucci 2003 p. 38). Furthermore, the
project did not appropriately rank high-risk tasks. There was ineffective use of instruments such
as the Activity Risk Index (ARI) which assesses activities according to their risk contribution
(Acebes et al. 2021 p. 1387). Furthermore, contract oversight was inadequate. More than 1500
unforeseen contract changes were the result of poor planning and lax enforcement making
management even more challenging (Borno 2020 p.130).
6. Outcomes and Consequences

The Big Dig suffered a number of serious repercussions as a result of its inadequate use of risk
management techniques. The significant cost overrun was the most noticeable. In the end the
project cost over $14 billion which is more than five times what was originally projected. Project
managers moved toll revenue from necessary maintenance to debt repayment in an effort to
control these soaring expenses (Salvucci 2003 p.39). A significant consequence was the projects
delays it was finished nearly ten years later than anticipated severely disrupting the citys
economy and infrastructure (Pickrell 1992). The repercussions were not just logistical or
financial they were also tragic. A tunnel ceiling collapse in 2006 claimed the life of a civilian
exposing serious weaknesses in safety risk assessments and a deficiency in continuous
inspections (Haynes 2008 p.6). A great deal of public and legal criticism was directed at the
project because of its numerous problems which included political controversy safety issues and
budget overruns. The project also failed technically. Monte Carlo simulations and a Schedule
Risk Baseline are two tools that project managers could have used to forecast how delays in
individual activities would impact the timeline as a whole (Acebes et al. 2021 p.1377).

7. Lessons Learned

The Big Dig offers important lessons for overseeing megaprojects in the future despite its
numerous failures. Proactive risk management is crucial to start. Developing effective response
plans requires early risk identification and analysis. The Big Dig lacked data-driven
contemporary risk management systems that can process and adjust to real-time data—
instruments that are now crucial for major infrastructure projects (Al Fardan, 2022 p.1). Another
important lesson is the necessity of ongoing observation. To avoid the kinds of failures that
occurred during the Big Dig comprehensive internal audits and early financial monitoring are
essential (Haynes 2008 p.6). Furthermore, stakeholders must continue to coordinate and
communicate clearly. Risks may go unnoticed or become unmanageable in the absence of this.
Megaprojects that are successful must also incorporate community consensus local planning and
environmental sustainability to guarantee long-term success (Salvucci 2003 p.40 to 41).
Effective leadership and governance are equally important. Procedures must be regularly
followed for risk management to be effective which requires efficient oversight and open
accountability (Mahalingam and Levitt 2007 Greiman 2013 p.244). Last but not least the Big
Digs design-bid-build methodology resulted in disjointed planning and design teams. Future
projects would be wise to steer clear of the silos that resulted from this as they hindered
collaboration and slowed decision-making (Borno 2020 p.131).
8. Conclusion

Effective risk management is a vital component of successful project delivery, especially in

complex and large-scale undertakings. The application of PMBOK’s risk management
knowledge area highlights the importance of identifying, analyzing, and responding to potential
threats throughout the project lifecycle. Real-world examples, such as the Boston Big Dig,
demonstrate how inadequate risk planning, communication breakdowns, and a lack of flexibility
in strategy can lead to significant setbacks. However, these challenges also offer valuable lessons
about the need for thorough planning, stakeholder alignment, and adaptive management
practices. When risk management is treated as an ongoing, integral part of project execution
rather than a one-time activity, projects are better equipped to navigate uncertainties and achieve
their intended outcomes. This analysis underscores that successful project management relies not
only on technical tools and processes, but also on a collaborative, transparent, and responsive
approach to handling risks in dynamic environments.
References

American Society of Civil Engineers (ASCE). (2008). Failure Investigation of the I-90
Connector Tunnel Ceiling Collapse. Reston, VA.

United States Government Accountability Office (GAO). (2001). Central Artery/Tunnel

Project: Cost and Schedule Issues. GAO-01-748.

Project Management Institute (PMI). (2008). Case Study: The Big Dig. Retrieved from
[Link]

Osei-Kyei, R., Narbaev, T. and Ampratwum, G. (2022) ‘A scientometric analysis of studies

on risk management in Construction Projects’, Buildings, 12(9), p. 1342.
doi:10.3390/buildings12091342.

Khodabakhshian, A., Puolitaival, T. and Kestle, L. (2023) ‘Deterministic and probabilistic

risk management approaches in construction projects: A systematic literature review and
comparative analysis’, Buildings, 13(5), p. 1312. doi:10.3390/buildings13051312.

Petronijevic, J. et al. (2023) ‘The missing link between project and Product Risk
Management: From the review to the call to action’, Journal of Engineering and Technology
Management, 69, p. 101770. doi:10.1016/[Link].2023.101770.

Salvucci, F.P. (2022) ‘The “Big Dig” of Boston, Massachusetts: Lessons to learn’,
(Re)Claiming the Underground Space, pp. 37–41. doi:10.1201/9780203741184-6.

Cho, A. (2012) ‘Betting big on science: A cautionary tale’, Science, 337(6091), pp. 149–151.
doi:10.1126/science.337.6091.149.

Alfreahat, D. and Sebestyén, Z. (2022) ‘A construction–specific extension to a standard

project risk management process’, Organization, Technology and Management in
Construction: an International Journal, 14(1), pp. 2666–2674. doi:10.2478/otmcj-2022-
0011.

Acebes, F. et al. (2020) ‘Project Risk Management from the bottom-up: Activity risk index’,
Central European Journal of Operations Research, 29(4), pp. 1375–1396.
doi:10.1007/s10100-020-00703-8.