Winch addresses a whole chapter on risk management in his book Managing Construction Projects; Chapter 13 and the title is Managing Uncertainty and Risk on the Project. The chapter is interesting and explains the theory, behind risk management. He shows some diagrams and models to explain theories and research outcomes. He talks about the practice of risk management and he gives some examples.

In their paper “Impact of risk management on project performance: the importance of soft skills” Monteiro de Carvalho and Rabechini explain that project management (theory) these days focuses strongly on project risk management instead of uncertainty management. They also state that there is a wide gap between theory and practice in organizations, if it comes to risk management. They give some interesting thoughts about risks and uncertainty management:

• The prescriptive use (often imposed on managers) of risk management applications leads to numerous problems, such as non-acceptance in practice, limited effectiveness, and ambiguous application scenarios.
• They also state that the focus on risks disregards uncertainty management.
• They further state that the pre-specified approach (risk-related) is only feasible if adequate information is available. That is not always the case (Unknown-Knowns, Known-Unknowns, and Unk-Unk’s).
• The relationship between risk management and project success is not consistent. Some researchers state that risk management has a low impact on project performance, others suggest that even moderate levels of risk management planning suffice to reduce the negative effects of risk on project success. These distinct findings may be explained by:
  • The contingency (probability) approach. Probability is dependent on the type of project and the situation(s). And most projects are unique.
  • The focus is on risk management, neglecting relevant aspects of uncertainties, such as the soft skills of project stakeholders.

In former years we asked students to choose one of the models explained by Winch and we discussed a method called the RISMAN https://nl.wikipedia.org/wiki/RISMAN. We experienced that students have difficulty using the tools mentioned by Winch like the risk management cycle, the cognitive model, the Probability Impact (PI) matrix, or the Risman method.

Why?

The models explained are in a sense theoretical and the question is: can we use them in practice? The essence of today’s; work is that you come up with (as clearly as possible defined) management actions and not per se using a risk tool or tools. I find the Probability – Impact (PI) matrix Winch uses (2011 page 361) confusing. Maybe it was a tool for research, but I question its use in practice. (On the internet you will find a lot more schemes and models).

Let me explain. The matrix is divided into four quadrants. The axes are understandable and clear. The impact of an incident can be low or high and the probability too. Now the words used in the quadrants. First the italic written words on the outside corners of the quadrants “Insure/Mitigate, Mitigate/Cancel, Accept and Externalise. None of these words feels to be a task of the manager. It feels like every word used is to push away the incident or source. For me the normally written words are maybe even confusing: rare catastrophe, probable disaster, management challenge, and bad luck. Why are they placed halfway on the Y-axe and low and high on the X-axe? And what is the relation with the italic words?

Let’s try to understand Winch. He explains:

1. Accept the risk and plan to respond to the risk event. This acceptance calls for action. One could be, raising the contingency of your budget or slack in your schedule. Also imposing a safety protocol on site or changing the engineering margin is an action. But why is it low-low? If the incident is “extra costs”, then some extra percentage of contingency is wise to cover for unforeseen events. In practice, money is always needed. For me the probability is high and the impact low because I have the money to pay for extra expenses. (And I will not lose my job). Winch explains that there always could be something as bad luck. Most of the time this will be an Unknown-Unknown event.
2. Externalise the risk down the supply chain by subcontracting. This sounds easy but remember that you need to be sure the agent can better cope with a given risk than you. You still need to act because outsourcing is a task and controlling outsourced work is often also needed. So externalizing is also an activity. In this sense, outsourcing is a challenge to the manager. Winch states that: “The lower impact risk sources can be managed in a wider variety of ways”. He only gives externalizing as an option. That is a pity because most of your work is a challenge. And not the insurance or the bad luck thing.
3. Mitigate the risk by changing the project mission or scope to minimize the probability of the risk event occurring. Winch states that “This is frequently the most appropriate response to identified risk sources” And he states this is especially the case at the start of projects. If you are well underway I don’t know if this is an acceptable solution, or a solution at all if you work, as a manager, for a client. Changing the mission and its scope is preventing a dream come true. In practice, I am hardly able to mitigate (parts of) the project scope. The client could state that he gave you the management task so get it done! Create a solution!, manage the thing! (Or I fire you!)
   1. But the probable disaster is also in this box. The explanation is that if you have a project with for instance an innovative technique or a huge design challenge and the outcomes are hardly predictable, be sure you (or the client) can take the risk. Because this kind of risk can’t be insured and no one else wants to have it. Winch means by mitigation cancel the total thing….
   1. Large infrastructure projects often have problems with costs and time. We have papers about it in our course. If a city is completely congested with traffic and in need of a subway system, then the municipality does not have a choice. It needs to be fixed to solve an even bigger problem. Mitigating is not an option but the management challenge is.
4. Insure or hedge against the risk where this is possible. This is about a catastrophe and insurance could be a solution. Like with the above responses, this also calls for action. You need to define the kind of insurance(s) needed in the brief, output specifications, or building specifications. Post contract maybe a system of control is needed. If you or the contractor does not live up to the safety standards and protocols maybe the insurance company won’t pay after an incident. And maybe the company will be prosecuted after a lethal incident on site. You better act.
5. And this is not in the chart. Delay the decision until more information is available. This is frequently used, particularly in relation to risks generated by the regulatory system.

This is the reason we use the words “COURSE OF ACTION”. In practice, most of the time, you can do something, or you need to do something with every uncertainty, doubt, or risk you defined. You can use the diagrams to get a hold on the uncertainty or risk but pushing away a potential risk is often not a solution. Planning and managing an approach often is a solution. Think about “Plan-do–check-act” Or the project design cycle: Awareness – Design – Performance – Reflection.