Risk Management: Turning the Register into a Living Control

Every GCC project has a risk register. Far fewer have risk management. The difference is whether risks are owned, analysed, linked to contingency and schedule, reviewed on a rhythm and acted on, and whether the PMC can prove all of that from the data.

Risk management is the function that ties all the others together. Cost overruns, schedule slippage, quality failures, safety incidents, claims and disputes are almost always risks that were either not identified, not analysed, not allocated clearly or not acted on in time. A PMC that manages risk well protects the owner's budget and programme before the problem becomes an event, a claim or a headline.

In the GCC, risk is shaped by scale and pace. Giga-projects and master-planned developments run many contracts in parallel, often with interfaces between packages that no single contractor owns. Supply chains reach across continents. Owners carry concentrated exposure across a programme of projects, and public-sector owners must show that contingency is controlled under their delegation of authority. In this environment a spreadsheet register reviewed at a quarterly workshop is not enough.

Each PMC firm manages risk in its own way. Some run formal quantitative analysis on every major project; others apply a lighter qualitative approach and escalate only the largest risks. Owners differ too, in their risk appetite, their scoring matrices and their reporting expectations. The CMAA Standard stays the reference: a plan, a process, owners, responses, a link to contingency, and a record that shows risk is being managed rather than merely listed.

What the CMAA Standard Expects

The CMAA Standard expects the construction manager to help the owner manage risk throughout the project life cycle. During pre-design and design, it expects the CM to help establish a risk management approach, to identify and assess risks affecting cost, schedule, quality and safety, and to advise on how risks should be allocated

How GCC PMC Firms Typically Do It Today

• The register is a spreadsheet. Risks are listed in Excel, copied between versions, and reviewed at workshops, with no reliable history of how scores and responses changed.
• Risks have no real owners. Responsibility is assigned to a department or to "the contractor", so actions drift and nobody is accountable.
• Contingency is not linked to risk. Contingency is held as a percentage and drawn down through change orders, with no traceable link back to the risks it was meant to cover.
• Quantitative analysis is a one-off. A Monte Carlo analysis is run for the business case and never repeated, so the confidence level quoted to the owner is out of date.
• Programme exposure is invisible. Each project has its own register in its own format, so the owner cannot see common risks, interface risks or total exposure across the programme.
• Risks and issues are confused. Events that have already happened remain in the risk register, while emerging risks are raised only in meetings.

How PMWEB Digitalises It

PMWEB does not replace the professional judgement of the risk manager or the specialist tools used for quantitative analysis. It gives the PMC a structured, auditable home for the whole risk process, linked to budget, contingency, schedule, contracts and issues. Each firm configures the register fields, scoring matrices, value lists and workflows to its own procedures and to the owner's risk policy.

Planning and identification

The risk management plan, including the scoring scales, risk categories, roles and review rhythm, is issued as a controlled document in PMWEB document management. The same scales and categories are set up as value lists, so every risk is scored on the same basis. Risks are identified from workshops, design reviews, constructability reviews, site observations and lessons learned from previous projects, and each is recorded in the PMWEB risk register with its cause, event and effect, category, the work breakdown or cost code it affects, the contract it relates to and the risk owner.

Qualitative and quantitative analysis

Each risk is scored for probability and impact on cost, schedule and other dimensions defined by the owner, with the score calculated automatically and plotted on the owner's heat map. Where the plan calls for quantitative analysis, the register holds the ranges needed: minimum, most likely and maximum cost and time impacts. That data can be exported to the firm's quantitative risk tool, and the results, such as confidence levels for cost and completion, are recorded against the project so the owner can see how they change between analyses.

Allocation through delivery method and contract

Risk allocation starts with the choice of delivery method and continues through the conditions of contract. Under a traditional design-bid-build contract the owner usually retains design risk; under design-build and turnkey arrangements more of that risk moves to the contractor, and the owner's amendments to the conditions of contract move the balance further. In PMWEB each risk records the party that carries it under the contract, so the owner can see which risks it retains and which it has transferred, and the PMC can check that contract drafting reflects the intended allocation.

Response planning and contingency

Each risk carries a response strategy, avoid, reduce, transfer or accept, with specific actions recorded as action items with owners and due dates. Residual risk after response is scored separately. The link to cost is where PMWEB adds most value. Contingency is held in the budget module as a defined line, informed by the risk exposure in the register. When contingency is drawn down through a budget transfer or change order, the transaction references the risk it relates to and is routed under the owner's DoA. The PMC can show at any time the remaining contingency, the risks it is intended to cover and the drawdowns made against each.

Monitoring, review and escalation

Review dates are set per risk, and the workflow engine reminds owners and escalates overdue reviews. Each change to scores or responses is kept in the audit trail, so the history of a risk can be seen. When a risk materialises, it is converted into an issue, with the link preserved, and any cost or time consequence flows into potential change orders, claims or schedule updates. Dashboards show top risks, trends in exposure, overdue actions and contingency against remaining risk.

Configuring PMWEB to Your Firm's Procedures

The CMAA Standard sets out what the CM should do about risk; the owner's policy, appetite and approval hierarchy, and the firm's own method, decide how. PMWEB is configured to apply them.

Evidence That the Practice Is Working

The PMC should be able to show that risk is being managed, not merely listed. Useful indicators include:

• Ownership coverage: the proportion of active risks with a named individual owner and a current response.
• Review compliance: risks reviewed within their scheduled review period, by project and programme.
• Action completion: risk response actions completed on time, and the ageing of overdue actions.
• Exposure trend: total residual risk exposure over time, by project and at programme level.
• Contingency traceability: the share of contingency drawdowns linked to an identified risk.
• Risk-to-issue conversion: issues that arose from a previously identified risk compared with those that were not foreseen.
• Analysis currency: the date of the latest quantitative analysis compared with the review rhythm set in the risk management plan.

Key takeaway

A risk register is only as useful as the decisions it drives. When risks are owned, scored consistently, allocated clearly through the contract, linked to contingency and reviewed on a rhythm, the PMC gives the owner early warning rather than late explanation, at project and programme level alike, as the CMAA Standard expects.

PMWEB turns the register into a living control, configured to the owner's risk policy, conditions of contract and DoA, and to the firm's own method. The CMAA Standard as the reference, the firm's procedures as the method, the record as the proof.

Next in the series: Article 11 — Sustainability and Resiliency