Risk, Quality and Safety: The Processes That Protect People and Assets

The processes covered in this article differ from the others in the series in one important respect. When cost or schedule control fails, the consequence is financial. When risk, quality or safety control fails, the consequence can be a collapsed structure, a defective hospital, a contaminated water supply, or a person who does not go home.

That difference should govern how seriously these processes are digitalized, and frequently it does not. Risk registers, inspection records and safety observations are among the last processes to be brought into a system, and among the first to be maintained as a compliance exercise rather than as a control.

The risk register that nobody uses

Almost every capital project has a risk register. A small minority have a risk register that changes anyone's behaviour.

The typical failure sequence is well known. The register is produced during planning, in a workshop, with the right people present. It contains thirty to sixty risks, scored for probability and impact, with owners and mitigation actions. It is included in the project execution plan.

It is then reviewed quarterly, in a meeting where the scores are largely unchanged because nobody has revisited the underlying assessment, the mitigation actions are marked "ongoing," and the register grows slightly. It is never used to inform a decision. When one of the risks materialises, the register is not consulted, because by then the event is an issue and is being managed as one.

The register failed because it was a document rather than a control. A risk register that functions has properties that a document cannot have: risks linked to the specific schedule activities and cost elements they threaten, so that exposure is quantified rather than described; mitigation actions with owners and dates that are tracked like any other

Quality: inspection as data, not as paper

Quality assurance on a construction site is a high-volume, repetitive, evidence-generating process. Inspection and test plans define what is checked. Checklists define how. Records are produced at each inspection. Non-conformances are raised, dispositioned and closed.

Executed on paper, this process produces a filing cabinet and nothing else. The individual record exists. The aggregate — which is where the information is — does not, because nobody is going to tabulate four thousand inspection sheets to determine whether a particular subcontractor's first-time pass rate is deteriorating.

Executed in a system, every inspection is a data point. And once inspections are data, questions become answerable that were previously unaskable.

Which trades are generating the most non-conformances. Which subcontractors have declining first-time pass rates. Which types of defect recur across projects, indicating a specification or design issue rather than a workmanship issue. Whether inspection coverage is actually complete or whether certain work is being closed out without record. How long non-conformances remain open before closure.

An entity delivering a portfolio can compare across projects and identify systemic issues that no single project team could see. That is a capability that only exists when the records are structured, and it is one of the clearest arguments for a common system across a portfolio rather than project-by-project tools.

Safety, and the value of the near miss

Safety management has a characteristic that distinguishes it from other project controls: the most valuable data is generated by events that caused no harm.

Near misses, unsafe conditions and unsafe acts are the leading indicators. Incidents and injuries are the lagging ones. An organisation that only records lagging indicators is measuring its failures. An organisation that captures leading indicators at volume can act before the failure.

The obstacle to capturing them has always been friction. A worker or supervisor who observes an unsafe condition must decide whether reporting it is worth the effort of finding a form, filling it in, and submitting it to someone. If the process takes ten minutes, most observations go unreported. If it takes thirty seconds on a phone, with a photograph, at the point of observation, reporting rates rise by an order of magnitude.

That is not a hypothesis about technology. It is the consistent experience of organisations that have moved safety observation capture to mobile devices.

Once the observations exist as data, they can be located, categorised, trended and mapped. Recurring hazard types can be identified. Specific areas of a site generating disproportionate observations can be investigated. Corrective actions can be tracked to closure with evidence. Contractor safety performance can be compared on a like-for-like basis across a portfolio.

For an entity delivering public infrastructure, the ability to demonstrate this — not to assert a commitment to safety, but to show the leading indicator data and the actions taken on it — is increasingly a condition of operating.

Permits, licences and regulatory compliance

Capital projects in the Kingdom operate within a substantial regulatory framework — building permits, municipal approvals, environmental clearances, utility authority consents, civil defence approvals, health authority requirements for healthcare facilities, and sector-specific obligations that vary by asset type.

Each of these has an application process, a lead time, a validity period and a renewal requirement. Individually they are manageable. Across a portfolio of thirty concurrent projects they represent hundreds of live obligations with hundreds of dates, and the consequence of missing one is a work stoppage.

A compliance obligations register within the PMIS — obligations linked to the projects and elements they affect, with status, responsible owner, expiry date and evidence of compliance attached — converts this from a memory exercise into a monitored one. Expiry alerts are generated in advance. Evidence of compliance is retained against the obligation rather than in a personal folder.

The same structure serves any obligation framework the entity must satisfy, whether regulatory, contractual, funding- related or, in the case of major events, imposed by an international governing body.

The connection between these three

Risk, quality and safety are usually managed by three different functions, using three different systems or none, reporting through three different channels.

The events they manage are not independent. A design risk that materialises produces a construction quality issue. A quality issue rectified under schedule pressure produces a safety exposure. A safety incident produces a work stoppage that produces a schedule risk. The causal chains run continuously between the three domains and are invisible when each is managed in isolation.

Holding them in a common system, linked to the same projects, elements, contracts and locations, makes the chains visible. That is not merely an efficiency gain. It is the difference between managing three registers and managing the actual exposure of the project.

Next in the series: no data, no AI — why the artificial intelligence ambition of every entity begins in the PMIS.