Chapter 6 Reference Card — Risk Management

One page. Self-contained. Come back to it when you are staring at a register or a contingency line.

Key Takeaways

• A risk is an uncertain event with a cost. If it is certain, it is scope. If it has no observable moment, it is an anxiety. If you cannot say what it costs, you have not finished thinking about it.
• Risk, uncertainty, and ignorance are three different problems. Price risk. Bound uncertainty and buy information to convert it. Manage ignorance structurally, with an outside reviewer and a contingency loading that assumes your list is incomplete — because it is.
• There are five responses, and they are alternatives, not a checklist: avoid, transfer, mitigate, accept, exploit. Acceptance without funding is not acceptance. It is hope.
• Risk should sit with the party best able to control it — and in practice it sits with whoever has the least leverage. Both are true. Reading a contract well means holding both.
• Shifting a risk always costs something, even when no invoice appears. Delete a differing-site-conditions clause and every bidder loads the earthwork package; the owner pays whether or not the bad soil exists.
• Every register row needs a person's name and a trigger. "Operations" cannot watch for anything. A trigger must be something a human being could declare on a Tuesday.
• The matrix communicates; the arithmetic decides. A 5×5 heat map multiplies rank labels, compresses ranges, and is blind above its top band. Above about $50,000, do the math.
• EMV = probability × cost impact. It is a portfolio number. You will never spend the expected value on any single row — you will spend zero or the whole thing.
• PERT mean = (O + 4M + P) ÷ 6. The most-likely value is not the expected value, and the gap is always in the same direction.
• The sum of most-likely durations is systematically optimistic, for two stacking reasons: activity distributions are right-skewed, and every merge point multiplies its feeders' on-time probabilities together.
• 🚪 Contingency is a priced, owned, drawn-down reserve for identified risk. Money set aside without a named risk attached is either fat or a lie, and both get spent. The test: could you show the owner the rows?
• Five buckets, five sets of rules: estimating contingency, construction contingency, owner's contingency, escalation allowance, management reserve. Mixing them is the most common money mistake in preconstruction.
• Size it two ways and reconcile in writing. The reconciliation is the deliverable. Northgate: $735,650 bottom-up, $1,320,000 top-down, and three named reasons for the gap.
• Schedule risk and cost risk are one risk seen twice — $10,650/CD on Northgate. Schedule buffer belongs at the project level, visible, drawn down like money. Never scattered across forty activities.
• Your leverage is highest when your information is worst. Influence falls and cost of change rises across the life of a job, and they cross around the end of design development.
• A single bad job can consume a company's year. One $4,000,000 loss is 39% of Kestrel's annual net at a 2.5% margin — plus bonding capacity, plus the jobs you can no longer chase.
• Safety risk cannot be transferred, and it is generated by the other rows. An acceleration decision made in a conference room becomes a hazard on a scaffold eleven weeks later.

Action Items — what to do on your job this week

1. Open your register and count the rows with a person's name in the Owner column. If it is less than all of them, that is your afternoon.
2. Read your contingency-use log and check every draw for a register row ID. Any draw without one is a hole in your identification, not a bookkeeping error. Fix the process, then the log.
3. Compute your burn ratio. Percent of contingency drawn, divided by percent of work complete. Write it on the cost report next month whether or not anybody asked for it.
4. Find your escalation allowance and confirm nothing has been spent from it that is not escalation. This takes twenty minutes and saves arguments in month nine.
5. Ask one subcontractor what worries them about your job. Write down the answer as a register row before you leave the trailer.
6. Locate your project's schedule buffer. If you cannot point at it in one place with a number of days on it, it is scattered through the activities and it is already spent.
7. Look at the biggest risk on your register and ask who controls it. If the answer is not the party holding it, you have found either a negotiation or an explanation of your price.
8. Add the safety column and ask of each schedule and cost response: what does this do to the people doing the work?

Common Mistakes and the Fix

Decision Framework

Step 1 — Is this a risk? Uncertain event, observable moment, quantified consequence. If any of the three is missing, fix the row before doing anything else.

Step 2 — Whose is it? Ask who controls it and then who the contract says owns it. If those are different parties, you have found either a negotiation, a price, or a future dispute.

Step 3 — Which of the five?

• Can you change the plan so it cannot happen, and is that worth what it costs? → Avoid
• Is there a party who controls it, or a market that prices it better than you? → Transfer
• Can you buy information or change the method to shrink it? → Mitigate
• Is it small, bounded, and cheaper to fund than to fight? → Accept, with money behind it
• Is it upside? → Exploit, and write the row that says who decides

Step 4 — Price it. Binary event → EMV. Uncertain magnitude → three points and PERT. Many interacting items → run the range and read the percentiles, not the mean.

Step 5 — Fund it. Bottom-up from the register, top-down by percentage, and then reconcile the two in writing. Fund to a confidence level, not to the mean, and load for the rows you have not thought of yet.

Step 6 — Watch it. Trigger, owner, monthly review. Report the burn ratio next to the cost report.

Step 7 — Two questions before you sign anything. Could I show the owner the rows behind my contingency? And: can the party I just handed this risk to see it, price it, and survive it? If either answer is no, you have not managed the risk. You have postponed it.

The Numbers Worth Memorizing