Project Management Institute

The development and application of a project risk identification, selection and management model (PRISM-C)

Melissa Bosiger, Graduate Research Assistant,Virginia Polytechnic Institute and State University

Flynn Auchey, PhD., Building Construction Professor, Virginia Polytechnic Institute and State University

Due to the nature of its business activities, processes, environment, and organization, the construction industry is associated with a high degree of risk. Risk involves many unknowns, along with unexpected, undesirable, and other unpredictable factors. The uncertainty of the weather, political situation, and environmental conditions are risks that exist on every construction project. A project, by definition, is something that we have not done previously and will not do again in the future. Because of this uniqueness, the industry has developed a “live with it” attitude on risk, considering it simply a part of doing business. Never before has the construction activity been assisted with such a high degree of technology. If the industry used this technology to create a new risk management tool that takes into account risk prior to construction beginning, profitability and project success can be maximized.

What is Risk?

There are many definitions for risks. Risk is apparent in every walk of life. There are few situations experienced that do not involve some level of danger. Kerzner defines risk in Project Management as “a measure of the probability and consequences of not achieving a defined project goal” (Kerzner, 1998). A definition of risk should not be restricted to accidents, nor to negative events only. Every construction project has its own unique set of risks. Methods of dealing with risk in construction have generally focused on risk distribution between the client and contractor rather than on effective risk management prior to starting the construction of a project.

Risks can be classified as knowns, knowns-unknowns, or unknowns-unknowns. A known risk is an item or condition that is understood, but cannot be measured with complete accuracy. Generally, such risks occur at a relatively high rate and contain a range of possible outcomes. Labor productivity is a good example of a known risk. Known-unknowns conditions or events are foreseeable but not normally expected. Normally, such events have a relatively low frequency and result in severe consequences. Earthquakes, hurricanes, strikes and unusual difficulty with a contractor are examples of this type of risk. Unknown-unknowns are conditions or events that cannot be predicted. These items are generally catastrophic in nature and have a low probability of occurring. An example of unknown-unknown is asbestos related hazards. Once an unknown-unknown is identified, it becomes a known-unknown.

Leung, Mok, and Tummala (1996) surveyed 52 engineers responsible for cost estimation in the Building Services Department of Hong Kong and other private consulting firms to ascertain how the construction industry perceives the concepts of risk and uncertainty in a construction project. From this survey, the most popular description for the term risk was that of “potential variations in key assumptions/outcomes and their probabilities.” The most popular description of uncertainty was that of “potential variations in key assumptions/outcomes and their probabilities” (Leung, Mok, & Tummula, 1996). This was the same result as the description for the term risk. Because uncertainty involves assessing probability, whereas risk involves evaluating the undesirable consequence as well as the occurrence of that undesirable consequence, the findings in the survey suggest that the concept of risk and uncertainty are not differentiated by the construction industry.

What is Risk Management?

According to Kerzner (1998) in Project Management, risk management is defined as “the process by which the likelihood of risk occurring or its impact on the project is reduced.” Kerzner (1998) explains that risk management is and organized means of identifying and measuring risk and developing, selecting, and managing options for handling these risks. The concept of risk management is not unique to construction; however, risk management is currently be used as a method of minimizing cost after a risk occurs. Seldom do contractors consider the positive implications of risk or the potential impact of risk on a project before deciding to bid.

Four Stages in Risk Management Process

Risk management is a growing element in projects. There are four stages of the risk management process that have become a standard reference (Baker, Ponniah, & Smith, 1997). The first step in a risk management is to identify risk prone areas in the project. The thoroughness with which this identification is accomplished will determine the effectiveness of risk management. Not all risks are high-level risks that will have a critical impact on a project. However, the cumulative effect of combining several low-level risks could have a severe impact. After the risk identification process, the second step is to devise a methodology for measuring the risk. After the risk have been appropriately identified and measured, the third step is to develop a risk response method or technique to reduce or control the risk. The final step is risk control. The risk control step documents the lessons learned on risk management to benefit future decision-makers.

Why Use Risk Management?

Risk management can be justified on almost all projects. The use of risk management in preparing cost estimates ensures a more systematic and rational way of making allowances for risks because it allows the estimator to develop a comprehensive understanding and awareness of the risks associated with the project. In addition, once the risks are identified and quantified, measures can then be taken to manage and minimize them. Effective risk management almost always leads to greater profits or greater efficiency.

The variations of risk management practices are considerable. The majority of construction companies prepare cost estimates based on a traditional single-figure cost-estimation approach. Although the estimators often consider risks, those risks are not assessed in a formal, systematic way.

Contingency Sum Method

The most common method to protect a company from potential risk is to add a contingency sum to the estimate. This approach has a number of weaknesses. This risk allowance is included on a once-and-for-all basis with no formal method of updating other than for inflation. The contingency figure is usually arbitrarily arrived at and may not be appropriate for the proposed project. Estimators also have a tendency to double count risks. Such an approach is illogical because the risks associated with the project are not separately identified for evaluation. Also, the allowances are often set too high for low-risk projects or too low for high-risk projects. A percentage addition still results in a single-figure prediction of estimated final cost, implying a degree of certainty that may not be justified. Most significantly for today's constructor, this method limits risk to a negative variable and doesn't consider any positive potential. Finally, this method tends to direct attention away from time and performance or quality risks. Therefore, the traditional single-figure approach is inadequate and cost inefficient.


The Risk and Opportunity Assessment Model (ROAM) is a risk management tool currently used in the construction industry to assess project viability before committing the resources required to develop a project plan and customer proposal. This model is to be completed by the project manager. It assists the project team and management in deciding which opportunities to focus on and which risks should be managed to ensure project success. It should not be used as a set of rules or as a substitute for good business judgment.

There are three steps involved in performing the ROAM. The first step is to evaluate the risks. A series of questions are asked to assess the risk associated the project. The risk scores are calculated by multiplying the raw score (Risk Probability (P)) times the preestablished Risk Impact (I). The total risk score is then calculated. The second step is to evaluate the opportunity. A series of ten questions within the model are to be answered and a score for each is calculated. The questions have been weighted on a scale of 1 (lowest) to 5 (highest) in terms of their relative importance to each other. The score is calculated by multiplying the raw score (Possible Opportunity (P)) times the preestablished Impact (I). After each questions has been scored, a total opportunity score is calculated by summing each of the individual questions scores. The third step is to map the opportunity and risk scores. The total scores for the opportunity and risk are to be used as coordinates on the matrix provided within the model. The opportunity score is placed on the vertical axis and the risk score is placed on the horizontal axis. When the scores intersect, determines the final scoring of the opportunity assessment. The location of this score on the matrix helps determine the quality of an opportunity and serves as an indicator of the level of risk that will have to be managed in order to ensure project success.


Another risk management tool is RAM. The ESI Risk Assessment Model (RAM) is intended to be used in the early life-cycle phases of a project or contracting opportunity. Its primary purpose is to provide a framework to help management and decision-makers with project selection or bid/no-bid decisions. The RAM model was developed by ESI based on studies of actual projects and contracts, and consultation with decision-makers. These studies showed that project selection and bid/no-bid decisions are made with considerations for both the potential risks and potential opportunities. Through the studies, the ESI developed a set of probability and impact questions to assess risk and opportunity. The RAM model recommends that at least four to six key project teams members be assembled for an assessment meeting to determine the answers to the probability and impact questions. The appropriate box is selected on the tool for each question. The RE (risk exposure) and the OE (opportunity exposure) are obtained for each question by multiplying the quantity of the selected probability times the quantity of the selected impact. After all 40 questions have been answered, a total risk exposure score is obtained by adding up the RE for the 20 risk assessment questions. A total opportunity exposure score is obtained by adding up the OE for the 20 opportunity assessment questions. These two quantities are then plotted on the ESI decision scale. The total risk exposure score is marked on the risk scale and the total opportunity exposure score is located on the opportunity scale. A line is drawn between these two points. The recommended decision is read off the decision scale at the point where the line drawn crosses the decision scale.

Exhibit 1

Exhibit 1

Problems With Current Risk Management Tools

Currently, risk identification is heavily dependent upon the experience and perceptivity of project management. According to a research article entitled “Practice, barriers, and benefits of risk management process in building service cost estimation,” approximately 80% of the construction industry uses intuitive assessment in measuring risks (Leung, Mok, & Tummala, 1996) Leung, Mok, and Tummala surveyed 52 building service engineers in Hong Kong. Their research identified some inherent problems with current risk management tools available. Their results are displayed in Exhibit 1. The time involved seemed to worry most of the people because the time allowed for the preparation of cost estimates is usually limited and pressuring.

In construction, most contractors have developed risk management techniques that rely on historical information and previous experience (Kim, 2000) Although these techniques assess risk, they are not very good at evaluating the consequences. The proposed risk management tool defines and assesses risk a project may have and also determines what the project profitability will be based on the impact of the identified risks and the company's historical data and past experience. After the risks have been identified and quantified, a decision tree approach is used to determine whether or not to carry out the project. If major financial risks are predicted, the decision generally is to go not further (see Exhibit 2).

Project Goals:

• Enable decision-making to become more systematic rather than subjective

• Force management to realize there are many different outcomes for a project

• Identify influencing factors in the general contractor's decision to bid or not to bid for project

• Conduct a thorough analysis of alternative options to managing risk

• Allow the decision-maker to confront risk and opportunity in a realistic manner

• Educate contractors about the potential positive opportunities when risk is managed.

Exhibit 2

Exhibit 2

Survey Methodology

Who Was Surveyed?

For our research, we worked with Branch and Associates, a medium-sized contractor, located in Roanoke, VA. Their projects include commercial buildings, healthcare facilities, industrial projects, hotels, motel, resorts, multi-family housing, schools, and institutions. Branch and Associates have been ranked in Engineering News-Record's top 400 contractors since 1988. They are currently ranked 127. Branch was selected due to its proximity to Virginia Tech, where the research was being conducted, which facilitated easier communication and more frequent visits.

Current Risk Management Procedures Used

For part of our research, we worked with the chief estimator, Larry Dickenson, who explained Branch's current approach to risk. Branch had developed a checklist specific to their companies past project experiences. After reviewing the checklist, we found that the checklist was being used as a simple catalog to help prevent risks from being overlooked. After the risks were recognized, the estimator was left to his own discretion as to what action to take. Typically, a lump sum contingency was added to the estimate. No real analysis was done to see how this risk could potentially be avoided or, more importantly, become a positive situation for the contractor to make money. Risk management's purpose is to minimize adverse events and maximize potential opportunities.

The Survey

Branch and Associates had compiled a moderate historical database. The data included bid amount, final cost, number of bidders, bid type, architect, building size, building type, and project complexity. For projects that cost more or less than the bid amount, the data did not show any apparent relationships between the final project cost and the actual occurrences that were experienced during construction. Therefore, we developed an electronic survey to assess Branch's past experience, which can be reviewed at The survey consists of 40 questions, divided into two sections. One section analyzes risk and the other section analyzes opportunity. For each question, the user is asked to select the probability of the risk or opportunity occurring and the potential impact if the risk or opportunity occurred. After the survey is completed, the answers are electronically transmitted to the researchers and inserted into a database for analysis. Ten projects were selected to be surveyed. The projects include schools, commercial buildings, multi-family housing, and institutional buildings.

The purpose of the survey is to identify risks that occurred and how they impacted the project cost. Every company handles risk in a different manner; therefore, this survey was designed to determine not only how Branch and Associates understood and responded to a project's risk, but also how their response affected profitability.

One critique of the survey is that it was conducted by one individual and not a group; therefore, the data could be inaccurate based on the individual's perception or the limited experience of the individual. If the person concerned has experienced primarily incident-free projects then risk identification will tend to be optimistic, and vice versa.

Implementation of Data Collected from Survey

Once the relationship between risk and actual profitability has been determined the same survey can be used as a method of identifying risk and determining profitability before a company decides to bid on the project. While it may be that many projects contain a number of reasonably standard and recognizable risk situations, each new project requires careful and individual consideration. A realistic estimate of the final cost is generally required as early as possible. At that stage, all potential risks, which can affect these estimates and act as constraints on the project, can be identified.

The primary basis for identifying risks is historical data, experience, and insight. The proposed model tried to combine these three aspects into one tool. Because each construction is unique, by definition, similar risks may not recur on similar projects. Historical records do not automatically imply new areas of risk. Risks such as an earthquake or a labor strike are unexpected risks that cannot be predicted by any tool. Therefore, no tool will be 100% effective in identifying every risk associated with a project.

One problem associated with a new tool is the natural tendency of human beings to resist change. One solution for this problem is education and training. If the benefits of using this risk management tool are made known to people and more education and training is provided using a computer-based decision system, then people may realize that the use of risk management tools can enhance decision-making and increase project profitability. Also, after the risk management tool has been implemented for some time, this problem would normally become less serious or even nonexistent; that is, familiarity with the tool will breed acceptance while increased profitability and efficiency will generate confidence in the tool.


Risks are ever present. The construction industry encounters high risk due to such factors as uniqueness of every project and exposure to external elements and the changing nature of risk. Depending on the uncertainties and the consequences, risks are accepted routinely, and measures are taken to minimize their consequences. Proper risk management should identify and control risks that have a potential of causing unwanted problems and is proactive rather reactive. The principal aim of this project is not to discourage a company from bidding on projects with high risk but to identify risk and encourage risk management in a more cost effective and timely manner. This tool will provide an effective method to explore and quantify risk for estimators and employees with limited experience.

Aspinwall, Elaine M., Bennett, Joanna C., Bohoris, George A., & Hall, Richard C. (1996, February). Risk analysis techniques and their application to software development. European Journal of Operational Research, 467–475.

Bajaj, D., Lenard, D., & Oluwoye, J. (1997, October). An analysis of contractors’ approaches to risk identification in New South Wales, Australia. Construction Management and Economics, 363–369.

Baker, Scott, Ponniah, David, & Smith, Simon. (1999, November). Risk response techniques employed currently for major projects. Construction Management and Economics, 205–213.

Bernstein, Peter L. (1998). Against the odds: The remarkable story of risk. New York: John Wiley & Sons, Inc.

Dawood, Nashwan. (1997). Estimating project and activity duration: A risk management approach using network analysis. Division of Civil Engineering and Building, School of Science and Technology, The University of Teesside.

De la Garza, Jesus M., & Rouhana, Khalil G. (1995, February).Neural networks versus parameter-based applications in cost estimating. Cost Engineering, 14–18.

Dexter, William F. (1999, May). Risk management: A mine field. Consulting-Specifying Engineer.

Diekman, James, Pecosk, Roger S., & Songer, Anthony D. (1997, January). Risk analysis for revenue dependent infrastructure projects. Faculty of Civil, Environmental, and Architectural Engineering, University of Colorado, 377–382.

Duffield, Colin F., Fayek, Aminah, & Young, David M. (1999, December). A survey of tendering practices in the Australian construction industry. Engineering Management Journal, 29–34.

Kerzner, Harold. (1998). Project management. New York: John Wiley & Sons, Inc.

Kim, Soon. (2000, January). Risk management in construction: An approach for contractors in South Korea. Cost Engineering, 38–44.

Leung, H.M., Mok, C.K., & Tummala, V.M. Rao. (1996, April). Practices, barriers, and benefits of risk management process in building services cost estimation. Department of Manufacturing Engineering, City University of Hong Kong, 161–175.

Ranasinghe, Malik. (1997, February). Risk management in the insurance industry: Insights for the engineering construction industry. School of Building and Real Estate, National University of Singapore.

This material has been reproduced with the permission of the copyright owner. Unauthorized reproduction of this material is strictly prohibited. For permission to reproduce this material, please contact PMI or any listed author.

Proceedings of the Project Management Institute Annual Seminars & Symposium
September 7–16, 2000 • Houston, Texas, USA



Related Content

  • Project Management Journal

    Team Collective Intelligence in Dynamically Complex Projects member content locked

    By Hansen, Morten Juel | Vaagen, Hajnalka | van Oorschot, Kim In concurrent engineering projects driven by short delivery times, team performance rests on the team’s capability to quickly and effectively handle different, emergent issues. We conducted an…

  • PM Network

    High-Wire Act

    By Parsi, Novid Seven years ago, government leaders in Alberta, Canada vowed to take a major step toward addressing the energy needs of the growing province. The resulting transmission line, the longest of its kind…

  • PMI White Papers

    The Impact of the COVID-19 Crisis on Project Business

    By Project Management Institute | Project Business Foundation This is a report on the results of a survey jointly conducted by PMI and the Project Business Foundation. The intention was to replace observations and opinions with reliable data. The mission was…

  • PM Network

    Playing with Fire

    By Jones, Tegan With the coastline of an entire continent burning, a scorched-earth urgency had teams across Australia racing to control the damage. Between September 2019 and January 2020, bushfires ravaged…

  • PM Network

    Trees of Life

    By Hendershot, Steve The world needs more trees—and a lot of them—to stem the damage wrought by mass deforestation. Brazil alone is destroying the equivalent of three football pitches per minute in the Amazon rainforest…