Why construction is risky

Every construction project is a promise to deliver something that does not yet exist, on land that has never been fully explored, with people and materials that have not yet been hired or bought, at a price agreed before most of the uncertainty has gone away. That is a description of risk. Construction is not unusually careless; it is unusually exposed. Each project is a one-off prototype, built outdoors, by a temporary organization of dozens of firms, under contracts that try to fix price and time long before the facts are known. This course is about how the industry identifies those risks, decides who should carry each one, prices and funds them, and transfers some of them to insurers and sureties.

The course builds on several earlier ones. CON-220 covers the law of contracts, changes, delay, liens, prompt payment and disputes. CON-300 shows how risk enters a bid price, CON-310 how contingency is tracked in the cost report, CON-320 how a surety judges a contractor's finances, CON-330 how subcontractors are prequalified and managed, and CON-340 how risk shifts between delivery methods. Here we bring those threads together and go deeper on the risk process itself, on the clauses that allocate risk, and on insurance and bonding. Nothing in this course is legal or insurance advice; policies, bonds and contracts must always be read in full, with professional help.

What we mean by risk

In project management, a risk is an uncertain event or condition that, if it occurs, affects at least one project objective such as cost, time, quality, safety or reputation. Two features matter. First, a risk has a probability: it may or may not happen. Second, it has an impact: if it happens, it changes an outcome. A certainty is not a risk; it is a fact to be planned and priced. A problem that has already happened is not a risk either; it is an issue to be managed. Keeping these three categories apart is the first discipline of risk management, because each is handled differently.

Opportunities deserve a mention because risk management is not only defensive. A design change that removes a temporary works package, a supplier that can deliver early, or a dry autumn that lets earthworks run ahead are all uncertain events with positive effects. Good registers record them alongside threats, and some contracts, especially target cost and integrated forms (CON-340), share the benefit when an opportunity is realised.

Why construction carries so much risk

Several structural features make construction riskier than most manufacturing or service work. A factory makes the same product thousands of times and can refine the process; a contractor builds a different building on a different site for a different owner every time. The work happens outdoors, exposed to weather and ground conditions. The project team is assembled for one job and dissolved at the end, so relationships and procedures are new. Price is usually fixed early, often on incomplete design. Payment flows down a long chain, so a failure at one link can affect everyone below it. Margins are thin, often a few percent, so a modest loss can wipe out the profit of an entire job, and several bad jobs can sink a firm.

Categories like these are useful as prompts when identifying risks, the subject of lesson 2. They are not watertight; contaminated soil is a site risk, an environmental risk, a regulatory risk and a cost risk all at once. What matters is that the team asks systematically about each area rather than relying on memory.

What the evidence says about overruns

Research on large projects has repeatedly found that cost and schedule overruns are common and that estimates are biased toward optimism. Studies of transport and infrastructure megaprojects by Bent Flyvbjerg and colleagues, covering thousands of projects in many countries, report that most exceed their budgets and that the distribution of overruns has a long tail: a minority of projects overrun by very large amounts. Building projects generally overrun less than tunnels, rail and information technology, but the pattern of optimistic estimates followed by growth is similar. The usual explanations are optimism bias, where planners underestimate difficulty in good faith, and strategic misrepresentation, where costs are understated to win approval.

Canadian and American examples show the range. Public reviews of troubled transit projects, hospital builds and stadiums in both countries have pointed to the same causes again and again: risk transferred to parties who could not manage it, design started before requirements were settled, ground conditions not investigated, unrealistic schedules, and weak contract administration. At the other end of the scale, small contractors fail every year because one job with an underpriced risk drains their working capital. CON-320 lesson 1 discusses contractor failure rates and their causes from the financial side.

The practical lesson is not that estimates are useless but that a single number is a poor description of an uncertain future. Lesson 3 shows how range estimates and Monte Carlo simulation turn an estimate into a distribution, and lesson 4 how contingency is sized from that distribution rather than as a flat percentage. Reference class forecasting, which adjusts an estimate using the actual outcomes of similar past projects, is another response to optimism bias that some public owners now require for major projects.

The risk management process

Most organizations follow a cycle based on international standards such as ISO 31000, Risk management: Guidelines, and on project management guidance such as the PMI standards (PMP-131 covers the PMI view). The cycle has five main steps, carried out continually rather than once.

The process applies at two levels. Owners manage project risk from the moment a business case is written; they decide which risks to keep and which to pass to designers and contractors through the contract. Contractors manage both the risks they accept under the contract and enterprise risks such as their backlog, bonding capacity and safety record. The same tools serve both, but the risk appetite differs: a public owner with a large portfolio can absorb variation that would ruin a small contractor.

Risk appetite and tolerance

Risk appetite is the amount and type of risk an organization is willing to pursue or keep to achieve its objectives. A contractor with a strong balance sheet might accept fixed-price work with ground risk; a smaller firm might decline it or insist on a differing site conditions clause. Tolerance turns appetite into thresholds, for example 'no single risk with an expected cost above 2 % of contract value may be left unmitigated' or 'the project must have at least an 80 % chance of finishing within budget'. Setting these thresholds early lets the team decide consistently which risks need action and which can simply be watched.

# How much of a year's profit can one risk consume? (illustrative)
revenue = 60_000_000
margin = 0.07
overhead = 3_100_000
profit = revenue * margin - overhead
print(f"Planned operating profit: {profit:,.0f}")
for loss in (250_000, 500_000, 1_000_000, 1_500_000):
    left = profit - loss
    print(f"Unrecovered loss {loss:>9,}: profit {left:>10,.0f}  ({loss / profit:.0%} of planned profit)")

Planned operating profit: 1,100,000
Unrecovered loss   250,000: profit    850,000  (23% of planned profit)
Unrecovered loss   500,000: profit    600,000  (45% of planned profit)
Unrecovered loss 1,000,000: profit    100,000  (91% of planned profit)
Unrecovered loss 1,500,000: profit   -400,000  (136% of planned profit)

The table produced by the code is a simple way to show a board or owner why tolerance thresholds matter. For a contractor whose planned profit is around $1.1 million, a half-million-dollar unrecovered loss consumes almost half of a year's earnings. Owners face a parallel problem with their budgets and funding approvals, which are often fixed and politically difficult to increase.

Who should carry a risk?

A widely cited principle, often attributed to the work of Max Abrahamson on engineering contracts, is that a risk should be allocated to the party best able to control it, or, if no party can control it, to the party best able to bear it at the lowest cost. Applied honestly, the principle produces sensible contracts: the contractor carries the risk of its own productivity and methods, the owner carries the risk of the ground it chose to build on unless it has paid for a thorough investigation, and natural catastrophes are insured. Applied badly, owners push every risk onto contractors who then price it, decline to bid or fail. Lessons 5 and 6 explore allocation in detail, and CON-340 lesson 11 compares how delivery methods allocate the big risks.

Transfer deserves a word of caution. Transferring a risk does not make it disappear. If a subcontractor that has accepted a risk cannot pay for it, the risk returns to the contractor; if the contractor cannot pay, it returns to the owner, sometimes with delay and litigation added. Insurance and surety exist precisely because they put a financially strong third party behind the transfer. That is why lessons 7 to 10 spend so much time on what policies and bonds actually cover.