2.6.28 Active Risk Management Strategies should be adopted for the appraisal and implementation of large policies, programmes or projects, and risk management principles should be applied to smaller proposals. Before and during implementation, steps should be taken to prevent and mitigate both risks and uncertainties. It is important to be transparent with sponsors about the potential impact of risks and biases in proposals.
2.6.29 Risk Management is a structured approach to identifying, assessing and controlling risks that emerge during the course of the policy, programme or project lifecycle. It involves a series of well-defined steps to support better decision making through good understanding of the risks inherent in proposal and their likely impact. Risk management includes:
• Identifying possible risks in advance and putting mechanisms in place to minimize the likelihood of their materialising with adverse effects
• Having processes in place to monitor risks and access to reliable up to date information about risks
• The right balance of control in place to mitigate the adverse consequences of the risks, if they should materialise; and
• Decision-making processes supported by a framework of risk analysis and evaluation
2.6.30 Following identification and analysis of risks, generation of an OB-adjusted expected NPV, and assessment of options' exposure to uncertainty, appraisers need to consider and adopt strategies to prevent and mitigate risks and uncertainties. Steps to be considered include:
• early consultation - to identify needs at the outset and avoid costs increasing later due to poor initial understanding of requirements
• deferring irreversible decisions - to allow more time to investigate mitigating measures or alternative ways to achieve objectives
• pilot studies - to acquire more information about risks and take steps to mitigate adverse consequences or increase benefits
• design flexibility - increasing the flexibility of designs to make proposals more robust against changes in future demand
• taking precautionary action - to reduce the risk of a very bad outcome, even where the probability is considered small
• transferring risk to the private sector - through contractual arrangements e.g. insurance. (The Green Book elaborates on ways to transfer risk)
• making less use of leading edge technology - where simpler methods can reduce risk considerably
• reinstating or developing different options - where risk analysis suggests this is worth doing
• commissioning research - to confirm or disprove the reliability of new technology, or to reassess the nature of a danger
• undertaking site investigations - to reduce risks from unforeseen ground conditions or refurbishment costs
• staging a project - so that it can be altered at successive review points
• abandoning the project - because it is too risky.
2.6.31 Business cases should report on all activity undertaken regarding Identification and analysis of risks and uncertainties, adjustment for optimism bias, assessment of uncertainty, risk management and risk reduction strategies.