Guidance notes - Structured risk identification workshop

Whatever risk valuation technique is used, before analysing and attempting to quantify the effect of risks on a project, the sources of risk must be identified first.

The risk identification process is probably the most important and useful part of the risk evaluation analysis. It benefits understanding of the project and its potential problems, as well as provoking thought about the appropriate management response to risks.

The identification of risks is best done using brainstorming. Good practice in brainstorming sessions is not described here. The purpose of the brainstorming should initially be purely to identify risks. There should be no quantification at this point. This is because quantification of risks is a complicated process and care must be taken to ensure that experts form their own views after some consideration of the identified risks in the context of the reference project and the Raw PSC. There is a danger that the group dynamics at the risk identification workshop/brainstorm session can give rise to conformism and thus a simplification of treatment and an underestimate, or overestimate of the level of risk. This is particularly the case if the quantification is done without sufficient preparation and forethought too early in the process. However, the identification of risks phase is less prone to these problems, and the creative benefits of group work early in the development of the PSC outweigh the dangers.

The aim after the brainstorming session is to ensure that all those attending leave with a common perception of the risks associated with the project and the risk experts understand what is required of them in the next stage - firming up the actual risk estimates of probability and cost. Depending on the stage of development of the project and time constraints, it is possible to complete both the risk identification and risk quantification workshops in the same day.

People who might be involved in the identification and quantification of risks are:

(i)  'core' service operational managers and stakeholders

(ii)  Departmental stakeholders

(iii)  the relevant PPP Authority representative/s

(iv)  project managers

(v)  technical consultants such as architects and design engineers

(vi)  financial and legal advisers

(vii)  the risk analyst.

A useful tool to help structure the thinking in the brainstorming session is a list of typical risks to which the project may be exposed. The Risk Allocation and Standard Commercial Principles guidance provides a useful starting point for developing this list.

Risk and outcome are often misunderstood. It is important to emphasise the key difference between these terms.

•  An outcome is a consequence of a risk such as 'delay', 'cost overrun', under-performance'; and

•  A risk is an event that causes the consequence, such as 'failure to grant a right of way', 'poor ground conditions', 'material defect'.

Accordingly, construction cost overrun' is not a risk and therefore should not appear on the risk register as an identified risk, but should be identified as a consequence of certain risk events.

The output from this stage should be incorporated into a risk register, including as a minimum:

•  risks identified and categorised for ease of reference (individual risk identification tags can also prove useful for future reference);

•  a rough cut of risk allocation; and

•  a 'risk expert' identified for each risk, whose role is to further refine the preliminary analysis in terms of description, consequence, and numerical risk estimates in the following stages of the risk valuation process.

In allocating risks, the risk allocation principles in the Risk Allocation and Standard Commercial Principles guidance should be the basis. The PPP project delivery is committed to optimal rather than maximum risk transfer. Consequently the identifiable risks of the project should be individually valued and allocated to the party best able to manage them at the lowest cost to government. If a risk is to be retained by government it is classified as a 'Retained' Risk, while if the private sector would be better placed to manage the risk, it is classified as a 'Transferred' Risk.

Most importantly, the PSC needs to accurately reflect the performance standards specified in the output specifications and articulated in the key performance indicators (KPIs) and payment mechanism. A key risk in this regard concerns performance. Performance risk relates to the risk that the service provider will not meet the required service standards and, as a result, will have some, or all of their income (service payments) 'abated'. This is a known risk transferred to the private sector. It is usual, and acceptable, in such cases for a risk premium to be built into the tendered price - as for all other Transferred Risks. Although in reality, government is unlikely to abate payments to a government service provider (i.e. as typically assumed under the PSC), for a fair comparison to be made with bids, this risk needs to be built into the PSC.

It is often the financial adviser who is responsible for facilitating the risk workshop and coordinating the risk estimates from the risk experts.

Department/Organisation

Attendees (participants) at the risk workshop

the Procuring Agency

[list names of participants]

the Relevant PPP Authority

[list names of participants]

[name of clinical operator]

[list names of participants]

[insert name of technical adviser]

[list names of participants]

[insert names of financial advisers]

[list names of participants]