PART 6 · RIGHT PROJECT, CLEAR PLAN

Lesson 15. Project risk management

Reading time ≈ 24 min · Based on Chapter 15 of the book

Prepare for sudden danger before it comes and you will stay safe and at peace;

treat it lightly and you will easily be overturned.

— I Ching

LEARNING OBJECTIVES

After this lesson you will be able to:

• Recognise risks that come from not understanding rightly, not working genuinely, and from personal bias.

• Describe a risk management structure that spans all project phases.

• Respond to the risk of losing talent and to misconduct (embezzlement, waste, bureaucracy).

• Distinguish contingency, budget allowances and management reserve; set contingency by probability.

• Choose contract pricing and contract type (EPC, EPCM) based on risk analysis.

Binh thư yếu lược teaches that what we have not thought of, we fear; fear stops us from reckoning, and that is a sign of defeat. Only by planning for hardship and danger does the mind grow calm. So it is with projects: prepare from the first idea to handover and operation.

Risk that comes from not understanding rightly

The most damaging sources of risk often do not appear on the technical risk register:

Not understanding the project, the nature of project management or the competences it needs.
Not working genuinely: superficial, hasty, bureaucratic, indifferent work.
Letting bias and ego drive decisions.
Not seeing how the project evolves and how it depends on its stakeholders.

Risk management is continuous, comprehensive and spans the life cycle. In each phase: identify stakeholders and their involvement, anticipate the risks they face, allocate risk-management responsibility sensibly, and keep the risk register current from start to finish.

Figure 15.1. Overall structure of risk management for a construction investment project.

THREE COMMON GAPS

1. Talent and conduct: the risks of losing good people and of misconduct are not identified or analysed.

2. Cost: a flat 10% contingency for every project, treated as risk management.

3. Contracts: awarding contracts to firms unable to manage the risks; or handling lump-sum contracts against international practice (the owner “clawing back” unused contingency, or the contractor claiming escalation although the lump sum already includes contingency).

To be proactive, organisations should clarify their risk strategy and risk culture, create a risk management function with suitable people, and remember that risk management is not only reducing risk but also creating value from it.

Talent risk and the “enemy within”

The risk of losing talent

Good people may leave just when the project needs them most. Retention measures: a career path, fair pay, opportunities to learn and to join the wider ecosystem of the organisation (culture, innovation, R&D, knowledge management, coaching, mentoring). Or accept the risk through flexible hiring and developing successors.

The risk of misconduct

President Hồ Chí Minh called embezzlement, waste and bureaucracy the “enemy within”. Embezzlement is stealing public property. Waste of labour, time and money is even more harmful. And the root is bureaucracy: “having eyes that do not see through, ears that do not hear fully”, reading reports on paper without checking on the ground.

Develop talent

Build knowledge, delivery capability and ethics in the core team.

Code of ethics

Issue it and have everyone sign; key people set the example.

Legal awareness

Train on the law; live and run projects by the law.

Self-criticism and criticism

Build them into regular project meetings.

A way to speak up

Controls, oversight, and a channel for reporting deviant behaviour.

Setting contingency

International practice distinguishes three kinds of reserve:

Type	Purpose	Controlled by
Contingency	Reduces or removes the impact of events not foreseen or not adequately forecast. Reserved for risk management.	The project
Budget allowances	Foreseeable items within scope that cannot yet be priced precisely: permits, tender evaluation, groundbreaking, financing, acceptance, inauguration… Already inside the base estimate.	The project
Management reserve	For major changes in scope or technology; used at senior management’s discretion.	Senior management, outside the project director’s control

Figure 15.2. Base estimate + contingency = budget; budget + management reserve = available funds.

Why a flat 10% is not sound

Current Vietnamese rules typically set contingency at about 10% (for additional quantities and price escalation); some countries use 5–15%. Modern theory sees three problems with a fixed rate:

It says nothing about whether 10% matches this project’s risks, so some projects must raise their budget while others hold far too much.
It is not tied to specific risks, so it is unclear when it may be used.
Holding contingency for the whole project is an inefficient use of scarce capital.

Contingency must come from the project’s own risk analysis, as a function of the desired probability that the final cost will not exceed the budget. The higher the probability, the larger the contingency.

Quantitative methods

Expected value	Contingency based on the expected value of risk events.
Normal distribution	Each cost item is a normal distribution; means and variances are combined.
Monte Carlo simulation	Produces a probability distribution of the total estimate.
Range estimating	Experts set a range and distribution for each item, then a simulation is run.
Multiple linear regression	Predicts final cost from independent variables such as location and size.

Figure 15.3. Steps to set the estimate and contingency: (i) base estimate; (ii) identify risk factors; (iii) estimate ranges and a cost–impact matrix; (iv) run the model; (v) choose the desired probability and set contingency.

Illustration based on the book’s example. The base estimate is USD 140 million. If the owner chooses P80, the total estimate is USD 150 million and contingency is USD 10 million. P70 or P80 is common; some organisations use P50 for every project and balance contingency at portfolio level.

The simulation also produces a sensitivity (tornado) chart for allocating contingency to each factor or phase. In the book’s example: 29.6% to design, 28.8% to materials, 18% to labour, 13.6% to technical solutions and 9.4% to equipment procurement. Leaders can then see whether the current contingency is still adequate and reallocate or release what is not needed, which is especially useful for portfolio management.

More important than the method is assembling a risk assessment team with the right knowledge and experience, including representatives of the main stakeholders.

Risk and the choice of contract

Contract pricing reflects how the parties allocate risk:

Pricing	Who bears financial risk	Effect on the bid price
Lump sum	The contractor, entirely: “win or lose, it’s theirs”	Highest contingency in the price
Fixed unit rates	The contractor bears rate changes; quantities are remeasured	Part of the contingency moves to the contractor by negotiation
Reimbursable / adjustable	The owner, entirely	The owner manages all contingency
Mixed	Agreed risk by risk	Cost matches the risk each party accepts

Figure 15.6. The EPC contract model.

Figure 15.7. The EPCM contract model.

Feature	EPC	EPCM
Structure	One contract with one contractor or consortium	Many contracts; the EPCM contractor prepares them, the owner signs and bears overall responsibility
Cost risk	Borne by the EPC contractor	Borne by the owner
Delivery risk	One party bears all schedule, cost, quality and warranty risk	Allocated to each contractor under its contract
Schedule	Construction can overlap design; suits urgent projects	Each contract takes about 6–8 weeks to tender, evaluate and award; design must finish before construction
Single point of contact	Preferred when the owner wants one point of responsibility	Many contractors, with different completion dates and warranties

The rule: if risk is low or the owner can control it, the owner may retain risk (reimbursable pricing, EPCM); if risk is high or the owner lacks the capacity, transfer it (lump sum, EPC). Risk allocation must be reflected properly in the contract terms and technical requirements, and form the basis for negotiating the price.

Apply it to your project

CHECK YOUR RISK MANAGEMENT

☐ A risk register was set up at the start and is updated at every phase.

☐ The register includes people risks: loss of key staff, misconduct.

☐ Contingency is set at a chosen probability, not just a fixed rate.

☐ Contingency is allocated by factor or phase and reviewed regularly.

☐ The contract type was chosen from risk analysis and each party’s capacity to bear risk.

Reflection questions

FOR INDIVIDUAL REFLECTION OR GROUP DISCUSSION

1. What percentage contingency does your project budget hold? Was it derived from risk analysis or simply fixed?

2. If your project director or chief engineer left tomorrow, how would the project be affected? Is there a successor?

3. On the last lump-sum EPC contract you worked on, did the owner “claw back” contingency or the contractor claim price escalation? What does that say about how risk allocation is understood?

Quick check

Question 1. Which reserve is outside the project director’s control?

Contingency
Budget allowances
Management reserve
Base estimate

Question 2. The base estimate is USD 140 million and the simulated P80 value is USD 150 million. The contingency is:

10% of 140
USD 10 million
USD 14 million
USD 150 million

Question 3. An owner with strong risk-control capability wants to use that strength. The more suitable choice is:

Lump-sum EPC
EPCM or reimbursable pricing
No contract
Always the lowest price

Question 4. According to President Hồ Chí Minh, the root of embezzlement and waste is:

Low salaries
Bureaucracy
Lack of technology
Foreign contractors

Answers and explanations

Question 1: C. The management reserve is controlled by senior management and used for major changes in scope or technology.

Question 2: B. Contingency = value at the desired probability − base estimate = 150 − 140 = USD 10 million.

Question 3: B. When risk is low or the owner can control it, the owner can retain risk through EPCM or reimbursable pricing.

Question 4: B. “Embezzlement and waste exist because of bureaucracy.”

Key points

THE ESSENTIALS OF THIS LESSON

• Major risks come from not understanding rightly, not working genuinely, and from bias and ego; risk management is continuous, comprehensive and spans the life cycle.

• Three common gaps: talent and conduct risks; unquantified cost risk (a flat 10%); contract types not matched to each party’s capacity to bear risk.

• Risk management is not only reducing risk but creating value from it.

• Budget = base estimate + contingency; available funds = budget + management reserve.

• Contingency should be set at a chosen probability (usually P70 or P80) using Monte Carlo simulation, and allocated using a sensitivity chart.

• Lump-sum pricing moves financial risk to the contractor; reimbursable pricing leaves it with the owner. EPC is a single point of responsibility with the contractor bearing the risk; EPCM uses many contracts with the owner bearing cost risk.

This lesson is adapted from Chapter 15 of Quản lý dự án: Hiểu đúng & Làm thật (“Project Management: True Understanding, Genuine Action”) by Truong Van Thien (Construction Publishing House, Hanoi, 2025). The content has been condensed and reorganised for learning; full data, quotations and references are in the book.