Since the Turnbull Report into internal control and risk management made it clear that companies would be compelled to institute formal risk management procedures, the quest has been on to find best practice procedures; particularly those which can be easily replicated between different companies. Such a holy grail is still sadly wanting.
However, one organisation has been granted the opportunity, if not the absolute necessity, of drafting risk management procedures for a highly complex, multi-project enterprise from a completely clean piece of paper.
That organisation is T4M Alliance, the company tasked in 2003 with the £1.8 billion upgrade of London Underground’s stations and the civil engineering work on its track infrastructure. The Alliance risk management team is drawn exclusively from Faithful+Gould, the project and cost management arm of the Atkins Group, one of the partners in the consortium which had won the contract from London Underground.
Stephen Dean-Corke is one of four risk managers seconded from Faithful+Gould to work on the Alliance Risk Team. He explains, "In a mature organisation, it is difficult to introduce new processes because historic company culture and entrenched management attitudes often get in the way. However, Trans4M Alliance was totally new, so we had the incredible opportunity to put in place what we saw as ‘best practice’ risk processes with very few constraints."
Traditional risk management in the construction industry has been project based, but the complex nature and large number of projects involved in the London Underground modernisation meant that a new approach was required. The Risk Team’s experience in a wide range of risk management scenarios was crucial to getting the strategy right.
"From the conception of the organisation, risk management was identified as key to the successful delivery of projects in all four sections of the contract: station upgrades and civils work on Bakerloo, Central and Victoria lines on the one hand and the sub-surface lines on the other."
Initially, BS6079 Part 3 was chosen as the most appropriate standard to adopt in view of its consistency with international standards and suitability to the nature and scope of the business. Once chosen, the standard had to be implemented right across the business, so risk register were put in place for each member of the executive board, including the managing director as well as their first reports plus each programme manager and each project. While the Risk Team provides the expertise to ensure the systems and procedures are correctly and fully established, Stephen Dean-Corke does not see the 'experts' as being the main movers in the process. "Our plan is, over time, to embed all reviews into the general operation of the business, so that the risk team is there to maintain an audit function."
One of the main tasks in the early stages was to understand and address the relationship between different types of risk – for example, those affecting the business as a whole, those impacting on the programme of works and those which simply affected an individual project. These relationships are constantly evolving, but clarity has to be created to avoid duplicating risks, creating uncoordinated treatment strategies and simply wasting effort for no practical result.
One method outlined by the team has been the concept of creating summary risks in the registers to draw together similar types of risk. This allows the registration of a broader spectrum of risk than would be possible if each specific risk were detailed.
Another novel idea is the adoption of a rolling wave planning approach, to risk management. The idea of not planning all risks in detail is very appealing; it cuts down significantly on the workload and allows the risk management team to focus on the most critical tasks. Stephen Dean-Corke says, “It’s impossible to treat all risks to the same level of detail and to try would be a waste of time, since low risk events are by their very nature unlikely to happen.”
Trans4m Alliance’s entire risk structure is supported by the Active Risk Manager (ARM) system, chosen by the Alliance as ‘best in class’ product that provided the functionality to sustain such a complex programme and organisation.
While the Alliance’s risk strategy is still evolving, Stephen Dean-Corke believes that the clean slate opportunity has been efficiently embraced. “The Risk Team has created some truly innovative practices here at T4M Alliance and we are learning all the time how to adjust them to fit the changing realities of what we face here.” While he would never claim to have invented a model risk management system, some of the initiatives being tested on this ground-breaking scheme deep under London may yet find their way into the internal audit textbooks of the future.