Claims advisory →
When a risk has materialised into an entitlement question.
Construction risk management is a project-controls discipline that connects uncertain events to named owners, decision rights, programme exposure, cost exposure and reporting cadence. It helps capital-project teams use a risk register as a decision tool, supported by quantitative schedule and cost analysis where the underlying data is fit for purpose.
The problem
A risk register alone does not improve outcomes. Effective risk management connects uncertain events to decision rights, programme exposure, mitigation ownership and reporting cadence. A register that is updated each month but has never changed a decision is usually a reporting artefact rather than a management control.HKA's CRUX Insight research found sums in dispute averaged 33.4% of contract budgets across more than 2,200 projects. Earlier intervention relies on seeing the risks that drive time, cost and contractual exposure while an action is still available. Quantitative outputs are useful only when their assumptions and the programme network are visible.
Scope
Risk maturity and framework review
Assess process, ownership, decision rights, escalation and reporting cadence against a recognised risk-management framework.
Risk-register rebuild
Establish a practical taxonomy, named owners, triggers, mitigation actions and the distinction between risks, issues and assumptions.
Quantitative schedule risk analysis
Model duration uncertainty and discrete risks against a validated programme to show a range of completion outcomes and key drivers.
Quantitative cost risk analysis
Model cost exposure and a contingency basis with assumptions stated, rather than a generic percentage.
Early-warning reporting
Define indicators, thresholds, owners and routes for decisions before risks become historical reporting.
Capability transfer
Facilitate workshops and train the team that will run the risk cycle.
Method
- 01
Start with the work, not the register
Review process, ownership, decision rights and cadence.
- 02
Check whether the programme can be risked
Resolve open ends, hard constraints, missing logic and unrealistic durations before relying on probabilistic results.
- 03
Rebuild or remediate the register
Set taxonomy, ownership, triggers and scoring basis.
- 04
Model transparently
State duration ranges, discrete risks, correlations and assumptions.
- 05
Report the basis, not just the result
Show confidence ranges, sensitivity drivers and limitations.
- 06
Connect to the routine
Embed indicators and escalation points in the project reporting cycle.
What you get
Risk maturity assessment
Current state against a recognised framework and prioritised gap list.
Risk management plan
Process, roles, decision rights, escalation and cadence.
Rebuilt risk register
Structured, owned, triggered and with a stated scoring basis.
QSRA report
Confidence range, drivers, sensitivity analysis and assumptions.
QCRA and contingency basis
Cost exposure model and decision-ready contingency basis.
Early-warning set and workshop pack
Indicators, thresholds, reporting route and training materials.
What we need
- Current risk register and recent review minutes
- Risk management plan or procedure
- Current programme and recent updates in native format
- Cost plan, current contingency position and its basis
- Contract risk-allocation provisions
- Organisation chart and decision authority
- Prior QSRA/QCRA and its assumptions
- Change, variation and claims history
Engagement
Engagement length and composition depend on the question, the available records and the required decision date. An initial discussion establishes scope; no published prices or generic duration promises are used.
| Engagement shape | Suitable where | Typical duration |
|---|---|---|
| Risk maturity assessment | An organisation unsure whether its process is working. | Confirmed after scope and record review |
| Register rebuild and workshops | A register that has become a formality. | Confirmed after scope and record review |
| Quantitative risk analysis | A contingency or completion-confidence question. | Confirmed after scope and record review |
| Embedded risk advisory | Facilitation and reporting through a delivery phase. | Confirmed after scope and record review |
| Capability programme | Training-led transfer to the project team. | Confirmed after scope and record review |
Scope limits
- Insurance placement, broking or coverage advice.
- Health, safety and environmental risk management.
- Assuming the client’s risk ownership or decision authority.
Frequently asked questions
QSRA applies duration ranges and discrete risk events to a programme network to produce a range of completion outcomes with associated confidence levels. It also identifies the activities and risks that drive that range.
Being current and being useful are different. The test is whether a risk has changed a decision. Where it has not, ownership, triggers and decision routes usually need attention.
There is no responsible general figure. QCRA derives a contingency basis from the project’s modelled exposure and stated assumptions, so the decision can be reviewed rather than negotiated by instinct.
Only after checking that it is fit for the purpose. Probabilistic analysis inherits defects in the deterministic network, so a schedule health check comes first.
No. This service covers commercial, programme, cost and delivery risk. Health, safety and environmental risk management is a separate discipline.
Initial discussion
Discuss a construction risk management challenge.
Share the project context, the decision required and the records available. The first conversation is used to establish whether the work is a fit.
A probabilistic completion date is only as credible as the network it is run against. Where the programme is not fit to be risked, that is the finding.
Last reviewed: August 2026