Recommendation ETI-9: Risk Management Standards

The identification and management of risk should be an integral part of the governance of all major public-sector contracts in future. In identifying and managing risk the following principles should be adopted:
• Probabilistic forecasts rather than single-point forecasts should be used to take account of the risk appetite of funders and project sponsors.
• Funders, sponsors and project managers should be cautious when adjusting uplifts and there should be critical review of claims that mitigation measures have reduced project risk.
• Effective governance needs to provide constant challenge and control of the project, including recording of where the project is compared with its baseline, and reacting quickly to get the project back on track, whenever there are signs that it is veering off course. This necessitates providing senior decision-makers with data-driven reports on project performance and forecasts combined with reports by the management team and independent audits.
• In reporting to governance bodies there should be special emphasis on detecting early warning signs that the cost, schedule and benefit risks may be materialising so that damage to the project can be prevented. If early warning signs do emerge, the project should revisit assumptions and reassess risk and optimism bias forecasts.
• The quality of evidence rather than process is the key to providing effective oversight and validation.