Effective risk analysis and monitoring

Do you have a checklist of the project risks and have you established who will be responsible for the risk monitoring?

In 2017 we purchased an asset to carry out a change of use in the center of Madrid. During the process we discovered that one of the associated procedures that we had not taken into account needed approval throughout the community of owners. This management delayed the delivery of licenses by two months and could have been avoided with a more exhaustive study of the risks.

By definition, a construction project involves some transformation: a new building, a refurbishment, or a change of use. Change involves uncertainty and it is not out of the question that there may be deviations from the initial forecast due to a possible future event. Therefore, we need to be aware that risks exist and that we must actively manage them. If potential future events are foreseen, actions can be implemented to address and manage them proactively. This will increase the chances of successful project completion.

In risk management, two aspects must be considered: the probability of an event occurring and the expected impact if it does occur. When the probability reaches 100% (i.e. the risk has materialized) it becomes a "problem". In management terms, a problem is something that is happening right now that jeopardizes (or will soon jeopardize) the delivery of one or more of a project's objectives or outcomes.

The first step should therefore be to recognize potential problems as early as possible. In this way we can maximize the opportunity to take effective action based on five criteria:

1. Risks at the organizational level: in relation to their place of action, i.e., the one that affects us at the company level.
2. Project risks: those that, within the project boundary, could affect the delivery of the business outcome.
3. Commercial risks: affect the operation of the commercial result once the project has been delivered.
4. Environmental risks: are external to the project environment but may nevertheless affect its objectives.
5. External risks: are beyond the immediate environment of the project but could have a major impact. Often in contractual terms, these can include "force majeure" risks (exceptional, unforeseen events or circumstances beyond the reasonable control of the parties to a contract). Many of us have seen, for example, the major impact the coronavirus crisis had on our investments.

However, they can go beyond force majeure, for example, due to a change in a municipality's policy or its interpretation of a law in Spain. An example is the risks suffered in the hotel sector due to changes in regulations.

Once identified, the purpose of risk management will be to:

• Assess the probability and impact of each risk.
• Identify alternative actions that can prevent the risk from occurring (avoidance), or if it does occur, ameliorate the impact (reduction), or provide a strategy to manage the accepted consequences (acceptance).
• Implement and monitor those actions that are cost-effective and necessary for the successful delivery of project objectives.
• Provide experiential learning feedback to improve the risk management of future projects and inform the training and development of project managers.

To achieve these objectives, effective risk management must:

• Anticipate and influence events before they occur by taking a proactive approach.
• Provide knowledge and information about predicted events.
• Inform and, where possible, improve the quality of decision making, recognizing the hierarchy of risk prevention, reduction, control and acceptance.
• Avoid covert assumptions and false definition of risks.
• Make the project management process open and transparent.
• Assist in the delivery of project objectives in terms of quality, time and cost benchmark thresholds.
• Enable the development of scenario planning in case of identification of a high impact risk.
• Provide enhanced contingency planning.
• Provide verifiable risk planning and control records.

In any case, it is important to keep in mind what are the main risks we may encounter. Although as investors we must draw up our own list, always relying on our team, below, I show the most important ones at a technical level that I usually detect in the development of my professional activity:

● Lack of licenses for the development of the activity: opening and/or activity license, operating license, first occupancy license, etc.

● Absence of a building permit, final work certificate, certificate of Stakeout Verification, certificate of Work Reception, among others.

● Lack of legal-registrar documentation of the property (title deeds, charges, land registry, etc.).

● Problems with the urban situation of the property (land classification, urban charges, non-compliance with the urban parameters of application) or the urban planning certificate of the property is not available.

● Lack of a detailed study to be able to develop the activity to be carried out.

● Lack of technical documentation of the project: approved technical projects (basic, execution, urbanization, activity, structure, installations), as-built plans (of finished work),

● The installations are not legalized or the documents proving this are not available.

● Industry bulletins, certifications, OCA (Authorized Control Body) reports, and maintenance contracts are not available.

● There are no certificates, approvals, DIT's (Technical Suitability Documents), of the products and/or equipment included in the building.

● The Self-Protection Plan (PAU) is not up to date.

● The installations do not have the mandatory minimum regulatory periodic tests (legal maintenance) or the documentation to verify it is not found.

● The connections are not legalized.

● There are no supply contracts.

● The existence of regulatory insurances (civil liability, construction risk, ten-year insurance) is not verified.

● Product and/or equipment warranties are not available.

● Adaptation of part or all of the building to current regulations may involve improvement works.?

● The proposed change of use requires an adaptation to current regulations.

● There are regulatory non-compliances, so there may be inspections by the competent bodies.

● There is no record of response to the requirements of the Public Administrations.

● Non-compliance with environmental parameters and/or absence of an environmental license.

● Excessive energy consumption. The building does not meet energy efficiency criteria.

● Lack of sustainable seals.

● The building does not adapt to accessibility criteria.

● Visible anomalies detected in the technical visit.

● Non-verifiable defects in the sizing of the installations.

● The as-built documentation is not up to date.

● Lack of clarity regarding the purpose of the investment to be made and the length of time the asset will be held in portfolio.

Having a simple checklist and risk management in Excel has helped me in the past, for example, to solve licensing risks effectively, saving more than six months in license processing. It should be noted that the investor checklist is different from the project management checklist because it is very important to focus on business critical risks, not project risks. However, the methodology is very similar to the one used by project managers to manage projects.