Standard Risk Management Model for Infrastructure Projects

This paper outlines a risk management method that is based on the use of a standard risk management model and is adapted to the specific nature of infrastructure projects. The standard model can be used to identify and quantify unexpected events in planning and executing a project. The use of a risk map will also be illustrated. A risk map can serve to classify the identified and quantified risk events, depending on the expected loss, to critical risks that call for a more in-depth treatment, and non-critical risks that are normally not monitored, while no measures are foreseen in advance. A risk map is used to determine what the anticipated effects of the measures to mitigate the critical risks will be, and how the anticipated measures enable the transition from a critical risk to a non-critical risk. In this article, the suggested risk management is illustrated using the example of the erection of a reservoir for a hydroelectric power plant. The use of the proposed tools for the identification, assessment, prioritisation, and management of risks proved highly successful. With the use of the proposed risk model, the critical risk events were lowered under the acceptable level of the expected losses.


Introduction
Infrastructure projects are one constant in our lives that interfere in our living environment and commonly involve huge investment costs. When managing such projects, the focus is mainly on the management of the content of work, times, resources, and costs. Risk management, however, is often neglected. Most frequently, the most important risks of the entire project are identified, and the measures to mitigate their consequences are prepared. Yet a project team lacks the time and motivation to prepare a more profound assessment of risks of individual components associated with the project.
The paper will illustrate the use of the standard risk management model, which includes the identification of risk event drivers, the assessment of probability of a risk event, and the identification of impact drivers caused by a risk event and the probability of its impact. The identified probability of the occurrence of a risk event and the probability of its impact serve as a basis for calculating the expected loss, most often in terms of time, money, or quality. The calculated losses can be represented in a so-called risk map, into which losses are plotted on the x-axis, while the product of the risk likelihood occurrence and its impact is plotted on the y-axis. A threshold line of expected losses divides the risks into critical risks (positioned above the threshold line of anticipated losses in the risk map) and less critical risks (positioned below the threshold line).
The standard model also allows an analysis of the consequences of the measures adopted and designed to eliminate or at least mitigate the expected risks both on the side of risk event drivers and on the side of risk impact drivers (there may be only a single or several drivers in both cases). In the risk map, the adopted measures represent a change in the risk position, the final goal being a shift of all critical risks below the threshold line of expected losses, i.e., below the limit of a still acceptable loss, by using the adopted measures in both risk factors.
The use of the suggested model will be illustrated using the example of an infrastructure project for the erection of a reservoir for a hydroelectric power plant on the Lower Sava River. The advantages and drawbacks of using the standard risk management model in the practical implementation of infrastructural (constructional) projects will be presented.

Review of references
Infrastructure projects most frequently involve the arrangement of an infrastructure building into a space (environment), which is why their success depends not only on internal factors, such as the client and contractor, but to a large extent also on external factors related to the environment. These factors aim to influence a project from various points of view; some of them support the project and want to make a positive contribution to the progress and success of the project, while others are completely or only partially against the execution of the project and are prepared to have a negative impact on the project. The execution of such projects is frequently considerably influenced by decisions of the government and the competent ministries. The mentioned impact factors may cause risk events on an infrastructure project, which may in turn have a very negative impact on the progress of the project, particularly on the execution time, on the costs, and often on the quality of the project deliverables.
Generally, risk management is a constituent part of the risk management strategy of a company and represents an important element in decision-making processes [1]. Infrastructure projects are particularly sensitive in terms of risks, because the risk events from similar previously executed projects only seldom repeat in a similar form and with a similar probability of their occurrence and consequences. Risk management in these projects is especially demanding, so it is important which risk management techniques are employed. Analyses show that financial and economic factors and quality are the most important risk factors that industry tries to avoid or transfer to other stakeholders [2].
The awareness or understanding that a risk may exist is in practice the most important aspect of risk analysis and management. How the participants understand the need for the treatment of each risk separately is therefore important for risk management [1].
As indicated by Hameed and Woo, numerous papers deal with the topic of risk management, yet the majority of research only includes risk management results from developed countries and only a very few from underdeveloped ones [3]. Slovenia belongs to the group of medium-developed European countries, even though a detailed analysis on the management of infrastructure projects has not yet been made.
Yafai [4] says that risks are treated in each infrastructure project differently, particularly based on an assessment of the probability of risk event occurrence and its impact and based on an individual project activity.
A variety of methodologies dealing with project management and consequently with the related risks can be found in literature. In practice, the most frequently applied methodology is the one proposed by the Project Management Institute [5]. Of the nine bodies of knowledge required for successful project management, it provides guidelines for risk identification, analysis, and response to project risks. Among other risk management methodologies, certain approaches warrant mention: PRINCE [6], which is mostly used in IT projects; DOD Risk Management [7], which is used for military industry projects; and a host of other methodologies [8]. A comparison of various risk management methodologies is shown in Table 1 [9].
An important earmark in risk management is a proactive approach, which is explained in detail by Smith and Merritt in the book Proactive Risk Management [10]. They suggest various risk analysis and evaluation models (standard, simple, cascade, and Ishikawa risk models) and tools that project stakeholders can use for recording, prioritising, solving and monitoring reactions to project risks.
One important tool for project risk identification and analysis is a risk breakdown structure that systematically breaks down potential risks on several levels [11] and provides possible breakdowns for various project types. He suggests that the risk in infrastructure projects is divided into three levels: on the first level, he differentiates among risks that result from (1) environment, (2) contractors, (3) client, and (4) project.
Of course, major risk drivers may differ depending on the project type and the environment in which a project is carried out. Importantly, a project team responsible for project execution must identify all possible risk drivers on the project in question and break them down on several levels in order to facilitate a correlation between risk factors and project activities. An Ishikawa diagram can be used to identify risks [

Risk management and infrastructure project
As infrastructure projects are most frequently integrated into a human living environment, risk factors (generators) appear in the risk assessment of such projects. In normal investment projects, these practically have no or in a few cases have a very small impact on project execution. Among the important impact factors that may cause risk events in infrastructure projects, the following warrant mention: • Impact of space management institutions (Government of the Republic of Slovenia, ministry, local communities).
• Complicated procedures involving the integration of infrastructure buildings into a space.
• Local population, interest associations, environmental, and other organisations.
• In cases of public procurement, the possibility of appeal, auditing, and legal proceedings.
• Client's incapacity to finance the investment.
• Problems relating to solvency or even of contractor bankruptcies.
In investment projects, and even more particularly in infrastructure projects, additional risks can arise due to the following reasons: • Poorly prepared plans for project execution without the use of adequate methods and techniques, usually also without a risk management plan.
• Poor and irregular reporting on work progress and actual costs.
• No reaction to deviations in the actual situation of the project from the plan.
• Frequent conflicts between parties executing the project because the responsibilities are not precisely defined.
• Execution time and cost pressures with a relatively low profit margin.
• Poor work safety due to pressures to produce good returns.
Experience in the management of investment projects has shown that, in a project planning phase, very frequently only the scope of a project is defined and a time and project cost plan are prepared. Normally, project managers do not deal with risks in the project planning phase. To assist project managers in risk management, a general model of project risk management was developed [9, 12], which originates from a particularly critical evaluation of the most frequently used project management procedures and especially project risks. The proposed model, which will be subsequently employed to manage a selected infrastructure project, is carried out in four phases and seven steps. Methods that a project team can use for efficient work are indicated for the execution of each individual step.  Figure 1 shows an amended project risk analysis model, namely, with reference to [9,12], and a risk map is added for a qualitative and quantitative analysis of activity risks, for the classification of risks to critical and noncritical ones (step 4) and for planning of measures for risk management (step 5). As evident from Figure 1, the risks related to the entire project are first identified in steps 1 and 2. Various approaches can be used. Smith and Merrit [10] propose four different models for the identification and quantification of risks: standard, simple, cascade, and the Ishikawa models. Each of the proposed models has its advantages and disadvantages. When addressing the risks of an entire project, we concentrate on general questions, such as What is the risk, and what kind of loss can be expected if project execution is delayed by 6 months?
The proposed models for risk identification and quantification can also be used in steps 3 and 4, where individual risks can already be assigned to activities.
One of the mentioned risk management models can be used for further risk analysis. In this study the standard model was used to manage the activity risks in infrastructure projects. The reason for this decision lies in the fact that the model is simple to understand that it first identifies potential risk events and only then the impact of a risk event on the execution of project activities using a calculation of the expected loss (in time or money).
According to [10], the standard model can be visualised as shown in Figure 2. In the standard model, a risk event is first identified. We can start from a previously prepared WBS/RBS matrix. One or several risk factors (drivers) can be identified for the incidence of a risk event. A project team must assess a probability of risk event occurrence Pe on the basis of the available data, on experience from previous similar situations or by using methods for decision-making in the event of uncertainty [13]. Then, it follows the assessment of the impact (consequences) if the risk event becomes a reality. In this case, again, one or several risk factors (drivers) of potential consequences are identified. The impact probability Pi is determined in a way similar to the risk event definition. The model features another parameter, the total loss Lt, which is the loss that will occur if a risk event and the impacts are realised. The total loss may be expressed as a loss in time, in working days, in monetary terms (EUR), or in quality (e.g., the number of poor or substandard products).
The expected loss Le can be calculated according to Eq. (1) [10]: In step 4, the criticality of the risk in question needs to be assessed separately from the qualitative and quantitative risk assessment and the total loss. We can use the calculation of the criticality level in the table of critical success factors, which is explained in detail in [9,12]. In the proposed risk management model, we can use the risk map [10] shown in Figure 3.
A risk map is a diagram in which risk likelihood is on the y-axis and represents a product of the probability of risk event occurrence and the probability of risk impact (Pe • Pi), while the total loss Lt is on the x-axis. The threshold line of losses divides the surface of the diagram into two parts: the upper part above the threshold with the field of critical risks (Risk 1), which will have to be addressed by adopting adequate measures and the lower part below the threshold with the field of The threshold line of the expected losses is defined by Eq. (2) [10]: Le in Eq. (2) represents the selected level of expected loss which is defined by the project team under consideration of the circumstances. It represents the value up to which the company is prepared to risk and accept the loss.

An example of infrastructure project risk management
The example of erecting a reservoir for a hydroelectric power plant (HPP) on the Lower Sava River [14] with a nominal power of 47.4 MW will be presented in the following. The HPP is of an impoundment facility type, with an arrangement of three vertical power units (double-regulated vertical power plant with a Kaplan turbine) with a nominal flow of 500 m 3 /s with five flow-through fields and an average annual production of 161 GWh. The test operation of the HPP was foreseen for October 2017.
The HPP has a belonging reservoir with an anticipated 19.3 million m 3 of water on a surface area of 3.12 million m 2 .
The planned goals for the erection of the reservoir for the HPP were as follows: • A reservoir with the belonging infrastructure.
• Development of water infrastructure and state-regulated and local infrastructures on the influence area of energy utilisation of the river's water potential.
• A reservoir with high-water dams, drainage ditches, and other corresponding site development facilities.
• Treatment and maintenance of water infrastructure intended for preserving and regulating the quantities of water on the influence area of energy utilisation of the river's water potential.

8
• Running, maintaining, and monitoring the status of the water infrastructure intended for protection against detrimental effects of water on the influence area of energy utilisation of the river's water potential.
• Implementation of extraordinary measures during periods of increased hazard levels due to the detrimental impact of the waters on the influence area of energy utilisation of the river's water potential.
• Maintenance of water areas and acquired areas on the influence area of energy utilisation of the river's water potential.
• Providing sufficient quantities of water on the influence area of energy utilisation of the river's water potential.
• Flood safety for populated areas, protection of agricultural areas and forests, flood irrigation, and firewater catchment.
• Development of roads and other infrastructure.
• Passage for water organisms, spawning grounds, and other habitats and protection of landscape and cultural heritage.
• Recreational areas and cycling paths.
The main stakeholders involved in the implementation of the HPP reservoir are as follows: • Investor with co-investors The investment value of the project amounted to EUR 140 million. The contractor appointed a project team for the preparation and management of the project of the erection of the HPP reservoir. The project manager and team members received the following assignments: preparation of technical documentation, preparation of works, acquisition of lands, and maintenance and supervision of the entire project. Contractors for the execution of works were hired for the execution of individual activities.
A project of the erection of a reservoir for this hydroelectric power plant was selected because this was a big and important infrastructure project in Slovenia. This project is especially suitable for presentation of the proposed method of risk management due to its size and intervention in space, and the authors helped the contractor by project preparation especially in creating a project management plan.

Content and project timeline
The project team broke down the project's work content according to the WBS principle into the following phases: project preparation, designing, acquisition of permits, call for tender for the reservoir, dam house erection, and reservoir erection. For each phase, the team defined the necessary activities and linked them to a project network diagram. The network diagram links 242 activities. This is relatively little given the scope of the investment; however, the timeline here is only meant for the management of the investment and not for the operative management of the works of the project. The contractors prepared their own detailed timelines for the operative execution of the works of the project, which were fully harmonised with the project's timeline.
A project time analysis revealed that 1928 days are needed for the execution of the project of the erection of the HPP reservoir, with the beginning of the project scheduled for 1/3/2012 and the completion for 10/6/2017. The term of completion is very important, since the test operation of the HPP depends on it. Figure 4 shows the project's timeline, wherein only the activities of the first phase are indicated.

Project's risk analysis
In the continuation, a method of use for risk management tools is shown using an example of an infrastructure project. In compliance with the method of Figure 1, an Ishikawa diagram of project risks was first drawn up, in which the key risk factors (groups) in this project have been identified: environment, contractor, client, Government of the Republic of Slovenia, and project execution. Possible risks in the project have been identified for individual risk groups (Figure 5).
The use of the Ishikawa diagram proved a very efficient tool in our case, since the team members had already used it in the quality management. The team members highlighted those risks that are most likely to occur in this project and inserted them in the prepared table template of critical success factors from the MS Project software according to [9,12]. The probability of a risk event occurrence and a probability of consequences were assessed for each activity according to the Likert five-point scale (1)(2)(3)(4)(5), and a risk rate for the activity was calculated. It is marked with as indicated (colour indicators: red, high; yellow, medium; and green, low risk rate). Figure 6 shows part of the project's risk analysis for the activities of the first phase (WBS group), which is project preparation. Based on the risk analysis of all project activities, the project team established that eight activities have a very high risk rate, which is why they decided to analyse these risks in more detail using the standard risk management model. For each of the eight high-risk activities, the project team determined the probability of a risk event Pe occurrence and a probability of consequences Pi and calculated the overall risk probability. The total loss Lt and the expected loss Le calculated using Eq. (2) were assessed.
The majority of risks in question result in a delay in the project and consequently in the launch of the HPP test operation. Our assessment of losses was based on data that indicated 1 day of interrupted operation of such an HPP means a loss of income of 17,600 EUR/day. Calculations for the expected losses are given in Table 2.
As evident from Table 2, some risk-related losses refer to monetary losses and others to time losses, which is why the risks related to monetary losses in terms of    (Figure 7) are shown in the risk map separately from the time losses due to delays (Figure 8).
In the risk map, in which the risks related to extra costs (Figure 7) are shown, four risks are identified: of those, three (T1, T6, and T8) are critical, while the T3 risk belongs to the group of noncritical ones. The project team subsequently prepared adequate measures for the critical risks to prevent or mitigate the consequences if a risk event were realised.
In the risk map, in which the risks related to delays (Figure 8) are shown, four risks are identified as well: of those, two (T2 and T4) are critical and two (T5 and T7) belong to the noncritical risks. Again, the project team prepared adequate measures for the critical risks to prevent or mitigate the consequences if a risk event were realised.
To illustrate preparation, analysis, and assessment of further measures to mitigate the risk consequences, the T1 risk was selected, i.e., the adoption of the DPN (state spatial plan). This is the first activity in the project having a high and critical risk (particularly due to the fact that it can delay the project's execution and due to the extra costs incurred). The state spatial plan is adopted by the Government of the Republic of Slovenia upon a proposal from the ministries and in conformity with other bodies issuing permits for the placement of infrastructure projects into the space. Local communities actively participate in this process. To mitigate the consequences of the T1 risk (delay in the adoption of the DPN), the project team prepared a plan of measures in three iterations, as shown in Table 3.  Table 2.

Evaluation of losses in huge project risks relating to the erection of the HPP reservoir.
For the anticipated measures, the project team assessed the probabilities of a risk event occurrence, a probability of impact after the adoption of a measure and the total and expected loss. Ten percent of the anticipated loss of income was determined by the project team as the value of the total loss. The calculations and results for all three iterations of measures are shown in Table 4.
Based on the results from Table 4, a risk map for the T1 risk was drawn up (delay in adopting a DPN), which is shown in Figure 9.
In the risk map in Figure 9, the threshold line denotes a still acceptable value of loss of EUR 100,000, which the project team considers to be the maximum tolerable value. T1 represents the starting situation, and there are no extra measures except warnings to the Government of the RS to start preparing a DPN for the erection of the HPP reservoir. The expected delay here will be 6 months, and the expected loss incurred by the client due to a delay in the scheduled start-up of the HPP is EUR 288,000. Point T1.1 represents a point of risk T1 in the risk map after a measure is adopted, with which the ministry responsible for infrastructure would appoint a co-ordinator to co-ordinate the preparation of the DPN. Still, a delay of 5 months is expected, while the expected loss in this case would be reduced to EUR 180,000, which still means that the risk is a critical one. Additional suggested measures, with      still expected, yet the expected loss is EUR 80,000, which is less than the maximum threshold value of EUR 100,000 the project team had determined for this risk.
In the project execution phase, the activities of the project must be closely monitored, and attention should be paid to the time of risk event occurrence. The project team can determine risk indicators [12] that remind them of points in time when a potential risk event might or could be expected to occur. It is not enough only to introduce measures, the situation should be constantly monitored and additional measures adopted to mitigate the impacts of risk events that occur. In the case of the erection of the HPP reservoir, the project team also constantly monitored the risk management activities and adopted adequate measures as required. The management of risks in the project in question was ultimately successful, since the HPP started operating on schedule and according to the timeline.
It is important to note that once the project was completed, the project team made a thorough analysis of their risk management strategy and identified those solutions that proved effective and successful and that would be worth using in similar projects in the future, as well as ineffective solutions that should be avoided in future projects.

Conclusions
Risk management is an important field of knowledge that is an integral part of [any] efficient project management. It is important that risk management be completely integrated into other areas of project management. The paper dealt with the risk management in infrastructure projects, which, compared to other projects (e.g., product development or IT projects), involve considerably more impact factors related to the environment and that are included in the process of planning and management of such projects.
The paper outlined the methods and tools that project management can use in project planning and management. The following methods are of particular importance for managing of an infrastructure project: an Ishikawa diagram for identification of potential risks; a table of critical success factors that identified risks to individual activities and classifies the risks of the activities as high-, medium-, and low-risk; a standard risk model that serves to determine expected losses in time, money, and quality; and finally, a risk map that classifies a risk as a critical or noncritical risk. The risk map can be used to analyse how the anticipated measures could work to reduce the critical nature of the risk.
The above-indicated methods have been successfully tested in the erection of the HPP reservoir. The project represented an important instance of interference in the space, even more than the placement of the HPP itself. It has been proved that the key risks in this project were those risks on which neither the investor nor the contractors have any influence. In our case, this was the integration of the building into the space and problems relating to the preparation of the DPN, which is crucial for further planning and subsequent project management. Risks also appeared in the acquisition of the land and in respect of the requirements demanded by parties granting the relevant permits, by the state, the groups with special interests, and pressure groups (conservationists).
The use of the proposed extended model for the identification, assessment, prioritisation, and management of risks proved highly successful in the HPP project. The table of critical success factors also proved very successful. It was created using the MS Project software that was also used for the planning and monitoring of the project. This integration allowed the project team to have the risk management data available in the same tool as other project management data, which proved to be particularly efficient in monitoring the execution of the project.
© 2019 The Author(s). Licensee IntechOpen. This chapter is distributed under the terms of the Creative Commons Attribution License (http://creativecommons.org/licenses/ by/3.0), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited. What was new here was the use of the standard risk model, with which the project team could (as with the critical success factor table) identify and quantify the importance of each risk and assess the expected loss. The advantage of using the model is its simplicity; its key drawback, however, lies in the fact that the result depends on the accuracy of team members' assessments of the probability and total loss factors. Nevertheless, this drawback did not prove a substantial disadvantage. The risk map, with which risks are classified as critical and noncritical, proved to be a very important tool. Determining the threshold line of acceptable losses could appear as a problem, as it is based on a subjective assessment of the team members. Also, the possibility of checking the impacts of the foreseen measures adopted for the most critical risks is important; yet as it turns out, there is often a lack of motivation among team members, and they prefer, instead, to simply follow their intuition.
The execution of the project in question revealed that infrastructure projects are considerably more demanding than other projects in terms of risk management. As a rule, stakeholders from the wider environment have to participate in such projects.
In any follow-up (work, analysis, research), it would be important to consider how to support the subjective determination of the data for the use of the standard model by means of decision-making methods in cases where there is an element of uncertainty present.
The results of the proposed extended model for managing the risks of this infrastructure project will be a great help to project managers who will carry out similar projects in the future.