PADCO|AECOM Navi Mumbai SEZ Phase I Jai Towers, Plot No.

. 68, Sector 15 CBD Belapur, Navi Mumbai 400 614 Maharashtra, India

Analysing Risks Quantifying the Risks: The identification of a risk, while essential, is incomplete to the process unless it is quantified. A risk, after all, is merely a potential event, and the significance of this event to the project must be identified. The significance of a risk is measured by two parameters- its Probability of Occurrence and its Consequence. The Probability of Occurrence is a measure of how likely the risk is to manifest itself as an event, and the Consequence is an estimate of the impact on the project should this event occur. Establishing the Probability of Occurrence and the Risk Consequences are the two fundamental components of Risk Analysis. Probability of Occurrence: The Probability of Occurrence is stated as a number in the range of 0.00 to 1.00. If the Probability of Occurrence of a risk is 0.00, then it may be discarded as a risk. For example, if one identifies as a risk the impact on a high-rise office tower of high-speed flying elephants, the Probability of Occurrence can probably be rated as very near 0.00. If the Probability of Occurrence is 1.00, the risk has become an event whose Probability of Occurrence is certainty. Establishing a realistic probability between these two extremes usually requires the exercise of both experience with similar tasks and risks and judgment as to the value of the assigned probability. Some observations in support of this effort may be helpful. Acts of God: Acts of God, as previously discussed, are limited to natural, environmental, and tectonic events. As such, there is usually extensive historic data available both regionally and globally, concerning the specific event under consideration. For example, rainfall intensity curves have been published for most of the globe by regional bodies concerned with either meteorological forecasting or hydrological design. Thus, storm intensities and durations with certain fixed recurrence intervals (i.e. 10, 25, 50, 100, 200, and 500 years) are available with but little searching of the internet or of authoritative sources. If a rainfall with an intensity of 15 inches (38 cm) per hour is listed

Analysing Risks

Page 2 of 6

October 10, 2006

with a recurrence interval of 100 years, the theoretical Probability of Occurrence of this event in any single year is 1/100 or 0.01. In the case of rainfall, it is suggested that the data examined be reflective of the events of the past decade, as recent trends in rainfall intensities and distributions reflect an upward migration to greater intensities with more frequent recurrence intervals. Even sparse, yet recent, data may be sufficient to suggest the appropriate shifting necessary to reflect a reasonable forecast of future rainfall intensities. For Acts of God which have no local historic data, further research will be required to arrive at a prudent yet realistic Probability of Occurrence. Internet researches of sites specific to the Risk under examination may prove helpful in this regard. The examination of historic data from other regions which do possess such historic data may prove helpful as well. For example, an examination of the location of the tectonic ridge which gave rise to the recent tsunami and its proximity to affected landmass areas may suggest a relationship which can be productively extrapolated to an examination of tectonic ridges closer to the Indian subcontinent. This, together with what data can be amassed on the potential for tectonic activity in these more proximate ridges, can be used to assess the Probability of Occurrence for a tsunami event affecting the NMSEZ project. Consultants with regional experience in the risk under consideration can also prove to be a helpful resource. There is a temptation to adjust the Probability of Occurrence number upward for Acts of God seen as cataclysmic in their Consequences. This should be resisted, since the Consequences of such Acts are factored into the Risk Analysis in another less-judgmental way. Acts of Man: Unless an elaborate record of past events on construction projects has been maintained, Acts of Man are not amenable to the type of rational numeric determination of Probability that attends Acts of God. Unless one knows, for example, that the Site Engineering documents will be seriously flawed 33% of the time, one must rely upon judgment to arrive at useful Probabilities of Occurrence. In the section on Risk Identification, it was stressed that the Risk Management Team be composed of individuals possessing solid experience in the tasks which were being examined for risk. It is here that that solid experience will pay dividends in arriving at Probabilities of Occurrence that are both realistic and reflective of their experience with the risks to those tasks.

Analysing Risks

Page 3 of 6

October 10, 2006

In general, it may be discovered that the Probabilities of Occurrence of any specific risk related to Acts of Man will be inversely proportional to the experience of the involved individuals with their tasks. The more experienced the individuals and the more conscientious they are in the performance of their duties, the lower the chance that an identified risk will occur. This assumes that the tasks are not so repetitive that inattention to them is engendered. In this regard, it is seen that the application to project tasks of individuals or teams with solid experience and conscientious approaches is essential to minimize risk. Consequences of Occurrence: The analysis of the identified risks is not complete without considering the consequences which would result if the risk becomes an event. These Consequences of Occurrence take two forms, Consequential Delay and Consequential Cost. Consequential Delay: If the risk becomes an event, then the resolution of the event will take time. For example, if the event involves the disruption of supply (either sources of supply or delivery of supplies) time is necessary to either resolve the delivery problem or secure alternate sources. This may be thought of as extending the duration of the task by the period of time consumed with resolving the problem. By applying the extended duration to the project schedule, the impact may be readily seen. It may be that the consequential delay to this task adversely impacts other tasks in the schedule which are, in turn, delayed producing a cascading domino effect. As was pointed out in the section on Risk Identification, not every risk will be critical, but every task may contain a critical risk. Consequential Cost: The costs associated with a risk becoming an event are assessed as the sum of the costs to: 1) Resolve the issue by whatever means may prove necessary and 2) Carry the project during the ensuing delays to both the task and to any subsequent tasks that are delayed in consequence. A simple example may serve to illustrate the assessment of these two elements of Consequences of Occurrence. In the construction of a large-diameter water pipeline, the specifications require that the pipeline be subjected to a leakage test with pressurized air. It is established as a risk that the compressor for conducting the test, which is

Analysing Risks

Page 4 of 6

October 10, 2006

to be transported from another jobsite in Delhi, may not be available since its use at the other jobsite is scheduled (on the original Delhi project schedule) to extend to within 3 days of its scheduled need at Navi Mumbai. It is now necessary to estimate the Consequences of Occurrence should his risk, currently estimated to have a Probability of Occurrence of 0.80, become an event. Consequential Delay: Progress on the Delhi project is currently running some 2 weeks behind schedule. Project Managers in Delhi estimate that the compressor may be needed there until 3 weeks after its originally scheduled arrival in Navi Mumbai. This means that the test of this pipeline cannot be commenced until 4 weeks after its scheduled date, since its transport from Delhi to Navi Mumbai is estimated to take a week. Thus, the delay to the onset of testing of the pipeline will amount to 4 weeks. This is the Consequential Delay to the pipeline testing task. However, in applying the 4-week delay in the completion of the pipeline to the project schedule, it is seen that the testing of the pipeline is to be followed by the backfilling of the trench and the commencement of road construction over it. The project schedule has allowed for a 1 week period between the testing operation and the backfilling of the trench to allow time for repairs to be made to the pipeline should the testing demonstrate that they are necessary. Although this one-week period could be used to off-set some of the delay in the arrival of the compressor, the Risk Management Team prudently decides to preserve this one-week period for pipeline repairs as originally intended. Thus there would be a cascading domino effect, of the compressor delay onto the trench backfill and road construction operation as well. The entire Consequential Delay, therefore, is a four-week delay in the completion of the pipeline and an ensuing four-week delay in the road construction task. Consequential Cost: If the costs of transport of the compressor remain the same as originally estimated, the Consequential Cost of the delay involves the sum of the costs of idle men and equipment awaiting the arrival of the compressor and (if there is a delay in the completion of either the entire project or of an identified project phase) the carrying costs of the project or phase. These may include insurance, project overhead, interest on borrowed capital, lost incentive profits, etc. In this regard, it is useful to compute the

Analysing Risks

Page 5 of 6

October 10, 2006

per day or per shift amount of these carrying costs so that they may be ready to hand for application to computations of Consequential Costs involving delays to the project completion. Risk Severity- The Probability-Impact Value: It is intuitive that risks of high Consequences but very low Probabilities (or of low Consequences but high Probabilities) may not be as important as others of high Consequence and high Probabilities. With the procedure outlined above, it is possible to arrive at a numerical ranking of risks using the Probability-Impact Value. Simply stated, the Probability-Impact Value is the product of the Probability and the Impact (in both Delay and Cost). Rationally, this becomes the statistical annual cost of the risk in time and money. In the pipeline example above, the Probability-Impact Value of Delay is the product of the Probability of Occurrence (0.80) and the Impact of Delay (4 weeks), or 3.20 weeks. Note that this delay must be applied to BOTH the pipeline testing task and the road construction task. If the Consequential Cost of the 4week delay to both operations was determined to be Rs. 80,000, the ProbabilityImpact Value of Cost would be Rs. 64,000. Annual Impact Cost and Break-even Assessment: As a footnote to this discussion, it should be observed that any mitigation effort contemplated to remove the risk altogether, such as the rental or purchase of an alternative compressor in Mumbai (in the case of the example) may be justified if it causes no more than 3.20 weeks of delay OR costs no more than Rs. 64,000, since these expenditures (in both time and money) represent statistical breakeven expenditures to avoid the risk. If it costs less than Rs. 64,000 over the estimated cost for the Delhi compressor and eliminates the delay, OR if it costs the same as the Delhi compressor and results in less than 3.2 weeks of delay then the decision should be made to rent or purchase in Mumbai and avoid the risk altogether. More information regarding Risk Mitigation is found in the section dealing with that issue. Prioritizing Risks- The Impact Rating Table: As mentioned previously, not all risks will constitute critical risks. Clearly what is needed is a means of assessing the relative severity of risks, prioritizing them

Analysing Risks

Page 6 of 6

October 10, 2006

according to their severity, and assisting in identifying which are to be considered critical. Fortunately, such a means is at hand. The process of computing the Probability-Impact Value has been described. This value is a numerical measure of the severity of the risk and can be used to rank the identified risks in order of their severity. Once the Probability-Impact Value of all identified risks has been computed, they are then compared with the Duration and the Cost of the entire project or project phase. Rankings are then established with color coding for each as follow:
Risk Level 1 2 3 4 5 Color BLACK GREEN BLUE YELLOW RED Probability-Impact Value (Delay) Less than 0.1% of Project Duration Less than 1% of Project Duration 1-2% of Project Duration 3-4% of Project Duration More than 5% of Project Duration Probability-Impact Value (Cost) Less than 0.1% of Project Cost Less than 1% of Project Cost 1-2% of Project Cost 3-4% of Project Cost More than 5% of Project Cost

Using this color-coding scheme, risks can not only be classified and prioritized according to severity, but visual tracking charts will very quickly display the risks in their proper perspective, rather than appearing as a solid wall of letters and numbers requiring time and diligence to understand. The Third Dimension- Time Horizon: In addition to Probability of Occurrence and Consequences of Occurrence, another measure of risk severity is the Time Horizon. Clearly, a RED risk which may occur two months from now is not to be considered as having the same priority for mitigation and management as a RED risk which may happen next week. Depending upon circumstances, even a BLUE risk next week may be considered of higher priority than a RED one later on. For this reason, it is recommended that risks associated with particular project tasks be plotted on a copy of the Project Schedule. The color-code of the risk is placed on the project schedule at the date at which it would manifest itself as an event were it to occur. In this way, the Time Horizon (time available) to accomplish Mitigation and Management may be appreciated in graphical form and resources mobilized to deal with the risk in time to manage it.