AI for Risk Assessment

This page is about project and commercial risk: the register that tracks what could go wrong on a job, what it would cost, and who owns doing something about it. It is not about health and safety risk assessment. That is a separate legal duty under the Management of Health and Safety at Work Regulations 1999, discharged through risk assessments and RAMS by a competent person, and it has its own page and its own template. The two get conflated constantly because they share a word. They have different purposes, different audiences and different consequences for getting them wrong. A project risk register exists to make uncertainty visible early enough to act. Most are maintained to satisfy a client requirement and read by nobody, which is a waste of the one tool that would have told you what was coming. WORKED EXAMPLE: RISK REGISTER, £6.2M INDUSTRIAL UNIT AT TENDER Five live risks at tender stage, scored as probability against cost impact, with expected monetary value. | Ref | Risk | Prob. | Impact | EMV | Owner | |-----|------|-------|--------|-----|-------| | R1 | DNO connection delayed beyond programme | 40% | £180,000 | £72,000 | Project Manager | | R2 | Contamination beyond SI findings | 25% | £240,000 | £60,000 | Commercial Manager | | R3 | Structural steel price movement before order | 60% | £45,000 | £27,000 | Buyer | | R4 | Planning condition discharge delays start | 30% | £90,000 | £27,000 | Client (shared) | | R5 | Key groundworks subcontractor insolvency | 15% | £320,000 | £48,000 | Commercial Manager | | | TOTAL EMV | | | £234,000 | | The tender carries a risk allowance of £150,000. So the register is saying the allowance is £84,000 light, and that is a conversation to have before submission rather than in month five. But read it more carefully, because the total is the least useful number on the page. R5 is the largest single exposure by some distance. Its worst case is £320,000, a third more than the next worst and seven times R3. By EMV it ranks third, behind two risks whose entire downside is smaller than R5's. That is what multiplying by probability does. It systematically demotes low-probability high-impact risks, and that is exactly the category that ends projects. A groundworks subcontractor going under at £320,000 on a £6.2m job is not a number you absorb, it is your margin and more. Manage that register top-down by EMV and R5 gets attention third, after a steel price movement you could have fixed with a forward order. R3 is the opposite: highly likely, and small enough that it is really a pricing decision rather than a risk. A 60% probability item is not uncertain, it is a thing that is probably going to happen, and it arguably belongs in the estimate rather than the register. R4 has a shared owner, which usually means no owner. Either your PM is chasing the client weekly or nobody is. That is what the register is for. Not the total, which nobody will ever pay. The pattern. Also worth stating plainly: the £234,000 total is not a budget. You will not experience the average outcome. You will experience some subset of these events at full cost and none of the others. EMV is a comparison tool for ranking and for sizing an allowance across a portfolio of risks, not a prediction of what this job will cost you. HOW AI HELPS Generating the first list. This is the strongest use by far. Give it the project type, procurement route, site constraints and programme, and ask for risks. You will get thirty, of which twenty are obvious, five are irrelevant, and five are things nobody in the room had said out loud. Those five are worth the exercise. Structuring the register consistently, with categories, owners, dates and mitigation. Drafting mitigation actions that are specific rather than "monitor closely". Writing the risk narrative for a report from the register. Challenging your own register. Ask what a project of this type typically suffers that your register does not mention. WHERE IT FALLS DOWN Probability and impact are yours. AI will assign numbers if asked and they will be invented. Those figures should come from your experience, your cost data and, ideally, from what actually happened on the last three jobs like this. It cannot tell you your appetite. Whether a £48,000 EMV on subcontractor insolvency is acceptable depends on your balance sheet and how the year is going. It does not know the specifics that matter most: this particular client's payment record, this particular subcontractor's order book, this particular site. WHEN NOT TO USE THIS APPROACH For health and safety risk. Use a proper risk assessment and RAMS process with a competent person. Scoring workplace hazards by cost is not how that duty works. Where the risk is a known certainty. If a thing is going to happen, price it. A register full of 80% probability items is an estimate wearing a disguise. Where nobody will own the actions. A register with no owners and no dates is documentation, not management, and producing one creates a record suggesting the risk was managed when it was not. FREQUENTLY ASKED QUESTIONS What is the difference between this and a RAMS? Purpose and law. A project risk register manages commercial and delivery uncertainty: cost, time, procurement, resource. A risk assessment and method statement discharges a legal duty to identify hazards to people and control them, prepared and approved by a competent person. Different scoring, different audience, different consequences. You need both and neither substitutes for the other. How do you score probability and impact? However you like, as long as it is consistent and you write down what the scale means. Percentage probability against a cost impact, as above, works well commercially because it produces an EMV you can compare against your allowance. A 1-5 matrix is simpler and suits a register with many qualitative risks. What matters is that a 4 means the same thing on Tuesday as it did in March, and that the basis is recorded so a new commercial manager can pick it up. Should the risk register drive the contingency? It should inform it, not set it mechanically. The EMV total gives you a defensible starting point for sizing an allowance, which is better than a percentage plucked from habit. But it needs adjusting for the shape of the risks: a register dominated by one enormous low-probability item needs different treatment from one made of many small likely ones, because you can absorb the second and not the first. Judgement on top of the arithmetic. How often should the register be reviewed? Monthly as part of the commercial cycle, and immediately whenever something material changes. The most common failure is a register written at tender, filed, and rediscovered at handover with every entry still open and still scored as it was eighteen months earlier. Risks that have passed should be closed and the actual outcome recorded, because that is the only way your next tender gets better numbers. Can AI predict risks we have not thought of? To a degree, and it is genuinely useful for it. It has been trained on a great deal of construction material and will surface category risks that are common in your project type: statutory undertaker delays, party wall matters, archaeology, protected species, adoption agreements. What it cannot do is know your specific circumstances, so it will never flag that this client always disputes variations or that your groundworker's order book has doubled in six months. Use it to widen the net, then apply what you know.