6.5.1
Monitoring and Managing Risks
Risk registers, risk reports, and risk mitigation plans are commonly used tools to track and manage risks. This section describes and illustrates each of these tools.
Risk Register
A risk register is one of the most common tools for tracking and managing risks within an agency, since it provides a framework for capturing critical information about each risk, its importance to the agency, mitigation plans and tracking and managing responsibilities. A risk register is typically generated as a spreadsheet, though other formats are available. An example of a comprehensive risk register, which includes assignments for risk mitigation strategies, is presented in Figure 6.4. Over time, columns may be added to indicate when the risk information was last updated, what further action is required and whether adequate progress is being made towards the mitigation strategy.
A risk register should be reviewed at least quarterly to evaluate whether the risk register or the risk management plan for any of the performance areas needs to be updated. Periodic changes to the risk profile may be obtained through executive staff meetings meant to evaluate progress regularly, or ongoing reports tracking risk mitigation efforts and results. Annually, the agency may determine whether any strategic-level risks should be adjusted based on evaluation of the agency’s performance and the risk reports provided by the risk owners.
Figure 6.4 Excerpt from a Risk Register Showing Responsibility for Risk Mitigation Activities
Source: Tillamook County Public Works Road Asset Management Plan. 2009.
Risk Reports
Risk reports, which reflect excerpts from the risk register, may be developed by risk owners to communicate ongoing activities and manage risks at any level of the organization. The type of risk report shown in Figure 6.5 conveys what steps are being taken to address project delivery risks.
TAM Webinar #50 - Improving Your Next TAMP Miniseries: Improving Risk Management and Resiliency
Risk Mitigation Plans
Some agencies see benefit in developing risk mitigation plans for their assets to ensure compliance with regulatory programs and help embed risk into all agency business activities. For example, a risk management plan may be developed when a bridge’s risk of failure reaches a certain threshold. These plans identify specific risks and mitigation strategies to undertake in order to reduce the likelihood or impact associated with the risk.
Figure 6.5 Sample Risk Report
Source: AASHTO. 2016. Managing Risk Across the Enterprise: A Guide for State DOTs.
Washington State DOT
The Washington State DOT recognized the potential safety risk to highway travelers and the adverse impact on regional commerce associated with unstable slope failure. To become more proactive in managing this risk, WSDOT developed the Unstable Slope Management System (USMS) that provides a method for evaluating known unstable slopes and using the information to prioritize slopes for funding of proactive stabilization efforts. The mitigation objective of the unstable slope management program is to sustain a desired state of good repair and low risk over the life span (> 20 years) of known unstable slopes and constructed geotechnical assets at the lowest practicable cost.
Bay Area Rapid Transit Authority (BART)
BART developed a Local Hazard Mitigation Plan in 2017 to reduce or eliminate long-term risks to human life and property related to hazards such as earthquakes, tsunamis, landslides, flood, sea level rise, wildfire, and drought. The analysis focused primarily on high-priority fixed assets such as passenger stations, substations, switching stations, train control rooms, shops/yards, ventilation structures, and emergency exits. These assets were prioritized based on criticality in terms of the impact of an asset failure on reliable and safe service capabilities. The Local Hazard Mitigation Plan details the potential impacts associated with each hazard type and presents prioritized mitigation actions that were determined by votes from the participating members of a Task Force Committee called the Emergency Preparedness Task Force Committee (EPTFC) that is made up of senior managers from all BART departments. The plan is updated at least once every five years. An example of the type of mitigation strategies that were developed are presented in the Figure below. The Plan has helped identify agency priorities that are being addressed and has fostered collaboration among different Departments to reduce potential hazards.
Lessons Learned from Implementing Risk Management
Following the 2016 publication of the AASHTO Guide for Enterprise Risk Management, TRB initiated an NCHRP project to pilot the framework introduced in the Guide. Pilot case studies were conducted by the Tennessee, Utah, and Washington State DOTs; a peer exchange was conducted; and a national community of practice (COP) was formed to provide support for the implementation of risk management and to advocate for further research in this area. Several risk management tools were developed through the research that are documented in the NCRHP report.
A variety of different types of risks were considered during the pilot studies. The Tennessee DOT focused primarily on three types of risks:
- Those associated with inconsistencies in quick-clearance processes associated with crashes and other highway incidents.
- Those associated with roadway plans that could affect the quality, cost, and schedule for delivering projects.
- Those caused when incomplete project plans are submitted for bids.
Several tools were developed to better manage these risks, including checklists, plan submittal delay forms, and a Memorandum of Understanding with the Tennessee Department of Safety to clarify roles and responsibilities for quick clearances.
The Utah DOT pilot addressed four initiatives:
- Reduce risks to Utah DOT objectives by improving hiring practices and retention.
- Reduce risks of poor performance by enhancing the employee evaluating process and strengthening leadership skills.
- Reduce risks of poor performance through a knowledge management process.
- Develop a repeatable and scalable process to assess corridor risks caused by natural disasters.
The study improved leadership access to information for hiring and leading employees, provided a training toolkit for supervisors, and resulted in a process to integrate and incorporate risk and resilience assessments into existing decision-making processes.
Washington State DOT used the pilot to support the full integration of its enterprise risk management practices. The agency also elected to address cultural sensitivity and inclusion in workforce development activities. These efforts resulted in new workforce development and outreach materials.
The pilot studies helped expose the participating agencies to strategies for managing risk. They demonstrated the importance of promoting enterprise risk management concepts among agency leaders to mainstream the concepts into common agency practices. This increases the likelihood that enterprise risk management practices endure beyond changes in agency leadership.
The participants also recognized important links between risk management and both performance and asset management programs. Several agencies recognized the importance of risk management to improving the resilience of a highway network to unexpected events such as flooding or erosion. The pilot studies demonstrated that the ability to use risks to inform planning and investment decisions can be beneficial.