Risk assessment in construction: catching the problem before it becomes an invoice

When a construction project overruns on time or budget, the cause is rarely a risk nobody could have spotted. More often it was there all along, but nobody put it into a system early enough.

A risk assessment is not about predicting the future. The purpose is far more practical: writing down what could go wrong, judging how serious it would be, and acting on it before it turns into a non-conformance, a delay or a cost nobody budgeted for.

Below we cover what a risk assessment actually is, how it is carried out in practice, what the regulations require, and why it is often the least visible risk that ends up costing the most.

What is a risk assessment?

Put simply, a risk assessment is the work of mapping what could go wrong in a project, then ranking it by how likely and how serious it is.

The assessment is the starting point for everything else in the risk work. Skip it, and the measures you take quickly become arbitrary, simply because nobody really knows where the effort is needed most.

IT ANSWERS THREE QUESTIONS

1

What could go wrong?

2

How likely is it?

3

What does it cost if it happens?

The steps in a risk assessment

In practice the work follows four steps, and they repeat for as long as the project runs.

It is usually the fourth step that fails. An assessment that ends up in a drawer after the kick-off meeting governs nothing. It only records that somebody once had the thought.

1

Identify

What could go wrong? Everything from falls on site to missing product documentation at handover.

2

Analyse

How likely is each individual risk, and how large are the consequences if it materialises?

3

Prioritise

What is urgent, and what can you live with? Ranking here sends resources where they actually count.

4

Document and follow up

Write the assessment down, give it an owner, and update it as the project changes.

What the regulations require

Risk assessment is not optional in Norwegian construction projects. The Building Owners’ Regulations place the responsibility on the builder to ensure that the risk conditions are assessed and that a written SHA plan is in place before work on the construction site begins.

The plan must be based on assessments made by the builder in the planning phase, and by the designers during the design process. The focus is therefore on the early stages, long before the first shovel is turned.

Safety, health and the working environment are, however, only one part of the picture. A real risk assessment must encompass a broader scope than that.

Need help with safety plans and documentation? Book a demo →

The five areas a risk assessment should cover

Risk in construction rarely arrives alone. It tends to show up in five forms that are closely connected.

Safety risk (HSE)

Danger to life and health on site. The most visible risk, and the most tightly regulated.

Financial risk

Overruns, price movements and unforeseen variations. Often a symptom of a risk that was overlooked somewhere else.

Schedule risk

Delays have a habit of spreading. One subcontractor falls behind, and the whole handover moves.

Quality risk

Wrong products, poor workmanship and defects that tend to surface only at handover.

Documentation and compliance risk

Missing or incorrect documentation on products, requirements and compliance. Easy to overlook, and often the most expensive of them all.

The risk most assessments forget

The first four points normally make it onto the agenda. The fifth, documentation and compliance, tends to sit outside the assessment until something goes wrong.

A typical project today handles thousands of product, chemical and sustainability documents, and the requirements keep multiplying. REACH governs the chemicals, the Construction Products Regulation (CPR) sets requirements for declarations of performance, and the incoming Digital Product Passport (DPP) is designed to make products traceable. On top of that, certifications such as BREEAM and the Nordic Swan Ecolabel require evidence that hazardous substances have genuinely been kept out.

A product already installed turns out not to meet the BREEAM requirements, and in the worst case has to come back out.

Declarations of performance are missing at handover, and the client cannot get its documentation approved.

A substance on the REACH candidate list is discovered too late, bringing both reputational and financial exposure.

All of this can be managed. The condition is that documentation is structured and traceable from the outset, rather than being rushed together in the weeks before handover.

Control over documentation means lower risk

The difference lies in whether you react to deviations after they have occurred, or prevent them in the first place. When the status of the documentation is visible at all times, compliance ceases to be something to be feared, and becomes part of the daily control.

This is exactly what Cobuilder is made for. Product data, documentation and requirements management are collected in one place.

Seltor achieved 99% documentation quality, because requirements and documentation were followed up systematically throughout the entire process instead of collected at the very end.

FAQ: About risk assessment

The client or principal carries the main responsibility under health and safety legislation, including making sure assessments are carried out and that a written safety plan exists. In practice, designers, project managers, contractors and subcontractors all contribute within their own areas.

Risk assessment is about mapping and ranking what could go wrong. Risk management is the whole process around it, including the measures you put in place and the follow-up over time. The assessment is the foundation management builds on.

As early as possible, and then continuously. Risk is cheapest to handle during planning and design, and the assessment should be updated whenever the project changes materially.

It is the risk that product and compliance documentation is missing, incorrect or fails to meet requirements such as REACH, CPR, DPP or BREEAM. The consequence can be non-conformances, delayed handover and, at worst, products having to be replaced.

Catch the risk you cannot see

Safety, cost and schedule are already on most projects’ radar. It is documentation and compliance that slip, and that particular risk is among the easiest to remove once the structure is in place.