Document No LBU – PMP – QACM – 001

Revision No 2
Revision Date AUGUST 2016
Page Page 1 of 105

RISK MANAGEMENT PLAN

DE V E LO P ME N T A ND UP G R AD ING O F TH E PR O PO S ED P AN B O R NE O HIG H WA Y
IN TH E STA T E O F SA RA W AK

Document Owner Head of Risk Management

Document Approver Board of Management

Date of Issue Version Name Title

August 2016 2.0 Abdillah Bin Azahari Head of Risk Management
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 2 of 105

Document Management Plan

1) Purpose

This management plan outlines the updating procedures and contact points for this
document.

2) Document Information

Document name WPC Project Risk Management Guideline

Document number LBU – PMP – QACM - 001
Applicable and Referenced LBU – FW – RM – 001 Risk Management Framework
Document LBU – FW – RM -002 Risk Governance Framework
LBU – OP – RM - 001 Risk Management Policy
LBU – TK – RM – 001 Risk Management Toolkit
Document availability Restricted circulation. Softcopy retained by Risk Manager;
Hardcopies available upon request.
Document owner Head, RM
Document sponsor Board of Directors, Lebuhraya Borneo Utara

3) Amendments and Review Strategy

All corrective actions/improvement requests (CAIRs) suggesting changes will be

acknowledged by the document owner.

Comments Frequency
Amendments Updates incorporated immediately they occur. As required
(Minor Revisions)
Review Amendments fundamentally changing the content or At least
(Major Revisions) structure of the document will be incorporated as annually
soon as practicable. They may require coordination
with the review team timetable.
Notifications All users that have registered their interest by e-mail Immediately
will be advised by e-mail of any amendments and
updates

4) Other Information (At Document Owner’s discretion)

There will be occasions, depending on the subject matter, when amendments will need to
be worked through by the Review Team before the amendment is actioned. This may cause
variation to the above noted time frames.

5) Distribution Of This Plan

Distribution of this plan will be at the discretion of the document owner.

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 3 of 105

Executive Summary
Highway design and construction projects can be extremely complex and are often fraught with
uncertainty. However, engineers, project managers, and cost estimators often overlook or fail to
recognize project uncertainty early in the project development process. As a result they do not
communicate uncertainty and its effect to the stakeholders. A comprehensive risk management
approach can help project teams identify, assess, mitigate, and control project risks. Among the
benefits of a comprehensive risk management approach is the ability to generate range estimates
early in the project development process and to establish justifiable contingencies that can be
resolved throughout the design and construction process. Undertaking a program as large as the Pan
Borneo Highway project involves risk from both the program and project-level perspectives. It is
critical to identify, manage, and mitigate risks at each stage of the PBH system’s life cycle.

This document, the Risk Management Plan (RMP), describes the management processes used on the
project to plan, identify, assess, categorize, quantify, handle and report/track risks associated with the
achievement of the project requirements and goals for the Pan Borneo Highway Project which is being
undertaken in the state of Sarawak. This RMP is consistent with ISO31000; 2009 Risk Management –
Principles and Guidelines and strives to incorporate “best practices” from other large scale highway
construction projects around the globe.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 4 of 105

TABLE OF CONTENTS
1.0 INTRODUCTION 7

1.1 BACKGROUND 7

1.2 PURPOSE 7

1.3 SCOPE AND CONTEXT 8

1.4 PROJECT SUMMARY 9

1.5 PROJECT GOVERNANCE 14

1.6 ASSUMPTIONS, CONSTRAINTS AND POLICIES 19

1.6.1 Assumptions 19

1.6.2 Constraints 19

1.6.3 Policies and Guidelines 20

1.7 RELATED DOCUMENTS AND STANDARDS 22

1.8 DEFINITION, ACRONYMS & ABBREVIATIONS 22

2.0 RISK MANAGEMENT PHILOSOPHY AND INTEGRATION 23

2.1 RISK MANAGEMENT PHILOSOPHY 23

2.2 RISK MANAGEMENT INTEGRATION 26

2.3 RISK BASK DECISION-MAKING 27

3.0 ROLES AND RESPONSIBILITIES 29

4.0 RISK MANAGEMENT PROCESS DETAILS 33

4.1 RISK MANAGEMENT PROCESS 34

4.2 ESTABLISHING THE CONTEXT 37

4.3 RISK IDENTIFICATION 41

4.3.1 Formal Risk Identification 41

4.3.2 Informal Risk Identification 41

4.3.3 Initiating and Documenting of the ‘Candidate’ Risk 41

4.3.4 Validating the ‘Candidate’ Risk 42

4.3.5 Assignment of a Risk to a Risk Owner 42

4.3.6 Subject Matter Expert (SME) in Risk Management 42

4.4. RISK ASSESSMENT 44

4.4.1 Risk Probability Ranking 44

4.4.2 Risk Analysis 45

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 5 of 105

4.4.3 Impact Time Frame 45

4.4.4 Review Risk Analysis and Ranking 45

4.4.5 Update Risk Spreadsheet with Team/Management Comment 45

4.4.6 Subject Matter Expert (SME) in Risk Assessment 45

4.5 RISK RESPONSE PLANNING 47

4.5.1 Risk Response Plan 47

4.5.2 Tools & techniques for Risk Response 48

4.5.3 Risk Response Description 49

4.5.4 Contingency Thresholds/Triggers (Trend Alerts) 49

4.5.5 Contingency Plan 50

4.5.6 Review Risk Response Plan 50

4.5.7 Update Risk Register and Risk Management Documents 50

4.5.8 Subject Matter Expert (SME) in Risk Response 50

4.6 RISK MONITORING AND CONTROL 52

4.6.1 Monitor Changes to Risk Profiles and Response Plan 52

4.6.2 Report Risk Status 52

4.6.3 Monitor Trigger Events (Trend Alerts) 53

4.6.4 Execute Contingency Plan(s) 53

4.6.5 Retire/Close Risks 53

4.7 RISK COMMUNICATION 55

4.7.1 Periodic Status Meeting 56

4.7.2 Revision History 56

4.7.3 Report Lessons Learned on Risk 56

5.0 RISK MANAGEMENT AND THE WPC CONTRACTOR 57

5.1 OVERSIGHT OF WPC CONTRACTORS’ RISK 57

5.2 WPC CONTRACTORS’ PARTICIPATION IN RISK MANAGEMENT 57

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 6 of 105

APPENDIX A LBU RISK IDENTIFICATION & RESPONSE PLAN TEMPLATE 58

APPENDIX B FRAMEWORK FOR LBU’S RISK MANAGEMENT 59

APPENDIX C GLOSSARY RISK MANAGEMENT TERMS 77

ANNEX I MANAGING AND MITIGATING THE PAN BORNEO HIGHWAY PROJECT 81

RISKS

ANNEX II THE PAN BORNEO HIGHWAY PROJECT RISK TAXONOMY 93

ANNEX III SUMMARY OF THE PAN BORNEO HIGHWAY PROJECT RISK PROFILE 98
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 7 of 105

1.0 Introduction

1.1 Background
Risk is defined as an event that has a probability of occurring, and could have either a positive
or negative impact to a project should that risk occur. A risk may have one or more causes
and, if it occurs, one or more impacts. All projects assume some element of risk, and it’s
through risk management where tools and techniques are applied to monitor and track those
events that have the potential to impact the outcome of a project.

Risk management is an ongoing process that continues through the life of a project. It includes
processes for risk management planning, identification, analysis, monitoring and control.
Many of these processes are updated throughout the project lifecycle as new risks can be
identified at any time. It’s the objective of risk management to decrease the probability and
impact of events adverse to the project. On the other hand, any event that could have a
positive impact should be exploited.

The International Organization for Standardization identifies the following principles of risk
management:

i. Risk management should create value.

ii. Risk management should be an integral part of organizational processes.
iii. Risk management should be part of decision-making.
iv. Risk management should explicitly address uncertainty.
v. Risk management should be systematic and structured.
vi. Risk management should be based on the best available information.
vii. Risk management should be tailor-made.
viii. Risk management should take into account human factors.
ix. Risk management should be transparent and inclusive.
x. Risk management should be dynamic, iterative and responsive to change.
xi. Risk management should be capable of continual improvement and enhancement.

Project risk management is an important aspect of project management. According to

the Project Management Institute's PMBOK, Risk management is one of the ten knowledge
areas in which a project manager must be competent.

1.2 Purpose
This document describes how the project team for the Pan-Borneo Highway Project will
perform the job of managing risks for the project. It defines the roles and responsibilities for
stakeholders in the risk processes, the risk management activities that will be carried out, the
schedule and subsequent budget for risk management activities and the tools and techniques
that will be used.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 8 of 105

The purpose of risk management is to ensure levels of risk and uncertainty are identified and
then properly managed in a structured way, so any potential threat to the delivery of outputs
(level of resourcing, time, cost and quality) and the realisation of outcomes/benefits by the
Client is appropriately managed to ensure the project is completed successfully.

The objectives of this risk management approach in the Pan Borneo Highway Project are to
identify, assess and mitigate risks where possible and to continually monitor risks throughout
the remainder of the project as other risks or threats emerge or a risk’s impact or likelihood
changes.

As risk management is an ongoing process over the life of a project, this Risk Management
Plan and Risk Register must be considered a ‘snap shot’ of relevant risks at one point in time.

This plan establishes the process for managing risks during all phases of the Pan Borneo
Highway Project. The scope of this plan also includes risks associated with the use of
program (Government and Contractor) financial resources, facilities, procedures,
equipment and personnel (civil servants, contractors, affiliated organizations, researchers,
etc.) that have been assigned to or are directly associated with the Pan Borneo Highway
Project. Where required, the process of risk identification, assessment and the development
of countermeasures will involve consultation with the Pan-Borneo Highway Project team
members, Project Design Consultants, relevant stakeholders and Contractors.

1.3 Scope and Context

The scope of this document pertains to the Pan Borneo Highway Project and its internal and
external risks. The risk management methodology identified in this document will be primarily
used by Pan Borneo Highway Project and is to be used during the entire Pan Borneo Highway
Project. The Pan Borneo Highway Project Work Package Contractors’ and Vendor’s risk
management methodology will be provided as a contractual deliverable and will develop a
separate Risk Management Plan. The Pan Borneo Highway Project Work Package Contractors
and Vendors will be responsible for managing their project risk and reporting to Lebuhraya
Borneo Utara (LBU) Project Managers.

Risk management goes further than planning, and the risk response actions planned and
incorporated in a risk management plan need to be executed effectively and monitored for
their effectiveness. The project manager should conduct frequent reviews of project risks and
the progress made in addressing them, indicating where risks are being effectively handled
and where additional actions and resources may be needed.

Project risk is an uncertain event or condition that, if it occurs, has a positive or a negative
effect on at least one project objective. A risk may have one or more causes and, if it occurs,
one or more impacts.

Risk management is the systematic process of planning for, identifying, analyzing, responding
to, and monitoring project risks. It involves processes, tools, and techniques that will help the
project manager maximize the probability and results of positive events and minimize the
probability and consequences of adverse events as indicated and appropriate within the
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 9 of 105

context of risk to the overall project objectives of cost, time, scope and quality. Project risk
management is most effective when first performed early in the life of the project and is a
continuing responsibility throughout the project’s life cycle.

The project risk management process helps project sponsors and project teams make
informed decisions regarding alternative approaches to achieving their objectives and the
relative risk involved in each, in order to increase the likelihood of success in meeting or
exceeding the most important objectives (e.g. time) sometimes at the expense of other
objectives (e.g. cost). Risk management encourages the project team to take appropriate
measures to:

 Minimize adverse impacts to project scope, cost, and schedule (and quality, as a result).
 Maximize opportunities to improve the project’s objectives with lower cost, shorter
schedules, enhanced scope and higher quality.
 Minimize management by crisis.

1.4 Project Summary

The Project involves the development and upgrading of the existing R3 single carriageway
Sarawak Trunk Road (Federal Route 1) to a dual carriageway Pan Borneo Highway (the Project)
of JKR R5 Standard.

The main components of the Project are:

1. Development and upgrade of the proposed Pan Borneo Highway:

i. Section 1 – (A) Sematan to Sg. Moyan (approximately 91 km); (B) Serian

Roundabout to Pantu Junction (approximately 74 km); (C) Pantu Junction to
Spaoh Junction (approximately 123 km); and (D) Spaoh Junction to Bintangor
Junction (approximately 99 km);
ii. Section 2 – (A) Bintangor Junction to Julau Junction (28.435 km) and Sibu Airport
Roundabout to Bintulu Airport Junction (177.4 km); and
iii. Section 3 – Bakun Junction to Pujut Link Road (approximately 167 km).

2. Development and upgrade of 109 bridges;

3. Construction of LBU’s main office, three (3) rest and service areas (RSA) including
regional JKR offices, and six laybys (toilets, parking and surau);

4. Junctions development and upgrade;

5. Drainage systems; and

6. Road furniture.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 10 of 105

The proposed Project will cover the existing Sarawak Trunk Road (Federal Route 1). This
development proposal extends approximately from Sematan to Miri with intermittent
stretches already upgraded by the Sarawak Government. Phase 1 of the Project consists of
developing and upgrading 740 km of the existing Trunk Road (see Figure 1 - 1).

The distinguishing characteristics of highway projects, e.g. size, complexity, public funding and
scrutiny, going through dense urban areas, underground works, etc. may cause uncertainties
and unexpected challenges. High public visibility and impact often create tight time
constraints and drive a rigorous schedule, necessitating innovation to construction processes.
Federal and state funded highway projects follow less-than-negotiable budgets that are very
difficult to change when unexpected circumstances arise. Additionally, as highway projects
are often subject to changes in design or scope based on the needs and the availability of
funding, a need for flexibility introduces more risk, particularly to the project budget.

The combination of these risk factors also introduces a number of additional risks. An
unqualified and/or inexperienced project team unable to respond capably to project risks may
expose the project to additional risk. Also, the presence of multiple project team members
can lead to the risk of conflicting interests. The project owner seeks to deliver an effective
project while respecting the public’s tax dollar while the contractor seeks to meet owner
requirements and still turn a profit.

In order to effectively manage risk, we must identify and quantify both risks such as these,
and their implications, in order to choose tools and strategies to best control and mitigate
them. Table 1 - 1 shows typical risks affecting highway construction that were obtained from
various sources of literature and implementing agencies.
Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 11 of 105

Figure 1 – 1

The Proposed Pan

Borneo Highway
Project
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 12 of 105

Table 1 - 1: Risks Typical to Highway Construction

Project Phase Typical Risk Issue

Project Initiation  Significant environmental economic impacts
 Funding uncertainty
 Uncertain political and public support
 Competing interests and competing projects

Preliminary Engineering  Changes to project scope and budgets

 Appropriate procurement methods
 Changes in design requirements
 Right-of -way acquisition
 Land acquisition & delivery
 Technical uncertainties
 Errors or omissions in quantities, inaccurate unit prices
 Market conditions
 Funding uncertainty
 Cost of environmental compliance
 Preliminary pre-engineering works (SI, survey, etc)

Final Design  Changes in project scope and budget

 Errors or omissions in quantities, inaccurate unit prices
 Changes in design requirements
 Preliminary pre-engineering work requirements
 Market conditions, permit requirements

Construction  Contractor performance, construction quality

 Final permitting, right-of-way acquisition
 Final permitting, land acquisition
 Unanticipated site/working conditions
 Field design changes
 Construction safety

Edwards (1995), Smith and Bohn (1999), and Kim and Bajaja (2000) list potential construction
risks.

Table 1 - 2 details some of the most common risk sources in construction projects.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 13 of 105

Risk Source Description of Risk Source

Cost Estimate is uncertain because it is based on past and projected costs
Schedule Schedule is uncertain because it is based on past and predicted
performance
Labour Labour strength and productivity uncertainties
Project Uncertain experience levels, team cohesiveness and composition
Management
Safety Potential for accidents and consequences of injuries or higher costs
Change Orders Potential increased cost, schedule delay, and poor technical
performance
Unforeseen Undefined underground conditions or hidden site conditions that can
conditions cause cost and schedule increase
Environmental Regulatory approvals and mitigation of environmental concerns can
concerns cost time delay or cost escalation
Inflation Potential for material and labour price increases
Weather Delay causing costs and technical non-performance from adverse
weather
Construction Level of difficulty increases the potential for cost and schedule growth
complexity
Fire Probability of fire hazard from work operations, vandalism or lightning
Suppliers Non-performance from vendors, sub-contractors or suppliers that can
cause impact to cost and schedule
Property loss Potential for loss due to flood, fire, theft, sabotage or vandalism
Design Incomplete or lack of design elements that considers construction
aspects
Quality Potential for consequence of poor quality and technical non-
performance
Political Potential loss of support leading to less opportunity to acquire new
projects

Table 1 - 2
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 14 of 105

1.5 Project Risk Governance

Projects face many risks - financial, operational, human capital, legal and contractual, socio-
political, and environmental - to name a few. Risk management and governance are
integrated. Good governance will drive risk management and risk management anchored
effective governance. The same principles apply to Governance of Project Management.
Projects face risks and risks might change over the course of a project. Project Governance
should entail the setting up of a project risk management process. A proper risk assessment
exercise would identify the inherent controls that are in place, and attempt to minimise risks
through management intervention and other means. The remaining residual risks are made
known, and are either transferred, dropped, or simply absorbed. Insurance is an effective way
to transfer risks which are insurable. However, some risks are not insurable and good project
governance is the most effective preventive measure. Governance of project risk, or the lack of
it, is the major attribute to project failure.

Common causes of project failure are well researched and documented. Lebuhraya
Borneo Utara has identified eight common causes of programme / project failures and these
common causes formed the basis of the Project Risk Governance framework for the Pan
Borneo Highway project.

Reasons for Project Failure Management or

Governance Issues?
Lack of clear link between the project and the organisation's key Governance
strategic priorities, including agreed measures of success.
Lack of clear ownership and leadership for the project from the Governance
organisation's governing body.
Lack of effective engagement with stakeholders. Governance
Lack of skills and proven approach to project management and risk Management
management.
Too little attention to breaking development and implementation into Management
manageable steps.
Evaluation of proposals driven by initial price rather than long-term Governance
value for money (especially securing delivery of business benefits).
Lack of understanding of and contact with the project contractors / Governance
service vendors at senior levels in the organisation
Lack of effective project team integration between clients, the Governance
supplier team and the supply chain.

Based on the framework, LBU has identified the following KEY GOVERNANCE PRINCIPLES to
manage Project Risk :
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 15 of 105

People

Regular
Purpose
Review

Key Risk
Governance
Principles

Strong
Internal Process
Controls

Planning

Figure 1 - 2 shows the project risk governance structure for the Pan Borneo Highway project
which details the required response and the limit-of-authority (LOA) that governs the risk
management response for the project.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 16 of 105

Figure 1 - 2 – LBU’s Risk Management Governance

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 17 of 105

LBU has also identified three (3) levels of defence to manage the project risks for the Pan
Borneo Highway Project as shown Figure 1 - 3.

RISK & CONTROL

Organisation’s FIRST
AN ESTABLISHED RISK AND
LINE
Operations CONTROL ENVIRONMENT

Board, Executive & Audit Committee

RISK & CONTROL

Oversight STRATEGIC MANAGEMENT,

Functions POLICY AND PROCEDURE SECOND
LINE
SETTINGS FUNCTIONAL
OVERSIGHT

RISK & CONTROL

Independent PROVIDE INDEPENDENT

Assurance THIRD
CHALLENGE AND LINE
ASSURANCE

Figure 1 - 3 – LBU’s Three Levels of Defence

Based on the implementation strategy of the Pan Borneo Highway Project, LBU has decided
to integrate the risk management process to incorporate both organizational-wide strategic
and operational risk management with the individual work-package based contractors’ risk
management. This is shown in Figure 1 - 4.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 18 of 105

STRATEGIC & CONTRACTORS’ PLANNING RISK MANAGEMENT PROCESS REPORTING PROCESS

PROCESS

EVALUATED & REPORTED

STRATEGIC
OBJECTIVES &
CEO/ BOARD REPORT
INDICATORS
STRATEGIC RISK
(RISK REGISTER)

ESCALATED
UP
CASCADED
CONSOLIDATED
ALIGNED & DOWN
& ESCALATED UP
CASCADED
DOWN
CONTRACTORS’ RISK
(RISK REGISTER)
PROJECT
CONTRACTORS’
EXECUTION/
OBJECTIVES &
PROGRESS REPORTS
INDICATORS

EVALUATED & REPORTED

Figure 1 - 4 – LBU’s Integrated Risk Management

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 19 of 105

1.6 Assumptions, Constraints and Policies

1.6.1 Assumptions

 Lebuhraya Borneo Utara’s role in the project as the Project Delivery Partner to
the government will be purely to manage the consultants who shall undertake
the design works and the work package contractors who shall undertake the
construction works.

 Acquisition of land within the Right-of-Way, a critical component required for the
success of the project, is vested with the state’s Land & Survey Department
(Jabatan Tanah dan Survei Sarawak)

 The project will be developed based on several packages and that these work
packages will be implemented concurrently so as to achieve the planned
construction duration as specified in the Project Delivery Partnership Agreement
(PDPA)

 Individuals, functional teams, Integrated Project Management Teams

(PMT)/Integrated Construction Management Teams (CMT), Consultants,
Government Agencies, Working Groups, and affiliated organizations play a
significant role in the Pan Borneo Highway project throughout all of phases of the
project. For this reason, the risk management process is built around the
significant participation of these individuals and teams working in concert on this
project.

 Increasing attention on risk-related concerns will continue. The emphasis on Risk

Management in management reviews and the need to communication risks with
stakeholders and senior management will continue.

 A consolidated project execution approach to the Master Implementation Plan

(MIP) will continue along established development timelines.

1.6.2 Constraints

 Design, development, and delivery schedules are essentially constrained by the

Project Delivery Date as specified in the Project Delivery Partner Agreement.


 Program expenditures are expected to be constrained by the baseline budget

limits and funding profiles.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 20 of 105

 The acquisition of land which represents a critical element required for the
successful execution of the project is vested with the Sarawak land and survey
department.

 LBU’s Project Delivery Partners, Consultants and Work Package Contractors will
operate under separate RMPs as required in existing agreements, contracts, or
other documentation and will interface with the LBU Pan Borneo Highway Project
risk management process as described in this plan. All related risk management
processes are constrained to be compatible with LBU’s Risk Management Plan.

 Existing technological, funding, and schedule constraints will not allow for the
complete elimination or mitigation of all risks. A certain level of risk will need to
be accepted. These accepted risks (residual risks) shall be documented with final
review and approval by the Project Delivery Partners as required.

1.6.3 Policies and Guidelines

 This Risk Management Plan will, as a minimum, be: reviewed annually; modified as
required after the selection of work package contractors, etc.; and updated to
reflect process changes during the different phases of the project's lifecycle.

 To the extent possible, this RMP will address commonality and related risks with
other related projects, utilize lessons learned from historical data, and review
other risk management processes for compatibility with this plan.

 All personnel involved in this project are responsible for adhering to risk
management policies and guidelines, as documented in this plan. All personnel
shall be provided open access to identify risks directly to the project through the
process defined in this plan.

 Risks (associated with technical performance, requirements, budgets, cost,

schedules, or other concerns) are the responsibility of the individual project
managers, functional heads, affiliated organizations or managers. Each is
required to take action to identify, assess and mitigate risks within their area of
control and report risks on a regular basis.

 Contractors shall, as a minimum, provide LBU with sufficient access and

documentation to demonstrate effective implementation of their RM processes
and shall periodically report their risks as part of the agreed upon management
procedures. They will also facilitate risk monitoring/tracking, insight and audits
by the program. All other RMPs will be subordinate to LBU’s RMP, to the extent
required to establish consistency and maintain compatibility.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 21 of 105

 Joint risk management activities conducted by projects and/or affiliated

organizations working on the Pan Borneo Highway project shall be planned,
coordinated, and conducted in a manner that is consistent with the RM approach
established by this plan.

 All changes to the baseline LBU RMP will be made in accordance with LBU’s
procedures. Changes to all other affiliated organization(s) risk management
processes should be communicated to LBU in a timely manner to ensure
consistency and compatibility with this plan.

 Risk documentation and communication at all levels within the Pan Borneo
Highway project shall be considered open and transparent in nature. Risk
information shall be available for review (through risk lists, risk databases, and
other means), but will remain subject to security, proprietary information, and/or
company restrictions that are imposed on all other project documentation.

 To maximize the effectiveness of the RM program, RM training and familiarization

shall be made available to the integrated Project Management Team. As a
minimum, project personnel are expected to have a basic understanding and
working knowledge of the RM processes and methodologies.

 This RMP is consistent with the risk management policies and guidelines
established by LBU’s Risk Management Department as highlighted in Section 1.7
of this Plan.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 22 of 105

1.7 Related Documents and Standards

This RMP is intended to complement the overall Pan Borneo Highway project management
process.

The RMP is consistent with the requirements and guidelines of the following
documents.

Project Delivery Partner Agreement dated 30th June 2015

PDPA Schedule C Appendix Master Implementation Plan for the Pan

C-1 Borneo Highway Project Sarawak Phase 1
ISO 31000: 2009 Risk Management – Principles and Guidelines

ISO Guide 73: 2009 Risk Management – Vocabulary

ISO/IEC 31010: 2009 Risk Management – Risk Assessment

Techniques
LBU – FW – RM – 001 LBU Risk Management Framework

LBU – FW – RM – 002 LBU Risk Governance Framework

LBU – OP – RM – 001 LBU Risk Management Policy

LBU – TK – RM – 001 LBU Risk Management Toolkit

1.8 Definitions

Definitions, Acronyms and Abbreviations

PM Project Manager
RM Risk Manager
RMP Risk Management Plan
CCC Certificate of Completion & Compliance
CF Certificate of Fitness
CPM Critical Path Method
EPU Economic Planning Unit
SOA Schedule of Accommodation
VO Variation Order

Specific risks definitions are shown in Appendix C.

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 23 of 105

2.0 Risk Management Philosophy & Integration

2.1 Risk Management Philosophy

The Risk Management process begins with the development of this plan in which the general
risk management paradigms are tailored to the Pan Borneo Highway Project; resources are
allocated; a support organization and functional responsibilities defined; and a risk
management process is established. As summarized in Table 2-1, Risk Management Data
Inputs and Outputs, the following activities are performed in the risk management process:

 Risk Management planning: The up-front activities necessary to execute a successful risk
management program.
 Establishing the context: Establishing the context defines the scope for the risk
management process and sets the criteria against which the risks will be assessed. The
scope should be determined within the context of the firm's organizational objectives.
 Identifying risks: A continuous effort to identify and document risks as they are found,
 Assessment/Analyzing risks: An estimation of the probability, impact, and timeframe of
the risks, and classifying sets of related risks, and prioritization of risks relative to each
other,
 Handling/Action planning: A decision about what to do with the risks, which, for
important risks, will include pre-authorized action (mitigation and fallback) plans for Risk
Owners,
 Tracking and controlling risks: Collecting and reporting status information about risks and
their mitigation plans (where appropriate) and taking corrective action as needed.
 Communicating and documenting risks: Continuous at each step of the process to provide
support for decision-making and risk traceability.

This process is consistent with LBU’s Continuous Risk Management (CRM) paradigm and
implementation guidelines represented in Figure 2-1. These risk management activities will
be carried out as part of the day-to-day activities of the project and departments as well as
during key project and departmental management meetings. A summary of the data inputs
and outputs in each function of the process is provided in Table 2-1.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 24 of 105

Risk Steps Inputs Outputs

RM Implementation Project Constraints and Risk Management Plan
Planning Assumptions, Project Risk Governance Plan
Organization, Master Implementation Risk Criteria
Plan, High-Level Requirements, WBS,
Top-Level Schedule, Policy
Requirements

Establishing the SWOT Analysis, AHP Analysis, Risk contexts and

Context PESTLE Analysis statements

Identification Individual and Group Concerns, Risk List

Project Data, Brainstorming
Historical Data and Lessons
Learned Information

Assessment/Analysis Risk Statement and List of Risks Risk Consequences,

Statements, Impacts,
Probability, Timeframe,
Classifications and Priority
Rank; Master Risk List,
Identification of
Groups of Risks,
Expected Value

Handling/Action Outputs of Analysis Step, Risk Action Plans, Risk and

Program Resources, Goals, and Mitigation Metrics, Project
Constraints (Cost and Schedule) Schedule and Budget
revisions reflecting
commitments to risk
action plans

Tracking/Control Action Plans, Metrics, Risk Status Reports regarding

Analysis Risks and Mitigation Plans
Outputs of Action and Tracking Project Decisions- Risk
Steps specific including Re-
Planning, Closure,
Contingency, or De-
scoping

Communication and Outputs of all RM Steps, Risk Management Database

Documentation Supporting information and reports, status reports,
documentation tracking
logs, and presentations

Table 2 – 1 – Risk Management Data Inputs & Outputs

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 25 of 105

RISK MANAGEMENT PLANNING ESTABLISH THE CONTEXT RISK IDENTIFICATION RISK ASSESSMENT & ANALYSIS RISK HANDLING/ ACTION RISK TRACKING & CONTROL

 Requirements  External Context How likely? /How severe? / occur? What is going to be done? What is going to be done? Is it going according to the plan?
 Responsibilities  Internal Context (What can go Wrong? /What can How soon or when?
 Definitions  Risk Management Context go right?)  Assign Risk Owner Track Status
 Resources  Determine the causes,  Consider options & alternatives
 Methods: or redesign
Procedures  Goals and objectives. conditions, or events  Compare Actual vs. Plan
 Risk Management Resource Research Historical Data  Determine Likelihood  Use standard practices or
 Structure, function and key Interview Experts  Comparison of Goals vs.
 Implementation processes.  Determine Consequences templates
Capabilities
 Strategy/Approach Comparison of Goals and  Identify best solution
 Physical and technological Capabilities  Develop Mitigation Plans
 Trend Analysis of Metrics
infrastructure and  Technical (Performance,  Earned Value Management
Trend Analysis of Metrics Operations, Safety) (Thresholds & Triggers)
maintenance arrangements. Systematic Analysis (WBS, (EVM)
 Cost  Reduce Likelihood of
 Locations of business sites Reliability, etc.)  Technical Performance Measures
 Schedule Occurrence
and other operations. Key Areas: (TPMs)
 Quality  Reduce Severity of
 Details of internal  Client Expectation Consequences
stakeholders.  Requirement  Expected Value  Acquire Additional Resources
Review Lower Tier Risks
 The prevailing culture and  Technology
Plot Risks (Risk Exposure)
workforce morale.  Management  Determine Risk Exposure Develop Action Plans and Fallback
 Resource capabilities such as  Plot on Risk Matrix Plans (Thresholds & Triggers)
 Engineering  Qualitative/Quantitative Escalate Risk to Higher Board/Panel
people, systems, processes
and capital.  Manufacture Analysis Recommend Elevating Risk to
 Supportability Higher Board/Panel
 Safety
 Software
 Operations
 Programmatic

RISK COMMUNICATION &

DOCUMENTATION

Enter Risk, Analysis, &

Handling/Action Data into the Risk
Information Management System

Report Status

Internal & External

Figure 2 – 1 Risk Management Functions

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 26 of 105

2.2 Risk Management Integration

The Pan Borneo Highway Project Risk Management philosophy defines a multi-layer approach
for risk management that allows the various departments within Lebuhraya Borneo Utara
Sdn. Bhd., the Project Delivery Partner organizations, the Working Committees, the Project
Management Team, the Design & Construction Management Teams, Consultants, Work
Package contractors, teams and associated groups, to retain authority and control over risks
for their areas of responsibility while supporting existing management and decision making
processes.

Project risks will be identified addressing technical, cost, and schedule impacts related to the:

 Successful design, development and handover of the Pan Borneo Highway;

 Activities and resources including staff, contractors, and facilities, of the various affiliated
and/or non-affiliated implementation organizations that may enter into partnership with
LBU in support of the Pan Borneo Highway project.

Risks managed by affiliated and/or non-affiliated organizations are considered within the
purview of LBU’s Risk Management team and will be tracked within the Pan Borneo Highway
Project Risk Management process. Responsibilities and actions to resolve joint risks will be
conducted in concert with the respective managing organizations, in accordance with existing
agreements and/or contractor requirements.

Figure 2-2 depict the integrated risk management process flow describing the risk information
flow between the LBU’s Project Risk Management Team (PRMT) and the individual Work
Package Construction Management Team (CMT). This team shall be led by the CMT’s Project
Manager. The risk management process has two tiers: LBU’s overall Strategic Risks and the
Work Package Risks (Referred to as “Contractors’ Risks”). This integrated approach ensures
that risks are identified, evaluated, and managed from an end-to-end system perspective
through the project’s life-cycle. The continuous risk management process has inherent
interrelationships with schedule, financial, Earned Value Management (EVM), and other
business reporting systems.

Contractors’ risks must be submitted to the respective CMT Project Manager. These risks are
those risks that significantly impact the individual Work Package objectives affecting the
different parameters that poses a threat to key milestones such as work package completion
dates or other key integration dates, or that require substantial resources. Similarly, the
Contractors’ risks shall be submitted to LBU’s PRMT by the CMT’s Project Manager. The
Contractors’ Risk will be integrated into the Strategic Risk Register and represent risks that
significantly impact either the overall Pan Borneo Highway Project objectives affecting the
different parameters that poses a threat to key milestones such as the overall project
completion date or other key integration dates, or that require substantial resources.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 27 of 105

The Risk Management process also provides options for reevaluating and updating risk
handling/actions, planning, tracking, and other activities of the Risk Management process.
The primary methods for modifying Risk Management implementation will be through the
periodic updates to this plan and through inputs to the PRMT.

2.3 Risk Based Decision-Making

The overall risk management has been expanded to include Risk-Based Decision Making
(RBDM) in concert with the CRM process. The RIDM process supports decision-making at each
management level tier using available quantitative and qualitative risk information.

Figure 2 – 3 shows LBU’s RBDM process flow that will be effected for this project.

COMMUNICATION

DECISION RISK RISK IMPACT

STRUCTURE ASSESSMENT MANAGEMENT ASSESSMENT

SAFEGUARD FAILURES

HAZARDS

INCIDENTS ACCIDENTS CONSEQUENCES EFFECTS

CAUSES
EXTERNAL INFLUENCES

Figure 2 – 3 LBU’s RBDM Process

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 28 of 105

STRATEGIC & CONTRACTORS’ PLANNING RISK MANAGEMENT PROCESS RISK INFORMATION MANAGEMENT SYSTEM
PROCESS

Changes Captured and Updated.

All changes cascaded down

LBU’S
STRATEGIC RISK
STRATEGIC
OBJECTIVES &
REGISTER
INDICATORS

Escalated Up
Aligned & Aligned & & RISK INFORMATION
Cascaded Cascaded Changes Consolidated MANAGEMENT SYSTEM
Down Down Captured &
Updated

CONTRACTORS’
(WORK CONTRACTORS’
PACKAGE) RISK REGISTERS
OBJECTIVES &
INDICATORS

Figure 2 – 2 Integrated Risk Management

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 29 of 105

3.0 Roles and Responsibilities

The key roles in risk management, and their major responsibilities are:

Senior management, who must promulgate organizational risk management policy, actively
support the risk management actions required for the project and ensure that all project
stakeholders and participants support those actions. The extent of their routine involvement
in a particular project will depend on the project‘s characteristics.

Sponsor, is responsible for:

 ensuring that adequate resources are available to manage the project‘s risks;
 ensuring there is active participation in the risk management process by a wide
cross section of stakeholders in the project;
 ensuring that risks that affect the project from outside the project‘s
boundary are managed; and
 monitoring and reporting the progress and effectiveness of the risk treatments.

Project Manager/Director, heads the project team and is assigned the authority and
responsibility for meeting the project objectives including the overall management of risks
within the project.

Risk Owners, have the overall responsibility and authority for treating the identified risks.
Within the project team they would be work package managers but risks to the in-service
system may belong to the business unit owning the system. Risk owners must have the
resources necessary to treat their risks. Risk owners are also assigned to monitor risks that
are not being treated.

Risk Manager, the person in the project with the overall responsibility, accountability and
authority for ensuring that the risk management process is applied effectively, including:

 driving and managing all aspects of the risk management process;

 ensuring all risks have an appropriate owner;
 maintaining the risk register, a template is included at Appendix 4;
 ensuring appropriately frequent risk reviews to identify new or changing risks;
 continually monitoring the cost-effectiveness and practicability of the risk
treatments;
 preparation of regular risk reports in accordance with the risk management
plan; and
 seeking and implementing continuous improvement to the risk management
process and sharing lessons with other projects and stakeholders.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 30 of 105

Client’s Representatives, must assist with the identification, analysis and evaluation of risks
and support the implementation of the selected risk treatments.

Project Team Members, are responsible for:

 assisting with the identification, analysis and evaluation of risks;

 assisting with the development of risk treatments; and
 risk management activities as set out in the risk treatments.

The following table discusses the roles and responsibilities of the various personnel involved
in the risk management of the project at Work Package level:

ROLES RESPONSIBILITIES
Head of Risk Management  Manage the implementation of all aspects of the risk
function, including implementation of processes, tools and
systems to identify, assess, measure, manage, monitor and
report risks.
 Assist in the development of and manage processes to
identify and evaluate risk and control self-assessments.
 Manage the process for developing risk policies and
procedures, risk limits and approval authorities.
 Monitor major and critical risk issues.
 Manage the process for elevating control risks to more senior
levels when appropriate.
 Manage the corporate risk and control assessment reporting
process as well as manage and maintain infrastructure
elements (e.g. management reporting, including reporting to
senior management).
 Be leaders in developing and improving management
reporting.
 Generate project management documents.
 Prepare high-level user requirements to assist in preparation
of Project Initiation Documents.
 Conduct compliance & risk assessments.
 Ensure the program is effectively integrated into project
implementation and delivery methodology.
Risk Manager  Facilitate risk identification activities
 Facilitate the communication throughout the risk process
 Report on risk management
 Ensure the risk spreadsheet is maintained
 Provide the Project Manager with recommendations and
status of risks
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 31 of 105

ROLES RESPONSIBILITIES
Risk Coordinator(s)/ Risk  Participate in Risk Meetings and reviews as required
Management Team  Provide expertise to project as necessary
 Assist in determining probability, impact, and timeframe
 Advise on the accuracy and completeness of information
in their area of expertise
Project Manager  Participate in the Risk Management Process
 Make control decisions (analyze, decide, execute for top
project risks
 Assign and change responsibility for risks and mitigation
plans within the project
 Authorize resources for mitigation/contingency planning
execution
 Coordinate communication with construction tasks
managers
 Review general risk measures/metrics with Risk
Management Team & consultants
 Escalate as required any risk
 Ultimately responsible for the final decisions on risk actions
Project Management  Attend Risk Meetings as required
Team (includes CMT, ICE)  Identify and assist to classify new risks
 Assist in determining probability, impact, and time frame
 Recommend approach and actions
 Prioritize identified risks
 Consult with Subject Matter Experts when necessary
Steering Committee(s)  Review and adopt or reject risk response strategy as
recommended by the Risk Management Team and/or Project
Manager
Risk Owners  Attend Risk Meetings as required
(WPC Contractors,  Map each high and medium risk to their WBS element(s)
functional support that will need to include response activities for that risk
departments)  Determine the probability, impact and exposure rating of
their identified risks
 Ensure accuracy of probability/impact/timeframe estimates
 Decide on the best response to each high risk: the 4Ts
 Include specific activities to address the identified risks as
part of their plans for producing the WBS element
 Report the results of the analysis back to the Risk manager
using the appropriate Forms provided
 Responsible for implementing individual risk response plans
 Report progress to Risk manager on an agreed upon
timeframe
 Consult with Risk Management Team when necessary
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 32 of 105

ROLES RESPONSIBILITIES
Independent Project  Participate in Risk Meetings and reviews as required
Oversight Consultant(s)  Perform their own risk identifications
 Provide Oversight of the project and report to external
stakeholders
 Submit status report to the relevant parties as required.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 33 of 105

4.0 Risk Management Process Details

1. Establish the
Context

6. Monitor report,
2. Identify and
update and
define risks
manage risk

RISK
MANAGEMENT
PLANNING

5. Develop and
3. Conduct Risk
implement risk
Analysis
treatments

4. Conduct Risk
Evaluation

Figure 4 – 1 LBU’s Risk Management Process

LBU’s project risk management process is summarized in the following steps.

Risk Management Planning – Prior to the initiation of risk management, activities in the
proposed baseline (scope, schedule and cost) are evaluated to determine their potential for
risk. This evaluation (or risk screening) assesses all activities against a set of screening
categories typically in the areas of design, planning, procurement, external interface,
construction, safety, regulatory and environmental, etc. Activities which are identified as
project risks will be tracked within LBU’s Risk Management Plan.

Establishing the Context - Establishing the context defines the scope for the risk management
process and sets the criteria against which the risks will be assessed. The scope should be
determined within the context of the firm's organizational objectives. Risks are uncertainties
that affect the achievement of business objectives, so risks cannot fully be identified if these
objectives and strategies are unclear.

Risk Identification – Identify risks that may impact the successful completion of the project.
Risks are identified for the entire life cycle of the project. Risks associated with project work
scope, cost and schedule are identified by systematically challenging the assumptions, logic
and scope of the project and examining the identified uncertainties associated with each
stage of the project.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 34 of 105

Risk Assessment – Assess the risks to determine their likelihood and impact on the project’s
cost, schedule and/or scope. This includes a qualitative and quantitative assessment of the
consequences (impact) of risks as well as the probability of the risks occurring.

Risk Treatment/Handling – Determine the risk handling strategy, whether, in order of

preference, the risk is accepted, mitigated, transferred or avoided.

Risk Management Impact and Control Actions – Assesses the risk impact on the project and
the effect of the risk treatment/handling strategies. Risk treatment/handling strategies will be
reflected in the project’s baseline, whereas residual risks will be reflected in the project
contingency.

Risk Reporting and Tracking – Risk reporting and tracking is the documentation of the risk
management process.

Risk management is an iterative process in which the effectiveness of control actions is

constantly evaluated, new risks are discovered, and existing risks are re-assessed. New or
revised control actions are implemented as needed. By managing risks, the process helps
minimize cost impact, schedule delays or the impact of other issue(s) that could impede the
project’s progress. The iterative process continues until all the risks are closed or the project
is completed.

4.1 Risk Management Process

This section provides the details on the RM process. The Pan Borneo Highway Project Risk
Management will incorporate a web-based Risk Management Information System (RMIS,
based on Oracle’s Primavera P6 Unifier and Enterprise Project Portfolio Management
platform) to compile and track risk data gathered from all the different Work Packages as well
as functional departments. All project team members are encouraged to use the RMIS to track
risks for their work package or function.

The Pan Borneo Highway Project, project organizations, contractors and other affiliated
organizations shall identify the risks in their respective areas and implement mitigation
strategies (corrective actions, action plans, mitigation plans, fall-back plans, etc.) to control
these risks. Periodically the risks for each of these organizations shall be reported to the
Risk Management Team, combined with other identified risks as applicable, and further
prioritized to generate the top risks for the overall Pan Borneo Highway Project. Only a
selected number of risks for the overall Pan Borneo Highway Project shall have additional
resources expended for mitigation. The remaining risks shall be monitored and managed
within established project constraints. The status of all identified risks, however, will continue
to be tracked with appropriate re-evaluation initiated if required.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 35 of 105

The Pan Borneo Highway Project Risk Management process has established a spectrum of
progressively increasing levels of documentation associated with identifying, tracking, and
reporting on potential concerns, identified risks, and issues.

The initial or lowest-level items that lack definition or are too far "over the horizon" are labeled
"concerns." These include "worries" or potential risks. These items represent a credible
uncertainty but lack details or maturity. An individual, team, or group may identify a concern
to one or more of the organization's goals. Pertinent information about the concern is
collected and documented that allows appropriate personnel to understand the concern and
to evaluate the details to qualify/quantify the potential risk.

As more details are developed these items, candidate or proposed risks, are considered for
adjudication by the cognizant review body. Once sanctioned or validated as "risk" these items
are tracked and managed by the appropriate risk management board.

The highest level items are defined as "issues". These are items include new problems that have
arisen or risks that have been realized. Each level represents greater likelihood of occurring
and requires higher levels of authorizations and scrutiny, see Figure 4 – 2.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 36 of 105

ISSUES

Realized
Project Management
Status

Increasing levels of scrutiny & likelihood

RISKS
High Level
Risks
escalation

Likely
Low & Mid
Level Risks
reviews
CANDIDATES

CONCERNS

Possible

Individuals, Teams & Working Groups meetings

Figure 4 – 2 Concerns, Risks and Issues Information Flow

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 37 of 105

4.2 Establishing The Context

Figure 4 – 3 shows the risk context that was established for the Pan Borneo Highway Project.

LBU has identified the following Risk Breakdown Structure (RBS) for the Pan Borneo Highway
Project:

RBS LEVEL 1 RBS LEVEL 2 RBS LEVEL 3

Project Risk Political Risks Legal & Regulatory Risks
Political Interference Risks
Sovereign Default Risks
Supply Chain Disruption Risks
Business Bureaucracy Risks
Banking Sector Risks
Sovereign Fiscal Risks
Cultural Change Risks
Scope Risks Planning Risks
Resource Allocation Risks
Organizational Risks
Schedule Risks
Schedule Risks Risks of Delay
Risks of Dependencies
Risks of Estimates
Scope Change Risks
Financial Risks Capital Availability Risks
Liquidity Risks
Default Risks
Risk of Estimates
Contractual Risks Pure & Particular Risks
Fundamental Risks
Speculative Risks
Governance Risks
Resource Allocation Risks
Productivity Risks
Suppliers/Vendors Risks
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 38 of 105

RBS LEVEL 1 RBS LEVEL 2 RBS LEVEL 3

Project Risk Quality Risks Operational Risks
Governance Risks
Resource Allocation Risks
Productivity Risks
Suppliers/Vendors Risks
Communication Risks Confidentiality/Access Risks
Integrity Risks
Governance Risks
Other Resources Risks Operational Risks
Governance Risks
Resource Allocation Risks
Productivity Risks
Suppliers/Vendors Risks
Technical Risks Planning Risks
Governance Risks
Resource Allocation Risks
Organizational Risks
Schedule Risks
Productivity Risks
Suppliers/Vendors Risks
Risks of Delay
Risks of Dependencies
Risks of Estimates
Scope Change Risks
Environmental Risks Legal & Regulatory Risks
Cultural Change Risks
Organizational Risks
Governance Risks
Suppliers’ Risks Operational Risks
Governance Risks
Resource Allocation Risks
Productivity Risks
Suppliers/Vendors Risks
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 39 of 105

RBS LEVEL 1 RBS LEVEL 2 RBS LEVEL 3

Project Risk Industrial Relations Risks Operational Risks
Legal & Regulatory Risks
Governance Risks
Resource Allocation Risks
Productivity Risks
Suppliers/Vendors Risks
Pure and Particular Risks
Fundamental Risks
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 40 of 105

LBU’s Context : Why Risk Management is relevant? Role definition : Who does what? Objectives: How can Risk Management help? Outcomes : What can Risk Management achieve?

LBU seeks to support its people doing their

jobs while balancing the strategic & Evidence & Assurance – A formalized Sensible
operational objectives, long-term handling
and structured risk management and
sustainability, external demands and various of
LBU as an organization accountabilities it faces consistent processes and approach
RISK problems
helps to demonstrate that decision Increased
1. Operates in a context, sector and society making is effective. MANAGEMENT stakeholder
which is: confidence
 Challenging and changing Responsible for particular
Standardized reporting - Making it ENHANCES
aspects of LBU’s operating
 Competitive (funding & resources) easier to keep track of risks, their
environment
 Constantly being scrutinized; and
associated controls and treatments and  Good Improved
 With expectations to lead by example
2. Has high expectations and best practice to monitor progress over time governance Accountability
standards placed on us by the Federal and Responsible for organization-  Reputation
Improved decision-making - Applying
State governments and agencies and the wide strategic & operational  Communication
community, or imposed by external regulators, issues a commonsense approach to risk Measured
 Reliability
funding bodies and other project delivery Executive management will help to better inform risk taking
partners decision-making processes, improve  Decision-making
Managers Sometimes
3. This complex environment and diverse wear both forward planning, lead to more  Ability &
Managing work
activities requires active monitoring and hats confidence
package sites & meaningful strategic and operational
adaptation both by the organization and within
operational issues planning and encourage critical
the organization (through the staff)
4. Ambitious goals and targets increase the thinking in formulating new activities.
pressure on the organization. EFFECTIVE RISK MANAGEMENT
Responsible for Formulate more convincing and better
activities within
their WPCs
substantiated proposals – A risk
assessment must accompany plans or
propositions, new activities or RISK
LBU as the Project Delivery Partner Performing duties initiatives. MANAGEMENT
in their WPCs Better
Practical approach to deal with REDUCES informed
1. Tight budgets make resourcing activities a Project decisions
problems or issues – by identifying
complex balancing acts. Managers Trying to help and what could threaten the achievement  Hasty, rash or
Efficient
2. Increasing audit, monitoring and reporting facilitate others in their poorly
WPC do their duties
of the overall objectives so that time allocation
functions requires diligence, coordination and considered
and resources can be more effectively of resources
good business practices decisions
3. Real and increasing exposure to personal legal allocated to address those concerns.
 Uncertainty
liability for managers at all levels, as regulators
seek to hold managers accountable for
Better manage activities where  Inconsistency
adverse events may arise. Maximized
compliance issues under their direction or  Procrastination
opportunities
control Learn from previous mistakes.  Adverse events
Staff or negative
Performing their consequences Everyone
duties  Embarrassment taking
or discredit from responsibility
poor outcomes for risk

Figure 4 – 3 – Risk Management From LBU’s Context

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 41 of 105

4.3 Risk Identification

Risk Identification is the process of determining those risks that might affect the project and
its outcome. When a risk and its characteristics are identified and documented, then a
response to the risk can be planned, and it can be monitored.

Risk identification is an iterative, on-going task throughout the project lifecycle. It consists of
a formal and an informal approach

4.3.1 Formal Risk Identification

The Risk Manager is responsible for conducting formal risk identification activities.
The Risk Manager stays apprised of the progress of the project, and communicates
with project team members to specifically identify risk. The Project Status Meetings
is the primary forum for the formal discussion of risk. The Risk Manager conducts
Risk Management team meetings as necessary to formally identify and track project
risk.

4.3.2 Informal Risk Identification

Informal risk identification occurs as a result of normal project business. Any person
associated with the project including consultants, work package contractor staff,
sponsor representatives, stakeholders and project delivery partners is expected to
identify and document a candidate risk as per Section 4.3.3

4.3.3 Initiating and Documenting of the Candidate Risk

The “Risk Identification and Response Plan” form in Appendix A is used to document
risk in the Pan Borneo Highway project. The identification of a risk is initiated by
documenting what is known about the specific risk in the top three rows of the form.
The description of the risk clearly indicates the concern, likelihood (if known), and the
possible consequences. The description may also include assumptions, constraints
and relationship to other project risks, issues or activities, and potential impacts to
the project budget, schedule, quality, or stakeholders.

The initiator submits the form to the Risk Manager. The Risk Manager and the
initiator ensure that the initiating information is complete. The Risk Manager assigns
a unique identifier, and inputs the information into the risk spreadsheet which is then
cascaded down to the relevant WPC PM.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 42 of 105

4.3.4 Validating the Candidate Risk

The Risk Manager is responsible for coordinating the review and validation of the
candidate risks. The Risk Manager relies on expert judgment in the project
management team to assess the candidate risk and determine if any concern or action
is warranted. This may include a risk review meeting with a Subject Matter Expert
(SME- i.e. consultant or whomever may best be suited to help identify the risk and all
its associated aspects) if more expertise is needed for proper assessment (See Section
4.3.6).

If a candidate risk is determined to be invalid, the risk is retired. If a candidate risk is

determined to be valid, the risk is assigned to a Risk Owner.

4.3.5 Assignment of the Risk to a Risk Owner

When a risk is deemed valid, the Project Manager will assign the risk to a Risk Owner.
The Risk Owner could either be an LBU Project Management Team Member or the
Work Package Contractor Team Member assigned to monitor, track and prepare a
response for an identified risk.

The Risk Manager will supply the previously initiated Risk Identification & Response
Plan form (see Section 4.3.4) to the Risk Owner for completion according to Sections
4.4, 4.5 and 4.6 of this plan. The Risk Manager and the Risk Owner will ensure that the
information on the form is complete and accurate.

4.3.6 Subject Matter Expert (SME) in Risk Management

When necessary, the Risk Owner and/or the Risk Manager will enlist SME(s) to assist
in risk identification.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 43 of 105

Step 1 – LBU Pan Borneo Highway Project’s Risk Identification (Section 4.3)
Person(s) Associated
with the Project

“Candidate” Risk ID
(Risk Submittal Form
Start
& Optional Risk
Response Action

Update the Risk

Candidate Register with the
Risk Register
Risk ID Input Result of Risk
Complete? Identification Review
Retire. Update Risk
Risk Manager

Meeting
Register

Meet with Risk Owner

Enter the Candidate Review & Validate
Is the Risk to Clarify Risk
Risk Information into the Candidate Risk
Candidate Identification and
the Risk Register (May require
valid? Hand off Risk ID and
assistance of SME)
Response Plan Forms
Manager

RM & PM Review Risk

Project

Identifications. PM
assigns the Risk to Risk Go to Figure
4-5
Owner

Figure 4 – 4 Risk Identification Process Flow

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 44 of 105

4.4 Risk Assessment

Analysis of the risk is necessary so that a proper response to the risk can be planned and
implemented. The risk description and primary risk areas as identified by the initiator on the
Risk ID form indicate to the Risk Owner the WBS elements in which the project team can take
steps to respond to the risk. The Risk Owner can enlist other team members or SME to assist
in identifying those WBS elements in which avoidance, mitigation, or transfer of the risk can
take place. Additionally, the characteristics of the risk will also help place it in the time frame
of the project lifecycle.

Using the tools provided in the Risk Probability Ranking Tables (see Appendix B), identified
risks are assigned a prioritized ranking based on the probability and impact as outlined in this
section. The results are recorded on the Risk Identification & Response Plan form in the
appropriate boxes by the Risk Owner, and entered and updated in the Project Risk
Spreadsheet which comprises of a Risk Register, Risk Tracking Log and Issue Tracking Log by
the Risk Manager.

4.4.1 Risk Probability Ranking

A current estimate will be performed based on professional judgment and past

experience for the probability (in percent) that the risk will occur over the impact time
frame given. This value can change over time as the risk is actively managed.

Probability % Probability
Designation Description
Rating Range
Occurrence is very unlikely and is
1 < 12% Rarely to happen generally controlled by following existing
processes, procedures, and plans.
Occurrence is unlikely and may be
Unlikely will
2 13% - 30% entirely controlled by following existing
happen
processes, procedures, and plans.
Occurrence is likely and may not be
3 31% - 70% Possible to occur entirely controlled by following existing
processes, procedures, and plans
Occurrence is most likely and may not be
4 71% - 90% Likely to occur entirely controlled by following existing
processes, procedures, and plans.
Occurrence is very likely and may not be
Almost Certain to
5 > 91% controlled by following existing
happen
processes, procedures, and plans.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 45 of 105

4.4.2 Impact Analysis

Risk will be analyzed for the impact on the project if it materializes.

The Impact Analysis for the Pan Borneo Highway project based on the Risk Type
categorization is as shown in ANNEX 1.

4.4.3 Impact Time Frame

The earliest and latest WBS elements that the risk could impact will be recorded on
the Risk Identification and Response Plan form to determine the risk impact time
frame. These identified WBS elements will be used to define the period of time the
risk is managed.

4.4.4 Review Risk Analysis and Ranking

The Risk Manager presents the risk analysis for discussion at the project management
team meetings on a bi-weekly basis or as and when required. At this time the impacts
and possible mitigation/contingency options are discussed, and the risk’s exposure is
assessed. The project team then reviews the risk for its relative rank among existing
risks and reviews the risk in combination with other risks (for example, with other
risks in a similar functional area or risks with similar impacts). The team may
recommend to the Risk Owner or Project Manager to adjust the response plans or
other project priorities to ensure the risk is adequately addressed.

4.4.5 Update Project Risk Spreadsheet with Team/Management Comment

After the team and/ or management review, the Risk Manager updates the Project
Risk Spreadsheet with any comments, and documents the next steps for the risk (if
any). If the management team changed the ranking of the risks, the Risk Manager
updates the Project Risk Spreadsheet to reflect current priorities and concerns.

4.4.6 Subject Matter Expert (SME) in Risk Management

When necessary, the Risk Owner and/or the Risk Manager will enlist SME(s) to assist
in risk analysis.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 46 of 105

Step 2 – LBU Pan Borneo Highway Project Risk Assessment (Section 4.4)

Go to
Risk Owner

From Rank the Assign the Calculate Assign Figure 4 - 7

Figure 4 - 4 Risk Impact the Risk Impact
Probability Score Exposure Timeframe
Risk Manager

Review Risk Update the Risk Assess and

Analysis with Risk Present Active
Register with Risk Implement Team’s
Owner; Assess Risks at Project
Analysis Risk Register Recommendations
need for Response Team Meetings
Information with Risk Owner
Planning
Project Manager

Review Active
Risks & Make
Recommendations
if Necessary

Figure 4 – 5 Project Risk Analysis Process Flow

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 47 of 105

4.5 Risk Response Planning

Those risks with an exposure rating of more than 12, or in a condition of great change, will
have a Risk Response Plan prepared to reduce the threat to project objectives.

4.5.1 Risk Response Plan

The following information is verified and documented in the Risk Identification &
Response Plan form (See Appendix A) by the Risk Owner and then entered into the
Project Risk Spreadsheet by the Risk Manager.

 Verify the Risk Description as described by the Initiator of the risk; clarify if
necessary

 Verify the primary risk area (cost/scope/schedule) as described by the

Initiator; clarify if necessary

 The WBS element(s) in which the Department will respond to the risk

 A probability, impact, and exposure rating. (See Section 4.4)

 The Risk Response Type (See Section 4.5.2)

 Impact time frame in which the risk may occur. (See section 4.4.3)

 Risk Response description to describe the approach or other background

efforts

 Contingency Plan Trigger under which the contingency plan will be

implemented

 Contingency plan, if a contingency plan is part of the response, the actions

that will be taken and by whom

 The current status of the risk

 The impact on the Critical Path

 Whether the control of the risk is internal, external, or internal/external to

the project
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 48 of 105

4.5.2 Tools and Techniques for Risk Response

Both Opportunities and Threats will be considered by LBU for this project. The basic
techniques for risk response is shown in Figure 4 – 6.

OPPORTUNITIES

EXPLOIT SHARE ENHANCE IGNORE

ELIMINATE ALLOCATE MODIFY ABSORB IN

UNCERTAINTY OWNERSHIP EXPOSURE BASELINE

AVOID TRANSFER MITIGATE ACCEPT

THREATS

Figure 4 – 6 Risk Response Strategies

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 49 of 105

The standard risk response strategies will be used on this project:

Avoidance – Reducing scope, changing the project plan, adding resources or time,
adopting a familiar approach instead of an innovative one, or avoiding an
inexperienced contractor may be example of avoidance that this project will use.

Transference- Shifting the consequence of a risk to a third party with the

responsibility for its management via contracts, performance bonds, warranty.

Mitigation – Involves taking early action to reduce the probability and /or
consequences of a risk event to an acceptable level of impact to cost, scope or
schedule.

Acceptance- This technique indicates that the project team has decided not to
change the project plan to deal with a risk or is unable to identify any other suitable
response strategy. Acceptance requires no action leaving the project team to deal
with the risk as it occurs.

4.5.3 Risk Response Description

If the response is not to accept the risk, then the conditions that will reduce or
eliminate the effects of the risk are developed by the Risk Owner and documented
on the Risk Identification and Response Plan form in the Risk Response Description
field. This response may be preventative, or may lessen the probability or impact of
the risk should it occur. The Risk Owner may require the assistance of the team, or of
SME to develop an appropriate Risk Response Description.

4.5.4 Contingency Thresholds/Triggers (Trend Alerts)

A contingency threshold or trigger is an indication that a change in the risk exposure

has occurred (a change in the probability and/or the impact) and that the risk event
has a greater potential to adversely affect the project. The trigger should be specific
and defined well enough to be tracked and to remove the uncertainty that the risk
event is occurring or is imminent. The Risk Owner documents the defining criteria of
the trigger on the Risk Identification and Response Plan. When this defined criteria is
reached, a contingency plan is implemented to respond to the risk.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 50 of 105

4.5.5 Contingency Plan

A contingency plan will be applied to risks that are imminent or are occurring. The
contingency plan describes what actions are to be taken by whom and in what order
to effectively respond to the negative circumstances or events. The contingency plan
also gives the initial recommended actions to be taken in the Issue Management
process when a risk event occurs and the risk becomes an issue.

4.5.6 Review Risk Response Plan

The Risk Owner and the Risk Manager will review the risk response plans at their
discretion and significant developments will be discussed at the regular status
meetings. A risk team will periodically review the plans, trigger events, and
measurements for tracking effectiveness to ensure they are feasible and appropriate
for the severity and ranking of the risk. The team may propose additional actions or
changes to the response plans before their implementation.

4.5.7 Update Risk Register & Risk Management Documentation

The Risk Owner provides status updates to the Risk Manager who updates the
project risk spreadsheet to reflect the actions being taken and document completion
of risk response plan tasks. In some cases, the actions also may be tracked in the
project work plan to ensure appropriate visibility. Response plan activities and their
effectiveness are reported in the regular status meetings.

4.5.8 Subject Matter Expert (SME) in Risk Response

When necessary, the Risk Owner and/or the Risk Manager will enlist SME(s) to assist
in risk response.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 51 of 105

Step 3 – LBU’s Pan Borneo Highway Project Risk Response Planning (Section 4.5)
Risk Owner

From Verify Info on Select Risk Develop & Identify Develop

Figure 4 - 5 Risk ID & Response Document the Contingency Contingency
Response Plan Technique Risk Response Threshold/ Plans
Form Triggers
Risk Manager

Review the Risk Submit to the Update the Risk Assess &
Response Plan Project Team for Register with the Risk Register Implement Team
Review & Response Plan Recommendations
with Risk Owner
Recommendations with Risk Owner
Project Team

Review Active Go to
Risks & Make Figure 4 - 8
Recommendations
if necessary

Figure 4- 7 – LBU Risk Response Planning

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 52 of 105

4.6 Risk Monitoring and Control

Risk tracking and control follows the progress of the risk and its probability, as well as the
status of any mitigation/contingency strategies that have been executed. When changes to
the risk profile occur, as in residual risks or secondary risks, the risk management process is
repeated. The Revision History of a risk is documented and updated in the proper field of the
Risk Identification and Response Plan form including the date of the entry and a description
of any changes affecting the risk.

4.6.1 Monitor Changes to Risk Profiles & Response Plans

The Risk Owner monitors the assigned risk, notifies the Risk Manager whenever there
is a significant change to the risk’s profile, and makes recommendations to address
the changes in the response plans. Recommendations to improve the effectiveness
of the plans are discussed, as are whether the measures are providing the necessary
information to track the risk’s progress.

The deficiencies and proposed changes are discussed with the management team
and changes are approved or sent back for further analysis/development, as needed.
Changes to risk profiles also are discussed, both individually and across all risks. Risk
ranking and project priorities may be changed as a result. If a risk’s profile changes
such that its probability and/or impact drops below the project risk tolerances, the
risk may be a candidate for retirement or closure.

4.6.2 Report Risk Status

Risks when first identified have a status of ‘Open’. Once a response plan is developed,
the risk status changes to ‘Treat” (even if the WBS response element has not yet
occurred). Upon implementation of the proactive portion of the risk response plan,
or if the risk strategy is ‘Acceptance’, the risk status changes to ‘Close’ or ‘Close But
Monitor’. If project developments or the effectiveness of the response plan leads to
the modification of the risk response plan, the risk status reverts back to ‘Treat’ until
implementation of the updated risk response plan.

The Risk Owner is required to report significant developments to the project team at
the regular project team meetings or as required. The Risk Manager reviews the status
of risk activities periodically (at least monthly) with the Project Manager and the
project management team and discusses the effectiveness of the current response
plans. The Risk Manager updates the risk spreadsheet to reflect the current risk state.
At the discretion of the Risk Manager, or by the request of the Project Manager, Risk
Management team meetings may be called in the interim between status meetings.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 53 of 105

4.6.3 Monitor Trigger Events (Trend Alerts)

The Risk Owner has the primary responsibility for monitoring the trigger events
associated with mitigation/contingency actions. The Risk Manager assists with
tracking triggers and includes any significant development in the regular risk status
review in the regular status meetings.

4.6.4 Execute Contingency Plan(s)

When a trigger event occurs or is imminent, the Risk Owner:

 Implements the contingency portion of the response plan and notifies the
Risk/Project Manager of the plan execution.

 Notifies all parties identified in the response plan and ensures all activities are
coordinated.

 Takes the specific measurements to determine the effectiveness of the activities.

 If the activities are not producing the desired effect he/she notifies the Risk
Manager immediately and proposes changes to address the deficiencies.

 The Risk Manager will work with the Risk Owner to enhance or change the
response plan including taking the matter to the project team and SME(s).

 If the risk event occurs, the risk becomes an issue and an Issue Form will be sent
to the Risk Manager.

4.6.5 Retire/Close Risk(s)

Risks are closed when the risk event actually occurs or when the likelihood of the risk
is reduced such that it is not worth expending resources to track it. Response Plans
are halted and closed. If the risk could possibly arise again, the risk may be reduced to
a ’Close But Monitor’ status and evaluated as agreed upon by the Risk/Project
Manager and the Risk Owner. Any stakeholder may recommend a risk for retirement.

The Project Manager makes the final decision to retire a risk. If there is any
disagreement, the Risk Management Committee and/or Sponsor should be involved
in the decision to retire a risk.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 54 of 105

Step 4 – LBU’s Pan Borneo Highway Project Risk Monitoring & Control (Section 4.6)
No
Execute
Trigger Event Yes Contingency
Occurred? Plan; Change if
necessary
Risk Owner

Inform Risk
From Monitoring of Manager of
Report Risk
Figure 4 - 7 Risk Profile & Changes
Status
Trigger Events

Risk Profile Revise

Yes Response Plan,
Change?
if necessary

No

Update the Risk Produce Risk

Present Status
Register with Status Report &
Risk Register Report if
Changes/Action Present in
necessary
meetings
Risk Manager

Has Contingency Update Register Monitor Risk

Yes
Plan Trigger or initiate Issue Profiles & Trigger
Occurred? Management Events

No

Figure 4 – 8 LBU Project Risk Monitoring & Control

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 55 of 105

4.7 Risk Communication

Communications regarding risks are continuous throughout the project’s life cycle both
through verbal and written reports.

Meeting Type Frequency Audience Inputs Deliverables

Risk Workshop One per WPC CMT Risk associated New risk
PMT with the Work identification.
WPC Packages Specific activities
to address the
identified risks as
part of the plan for
producing each
WBS element.

Risk Management
Plan

Risk Register

Team/Coordination Regularly or as CMT Risk associated New risk

Meeting required PMT with the WBS identification.
elements that will Specific activities
be worked on to address the
during the duration identified risks as
part of the plan for
producing each
WBS element.

Risk Management Regularly or as Risk Management Adopt or reject risk Closure

Committee required Committee response strategies Authorization
Meeting

External Control As needed or External Control External Independent

Agencies (Auditors, required Agencies dependency Project Oversight
ICE, etc) mitigation Report
recommendations
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 56 of 105

4.7.1 Periodic Status Meeting

On a periodic basis, the Risk Manager solicits updates from the risk owners and
updates the project risk spreadsheet (Risk Registers, Risk Issues Logs, etc). Risk
management activities and the current log of active risks are discussed at project
team status meetings. This includes formal and informal identification and status of
individual risk activities and assignments. Current risk status and the results and
effectiveness of mitigation/contingency actions are reviewed, along with the status
of risk trigger events and risk profiles.

4.7.2 Revision History

Any action taken on a specific risk will be logged in the Revision History field on the
Risk Identification and Response Plan form, and will be logged in the risk spreadsheet
by the Risk Manager. This will serve as the repository of the life cycle documentation
of the risk activities. This will also serve for justifying specific actions that were taken
along with completing the lessons learned. The pertinent dates event or decision
made, the person(s) most knowledgeable about the event and a short description of
the event will be captured.

4.7.3 Report Lessons Learned On Risks

The Risk Manager documents the result of risk actions (whether successful or
unsuccessful) and lessons learned in the risk spreadsheet. At the end of the phase,
the Risk Manager discusses the results of the lessons learned sessions with the PM
and with others as appropriate. The Risk Manager leads a final risk review to
document the final status and results of mitigation and/or contingency actions to
identify lessons learned during the project.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 57 of 105

5.0 Risk Management and the WPC Contractor

5.1 Oversight of WPC Contractors’ Risks

The WPC contractor is required to produce a risk management plan, to populate and use a
project risk register, and to actively monitor and respond to risks.

Risk management on the Pan Borneo Highway project is a team effort. Cooperation between
LBU’s project team and the contractor is expected. If risk identified by the contractor is
significant, the project may open a corresponding risk within the project’s risk spreadsheet
and initiate its own mitigation/contingency actions to complement or supplement the
contractor’s risk response plans.

5.2 WPC Contractor Participation in Risk Management

The WPC contractor (and any subcontractors) is encouraged to participate in risk identification
for the overall project effort. Any concerns or questions regarding the project’s risk
management efforts are directed to the Risk Manager.

WPC contractor staff may be assigned as a risk owner and may assist with mitigation and
contingency actions, as appropriate.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 58 of 105

APPENDIX A – LBU Risk Identification & Response Plan Template

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 59 of 105

APPENDIX B – Framework For LBU’s Risk Management Plan

I. Risk Probability Rating

Based on the preliminary risk analysis undertaken by the Risk Management Department (Refer
to ANNEX I), the following Risk Probability Rating was established for the Pan Borneo Highway
project.

Probability Range
Rating (within a 12 months Rating Description
period)
1 Rarely < 12% May occur in exceptional circumstances
2 Unlikely 12% - 30% Could occur at some time
3 Possible 31% - 70% Might occur at some time
4 Likely 71% - 90% Will probably occur in most circumstances
5 Certain ˃ 90% Expected to occur in most circumstances

II. Impact Probability Rating

Rating Score Rating Description

I Insignificant 1 A risk event that, if it occurs will have little or no impact
on achieving outcome objectives.

II Minor 2 A risk event that, if it occurs, will have a minor impact on

achieving desired results, to the extent that one or more
stated outcome objectives will fall below goals but well
above the minimum acceptable levels.

III Moderate 3 A risk event that, if it occurs, will have a moderate impact
on achieving desired results, to the extent that one or
more stated outcome objectives will fall well below goals
but above minimum acceptable levels.

IV Significant 4 A risk event that, if it occurs, will have a significant

impact on achieving desired results, to the extent that
one or more outcome objectives fall below acceptable
levels.

V High 5 A risk event that, if it occurs, will have a severe impact on

achieving desired results, to the extent that one or more
of its critical outcome objectives will not be achieved.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 60 of 105

III. Overall Risk Rating and Project Risk Matrix

5 5 10 15 20 25

4 4 8 12 16 20
PROBABILITY

3 3 6 9 12 15

2 2 4 6 8 10

1 1 2 3 4 5

I II III IV V

IMPACT

The following definition has been agreed to categorize the overall risk rating:

Score Rating Recommended Action

16, 20 & 25 Extreme Immediate Action Required (Executive management)

10,12 & 15 High Executive Management attention required

5,6,8 & 9 Medium Management by specific reviewing and monitoring of

procedures (Managers)
1,2,3 & 4 Low Manage by routine procedures, unlikely to need specific
application of resources (managers and key staff)

The Work Package Contractors shall be required to follow this RISK MATRIX and RATING
SYSTEM.

IV. Consequence Ratings

The following section shows the consequence rating for all the risk categories identified for
the Pan Borneo Highway project. These consequence ratings are used as a benchmark for the
evaluation of all the identified risks.
 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 61 of 105

RISK IMPACT CRITERIA FOR POLITICAL RISKS

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 62 of 105

RISK IMPACT CRITERIA FOR SCOPE RISKS

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 63 of 105

RISK IMPACT CRITERIA FOR SCHEDULE RISKS

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 64 of 105

RISK IMPACT CRITERIA FOR FINANCIAL RISKS

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 65 of 105

RISK IMPACT CRITERIA FOR CONTRACTUAL RISKS

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 66 of 105

RISK IMPACT CRITERIA FOR QUALITY RISKS

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 67 of 105

RISK IMPACT CRITERIA FOR COMMUNICATION RISKS

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 68 of 105

RISK IMPACT CRITERIA FOR OTHER RESOURCES RISKS

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 69 of 105

RISK IMPACT CRITERIA FOR TECHNICAL RISKS

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 70 of 105

RISK IMPACT CRITERIA FOR ENVIRONMENTAL RISKS

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 71 of 105

RISK IMPACT CRITERIA FOR SUPPLIERS’ RISK

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 72 of 105

RISK IMPACT CRITERIA FOR INDUSTRIAL RELATIONS RISKS

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 73 of 105

RISK IMPACT CRITERIA FOR ORGANIZATIONAL RISKS

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 74 of 105

RISK IMPACT CRITERIA FOR CULTURAL AND SOCIETAL RISKS

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 75 of 105

RISK IMPACT CRITERIA FOR OCCUPATIONAL SAFETY & HEALTH RISKS

 Document No LBU – PMP – QACM – 001
Revision No 2
Revision Date AUGUST 2016
Page Page 76 of 105

RISK IMPACT CRITERIA FOR HUMAN RESOURCE RISKS

 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 77 of 105

APPENDIX C - GLOSSARY OF RISK MANAGEMENT TERMS

Consequence

The outcome of an event expressed qualitatively or quantitatively, being a loss, injury, disadvantage
or gain. There may be a range of possible outcomes associated with an event.

Control

Any action taken by management, the board, and other parties to manage risk and increase the
likelihood that established objectives and goals will be achieved.

Cost

Of activities, both direct and indirect, involving any negative impact, including money, time, labour,
disruption, and goodwill, political and intangible losses.

Contingency

Budget (cost benefit) or time (duration) that may be used in the event of a risk occurrence.

Event

An incident or situation, which occurs in a particular place during a particular interval of time.

Frequency

A measure of the rate of occurrence of an event expressed as the number of occurrences of their
event in a given time. See also Likelihood and Probability.

Hazard

A source of potential harm or a situation with a potential to cause loss.

Inherent limitations

Those limitations of all enterprise Risk Management Frameworks. The limitations relate to the limits
of human judgment; resource constraints and the need to consider the cost of controls in relation to
expected benefits; the reality that breakdowns can occur; and the possibility of management override
and collusion.
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 78 of 105

Inherent risk

High inherent risks that are well controlled may fall out of our field of view if only the residual risk is
assessed. The purpose of assessing inherent risk is to ensure that we maintain focus on compliance
with controls. The inherent risk should be considered in the absence of LBU added controls.

Likelihood

Used as a qualitative description of probability or frequency of a risk occurring.

Loss

Any negative consequence, financial or otherwise. Can be differentiated as follows;

 Maximum foreseeable loss- highest possible loss after considering controls
 Maximum possible loss – highest possible loss without considering controls

Monitor

To check, supervise, observe critically, or record the progress of an activity, action or system on a
regular basis in order to identify change.

Probability

The likelihood of a specific event or outcome, measured by the ratio of specific events or outcomes to
the total number of possible events or outcomes.

Reasonable assurance

The concept that enterprise risk management, no matter how well designed and operated, cannot
guarantee that an entity’s objectives will be met. This is because of inherent limitations in all Risk
Management Frameworks.

Residual risk

The remaining risk after management has taken action to alter the risk’s likelihood or consequence.

Risk

The possibility of an event occurring that will have an impact on the achievement of objectives. Risk is
measured in terms of consequence and likelihood.
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 79 of 105

Risk acceptance

An informed decision to accept the consequences and the likelihood of a particular risk.

Risk acceptance criteria

Management’s formal establishment of criteria or boundaries designed so that the residual risk does
not exceed the selected range of financial and operating outcomes.

Risk analysis

A systematic use of available information to determine how often specified events may occur and the
magnitude of their consequences.

Risk appetite

The level of risk that is acceptable to the board or management. This may be set for the organisation
as a whole, for different groups of risks or at an individual risk level.

Risk assessment

The overall process of risk analysis and risk evaluation.

Risk avoidance

An informed decision not to become involved in a risk situation.

Risk evaluation

The process used to determine risk management priorities by comparing the level of risk against
predetermined standards, target risk levels or other criteria.

Risk identification

The process of determining what can happen, why and how.

Risk Management Framework

The totality of the structures, methodology, procedures and definitions that an organisation has
chosen to use to implement its Risk Management Processes.
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 80 of 105

Risk Management Processes

Processes to identify, assess, manage, and control potential events or situations, to provide
reasonable assurance regarding the achievement of the organisation’s objectives.

Risk Plan / Register

The means by which an organisation elects to manage or treat the individual risks. The main categories
are to accept the risk; to mitigate it by reducing its consequence or likelihood; to transfer it to another
organisation or to avoid the activity creating it.

Risk Register / Risk Management Plan

The summary report of all individual risks within each assessment, which include; risk ratings
(inherent, residual and targeted), level of control, risk decision, risk owner and summary of key
controls and/or mitigating actions.

Stakeholders

Those people and organizations who may affect, be affected by, or perceive themselves to be affected
by, a decision or activity.
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 81 of 105

ANNEX I MANAGING & MITIGATING THE PAN BORNEO HIGHWAY PROJECT

RISKS

Introduction

Undertaking a project as large as the Pan Borneo Highway (PBH) project involves risk from both the entire project
and Work Packages-level perspectives. It is critical to identify, manage, and mitigate risks at each stage of the PBH
Project’s life cycle.

This section identifies high-level risks associated with the project's successful execution and a description of the
specific risk mitigation and management approach that the Authority is applying to each of those risks. In addition,
this chapter discusses general risk mitigation and allocation strategies, as well as the risk management plan being
administered by Lebuhraya Borneo Utara (LBU). In summary, this section provides the following:

Identification of key risks — This section discusses key project risks identified to date. Individual risks have been
consolidated into risk categories for presentation purposes. It is likely that additional risks will arise and may
become critical path items as the project moves forward to implementation and operation. The purpose of
identifying risks is to assess and understand them so that mitigation plans, risk allocation strategies, and risk
management processes can be applied in an appropriate manner.

Risk mitigation and allocation strategies — This section discusses initial risk mitigation strategies for the key risks.
Each risk is unique and is often linked to other risks; a tailored risk mitigation strategy is required to address them
proactively. In determining and implementing the most appropriate risk mitigation strategies, LBU has drawn
heavily on international precedent and lessons learned. These general approaches include procurement
contracting and delivery strategies with associated risk transfer.

Risk management plan and processes—This section discusses processes to manage and monitor risk throughout the
PBH project's life cycle. A key step in tailoring risk management processes is occurring as part of the risk management
plan process for delivery of the first construction segment of Phase 1.
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 82 of 105

Keyrisks

LBU has taken a number of steps to reduce and mitigate risk to the project. An overall risk management plan and
organization have been established, as described in the Risk Management Plan section. Foreseeable risks have been
identified that may threaten the project's viability; and the causes of each risk have been investigated to determine
the underlying driver and cause. This process is integral in guiding the risk assessment and analysis described in the
Risk Mitigation and Allocation Strategies section of this section. This process also helped in the identification of
the relevant and effective mitigation and management strategies described below. Discussed below are key high-
level project risks that have currently been identified. In addition, LBU has developed numerous tools to identify
and manage all foreseeable project risks in considerably more detail. It is not the purpose of this section to detail
all of the potential risks the project will face but rather to highlight key categories of risks.

Cost andschedule

Description

The current cost estimating system is based on static inputs, such as unit prices and inflation. Thus a risk exists that
projected costs and schedule could fluctuate as these underlying inputs are refined or change in world or regional
markets. Design for the PBH has been completed, and many cost and schedule updates and changes have been
incorporated to reflect more detailed design, environmental mitigation measures, and refined contingencies.
Although considered unlikely, the design for the project as a whole could change and, therefore, capital costs could
further change.

The schedule is tied directly to the availability of funding. While this has been discussed with a range of
stakeholders, the actual schedule will be different. In the event that funds are provided over longer periods of
time, capital costs likely will rise as a result of inflation.

Potential impact

The impact to the project could be wide ranging and include the following:

 Delay or inability to complete the project

 Increase in construction and operations costs
 Loss of stakeholder support
 Delay or inability to receive or keep funding
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 83 of 105

Mitigation and management approach

Realizing that increases to costs and schedule are a risk to the project, LBU has been heavily focused on managing
these risks and has implemented a variety of mitigation measures, including the following:

 Developing and implementing the PBH by breaking up the entire length of the highway in manageable Work
Package Sections.

 Procuring the Work Packages under contracts that transfer significant cost and schedule risk to the Work Package
contractor by including a number of terms and conditions in the construction packages for the PBH
Project that are designed to help ensure schedule and cost certainty. These proposed contract provisions
include limiting the situations in which change orders, increase to costs, and time extensions are allowed.
In addition, the contract stipulates that liquidated damages are payable to LBU in the event the Work
Package contractor cannot deliver the construction package by a certain date.

 Advancing the procurement for the initial construction segments of the PBH to take advantage of favorable
construction pricing, maintaining project schedule, and resolving issues before implementing the project-wide
development.

 Adopting an aggressive cost-management strategy for the entire system that leverages private- sector
delivery models that transfer risk of cost increases and schedule delay where appropriate. The contracting
methodologies that will be considered will have the ability to provide greater price certainty and
transfer the risk of cost and schedule overruns, contract interface, and performance of the PBH
system or its components to the Work Package contractor.

 Continuing to review and validate construction cost estimates, including the underlying cost (e.g., unit prices).

 Developing construction cost estimates based on a range of alternative alignments, underlying cost
assumptions, escalation factors, and implementation timing to understand impacts to the project's
commercial and financial viability.

 Continuing to incorporate value engineering to reduce overall project cost without compromising quality or
safety as engineering proceeds to the 30 percent design level.

 Developing a schedule for the entire project—and highly dependent—on funding availability.
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 84 of 105

Staffing and organizational structure

Description

Implementation of the PBH Project is a complex undertaking. The scale, size, and technical complexities necessitate
a robust internal project management team, complemented by external resources, with the specific skills and
expertise necessary to manage this unique project. For example, during the peak construction years, the annual
construction outlay will be several billion dollars. This volume of effort alone warrants attention on the size and
capabilities of LBU's staffing and organizational structure.

LBU has increased staffing and capacity, and expanded its organizational structure. This focus on increased staffing
will continue to be required to meet the future demands of the project. LBU supplements its internal staff with
full-time and part-time consultants with particular areas of expertise, including a Project Management Team
(PMT). As with many large-scale public works projects and projects, the PMT augments LBU staff in specific project-
related functions, such as planning, engineering and construction management, project administration, risk
management, and procurement/contract administration. Coordinated LBU staff augmentation using
consultants will continue to be critical for a project of this magnitude since it will be difficult for the state to have
ready access to the breadth and depth of expertise required and address the significant peaks and valleys in
workforce requirements inherent in the development, design, construction, and initial operation of the project
components.

Staff augmentation does not relieve the need to build LBU's management and support team as consultants are
not in a position to establish strategy and make management decisions on behalf of the state. LBU management
and staff, the PMT, other key LBU consultants and supporting agencies must coalesce into a seamless, integrated
structure for successful implementation of this project.

Potential impact

The impact to the project could be wide ranging and include the following:

Delay in critical management decision making

 Loss of stakeholder support
 Delay or inability to receive funding

 Delay or inability to complete the project

 Increase in construction and operations costs
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 85 of 105

Mitigation and management approach

LBU's Board of Directors has made this a priority and is working with staff to address key issues. LBU has
implemented and will continue to implement measures aimed at mitigating and managing risk related to staffing
and organizational structure. Some of these mitigation measures include the following:

 Soliciting candidates to fill open positions to lead major work streams.

 Engaging the PMT and other consultants to provide supplemental expertise in areas necessary to develop and
implement the project. An integrated organizational structure has been developed to support that
effort. In addition to the measures described above, LBU is pursuing the use of business and
commercial structures to transfer risks associated with certain administrative and management
functions during the construction and operation phases.

Approvals

Description

Delay in or inability to receive environmental approvals is a project risk. The approvals process for a project of this
size and nature are complex and involve a large number of agencies at the federal, state, and local levels.
Coordination both within and outside the LBU must be managed daily and is inextricably linked to staffing and
organizational structure risk.

The environmental approvals process also has implications for public support of the project as the public's reaction
is largely dependent on the transparency and quality of information disseminated during the environmental
approval process. In addition, there are many other permits and governmental approvals that must be secured
before beginning construction.

Potential impact

The impact to the project could be wide ranging and include the following:

 Loss of public funding and an increase to the amount of state funding required for the project

 Increase in costs associated with schedule delay

 Inability to secure necessary environmental clearances and approvals

 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 86 of 105

Mitigation and management approach

The LBU understands the risk related to the approvals process and is taking the requisite steps to mitigate this risk,
including the following:

 Increasing the LBU's internal staffing and soliciting individuals given the complicated nature and magnitude of
agencies involved in the approval processes. The risk of delay in or inability to obtain approvals is linked
to the internal management of these processes.

 Developing a planning schedule to evaluate funding needs .

 Continuing to coordinate with federal agencies to further the LBU's interagency collaboration efforts.

 Focusing on ensuring that the right-of-way acquisition and environmental approval processes are legally compliant
and aligned to project delivery schedules. In addition, the LBU continues to coordinate with the relevant
authorities to refine the ROW acquisition process with the objective of shortening the duration of time
necessary to acquire ROW.

 Pursuing a variety of methods in which to transfer risk related to approvals such as transferring the
responsibility (and risk) associated with securing other permits and governmental approvals to the Work
Package contractors.

Funding

Description

A number of risks exist related to funding. Failure to receive the anticipated amount of public funding at the
requisite time could threaten the pace of development and ultimately the viability of the full project. In
addition, the amount and timing of public funding impacts many other aspects of the project, including the
project schedule, phased implementation, staffing and management approach, and technical aspects.

Potential impact

The impact to the project could be wide ranging and include the following:

 Delay or inability to complete the project

 Significant increase to project costs
 Loss of stakeholder support
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 87 of 105

Mitigation and management approach

LBU acknowledges the risk associated with the receipt of public funding and has taken a number of steps to
mitigate and manage this risk. LBU's risk mitigation and management approach includes the following:

 Securing backup funding for certain aspects of the implementation plan.

 Developing the system in functional phases and placing completed sections into immediate service to help
mitigate the risk of funding delays by providing decision points for policy makers to determine how and
when the next steps should proceed while leaving a fully operational phase that generates socio-
economic benefits.

 Focusing on maintaining stakeholder support for the project.

 Performing a full economic analysis report, as well as technical reports, to demonstrate the need for public
funding for such an important project.

 Maintaining effective communication.

 Establishing a cash management strategy. to refine the cash management process associated with the
timely receipt of proceeds for project expenditures and the appropriate handling of federal
reimbursement payments.

FinancingforWorkPackageContractorsandSub-contractors

Description

While the project will require significant public funding, third-party financing is anticipated to be available once
the work packages have been awarded. The ability to finance the project, or a specific portion of the project, by
the WPC Contractors and sub-contractors is largely dependent upon the risks associated with their revenue source
used for repayment and the availability of significant amounts of capital in the market.
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 88 of 105

Potential impact

The impact to the project could be wide ranging and include the following:
 Delay or inability to complete the project
 Increase in the public funding required
 Re-scoping of project segments or contract approaches
 Loss of political support
 Increase in project costs

Mitigation and management approach

LBU understands the potential need for supplementary private financing to deliver the LBU project and has begun
mitigating and managing risk related to potential financing. LBU's risk mitigation and management approach
includes the following:

 Considering the use of delivery models that leverage private finance to help deliver elements of the project.

 Monitoring private-sector investor interest.

 Considering the use of innovative commercial mechanisms and that may help reduce any perceived risk of
payment associated with the underlying funding source.

 Working to align state stakeholders to help reduce the perceived risk associated with financing as lenders
carefully review the public sector's commitment to a project. Key to this confidence is continuity of support
to advance the LBU system. This also will help reduce the perceived risk associated with private financing
as lenders and financiers carefully evaluate public- sector partners prior to making investments.

 Continuing outreach and communication with potential private partners. LBU undertakes ongoing outreach
to the private sector to keep them updated as to the PBH project progress and to seek input to ensure the
project reflects and protects the future interest of private-sector participants. This will provide long-
term value to the state and other stakeholders.

Right-of-way

Description

Acquiring right-of-way (ROW) for a project of this nature is normally the responsibility of the Sarawak Land and
Survey Department. A risk exists with regard to the estimated cost and schedule of acquiring ROW. This is partly
because of opposition to certain alignments of the project and the schedule required to meet conditions of
federal funding sources.
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 89 of 105

Potential impact

The impact to the project could be wide ranging and include the following:

 Delay or inability to complete the project

 Increase in project costs
 Schedule delays
 Loss of political support
 Increase in the public funding required

Mitigation and management approach

LBU is working toward mitigating and managing the risk associated with ROW in a variety of ways, including the
following:

 Developing a ROW acquisition plan for the first few preliminary Work Packages that sets forth the parcels that
must be acquired and the timeline for acquisition and sharing this ROW acquisition plan with other
appropriate state agencies also will facilitate timely receipt of funding and completion of the relevant
government review and approval processes. The ROW acquisition plan will be released for review by all
contractors who have been prequalified to submit a proposal to participate in the Invitation to Bid (ITB)
exercise. The contractors must design and construct the work within the right-of-way limits set forth in
the ROW acquisition plan. In addition, each contractor must agree to the ROW acquisition plan before
submitting its proposal and certify that it is able to construct within the ROW acquisition plan.

 Structuring the contracts for all the Work Packages such that multiple notices to proceed can be issued as the
ROW is acquired. This will mitigate delay to one portion of the work as a result of delay in ROW acquisition
for a distinctly separate portion of the work.

 Continuing communications with the utility suppliers and other stakeholders that may hold shared ROW required
for the PBH alignment.

 Commissioning a peer review of ROW estimates and the use of a formal approval process after the review to
improve accuracy and accountability.

 Identifying ROW risk and uncertainty early in the process to focus design efforts that mitigate ROW cost and
setting a contingency amount that reflects these risks and uncertainties to allow for the appropriate
understanding and communication of estimate accuracy.

 Implementing ROW cost-control mechanisms founded on the baseline ROW cost estimate and
documentation supporting estimate updates to provide LBU with information to make timely decisions.
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 90 of 105

 Continuing cost control throughout the appraisal and acquisition process to monitor actual ROW expenditures
for comparing forecast ROW costs with the updated baseline budget.

Stakeholder agreements, interface, and integration

Description

Given the complex, multi-jurisdictional nature of this project, many interface agreements and integration risks
exist associated with both construction and operation activities. For example, a system integration and interface
risk exists related to the utility providers.

Important to the success of the project is its integration within a larger statewide transportation strategy. The
project must integrate with and support local transportation systems to allow travelers to move long distances
and then within urban/town areas to their destinations. LBU must be an active participant within the larger
statewide transportation planning structure.

Interface management is a LBU risk. In addition to integration and interface risks with other agencies and
entities, an integration risk related to the highway infrastructures also exists. Given the experiences of other
highway construction projects with transport-system integration risk, LBU is focused on mitigating and managing
this risk from both a technical and stakeholder perspective.

Potential impact

The impact to the project could be wide ranging and include the following:

 Delay or inability to complete the project

 Increase in project costs
 Loss of political support

Mitigation and management approach

LBU is mitigating and managing integration and interface risk in a variety of ways, including the following:

 Increasing LBU staff dedicated to third-party agreements/interface and developing detailed cooperation
agreements/memorandums of understanding with the local authorities, utilities providers, etc.

 Drafting technically detailed utility agreements and finalizing them with utility owners, as well as seeking
exemption, if any or if possible While LBU is responsible for securing agreements with the utilities, LBU
intends to transfer much of the risk related to maintaining the agreements to the WPC contractors
responsible for constructing the PBH.
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 91 of 105

 Implementing a verification and validation approach that employs independent verification and validation based
on proven international practice in LBU and internationally accepted standards. This approach provides full
transparency and ensures that all requirements in the procurement documents provided to the
contractor can be traced back through the requirements development process to state and federal
codes, industry standards, and international guidelines. In addition, fewer hold-points are created,
resulting in a positive impact on delivery schedule and cost while placing liability with the contractor to
demonstrate compliance.

 Implementing a phased approach to the PBH system allows operational development to mitigate technical
integration and interface issues before the full system becomes operational.

 Using innovative delivery models that transfer system integration risk to the private sector, where
appropriate.

 Enhancing stakeholder outreach and communication. To maintain stakeholder support, LBU will employ a
multi-pronged initiative of outreach and communication to all stakeholder groups throughout the state.
This strategy involves regular communication with local elected officials and local government staff to
keep them apprised of new information relating to the Project, building trust and confidence in LBU.
Business organizations, such as chambers of commerce and economic development groups, have been
contacted to establish relationships. Additionally, through the environmental processes (workshops, open
houses, meetings, etc.) LBU has attempted to reach out to the broader community to communicate the
goals and benefits of the project.
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 92 of 105

Risk mitigation and allocation strategies

The previous section identified key risks, as well as the specific mitigation and management approach.

This section describes those strategies that LBU has implemented to mitigate many types of risks.

Principles

LBU's risk mitigation and allocation approach is based on four key principles:

All project personnel are part of the risk management process — Risk management is integrated with other project
management processes and aligned with LBU's goals and values. As such, everyone is involved, and risk management
is every team member's responsibility.

Key risks must be documented and monitored — All key project risks are documented in a risk register that contains
relevant information about the risk, including underlying causes, probability of occurrence, potential impact,
mitigation strategy, and status. The risk register is discussed in more detail below.

Risks are "owned"—All key risks are assigned a named owner within the team responsible for monitoring and control
of the risk. Additionally, specific mitigation actions are assigned to named team members who are in the best
position to execute these actions, with due dates for their completion.

Communication and reviews are regular—The risk register is reviewed regularly and updated to reflect the current
status of the project and its risk management efforts. Progress on mitigation actions, status of key project risks,
and mitigation actions along with any new risks that have arisen is reported monthly.

LBU has developed and will continue to develop tailored mitigation strategies based on the nuances of a particular
risk. Some general, overarching themes exist, such as balanced risk transfer and contracting strategies.

Balanced risk transfer

LBU is aligning technical and operational risk transfer with commercial and financial risk transfer to realize the
benefits of a balanced risk transfer approach. For example, transferring the responsibility of construction to
private-sector partners insulates the procuring authority only to the extent that the private-sector partner also
bears the appropriate level of financial risk.

Contracting strategies

LBU is also planning to capture the benefits of innovative contracting strategies to transfer risk to the private-
sector partners.
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 93 of 105

ANNEX II THE PAN BORNEO HIGHWAY PROJECT RISK TAXONOMY

Introduction

Risk management is a topic heavily researched and important for industry professionals. Both
academic and industry perspectives are critical to advancing this field, especially in risk identification
and taxonomy. A unique comparison and convergence of these perspectives was developed for the
Pan Borneo Highway Project in order to understand the most relevant risks for the project and to
ensure they are addressed in the risk management process.

Identification of Key Risk Issues

Key Risks - Overall Project Implementation

The Key Risk that could affect the overall implementation of the PBH Project were identified by
utilizing the Analytical Hierarchy Process (AHP) analysis and the results are shown in Table II – 1.

Based on the analysis, the following risk areas were determined to have the potential of affecting the
successful implementation of the project. Based on this finding, it was recommended that all
departments and personnel involved in the implementation of the project should give due priority in
the mitigation of these risk areas during the life cycle of the project.

Ranking Risk Risk Ratings

1 Risks associated with land acquisition 0.1872
2 Risks associated with utilities relocation 0.1853
3 Risks associated with funding/payment 0.1593
4 Risks associated with project schedules 0.1130
5 Risks associated with contracts management 0.0695
6 Risks associated with contractors’ performance and procurement 0.0691
activities
7 Risks associated with partnerships 0.0656
8 Risks associated with material supply 0.0530
9 Risks associated with resource management 0.0524
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 94 of 105

Table II – 1 Key Risks for the Overall PBH Project Implementation

 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 95 of 105

Key Risks – Project Execution Phase

The Risk Management Department had undertaken an extensive study to ascertain the key risks that
could significantly influence the delivery of the Pan Borneo Highway project throughout the entire life
cycle of the project from initiation to close-out. The following are the major key risks that were
identified for the PROJECT EXECUTION phase:

SIGNIFICANCE
RISKS CATEGORIES INDEX
SCORES
Cost related Tight project schedule 0.67

risks Design variations 0.49

Variations by the client 0.46

Unsuitable construction program planning 0.42

Occurrence of dispute 0.42

Price inflation of construction materials 0.41

Excessive approval procedures in administrative 0.40

government departments

Incomplete approval and other documents 0.39

Incomplete or inaccurate cost estimate 0.38

Inadequate project scheduling 0.38

 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 96 of 105

SIGNIFICANCE
RISKS CATEGORIES INDEX
SCORES
Time related Tight project schedule 0.57

risks Design variations 0.48

Excessive approval procedures in administrative 0.48

government departments

Variations by the client 0.47

Incomplete approval and other documents 0.45

Unsuitable construction program planning 0.45

Inadequate project scheduling 0.42

Bureaucracy of government 0.39

High performance or quality expectations 0.38

Variations of construction programs 0.38

Quality Tight project schedule 0.56

Related Risks Inadequate project scheduling 0.41

Unsuitable construction program planning 0.38

Incomplete or inaccurate cost estimate 0.38

Low management competency of subcontractors 0.36

High performance or quality expectations 0.35

Variations of construction programs 0.35

Unavailability of sufficient amount of skilled labour 0.31

Design variations 0.30

Lack of coordination between project participants 0.29

 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 97 of 105

SIGNIFICANCE
RISKS CATEGORIES
INDEX SCORES
Environmental Tight project schedule 0.39

related risks Variations of construction programs 0.28

Unavailability of sufficient professionals and 0.27

managers

Excessive approval procedures in administrative 0.27

government departments

Variations by the client 0.25

Inadequate or insufficient site information (soil test 0.25

and survey report)

Low management competency of subcontractors 0.24

High performance or quality expectations 0.24

Inadequate project scheduling 0.23

Serious noise pollution caused by construction 0.23

Safety Related Tight project schedule 0.45

Risks Low management competency of subcontractors 0.37

Unsuitable construction program planning 0.33

Variations of construction programs 0.30

General safety accident occurrence 0.30

High performance or quality expectations 0.27

Design variations 0.26

Lack of coordination between project participants 0.26

Excessive approval procedures in administrative 0.25

government departments

Unavailability of sufficient amount of skilled labour 0.24

Unavailability of sufficient professionals and 0.24

managers
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 98 of 105

ANNEX III SUMMARY OF THE PAN BORNEO HIGHWAY PROJECT RISK

PROFILE

The risk analysis of the Pan Borneo Highway was conducted in September 2015 and involved the entire
project team. A total of 245 risk were identified for 7 potential risk events based on the Work
Breakdown Structure (WBS) derived. The WBS was derived from the Risk Breakdown Structure (RBS)
of the project.

The potential risk events identified were:

WBS Identifier Risk Event

1.0 Planning Risks

2.0 Design Risks

3.0 Procurement Risks

4.0 External Risks

5.0 Construction Risks

6.0 Testing & Commissioning Risks

7.0 Handover Risks

 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 99 of 105

The following table shows the breakdown of the risk events identified (as of September 2015):

Extreme Medium
No of Risks High Risks Low Risks
Risk Event Risks Risks
Identified Identified Identified
Identified Identified

Planning Risks 65 5 13 16 31

Design Risks 28 2 6 8 12

Procurement Risks 31 3 8 8 12

External Risks 19 5 0 8 6

Construction Risks 72 6 19 31 16

Testing & Commissioning 22 1 2 13 6

Handover 9 0 0 3 6

TOTAL 246 22 48 87 89

PERCENTAGE 8.94% 19.51% 35.37% 36.18%

As of July 2016, a total of 262 ` risk were identified for 8 potential risk events based on the Work
Breakdown Structure (WBS) derived. The WBS was derived from the revised Risk Breakdown Structure
(RBS) of the project.

WBS Identifier Risk Event

1.0 Planning Risks

2.0 Design Risks

3.0 Procurement Risks

4.0 External Risks

5.0 Construction Risks

6.0 Contractors’ Risks

7.0 Testing & Commissioning Risks

8.0 Handover Risks

 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 100 of 105

Subsequent revisions of the project risk profiles are included in the monthly risk report.

LBU’s Risk Management Tools

LBU monitors and manages the Pan Borneo Highway project by utilizing the following tools:

1. Risk Register (Figure III – 1)

2. Risk Tracking Logs (Figure III – 2)
3. Risk Issue Management & Escalation Plan (Figure III – 3)
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 101 of 105

Figure III – 1 : LBU’s Risk Register Format

 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 102 of 105

Figure III – 2 : LBU’s Risk Tracking Log Format

 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 103 of 105

Figure III – 3 : LBU’s Risk Issue Management & Escalation Plan Format
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 104 of 105

ENDORSEMENTS

HEAD OF RISK MANAGEMENT

Name : ABDILLAH BIN AZAHARI (CIPM, PMP, RMP)

Signature :

Date :
 DOC. NO LBU – PMP - QACM - 001
REV. NO 2
RISK MANAGEMENT PLAN REV. DATE JULY 2016
PAGE Page 105 of 105