.png)
ABSTRACT: Enterprise Risk Management (ERM) implementation on large Military Construction (MILCON) projects and programs are not well defined. This paper provides recommendations to DOD MILCON executives on how to implement an Enterprise Risk Management (ERM) strategy on MILCON projects and programs based on substantive research within the last seven years. Risk management on large MILCON construction projects and programs should; assessing risk management knowledge and capabilities, evaluate the organization's Risk Management Maturity (RMM), and should be specified on MILCON projects and programs and with new technologies. The goal in all risk management initiatives is to not only reduce the probability of bad things happening but, more importantly, to discover opportunities the process uncovers.
Military Construction (MILCON) Management Responsibility for Enterprise Risk Management (ERM)
Enterprise Risk Management (ERM) implementation on large Military Construction (MILCON) projects and programs are not well defined. ERM is mature in the financial, insurance, and energy industry but not in the construction industry (Hoyt and Liebenberg 2011; Muralidhar 2010; Wu and Olson 2008, Zhao, 2013). When Hwang and Chen (2015) did research on risk management in the construction industry, they found that construction industry respondents did not adequately understand risk management benefits when compared to the IT industry respondents. The Office of Management and Budget (OMB) Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control, dated July 2016, requires federal agencies to implement ERM, but that is difficult if there is confusion or gaps in understanding what ERM involves and how to implement it successfully. For example, when the Defense Finance and Accounting Agency (DFAS) implemented their ERM in 2019, they not only exceeded compliance requirements but also demonstrated added value to the enterprise (Maled, 2019).
When evaluating risk management techniques, practitioners need to consider the multiple facets behind managing MILCON projects and programs. Some of the major challenges with managing risk on large US MILCON projects or programs include; the specific Military organization structure (NAVFAC, USACE, WHS, VA, DOD, etc…), organizational culture, 1391 development, and approval process, funding constraints and lengthy Congressional MILCON funding approval process, trust-building, project team long term continuity internal and external to the organization, and working with multiple stakeholders. To ensure that compliance requirements are met, and to get the most out of construction projects and programs, new ERM techniques directly related to construction need to be implemented.
The DD 1391 processor system is used by the Department of Defense to justify and support funding for US Military construction (MILCON) projects to the US Congress. The MILCON process from DD 1391 development to the allocation of funds to the military services could take three or more years, see table 2 below.
Figure 1. Military Construction Process from DOD information, CRS graphics
MILCON construction challenges are further exacerbated by the lack of adequately trained staff, as well as competition with other large construction projects and programs. The construction industry's reputation when it comes to risk management is unacceptable, even considering that large construction projects often fail to complete on time and within budget (Hwang et al., 2015, Smith et al. 2006, Mills 2001, Azhar et al. 2008). Although risk management in terms of cost, schedule, and performance is defined and taught at the Defense Acquisition University (DAU, 2010, Stuban, 2011), the current Enterprise Risk Management (ERM) system either does not work or is not being fully implemented.
The USA Medical Command’s Performance Information Risk Management System (PIRMS) is an excellent start, but may not address all the concerns necessary for managing risk on large MILCON projects. MILCON executives should also consider the OMB Circular A-123 risk management requirements and guidelines, as well as the self-assessment conducted by DFAS when developing an ERM strategy (Maled, 2019). These three public sector Risk Management Resources provide excellent guidelines and resources for successfully implementing Enterprise Risk Management on US Government construction projects.
The US Military construction community is not alone in the struggle to get the most out of ERM on construction projects. Private sector companies in the US and abroad have also had problems implementing enterprise risk management on large scale construction projects. Limited research within the construction industry on best practices and return on investment related to ERM also makes it difficult to make quality improvements in implementation (Zhao1, 2013 CHANGE). As a result, Military leadership cannot simply turn to the private sector for a quick fix in delivering MILCON projects on time, within budget, and at the quality our Military expects. Even though some companies offer risk management workshops and services, we are unlikely to experience the real benefits of ERM in improving costs, schedules, and quality on MILCON projects until fundamental changes occur in both the private and public sectors.
At this point, new risk management organizational structures are needed in order to clarify the benefits of enterprise risk management (ERM) on large MILCON construction projects and to overcome the barriers to implementation commonly associated with multiple stakeholder involvement. The intent of this paper is to provide the Department of Defense (DOD) leadership with recommendations on how to effectively implement risk management throughout the life cycle of MILCON programs and projects.
Within the last seven years, research into ERM best practice indicates that large MILCON construction projects and programs should address the following: The MILCON ERM strategic process, figure 2, is based on these three principles and depicted in figure 2.
1. Assess Risk Management Knowledge and Capabilities, both internal and external, to the organization. (Risk Management Maturity, Enterprise Risk Management)
2. Evaluate the organization's Risk Management Maturity (RMM) and create enterprise risk management (ERM) organizations. (Trust and long-term continuity)
3. Specify risk management for MILCON projects and programs and implement new technologies for; project control, risk, and schedule management on all projects and programs.
Figure 2. MILCON ERM Strategic Process
Assess Risk Management Knowledge and Capabilities
Effective risk management is critical for construction projects and program success (Serpell et al. 2017). Research findings related to effective risk management clearly show that risk management is either not used at all, or what is used is ineffective. The primary reason, according to Serpell et al., is that leaders and managers lack the knowledge and/or capabilities to perform effective risk management at this level of operation. They also stated, “… the extended belief within the industry that RM [risk management] is not really relevant for construction project management.” Abdulramhman et al. (2019), correctly stated that for organizations to succeed, they must be proactively committed to risk management throughout the project, not just as an initial strategy. As a result, the best way to assess an organization's knowledge and capabilities are to ask the following questions of the design and construction project teams:
Has the organization or individuals performed project or program risk management on similar projects? Can they quickly obtain and outside consultant to assist?
Does the project need special tools to assess risk? Acumen Fuze or Risk or Primavera Risk? Are they familiar with using these tools or an MS Excel risk management register?
Does the organization have lessons learned logs on similar projects or an active risk management log?
How would the organization assess the trust and long-term continuity of the project team?
How mature are the scheduling, project controls, and design effort? Where in the project, life cycle did risk management start?
Research in the field also shows that implementing advanced scheduling techniques on projects and programs drastically reduces project risk and should be assessed on all programs and projects. When evaluating MILCON programs, the Integrated Master Schedule must show all utilities, infrastructure, and major milestones to include stakeholder involvement.
The schedule should also include all activities before construction, including: (Figure 3. Typical Integrated Master Program Schedule)
Charrette / DD 1391 development (prior to design)
Design (for DBB projects) at least one year before construction
Major Milestones before construction start (Award, design reviews, and other stakeholder major milestones)
Construction (estimated duration)
Commissioning (CX) work after construction complete (estimated to be 3 months after BOD)
FFE after construction and CX completion (Estimated to be 2 months after CX completion)
Figure 3. Typical IMS Program Schedule
Assessing the risk management knowledge and capabilities of the project is extremely important. Different projects and programs need different approaches and talent sets. (Cagliano et al. 2015). The team needs to demonstrate the knowledge and ability to identify, assess, and control all risks. If the team cannot demonstrate this capability, effective risk management will not occur without outside help.
Cogliano et al. 2015 evaluated six project risk management processes and summarized them into three phases shown below:
“The first steps of these processes are aimed at understanding the characteristics and objectives of the project at issue and planning the risk management effort by deciding its level, scope, and purpose.
The intermediate steps are intended to identify risks together with their causes, effects, and how they relate to each other, assess their probabilities of occurrence and impacts, prioritize them, devise risk response strategies, and establish contingency plans.
The final steps are in general dedicated to carrying out the identified responses to risk, monitoring and refining them, identifying, evaluating and treating new emerging risks as well as to communicating the results of the risk management process and recording all the knowledge, experience and lessons learned during its implementation.”
The first step involves the planning stage. Improper planning at the beginning has also been found to significantly increase business performance risk on projects and programs (Cogliano et al. 2015, Saeed, 2018). Organizations must address risk management capabilities and knowledge during the planning and organizational development stage. How existing risk management practices overlap with the new Enterprise Risk Management (ERM) initiative is extremely important (Maled, 2019). Risk management during the planning stage has proven to be the most critical during the life cycle of a project or program (Cogliano et al. 2015). Iqbal et al. (2013) research on risk management in construction projects stated the “…results of the analysis demonstrate that the production of proper schedule by getting updated data of the project and guidance from previous similar projects are the most effective preventive risk management techniques..” Da Silva et al. (2019) research on risk and uncertainty on engineering projects confirmed these results. Their research indicates schedule delay concerns as the most significant consequence of disregarding or underestimating project risks.
Figure 4. Consequences of Disregarded or Consequences of Risks Da Silva et al. (2019)
Therefore, assessing schedule risk management and capabilities is extremely important as well. The following MILCON Program scheduling recommendations can be used to assess the team’s risk management capabilities:
Recommend MILCON program managers consider, when applicable, all future electrical distribution system upgrades, future wastewater and water treatment upgrades, environmental assessments, possible archaeological impacts, and other infrastructure projects and programs during the life cycle of the program. Public-Private Partnership (PPP) projects may not have been considered during the MILCON process and should be considered when implementing the MILCON Program.
Recommend developing a detailed relocation plan in general and per building least a year before the first relocation or swing, when applicable.
A Push-Pull Planning Charrette or workshop is also recommended before starting large MILCON programs. The Charrette could explore final blocking and stacking and explore building renovation construction sequencing or different renovation phasing approaches based on stakeholder involvement. The Program Management team could also review designs to identify conditions that maximize the potential for concurrent (rather than sequential) construction and optimize project performance period using detailed Integrated Master Schedules developed in Primavera P6.
Implementation of an Integrated Master Schedule can enhance a massive MILCON program's ability to plan more effectively, control the seams between projects and deal with unforeseen challenges. Making the schedules of all the projects visible in a digestible way for DOD construction managers should be the team’s goal. The design and construction team should make use of the entire suite of communications and control applications at the team’s collective disposal. With the entire program visible, better phasing decisions can be made at both the MILCON project and program levels.
Evaluate the Organization's Risk Management Maturity (RMM)
Implementing a successful Enterprise Risk Management strategy also means assessing risk management maturity (RMM) and culture (Maled, 2019). Risk management on large MILCON is not a stand-alone activity or defined similarly to partnering. Although risk management is implemented on many MILCON projects, it typically a task assigned to the on-site construction management team. Traditionally there is a separation between project management and the ability to adequately identify, assess, and control associated project risks (Cogliano, 2015), which is part of the problem. The goal should be to create a newly defined Enterprise Risk Management Organization for total life-cycle management with trust and long-term continuity, rather than passing it over as a task for one or more teams. Often outside facilitators are hired to perform risk management workshops and to develop a risk management matrix for the project or program. They are seldom valued as a continuous process or procedure or even worth investing in a full-time equivalent (FTE) position. One reason for the lack of financial support may be that risk management is hard to quantify unless things go wrong, so it is usually something the Program or Construction Manager wants to control.
The good news is that how to identify, quantify, and respond to multiple risks on large MILCON projects after the budget has been approved and during the design and construction phase is well defined (Turnbaugh, 2005, Cagliano et al. 2015, Shahid et al. 2015, and …_). The major challenge seems to be that MILCON projects are becoming larger and more complicated, based on advances in both construction technologies and complicated requirements for new weapon systems. The F-35, Ford Class Aircraft Carrier, and the Virginia class fast attack submarines are just a few examples of the complexities involved. We should also keep in mind that how the construction industry addresses risk management for large MILCON programs that may dramatically affect the success or failure of the weapon systems. Commands are also required to spend money and issue contracts before examining all the risks involved which are not always wise or feasible, which is why a new approach to risk management is needed.
Creating added value by implementing an ERM system takes time and should be employed incrementally with other risk management initiatives (Maled, 2019). Understanding the organization's Risk Management Maturity is the first step in creating the ERM organization and is extremely important (Abdulramhman et al. (2019). Most risk management in construction research begins with the analysis of their risk management systems and practices. The Abdulrahman et al. (2019) risk management maturity questionnaire or index for Joint Venture (JV) adopted from research performed by Zou et al. (2010 and Mu et al. (2015) is an excellent resource to evaluate the organization's risk management maturity. The research also used to develop this approach comes from “six different risk management maturity (RMM) models” (Salawuu, 2016). The risk management maturity index survey includes the following:
Management Perspective
Risk attitude and culture
Risk management process
Organizational risk management practices.
To date, no Enterprise Risk Management Maturity (ERMM) model has been developed specifically for the construction industry, although they are common in other sectors (Zhao et al. 2013). Standard & Poor’s ERMM for the insurance companies covered five criteria and three assessment outcomes (Santori et al. 2007). Ciorciari and Blattner's (2008) ERM model for the banking industry covered eight criteria and 123 elements. The U.S.-based Risk and Insurance Management Society (RIMS) (2008) ERM model examines 25 areas and 68 best practices. Zhoa et al. 2013 further explained that, “… Aon (2010), a professional ERM service provider, proposed an ERM maturity self-assessment model applicable to various industries. In this model, ERM maturity was assessed against nine criteria that were viewed as hallmarks of an advanced ERM program, and implementation was categorized into initial or lacking, basic, defined, operational, and advanced levels”.
Zhoa et al. 2013 also developed a Fuzzy Enterprise Risk Management Maturity Model for Construction Firms in-order to help improve ERM implementation and to highlight week areas. The 16 assessment areas, shown below:(Table 1), can help MILCON project and program executives assess their Enterprise Risk Management Maturity.
Table 1. Fuzzy Enterprise Risk Management Maturity Model for Construction Firms Zhoa et al. 2013
M01 Commitment of the board and senior management
M02 ERM ownership
M03 Risk appetite and tolerance
M04 Risk-aware culture
M05 Sufficient resources
M06 Risk identification, analysis, and response
M07 Iterative and dynamic ERM process steps
M08 Leveraging risks as opportunities
M09 Risk communication
M10 A common risk language
M11 A RMIS (risk management information system)
M12 Training programs
M13 Formalized key risk indicators
M14 Integration of ERM into business processes
M15 Objective setting
M16 Monitoring, review, and improvement of ERM framework
MILCON Enterprise Risk Management Strategy and New Technologies to Improve RM Strategies
The next step in developing an active Enterprise Risk Management strategy is to develop an ERM plan that specifies using Risk Management throughout the organization. Studies have shown that safety, schedule delays, and cost impacts, and defective designs are the highest risks for construction projects (Iqbal et al. 2015). Additionally, project documentation, project controls, and scheduling, especially at the beginning of the project, is essential. Coligliano (2015) addressed what they called “Information Disconnects.” They said many projects are organized in ways that create information disconnects. This leads to reduced risk communication in the same way that information disconnects create communication problems in other Project Management areas. (Cogliano et al. 2015, Smillie and Blissett 2010; Tah and Carr 2001; Thompson and Bloom 2000). To avoid information disconnects, the ERM strategy should include a strategy to address information flow throughout the enterprise on MILCON projects and programs. Statistically and qualitatively evaluating risk management registers, lessons learned database, and the big data coming from the MILCON initiative is essential. Without this information, enterprise risk opportunities through artificial intelligence and stakeholder involvement will not be seen.
The Project Management Institute (PMI) Project Management Body of Knowledge (PMBOK®) Guide 6th (2017) addition clearly identifies risk management processes as one of the 10 knowledge areas. Most engineering project managers and construction engineers know and try to apply the PMBOK® (DaSilva et al. 2019). The PMBOK® only describes the risk management processes and not the exact models to address RM. Although all processes are not used on every project or program, they should still be addressed when evaluating risk management or enterprise risk management (ERM) strategies. Joseph Phillips (2015) quick reference guide, Table 2, below shows the process name, input, tools and techniques, and corresponding risk management output for each RM process.
Table 2. PMBOK PM Quick Reference Guide by Joseph Phillips 2015
Implementing new technologies for project control, risk, and schedule management on all projects and programs is also critical. Risk management practitioners create unique and innovative risk management registers in Microsoft Excel and other relational database applications. An example from a sizeable multibillion-dollar design and construction program risk register is shown below, Figure 5. The risk register template is broken down into the phases or WBS of the program showing pre-award and design phase, solicitation phase, and construction and close-out phases.
Figure 5. Risk Register Example (Large Program)
The risks are quantified, described with impact, and the risk probability and impact are color-coded. These technologies are well defined but are not standard across the industry, especially for Military Construction (MILCON) projects and programs. New tools or workshops are needed across the enterprise in-order to standardize risk registers for different types of MILCON projects and programs. This could also be organization-specific depending on the stakeholder involvement, the risk management knowledge and capabilities, and risk management maturity (RMM), as stated above.
Using technologies typically not used or seen in the construction industry should also be considered. QSR International, NVIVO, qualitative data analysis software is the perfect solution for conducting needed risk management qualitative studies. Also, IBM Corporation, SPSS, statistical analysis software should be considered for large MILCON projects and programs. Several popular risk management software applications are used in the construction industry and on MILCON projects. The most popular risk management applications are shown below:
Oracle Primavera Risk Analysis and Contractor Analysis is a risk analytics software solution to manage the total life cycle of the project or program. Primavera P6 scheduling software is used on most if not all MILCON construction projects. Risk Analysis and Contractor integrates the schedules and reporting from other Oracle (Primavera) applications.
Palisade Corporation, @RISK, risk analysis software uses Monte Carlo simulation to mathematically determine and track possible risk scenarios with probabilities of occurrence for each.
Risk Reasoning Ltd, RiskAid, a software tool to manage risk and uncertainty.
Acuity Risk Management, STREAM, uses a tree-type structure to organize risk registers and reporting with workflow.
PMA Technologies, NetPoint, integrates scheduling through planning to address communication and collaboration.
Conclusion
Enterprise Risk Management (ERM) implementation on large Military Construction (MILCON) projects and programs are not well defined. ERM models and strategies are mature in the financial, insurance, and energy industry, but still lacking within the construction industry (Hoyt and Liebenberg 2011; Muralidhar 2010; Wu and Olson 2008, Zhao, 2013). The Office of Management and Budget (OMB) Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control, dated July 2016, requires federal agencies to implement ERM. The Defense Finance and Accounting Agency (DFAS) implemented a US Government DFAS ERM in 2019 to exceed compliance and to show the added value of this implementation (Maled, 2019).
When evaluating risk management techniques, practitioners need to consider the multiple facets behind managing MILCON projects and programs. The challenges associated with managing risk on large US MILCON projects or programs are complex but well documented. These challenges are also drastically different from other industries and include a long, 2 or 3 year, 1391 development, and approval process, and the complexities of working with multiple stakeholders and DOD organization structures. As a result, new and innovative ERM techniques are needed to improve construction project and program performance.
This paper provides recommendations to DOD MILCON executives on how to implement an Enterprise Risk Management (ERM) strategy on MILCON projects and programs based on substantive research within the last seven years. Risk management on large MILCON construction projects and programs should; assessing risk management knowledge and capabilities, evaluate the organization's Risk Management Maturity (RMM), and should be specified on MILCON projects and programs and with new technologies. The goal in all risk management initiatives is to not only reduce the probability of bad things happening but, more importantly, to discover opportunities the process uncovers.
Figure 7. MILCON ERM Strategic Process
REFERENCES
Abdulrahman, R. S., Ibrahim, A. D., & Chindo, P. G. (2019). Assessment of Risk Management Maturity of Construction Organisations in Joint Venture Projects. Journal of Engineering, Project & Production Management, 9(1), 20–28. https://doi.org/10.2478/jeppm-2019-0004
Azhar, S.; Ginder, W. C.; Farooqui, R. U. 2008. An assessment of risk management practices in the alabama building construction industry, in International Proceedings of the 44th Annual Conference, Associated Schools of Construction, 2–5 April 2008, Auburn University, Auburn, Alabama.
Ciorciari, M., and Blattner, P. (2008). “Enterprise risk management maturity-level assessment tool.” 2008 Enterprise Risk Management Symp., Society of Actuaries, Schaumburg, IL.
Da Silva, T. F. L., Vieira, D. R., Melhado, S. B., & Carvalho, M. M. (2019). Risk and Uncertainty in Engineering Projects: A Survey of Professionals. Journal of Modern Project Management, 7(1), 200–213. https://doi.org/10.19255/JMPM01912
Discovery of Internal and External Factors Causing Military Construction Cost Premiums. (2014). Journal of Construction Engineering & Management, 140(3), 1. https://doi.org/10.1061/(ASCE)CO.1943-7862.0000810
Hwang, B.-G., & Chen, M. (2015). Sustainable risk management in the construction industry: lessons learned from the IT industry. Technological & Economic Development of Economy, 21(2), 216–231. https://doi.org/10.3846/20294913.2014.979455
Iqbal, S., Choudhry, R. M., Holschemacher, K., Ali, A., & Tamošaitienė, J. (2015). Risk management in construction projects. Technological & Economic Development of Economy, 21(1), 65–78. https://doi.org/10.3846/20294913.2014.994582
Kashiwagi Jacob, Sullivan Kenneth, & Kashiwagi Dean T. (2009). Risk management system implemented at the US Army Medical Command. Journal of Facilities Management, 7(3), 224–245. https://doi.org/10.1108/14725960910971496
Maled, J. (2019). ERM: Building the Foundation. Armed Forces Comptroller, 64(4), 34. Retrieved from http://search.ebscohost.com/login.aspx?direct=true&AuthType=shib&db=f5h&AN=139850178&site=eds-live
Mills, A. 2001. A systematic approach to risk management for construction, Structural Survey 19(5): 245–252. http://dx.doi.org/10.1108/02630800110412615
Salawu, R. A. and Abdullah, F. (2015). Assessing Risk Management Maturity of Construction Organisations on Infrastructural Project Delivery in Nigeria. Global Conference on Business & Social Science. Procedia and behavioural sciences, 172, 643-650.
Santori, L., Bevan, K., and Myers, C. (2007). Summary of Standard & Poor’s enterprise risk management evaluation process for insurers, Standard & Poor’s, New York.
Serpell, A., Ferrada, X., & Rubio, N. L. (2017). Fostering the effective usage of risk management in construction. Journal of Civil Engineering & Management, 23(7), 858–867. https://doi.org/10.3846/13923730.2017.1321578
Serrado, I. P., dos Santos, J. A. N., de Oliveira, N. L. F., & Aleluia Freitas, A. P. (2019). Identification of Importance Levels of Market Risks in the Construction Sector. Journal of Engineering, Project & Production Management, 9(2), 74–84. https://doi.org/10.2478/jeppm-2019-0009
Smillie, L., and A. Blissett. 2010. “A Model for Developing Risk Communication Strategy.” Journal of Risk Research 13 (1): 115–134.
Smith, N. J.; Merna, T.; Jobling, P. 2006. Managing risk in construction projects. Oxford, UK: Blackwell Publishing.
Stuban, S. M. F., Mazzuchi, T. A., & Sarkani, S. (2011). Employing Risk Management to Control Military Construction Costs. Defense Acquisition Research Journal: A Publication of the Defense Acquisition University, 18(2), 144–159. Retrieved from http://search.ebscohost.com/login.aspx?direct=true&AuthType=shib&db=bth&AN=69635140&site=eds-live
Tah, J. H. M., and V. Carr. 2001. “Towards a Framework for Project Risk Knowledge Management in the Construction Supply Chain.” Advances in Engineering Software 32: 835–846.
Thompson, K. M., and D. L. Bloom. 2000. “Communication of Risk Assessment Information to Risk Managers.” Journal of Risk Research 3 (4): 333–352.
Turnbaugh, L. lisa. turnbaugh@dmjmharris. co. (2005). Risk Management on Large Capital Projects. Journal of Professional Issues in Engineering Education & Practice, 131(4), 275–280. https://doi.org/10.1061/(ASCE)1052-3928(2005)131:4(275)
Using Technology to Improve Risk Management in Construction. (2019). Professional Safety, 64(12), 46. Retrieved from http://search.ebscohost.com/login.aspx?direct=true&AuthType=shib&db=bth&AN=140077527&site=eds-live
Yousif Salam Saeed. (2018). Cost and Time Risk Management in Construction Projects. Tikrit Journal of Engineering Sciences, (1), 42. https://doi.org/10.25130/tjes.25.1.07
Zhao, X., Hwang, B.-G., & Low, S. P. (2013). Developing Fuzzy Enterprise Risk Management Maturity Model for Construction Firms. Journal of Construction Engineering & Management, 139(9), 1179–1189. https://doi.org/10.1061/(ASCE)CO.1943-7862.0000712
Zou, P. X., Chen, Y., and Chan, T. (2010). Understanding and improving your risk management capability: Assessment model for construction organizations. Journal of Construction Engineering and Management, 854-863.