Study guide
13.1 Risk Management Framework & Risk Breakdown Structure (RBS)
AACE Certified Cost Professional CCP
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Introduction & Total Cost Management (TCM) Framework
1.1 AACE CCP Exam Structure, Eligibility & the In-Exam Memo 1.2 The Total Cost Management (TCM) Framework & PDCA Cycle 1.3 Strategic Asset Management vs. Project Control Processes
2 Chapter 2: Cost Estimating Fundamentals & Classification
2.1 AACE Recommended Practice 18R-97 Estimate Classification System 2.2 Direct vs. Indirect Costs and Cost Element Breakdown 2.3 Quantity Takeoff, Standard Cost Databases & Pricing Sources
3 Chapter 3: Conceptual & Parametric Estimating Techniques
3.1 Capacity Factoring & the Six-Tenths Rule 3.2 Parametric Estimating, Lang Factors & Hand Factors 3.3 Cost Indices, Location Adjustments & Escalation Modeling
4 Chapter 4: Cost Engineering Economics & Time Value of Money
4.1 Simple & Compound Interest, Equivalence & Cash Flow Diagrams 4.2 Discrete Compounding Formulas & Uniform Series Factors 4.3 Nominal vs. Effective Interest Rates & Continuous Compounding
5 Chapter 5: Project Profitability & Capital Investment Decision-Making
5.1 Net Present Value (NPV) & Present Worth Analysis 5.2 Internal Rate of Return (IRR) & Incremental IRR Analysis 5.3 Payback Period, Benefit-Cost Ratio (BCR) & Breakeven Analysis
6 Chapter 6: Depreciation Methods, Taxes & Asset Valuation
6.1 Classical Depreciation Methods (Straight-Line, DDB, Sum-of-Years-Digits) 6.2 Modified Accelerated Cost Recovery System (MACRS) & Tax Shield 6.3 After-Tax Cash Flow Analysis & Asset Replacement Economics
7 Chapter 7: Project Scope, Work Breakdown Structure (WBS) & Baselines
7.1 Work Breakdown Structure (WBS) Principles & the 100% Rule 7.2 Organizational Breakdown Structure (OBS) & Control Accounts 7.3 Establishing the Performance Measurement Baseline (PMB)
8 Chapter 8: Critical Path Method (CPM) Planning & Scheduling Logic
8.1 Precedence Diagramming Method (PDM) & Dependency Relationships 8.2 Forward Pass, Backward Pass & Float Calculations (Total vs. Free Float) 8.3 Schedule Baseline Development, Calendar Constraints & Milestones
9 Chapter 9: Schedule Optimization, Compression & Probabilistic PERT
9.1 Schedule Crashing & Least-Cost Slope Optimization 9.2 Fast-Tracking Risks, Overlap Analysis & Execution Strategies 9.3 PERT Three-Point Estimating & Probabilistic Duration Variance
10 Chapter 10: Resource Management, Productivity & Learning Curves
10.1 Resource Loading, Leveling vs. Resource Smoothing 10.2 Labor Productivity Factors, Work Sampling & Efficiency Loss 10.3 Learning Curve Theory (Wright Cumulative vs. Crawford Unit Models)
11 Chapter 11: Earned Value Management (EVM) Core Principles & Metrics
11.1 ANSI/EIA-748 EVM Framework & Core Metrics (PV, EV, AC) 11.2 EVM Variances & Performance Indices (CV, SV, CPI, SPI) 11.3 Work Progress Measurement Techniques (0/100, 50/50, Milestone Weighting)
12 Chapter 12: EVM Forecasting, Indices & Baseline Change Control
12.1 Estimate at Completion (EAC) & Estimate to Complete (ETC) Formulas 12.2 To-Complete Performance Index (TCPI) & Variance at Completion (VAC) 12.3 Integrated Change Control, Baseline Revisions & Trend Management
13 Chapter 13: Risk Management Planning & Qualitative Risk Analysis
13.1 Risk Management Framework & Risk Breakdown Structure (RBS) 13.2 Qualitative Risk Assessment & Probability-Impact (P-I) Matrix 13.3 Risk Response Strategies & Threat/Opportunity Management
14 Chapter 14: Quantitative Risk Analysis, Monte Carlo & Contingency Estimating
14.1 Expected Monetary Value (EMV) & Decision Tree Analysis 14.2 Monte Carlo Simulation & Probability Distributions in Cost/Schedule 14.3 Contingency Estimating & AACE Recommended Practice 40R-08
15 Chapter 15: Contract Types, Procurement Strategy & Commercial Terms
15.1 Contract Types & Risk Allocation (Firm Fixed Price, Cost-Plus, T&M) 15.2 Project Delivery Systems & Procurement Lifecycle (DBB, DB, EPC, CMAR) 15.3 Commercial Terms, Bonds, Retainage & Claims Management
16 Chapter 16: Quality Management, Value Engineering & Technical Communication
16.1 Quality Management & Cost of Quality (CoQ) 16.2 Value Engineering, Function Analysis System Technique (FAST) & Life Cycle Costing 16.3 The CCP Memo, Cost Report Writing, Data Presentation & AACE Ethics 16.4 AACE CCP Capstone Review & High-Yield Exam Strategies
17 Chapter 17: Cost Accounting, Budget Administration & Cost System Governance
17.1 Historical Cost Databases, Data Organization & Benchmarking 17.2 Committed Costs, Accruals, Work-in-Place & Invoice Validation 17.3 Budget Creation, Operating Budgets & Funding Requirement Forecasting 17.4 Cost System Governance, the Code of Accounts & Preserving Project Controls Data
18 Chapter 18: Estimate Preparation, Review & Cost Driver Analysis
18.1 ROM, Summary-Level and Detailed Estimates: Preparing and Reviewing 18.2 Verifying the Basis of Estimate & Analyzing Estimates 18.3 Cost Drivers, Change Order Impact & Resource Utilization Analysis
19 Chapter 19: Interfacing with Other Disciplines & Stakeholders
19.1 Coordinating with Internal Disciplines & Supporting Project Leadership 19.2 Communicating Cost Estimates and Cost/Schedule Key Performance Indicators 19.3 Supporting Tenders, Procurement, Audits, Field Verification & Recovery
20 Chapter 20: Cost Reporting, Dashboards & Profitability Analysis
20.1 Cost Reports, Performance Dashboards & the Reporting Cycle 20.2 Variance Reports & Explaining Project Financial Health 20.3 Profit Margin Analysis & Profitability Enhancement
21 Chapter 21: Cost Support to Scheduling & the CCP Exam Memo
21.1 Cost and Resource Loading Summaries from the Project Schedule 21.2 Translating Schedule Change into Cost Impact 21.3 Writing the CCP Exam Memo: A Worked Domain 7 Walkthrough
13.1 Risk Management Framework & Risk Breakdown Structure (RBS)
Key Takeaways Explain This Topic AI
In AACE Total Cost Management (TCM), project risk is defined as an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) effect on at least one project objective such as cost, schedule, scope, quality, or safety.
AACE Recommended Practice 65R-11 establishes an integrated six-stage risk management lifecycle: Risk Planning, Risk Identification, Qualitative Risk Analysis, Quantitative Risk Analysis, Risk Response Planning, and Risk Monitoring & Controlling.
The Risk Breakdown Structure (RBS) is a hierarchical, source-oriented taxonomy that organizes potential project risks into standard Level-1 domains: Technical/Execution, External/Market, Organizational/Enterprise, and Project Management.
The Risk Register serves as the central, living project repository documenting unique Risk IDs, cause-event-impact descriptions, root-cause triggers, qualitative scores, designated individual Risk Owners, and approved response action plans.
Cross-referencing the Risk Breakdown Structure with the Work Breakdown Structure (RBS-WBS Matrix) provides an exhaustive verification tool that ensures every major deliverable and control account is systematically audited for potential risk exposure.
Last updated: August 2026
13.1 Risk Management Framework & Risk Breakdown Structure (RBS)
Domain 6 of the May 2026 CCP blueprint — Inform the Risk Management Process — is 7% of the exam, 9 questions . Read the domain title carefully: the cost professional informs the risk process, they do not own it. This section covers 6.A work with Risk SME(s) to understand the risk profile and 6.B support development of risk registers , both of which are supporting verbs. On the exam, an answer that has the cost engineer unilaterally setting the risk profile is usually wrong for that reason alone.
In capital project delivery and Total Cost Management (TCM), uncertainty is an inescapable reality. Complex engineering, procurement, and construction (EPC) projects operate in dynamic environments characterized by geotechnical unknowns, fluctuating commodity prices, labor productivity variations, regulatory shifts, and intricate supply chains. Without a structured, proactive risk management architecture, projects inevitably default to reactive crisis management, leading to catastrophic cost overruns, schedule delays, and compromised quality.
Under the AACE International Total Cost Management (TCM) Framework , AACE Recommended Practice 65R-11 (Integrated Cost and Schedule Risk Analysis and Contingency Determination) , and international standards such as ISO 31000 and the PMBOK Guide , risk management is not a one-time administrative exercise. It is a continuous, iterative process integrated directly into project planning, estimating, scheduling, and change control. For Certified Cost Professional (CCP) candidates, mastering foundational risk concepts, the integrated risk management lifecycle, the Risk Breakdown Structure (RBS), and Risk Register architecture is essential for both exam success and executive-level project controls.
- 1. Foundational Risk Concepts in Total Cost Management (TCM)
- The Dual Definition of Risk: Threats vs. Opportunities
In classical colloquial usage, 'risk' carries an exclusively negative connotation. However, professional cost engineering adopts a balanced, dual definition: Project Risk = f ( Uncertain Event or Condition , Probability of Occurrence , Impact on Objectives ) \text{Project Risk} = f(\text{Uncertain Event or Condition},\; \text{Probability of Occurrence},\; \text{Impact on Objectives}) Project Risk = f ( Uncertain Event or Condition , Probability of Occurrence , Impact on Objectives )
AACE / ISO Definition: An uncertain event or condition that, if it occurs, has a positive or negative effect on at least one project objective (such as cost, schedule, scope, quality, or safety).
Threats (Negative Risks): Uncertain events that jeopardize project success by increasing expenditures, delaying critical path milestones, degrading technical specifications, or creating safety hazards (e.g., unexpected subsoil rock formations requiring blasting).
Opportunities (Positive Risks): Uncertain events that enhance project outcomes by reducing costs, accelerating delivery, improving energy efficiency, or expanding asset profitability (e.g., early vendor fabrication slots opening up at a discounted rate). +-----------------------------------------------------------------------------+
- | THE DUALITY OF PROJECT RISK |
- | |
- | [ UNCERTAIN PROJECT EVENT / CONDITION ] |
- | ├── [ THREAT (Negative Risk) ] --> Cost Overrun, Delay, Rework |
- | └── [ OPPORTUNITY (Positive Risk) ] --> Cost Savings, Acceleration, Gain |
- | |
- | TCM GOAL: Minimize Threat Exposure & Maximize Opportunity Realization |
- +-----------------------------------------------------------------------------+
- Uncertainty vs. Risk (The Knightian Distinction)
In cost engineering literature, Frank Knight's classical economic distinction is foundational:
Knightian Uncertainty (Unmeasurable Uncertainty): Situations where the potential outcomes are unknown, or the probabilities of those outcomes cannot be mathematically or empirically quantified due to a total lack of historical data (e.g., executing a deep-space mining project).
Project Risk (Measurable Uncertainty): Situations where the set of possible outcomes is identifiable, and historical data, engineering analogs, or structured expert judgment allow the assignment of credible probability distributions and financial/schedule consequence ranges.
Aleatory vs. Epistemic Uncertainty
Cost engineers categorize project uncertainty into two distinct physical and cognitive types:
Aleatory Uncertainty (Stochastic / Inherent Randomness): Inherent variability in natural or physical processes that cannot be eliminated through further engineering studies (e.g., daily ambient temperature fluctuations, historical annual precipitation patterns, concrete slump test variability). Aleatory uncertainty is managed through probabilistic statistical modeling and financial contingency.
Epistemic Uncertainty (Knowledge Deficiency / Reducible Uncertainty): Uncertainty resulting from a lack of technical data, incomplete site characterization, or early design maturity (e.g., unknown subterranean soil stratigraphy prior to geotechnical core borings, unfinalized Piping & Instrumentation Diagrams [P&IDs]). Epistemic uncertainty can and should be systematically reduced by investing in front-end engineering studies, site investigations, and technology prototyping.
2. The Integrated Risk Management Process (AACE RP 65R-11)
According to AACE Recommended Practice 65R-11 , integrated risk management follows a structured, iterative six-stage lifecycle that interfaces continuously with project estimating, CPM scheduling, and baseline change control. +-----------------------------------------------------------------------------+
- | AACE RP 65R-11 INTEGRATED RISK MANAGEMENT LIFECYCLE |
- | |
- | [ 1. RISK MANAGEMENT PLANNING ] |
- | │ (Define scope, methodology, roles, scoring thresholds, cadence) |
- | ▼ |
- | [ 2. RISK IDENTIFICATION ] |
- | │ (Uncover threats/opportunities via RBS, workshops, Delphi) |
- | ▼ |
- | [ 3. QUALITATIVE RISK ANALYSIS ] |
- | │ (Evaluate Probability & Impact; P-I Matrix scoring; ranking) |
- | ▼ |
- | [ 4. QUANTITATIVE RISK ANALYSIS ] |
- | │ (Monte Carlo simulation, cost/schedule contingency modeling) |
- | ▼ |
- | [ 5. RISK RESPONSE PLANNING ] |
- | │ (Formulate Avoid/Transfer/Mitigate/Accept; assign Risk Owners) |
- | ▼ |
- | [ 6. RISK MONITORING & CONTROLLING ] |
- | (Track triggers, perform audits, execute fallbacks, retire risks)|
- +-----------------------------------------------------------------------------+
The Six Lifecycle Phases Detailed:
Risk Management Planning: Establishes the governing Risk Management Plan (RMP) . Defines the organizational risk tolerance, scoring thresholds, data sources, workshop schedules, software tools, budgeting for risk activities, and governance hierarchy.
Risk Identification: The exhaustive, systematic process of identifying all potential threats and opportunities that could influence project execution. Uses structured tools (RBS, checklists, Delphi interviews, brainstorming, prompt lists).
Qualitative Risk Analysis: The process of evaluating the relative likelihood (probability) and multidimensional consequences (cost, schedule, quality, safety) of each identified risk. Assigns discrete priority scores using a Probability-Impact (P-I) Matrix to separate high-priority critical risks from low-priority watch list items.
Quantitative Risk Analysis: The numerical modeling of combined risk uncertainties on the project cost estimate and critical path schedule (using probabilistic Monte Carlo simulations, Latin Hypercube sampling, Expected Monetary Value, and sensitivity tornado diagrams) to establish baseline contingency reserves (explored in Chapter 14).
Risk Response Planning: Developing actionable, cost-effective treatment strategies for threats (Avoid, Transfer, Mitigate, Accept) and opportunities (Exploit, Share, Enhance, Accept), assigning dedicated individual Risk Owners , and incorporating mitigation costs into project budgets.
Risk Monitoring and Controlling: The continuous surveillance of project execution to monitor identified risk triggers (Key Risk Indicators), evaluate the effectiveness of implemented response strategies, conduct periodic risk audits, identify newly emerging risks, and formally retire closed risks.
3. Systematic Risk Identification Methodologies
High-performing cost engineering teams avoid unstructured, ad-hoc guessing during risk identification. Instead, they deploy structured, repeatable elicitation techniques:
Identification Technique Operational Mechanics Primary Advantages Limitations / Pitfalls
Delphi Technique Multi-round, anonymous questionnaires administered to independent subject matter experts (SMEs), with aggregated feedback shared between rounds until statistical consensus is reached. Eliminates groupthink, interpersonal politics, and authority bias (dominance by senior executives). Time-consuming; requires disciplined facilitator and committed expert panel.
Structured Brainstorming / Workshops Multidisciplinary team sessions (engineering, procurement, construction, operations, estimating) guided by an experienced risk facilitator using prompt lists. Generates cross-functional synergy; identifies interface and hand-off risks rapidly. Prone to anchoring bias and loud voice dominance if poorly facilitated.
Nominal Group Technique (NGT) Participants independently write down risks silently, followed by round-robin listing and structured group voting/ranking. Balances participation across junior and senior team members; prevents early anchoring. Requires strict adherence to structured meeting rules.
Checklists & Historical Lessons Learned Standardized inventories of risks compiled from historical corporate databases, closeout reports, and AACE technical benchmarks. Fast, repeatable; prevents forgetting recurring historical failure modes. Induces tunnel vision; fails to identify novel or project-specific unique risks.
Ishikawa (Fishbone / Cause-and-Effect) Diagrams Deconstructs a central failure event (e.g., '6-Month Hydrotest Delay') into contributing root causes across categories (People, Machinery, Methods, Materials, Measurement, Milieu). Traces deep root causes rather than superficial symptoms; aids causal statement writing. Can become visually complex and unwieldy for multi-faceted industrial systems.
SWOT Analysis Evaluates internal S trengths and W eaknesses against external O pportunities and T hreats. Integrates strategic enterprise risks with technical project constraints. Qualitative and high-level; lacks granular engineering specificity.
4. Risk Breakdown Structure (RBS) Architecture
The Risk Breakdown Structure (RBS) is a hierarchical, source-oriented decomposition of potential project risk sources. Just as the Work Breakdown Structure (WBS) decomposes project deliverables and the Organization Breakdown Structure (OBS) decomposes organizational accountability, the RBS organizes the universe of risks into structured categories and subcategories. +-----------------------------------------------------------------------------+
- | STANDARD INDUSTRIAL RISK BREAKDOWN STRUCTURE (RBS) |
- | |
- | LEVEL 0: TOTAL PROJECT RISK |
- | ├── LEVEL 1: TECHNICAL & EXECUTION RISKS |
- | │ ├── 1.1 Engineering Complexity & Design Maturity (FEED level) |
- | │ ├── 1.2 Geotechnical, Subsurface & Environmental Site Conditions |
- | │ ├── 1.3 Technology Readiness & Novel Equipment Prototyping |
- | │ ├── 1.4 Constructability, Rigging & Heavy Lift Logistics |
- | │ └── 1.5 Quality, Welding Specifications & Factory Acceptance Testing |
- | ├── LEVEL 1: EXTERNAL & MARKET RISKS |
- | │ ├── 2.1 Commodity Price Volatility (Structural steel, copper, nickel) |
- | │ ├── 2.2 Global Supply Chain & Vendor Manufacturing Lead Times |
- | │ ├── 2.3 Statutory, Permitting & Environmental Regulatory Approvals |
- | │ ├── 2.4 Geopolitical, Currency Exchange & Import Tariff Shifts |
- | │ └── 2.5 Force Majeure, Severe Weather & Natural Disasters |
- | ├── LEVEL 1: ORGANIZATIONAL & ENTERPRISE RISKS |
- | │ ├── 3.1 Corporate Financing, Cash Flow Liquidity & Capital Allocation |
- | │ ├── 3.2 Inter-Project Resource Competition & Craft Labor Availability |
- | │ ├── 3.3 Executive Governance, Sponsor Turnover & Stakeholder Alignment|
- | │ └── 3.4 Contractual Delivery Model Alignment (EPC vs. EPCM vs. IPD) |
- | └── LEVEL 1: PROJECT MANAGEMENT & CONTROLS RISKS |
- | ├── 4.1 Estimating Basis Accuracy & Scope Definition Maturity |
- | ├── 4.2 Integrated Schedule Logic, Float Distribution & Calendars |
- | ├── 4.3 Change Management Discipline & Scope Creep Prevention |
- | └── 4.4 Subcontractor Performance & Interface Management |
- +-----------------------------------------------------------------------------+
The Four Primary Level-1 RBS Domains:
Technical & Execution Risks: Pertain to the physical, engineering, and technological characteristics of the project. Includes design maturity (Front-End Engineering Design [FEED] completeness), novel technology readiness levels (TRL), subterranean geotechnical conditions, constructability constraints, and commissioning complexity.
External & Market Risks: Pertain to external macro-environmental factors beyond the direct control of the project execution team. Includes market commodity pricing, global maritime logistics, foreign currency volatility, changes in environmental legislation, local community opposition, and extreme weather phenomena.
Organizational & Enterprise Risks: Pertain to internal enterprise governance, corporate financing stability, portfolio-level resource competition, labor union relations, corporate restructuring, and commercial contract strategy.
Project Management Risks: Pertain to project controls execution discipline. Includes baseline estimating accuracy, critical path schedule integrity, earned value measurement rigor, scope change control adherence, and communication protocols.
5. The RBS × \times × WBS Integration Matrix
To ensure exhaustive risk coverage across an industrial facility, cost engineers construct an RBS-WBS Risk Matrix . By mapping hierarchical RBS risk categories along the vertical axis against WBS control account deliverables along the horizontal axis, the team systematically interrogates every work package for vulnerability to specific risk sources. +-----------------------------------------------------------------------------+
- | RBS x WBS CROSS-MAPPING MATRIX |
- | |
- | RBS Category / Source | WBS 1.1 Civil | WBS 1.2 Piping | WBS 1.3 Elect|
- | ------------------------- | ------------- | -------------- | -------------|
- | 1.2 Geotechnical / Soils | [RISK] | --- | --- |
- | 1.3 Novel Equipment Tech | --- | [RISK] | [RISK] |
- | 2.1 Commodity Volatility | --- | [RISK] | [RISK] |
- | 2.2 Supply Chain Delay | --- | [RISK] | [RISK] |
- | 3.2 Craft Labor Shortage | [RISK] | [RISK] | [RISK] |
- | 4.3 Scope Creep / RFIs | [RISK] | [RISK] | [RISK] |
- +-----------------------------------------------------------------------------+
Tip
Exhaustive Identification Check: An RBS-WBS Matrix ensures that cross-cutting systemic risks (such as regional skilled pipefitter shortages) are mapped to every impacted control account, while localized physical risks (such as underground sinkholes) are precisely pinned to civil foundation packages.
6. Risk Register Architecture & Syntax Standards
The Risk Register (or Risk Log) is the definitive living management repository that documents all identified risk information throughout the project lifecycle.
The Standardized Cause-Event-Impact Syntax
A cardinal rule of professional cost engineering is to strictly separate the Root Cause , the Uncertain Event , and the resulting Impact . Conflating causes with risks leads to vague descriptions that cannot be effectively mitigated. +-----------------------------------------------------------------------------+
- | STANDARDIZED RISK STATEMENT FORMULATION |
- | |
- | 'Due to [ ROOT CAUSE / EXISTING FACT ], |
- | [ UNCERTAIN EVENT / THREAT OR OPPORTUNITY ] may occur, |
- | which will lead to [ QUANTIFIABLE IMPACT ON COST/SCHEDULE/QUALITY ].' |
- +-----------------------------------------------------------------------------+
Flawed Risk Statement: 'The concrete estimate is a risk.' (This is an un-actionable condition, not an event).
Compliant Risk Statement: 'Due to congested metropolitan traffic and limited on-site batch plant access [Cause], continuous structural concrete pours may experience transit delays exceeding 90 minutes [Uncertain Event], resulting in cold joints, failed cylinder strength tests, mandatory hydro-demolition rework, and an estimated $350,000 cost overrun and 3-week schedule slip [Impact].'
Standard Risk Register Data Schema:
- Field Name Description Example Entry
- Risk ID Unique alphanumeric tracking identifier. RSK-CIV-042
- RBS Code Level-1 / Level-2 classification. 1.2 Geotechnical
- WBS Element Impacted Control Account. WBS 03-120 Foundation Piling
Risk Description Formal Cause-Event-Impact structured statement. Due to high water table [Cause], sheet piling may buckle [Event], causing $200k rework [Impact].
Risk Trigger Observable early warning indicator (Key Risk Indicator). Piezometer reading exceeding +3.5 m hydrostatic head.
Risk Owner Single named individual accountable for monitoring and response. Lead Geotechnical Engineer (J. Martinez).
Pre-Treatment Score Qualitative Probability ( P P P ) and Multi-Objective Impact ( I I I ). P = 4 P = 4 P = 4 (High), I Cost = 4 I_{\text{Cost}} = 4 I Cost = 4 , I Sched = 3 I_{\text{Sched}} = 3 I Sched = 3 → \rightarrow → Composite = High (Red)
Response Strategy Selected treatment method. Mitigate (Pre-install dewatering wellpoints).
Action Plan Discrete mitigation tasks, budget, and deadlines. Procure 4 deep-well pumps ($45,000); install by Oct 15.
Post-Treatment Score Expected Residual Risk rating after response completion. P = 1 P = 1 P = 1 (Low), I Cost = 2 I_{\text{Cost}} = 2 I Cost = 2 → \rightarrow → Composite = Low (Green)
Status Current operational state. Active (Surveillance ongoing)
Important
The Principle of Single Risk Ownership: Every risk in the Risk Register must be assigned to exactly one named individual (the Risk Owner). Shared ownership ('Engineering Team') results in zero accountability. The Risk Owner is responsible for tracking early warning triggers, executing mitigation action plans, and reporting status updates during monthly project controls reviews.