Avoiding Risk

1. Risk is decided early

The cheapest moment to avoid a risk is before you've committed to it, and the most common error at that moment is optimism. Planners take the "inside view", building up from the details of this project, and the inside view almost always comes in low. The correction is the outside view: how did similar projects, plants or rollouts actually go? Start there, then adjust. CM-RSK-02 · CM-RSK-01

Three habits make early risk visible:

• A pre-mortem. Before committing, imagine the project failed and have each person write down why. It surfaces risks people were reluctant to raise, and it takes twenty minutes. CS-03
• Honest ranges. An early estimate is a range, set by risk analysis, not a number with "plus or minus 5%" typed beside it. Systemic risks such as unclear scope and complexity dominate early, and rarely appear on a risk register. CM-RSK-03 · CM-RSK-04
• A capacity check. Ask what happens to the organization, not just the project, if it goes badly: bonding, cash, covenants, key people. FIN-CON-05 · FIN-FPA-04

Be wary of the famous numbers used to justify decisions. "1-10-100", "70% of transformations fail", "9.2% value leakage", "rework is 30% of construction": each is either folklore or a figure stripped of its context. Build the case from your own data and named sources. QMS-COQ-01 · VCM-EVD-01 · QMS-RWK-03 · CM-EVD-01

Consider a manufacturer deciding whether to add a second production line. The inside view says eighteen months and a known budget, built up from equipment quotes. The outside view asks how the last three line installations in the company, and comparable ones at peer plants, actually went: how long commissioning took, how long it took to reach rated output, what broke in the first year. If the answer is "six months longer than planned, and output at 70% for the first quarter", that belongs in the business case now, along with the training and maintenance staffing that the quotes leave out. CM-RSK-02 · DM-WRK-04

2. Put the strongest controls where mistakes can't be undone

Not every step deserves the same scrutiny. The principle that runs through quality, safety, plants and software is the same: tier controls by consequence, and concentrate them where a mistake can't be reversed. QMS-ARC-03

• On site: hold points before concrete, grout or cladding conceals the evidence, defined in the contract so nobody argues about them at 6 AM. QMS-ITP-02 · QMS-ITP-03
• In design: remove hazards at the drawing board, such as permanent anchor points, parapet heights and prefabrication that cuts work at height, rather than relying on people to manage them later. Falls caused about 38% of US construction deaths in 2024. CM-SAF-03 · CM-SAF-01
• In plants: treat every change to control logic as a change, through review, simulation and management of change, and never let AI-written code act as a safety function. SOP-GOV-03 · PRM-MFG-01 · PRM-MFG-02
• In software: roll out in stages with automated health checks. One cloud provider's staged-rollout system blocked 99.2% of bad rollouts before they reached most customers. SWD-REL-03
• Everywhere: set stop-work conditions in advance and back people who use them. A stop condition decided in the moment, under schedule pressure, rarely gets used. SOP-USE-03

The corollary is just as important: don't spend control effort on what's cheap to undo. Teams that put every step through the same heavy process train people to treat all controls as paperwork, including the ones that matter.

Finding the irreversible steps is a short exercise, best done with the people who do the work. Walk through the process, whether a pour, a cutover, a shutdown or a contract award, and at each step ask: if this is wrong, can we undo it, and at what cost? Mark the steps where the answer is "no" or "only at great cost". Those are where the hold points, second checks, simulations and sign-offs belong. Everything else gets the lightest control that works. Most teams find that a handful of steps carry most of the risk, and that some of their heaviest controls sit on steps that are easy to reverse. QMS-ARC-03 · QMS-ITP-01

3. Build a way back

Many risks can't be prevented, only made recoverable. The question to ask of every plan is: if this goes wrong, how do we undo it, and have we tried?

• Rollback over repair. In a study of high-severity incidents at a major software company, nearly 80% of bug-caused incidents were fixed by rolling back or failing over, not by writing a fix. Invest in rollback, kill switches and monitoring before you need them. SWD-INC-01 · SWD-INC-02
• Manual and degraded modes. Plants, hospitals and offices that can run on paper for a day survive outages that stop others. Write the procedure, and rehearse it. CYBER-11
• Backups you can restore. Keep immutable, offline copies, including of identity systems, and test full restores, not just backup jobs. CYBER-09 · CYBER-10
• Exits in contracts. Negotiate how you leave a vendor, in which data formats and how fast, while you still have leverage, before signing. CYBER-15 · CDE-03
• Off-ramps in delivery. Where scope is uncertain, a progressive design-build contract with an off-ramp lets both sides stop before the price is locked. CM-DEL-06

A way back you haven't rehearsed is a hope. Exercises, tabletops and restore tests turn it into a capability. CYBER-13 · GL-16

Rehearsals don't need to be elaborate. A ninety-minute tabletop once a quarter, built around a realistic scenario such as the scheduling system down on pour day, a key supplier insolvent or a control system change gone wrong, will expose the gaps: the phone numbers nobody has, the backup nobody has restored, the decision nobody knows they own. Write down what you found, fix the three most important gaps, and run a different scenario next quarter. The goal isn't a perfect performance; it's finding the problems while they're cheap. CYBER-13 · CYBER-01 · #61

4. Share risk on purpose

Contracts and supply chains decide who carries which risk, whether anyone meant them to or not. Make the allocation deliberate:

• Tier your vendors by the consequence of their failure, and put the full checks (financial, quality, security) on the critical few. VCM-SUP-01 · VCM-SUP-02
• Allocate price and tariff risk in writing. Index volatile materials with stated triggers, and treat changes in law as compensable changes. VCM-PRC-01 · VCM-PRC-02 · VCM-PRC-03
• Flow obligations down with a signed matrix: security, privacy, due diligence and information requirements reach the sub-tiers only if the contracts carry them. VCM-CMP-01 · NIST-SUP-02
• Read a vendor's assurance report fully. It covers the vendor's half of the controls and assumes you run yours. FIN-TEC-03
• Run a notice register. Many risks transfer silently when a notice deadline is missed: a non-payment notice, a claim time bar, an early warning. VCM-ADM-01

Choose security instruments knowingly, too. Surety bonds and subcontractor default insurance move different risks to different parties, and no independent data compare their default rates. VCM-PAY-03

The cost of leaving this to chance shows up when a key subcontractor gets into trouble. If the mechanical subcontractor on a hospital job stops paying its suppliers, the general contractor who tiered its vendors already knows it's a critical trade, has been watching its payment behaviour, holds a bond or default insurance chosen for this risk, and has a notice register that shows exactly which deadlines are running. The one who didn't finds out from a supplier's lien, scrambles for a replacement at a premium, and discovers the contract never said who carries the delay. VCM-SUP-01 · VCM-PAY-01 · VCM-ADM-01

5. Watch the signals that come before the failure

Lagging measures such as injuries, overruns, outages and claims tell you about risk after it's arrived. Leading signals give you time to act:

• Safety: pre-task plan quality, near-miss and good-catch reports, how fast corrective actions close, and verified controls on high-energy hazards. CM-SAF-02
• Schedule: Percent Plan Complete and the reasons commitments are missed; and schedule pressure itself, which drives risk-taking. CM-LEAN-02 · CM-LEAN-03 · CM-SAF-06
• Quality: repeat nonconformances, corrective actions closed without evidence, and hold points bypassed. QMS-ARC-04 · QMS-ITP-04 · QMS-CAP-03
• Assets: condition and criticality, not age. A healthy old chiller isn't a risk; a failing cooling-tower fan bearing is. FAM-MNT-04 · FAM-MNT-01
• Systems: service levels defined by what users experience, with an agreed rule for what happens when reliability runs out. SWD-SLO-01 · SWD-SLO-02

A signal is only useful if someone acts on it. Keep a risk register small enough to read, delete risks nobody would act on, and tie numbers to actions agreed in advance. FIN-RSK-03 · FIN-RSK-04

Signals also travel across disciplines, which is where they're most often lost. A falling Percent Plan Complete is a schedule signal and a safety signal. A run of rushed corrective actions is a quality signal and a sign of a team under pressure. A vendor missing deliveries is a supply signal and possibly a solvency signal. A short weekly review that puts the site, quality, commercial and safety signals on one page, with the people who own each in the room, catches combinations that each discipline's report alone would miss. CM-LEAN-03 · CM-SAF-06 · #20

6. When it happens anyway

Even well-run organizations have bad days. What separates a bad day from a disaster is mostly decided before it starts:

• Pre-assign decision rights in a short plan, so nobody spends the first hour arguing about who decides. CYBER-01
• Give the incident roles: someone in command, someone running the fix, someone communicating. SWD-INC-03 · SWD-INC-04
• Mitigate first, understand later. Restore safety and service before chasing the root cause. SWD-INC-01 · NIST-OTX-03
• Pool information before deciding, and keep a timestamped log of decisions and why. CS-08 · CYBER-18
• Tell people early and honestly, on a channel that works when your systems don't. CYBER-24 · CYBER-12

Imagine a plant at 2 AM: a packaging line stops, the control screens show alarms nobody recognizes, and the night supervisor can't reach the controls engineer. A prepared site has a one-page plan on the wall that says who decides whether to shut the line down, how to run in a safe manual mode, and who to call next. The supervisor makes the call, logs the time and reasons, isolates the line, and posts an update to the morning shift. Nobody is guessing, and the investigation the next day starts from a clear record rather than recollections. CYBER-01 · CYBER-11 · CYBER-18

Afterwards, learn properly. Review the conditions that combined, not the person who happened to be nearest; root-cause tools generate hypotheses, so require evidence for each link. Then close the loop: give actions owners and dates, and check whether the problem came back. The most common failure in quality, safety and software alike is an action closed on paper that never prevented anything. SWD-INC-05 · SWD-INC-06 · QMS-RCA-02 · QMS-CAP-03 · SWD-INC-07

One last habit ties the guide together: share what you learned beyond the team that had the incident. The site that nearly lost a crane lift, the plant whose backup wouldn't restore and the project that missed a notice deadline each learned something other teams will need. A short, blame-free summary of what combined to cause the event, and what changed as a result, circulated across disciplines, turns one team's bad day into everyone's warning. Organizations that do this consistently find that their near-miss reports go up and their serious events go down, because people see that reporting leads to fixes rather than to blame. CM-SAF-02 · #33 · #64

The habits. Start from the outside view. Run a pre-mortem. Concentrate controls where mistakes can't be undone. Build and rehearse a way back. Allocate risk in writing and keep a notice register. Watch leading signals and act on them. Pre-assign decisions, mitigate first, communicate early, and learn without blame.