The Risk That Wasn't on the List
A hospital estates team is managing the refurbishment of a radiology suite. Risk identification was done in a single two-hour workshop with the project team, the contractor and the equipment supplier. The register has 34 risks, dominated by construction-phase issues (dust ingress, power isolation, delivery delays). The workshop did not include the radiology clinical lead, the infection control team, or the facilities maintenance manager. Three weeks into construction, the infection control team halts work because the temporary hoarding does not meet the trust's dust-control standard for an adjacent CT scanner. The contractor says the standard was never provided. The clinical lead reveals that the trust had planned to keep one scanner operational throughout, which the project plan assumed would be shut down. The register contains no entry for either issue.
1. Analyse why the identification process failed to surface these two risks, using the concept of stakeholder-derived risk sources.
Read the worked answer
Both failures are stakeholder-omission failures, not analytical ones. Risk identification draws on the knowledge held by people who understand the system; the workshop assembled people who understood the construction, not the operating environment.
- Infection control: the dust-control standard is held by infection control, not the contractor. The contractor cannot comply with a standard it has not been given, and the project team did not know to ask. The risk (work stoppage from non-compliant hoarding) was entirely foreseeable to one absent stakeholder.
- Clinical continuity: the assumption that the scanner would be shut down was never tested against the clinical lead's actual operating plan. This is an assumption-based risk - the plan embedded an unvalidated assumption that only the clinical lead could confirm or refute.
The 34 risks are skewed to construction because the participant list was skewed to construction. A register's content is a mirror of who was in the room. The two-hour, single-session format also gave no structured prompt (e.g. assumptions analysis, interface analysis) that would have exposed the continuity assumption.
2. Recommend how the identification approach should be redesigned for the remainder of the project and for similar future schemes. Be specific about methods, not just 'involve more stakeholders'.
Read the worked answer
Immediate (this project)
- Convene a targeted workshop with infection control, the clinical lead, and facilities maintenance. Use assumption analysis on the plan: list every assumption about how the hospital will operate during works and have each stakeholder confirm or challenge it.
- Run an interface analysis across the construction/clinical-operations boundary - the two failures both sit on that interface.
- Add a standing item to the project board: 'what has changed in the operating environment?'
Structural (future schemes)
- Define the stakeholder set by risk source, not by contract: who owns the standards, who owns the operations, who owns the interfaces?
- Use multiple identification techniques rather than one workshop: structured interviews with absent-but-critical stakeholders, checklist/prompt lists tailored to healthcare estates, and a review of lessons from prior schemes.
- Give external parties (contractor, supplier) the trust's standards as an input to identification, so they can identify compliance risks themselves.
- Record the participant list and the techniques used alongside the register, so gaps in coverage are visible at review.
The test of the redesign is whether a future register contains entries that could only have come from a clinical or infection-control perspective.