Risk, quality and procurement management
Risk
Risk is an uncertain event or condition that, if it occurs, affects objectives. It is not an issue: an issue has already happened and is managed in the issue log. The risk process is identify, analyse, plan responses, implement and monitor. Qualitative analysis uses probability and impact; quantitative analysis may use EMV = probability × impact. Response strategies for threats are avoid, mitigate, transfer, accept and escalate; for opportunities they are exploit, enhance, share and accept. Transferring risk through insurance or a fixed-price contract does not remove it; it allocates financial consequence. Record residual and secondary risks.
Quality
Quality management covers planning, assurance and control. QA is process-focused and preventive; QC is product-focused and detective, using inspections and tests. Cost of quality = prevention + appraisal + internal failure + external failure; prevention is usually cheapest. Use PDCA for improvement, and define quality metrics and acceptance criteria before execution.
Procurement
Make-or-buy analysis decides whether to deliver internally. Contract type allocates risk: firm fixed price favours the buyer when scope is stable; cost-reimbursable favours the seller; time and materials suits small, evolving work with a cap. Procurement documents must state evaluation criteria, weights and minimum requirements. Administer contracts with performance reviews, payment controls, change control and closeout.
Worked example
A supplier bid is fixed price €400,000; a cost-reimbursable option estimates €360,000 plus an 8% fee. If scope is well defined and the buyer can bear design changes, fixed price caps cost but may attract a risk premium. If scope is uncertain, cost-reimbursable reduces the chance of disputes but gives the seller less incentive to control cost. The PM should compare total expected cost including likely change costs, not just the bid number.
Traps
- Treating a risk as closed because a response was planned; close only after monitoring confirms it is no longer relevant.
- Using EMV as the only criterion; it ignores risk appetite and catastrophic tail risk.
- Calling QC quality assurance because both involve inspections.
- Assuming the lowest bid is best value; evaluate against weighted criteria.
- Forgetting contract closeout and final acceptance.