Tunnel Project Risk Matrix and Community Consultation
A joint venture is building a 3.2 km tunnel. The risk team uses a 3×3 matrix (low/medium/high) to rank 18 risks. Two risks both score 'high': 'unexpected geological fault' and 'community protest blocking site access'. The team treats geological uncertainty by buying insurance, but the policy excludes consequential loss and delay costs. Community communication consists of a one-off letter to 400 households; no meetings are held. Monitoring happens in monthly progress meetings, where risk is discussed only if time permits. A geotechnical adviser says the fault probability is uncertain because only two boreholes were drilled. The project director asks whether the risk process provides a sound basis for decisions.
1. Evaluate the limitations of the 3×3 matrix for these two risks.
Read the worked answer
The matrix gives both risks the same label but hides material differences. 'Unexpected geological fault' has high uncertainty because only two boreholes were drilled; its consequence may include delay, cost overrun, safety and contractual claims. 'Community protest' has social and political drivers, may escalate quickly, and can be influenced by engagement. A 3×3 matrix cannot show velocity, controllability, detectability, confidence in the estimate or the difference between financial loss and schedule disruption.
Because both are 'high', decision-makers may treat them as equivalent and allocate attention by label rather than by manageability. The matrix also lacks defined criteria for what 'high' means, so different assessors may score differently. ISO 31000 does not require a particular matrix, but it requires analysis that supports evaluation against criteria. The team should supplement the matrix with narrative descriptions, confidence ratings, consequence types and velocity. For the geological risk, the low number of boreholes should be recorded as an information limitation that affects confidence.
2. Assess the treatment for geological uncertainty.
Read the worked answer
Insurance is a transfer option, not a complete treatment. The policy excludes consequential loss and delay costs, which are likely to be among the largest consequences of a fault. Buying insurance therefore reduces some financial exposure but leaves schedule, contractual and reputation consequences largely untreated.
ISO 31000 expects treatment options to be selected based on the risk and evaluated for residual risk. The team should consider reducing uncertainty through additional boreholes or geotechnical testing; reducing consequence through schedule float, flexible tunnel alignment, contractual provisions and contingency budget; and sharing risk through appropriate insurance or joint-venture arrangements. Avoidance may not be feasible at this stage, but the option should be documented.
The treatment plan should state expected effect, owner, cost and trigger for review. If residual risk remains high after these measures, it should be escalated with a documented acceptance decision. Insurance alone gives a misleading impression that the risk is handled.
3. Recommend improvements to communication, consultation and monitoring.
Read the worked answer
Communication and consultation should be planned, two-way and ongoing. A one-off letter to 400 households is information-giving, not consultation. The project should identify affected groups, local authorities and community representatives; hold accessible meetings; provide a clear route for complaints and questions; and record concerns and commitments. Consultation should feed into risk identification and treatment - for example, construction traffic, noise, vibration and access - rather than being treated as public relations.
Monitoring should be proactive and assigned. Leading indicators could include borehole results, ground settlement readings, complaints and enquiries, attendance at community meetings, and progress against agreed commitments. Triggers should be defined: for example, a specified settlement threshold or a cluster of complaints requires review. Monthly progress meetings are too weak if risk is discussed only when time permits; a standing risk review with owners and actions should be held.
ISO 31000 expects monitoring and review to cover both risks and the effectiveness of treatment, with results recorded and reported. The project director should require a short monthly risk dashboard and a clear escalation route.