Construction Risk Assessment: How to Identify and Manage Project Risk

Every construction project carries risk - some of it physical and safety-related, some of it commercial, and some of it buried in the ground before a single brick is laid. A construction risk assessment is the structured process of identifying what could go wrong on a project, judging how likely it is and how serious the consequences would be, and deciding what to do about it before it happens.

For quantity surveyors and commercial managers, risk assessment is not just a site safety exercise handed to the health and safety officer. It underpins cost planning, contract drafting, subcontractor procurement, cash flow forecasting and claims defence. A well-run risk assessment process is one of the clearest markers of a mature commercial team, and it directly protects margin on a sector where, according to recent UK delivery data, the majority of projects still finish late or over budget.

This guide covers what construction risk assessment actually involves, the legal framework behind it under CDM 2015, the main categories of risk a QS or commercial manager needs to track, a practical step-by-step process for carrying one out, and how to build and maintain a risk register that actually gets used rather than filed and forgotten.

Whether you're new to commercial management or refreshing your approach ahead of a large scheme, treat this as a working reference you can return to when scoping risk on your next project.

What Is Construction Risk Assessment?

Why it matters for QS and commercial managers

Construction risk assessment sits at the intersection of health and safety law and commercial management. On the safety side, it is a legal duty: employers must assess the risks to which employees and others are exposed, and where five or more people are employed, the significant findings must be recorded in writing. On the commercial side, it is simply good practice - and increasingly, a contractual requirement written into NEC4 and JCT frameworks, where early warning and risk register clauses expect the contractor and employer to actively manage known and emerging risks rather than wait for them to materialise as claims.

For a quantity surveyor, risk assessment feeds directly into cost planning and contingency setting. A tender allowance without a proper risk assessment behind it is a guess dressed up as a number. For a commercial manager running live contracts, the risk register is the tool that turns vague unease about a subcontractor's cash position, a design gap, or a weather-sensitive programme into something that can be tracked, escalated and priced. Skipping this step doesn't remove the risk - it just means it gets discovered later, usually at the worst possible moment and the highest possible cost.

• Protects contingency and cost planning by pricing known uncertainty rather than guessing at it
• Satisfies legal duties under CDM 2015 and the Health and Safety at Work etc. Act 1974
• Supports contractual compliance with NEC4 early warning and JCT risk allocation clauses
• Creates a paper trail that defends against disputes, delay claims and insurance issues
• Improves subcontractor and supply chain decisions by surfacing financial and delivery risk early

The Legal Framework: CDM 2015 and the HSE Five-Step Method

Who is legally responsible

In Great Britain, construction risk assessment for health and safety is governed primarily by the Construction (Design and Management) Regulations 2015 (CDM 2015), enforced by the Health and Safety Executive (HSE). CDM 2015 places duties on every party involved in a project - clients, principal designers, designers, principal contractors and contractors - to plan, manage and monitor health and safety risk throughout the project lifecycle, not just once construction starts on site. The principal designer, for example, must identify and eliminate or control foreseeable risks during the design stage, before those risks are ever built into the works.

Most practical risk assessments in UK construction follow the HSE's five-step method, because it is simple, repeatable and defensible if an assessment is ever challenged after an incident or inspection. The five steps are: identify the hazards; decide who might be harmed and how; evaluate the risks and decide on precautions; record your findings and implement them; and review the assessment and update it as work progresses. HSE inspectors expect risk assessments and Risk Assessment Method Statements (RAMS) to be site-specific, regularly reviewed, and genuinely understood by the workforce carrying out the work - a generic template copied from the last job will not satisfy scrutiny.

The Main Types of Risk on a Construction Project

Safety and site risk

This is the most familiar category: falls from height, moving plant, manual handling, hazardous substances (covered separately under COSHH), noise, vibration and asbestos in refurbishment work. These risks are assessed through RAMS and site-specific method statements, reviewed at each stage of the works.

Commercial and cost risk

Price inflation on materials, subcontractor insolvency, inaccurate quantities, and unpriced provisional sums all sit squarely in the QS's territory. UK tender price inflation was forecast at around 3.0% for 2026 alone, with building costs projected to rise 13.1% and tender prices 15.5% over five years - numbers that make contingency planning and early cost risk assessment essential rather than optional. Subcontractor failure is a live risk too: construction has accounted for roughly 17% of all UK corporate insolvencies for several years running, despite representing only around 14% of registered businesses, so financial due diligence on the supply chain is itself a risk-management task.

Programme risk

Delay is now closer to the norm than the exception on UK projects. Industry delivery data has reported that a large majority of projects run beyond their original programme, with UK infrastructure schemes in particular facing lengthy pre-construction phases and high rates of both delay frequency and severity compared with international peers. Weather, late information, statutory approvals, utility diversions and access constraints are the recurring culprits and each deserves its own line in a risk register rather than being lumped together as "delay".

Design and technical risk

Incomplete design at tender, buildability issues, ground conditions that differ from the site investigation, and coordination clashes between disciplines all create risk that crystallises as variations, extensions of time or defects if not caught early. Ground risk in particular is notoriously underpriced - a site investigation that stops short of full coverage can leave contamination, made ground or archaeological finds as an expensive surprise.

How to Carry Out a Construction Risk Assessment: A Step-by-Step Process

The HSE's five-step method works as well for commercial risk as it does for site safety, provided it is applied with a commercial lens. In practice, most experienced QS and commercial teams run a version of the following process at each project stage - tender, pre-construction, and throughout delivery - rather than treating it as a single one-off exercise.

A useful discipline is to run this process jointly with the site team rather than as a desk exercise. Operatives and subcontractor supervisors often spot practical risks - access sequencing, plant conflicts, storage constraints - that don't show up on a drawing. On the commercial side, involving the buyer or procurement lead early means supply chain and price risk gets flagged before packages are let, not after.

Building and Maintaining a Risk Register

The risk register is the working document that turns assessment into action. A good register is short enough that people actually read it. Still, detailed enough to be useful: each entry needs a clear description, a category, a likelihood and impact score, an owner, a mitigation or contingency plan, and a review date. Registers that try to capture every conceivable risk in exhaustive detail tend to get abandoned - the goal is to track the risks that matter, not to produce an exhaustive academic exercise.

On live contracts, the risk register should be a standing item at monthly commercial and progress meetings, not a document opened only when something has already gone wrong. Under NEC4 in particular, the early warning mechanism effectively forces this discipline - either party can register a compensation event risk early, and both are expected to meet and discuss mitigation before it becomes a formal claim. JCT contracts don't mandate the same live process, but experienced commercial managers run an equivalent register anyway, because the alternative is discovering the risk only when it appears as a variation or an extension of time claim.

Common Mistakes in Construction Risk Assessment (and How to Avoid Them)

Most weak risk assessments fail for predictable reasons rather than exotic ones. The most common mistake is treating risk assessment purely as a health and safety compliance exercise and leaving commercial risk out of the process entirely - a project can be fully RAMS-compliant on site and still lose money because nobody assessed subcontractor solvency or material price exposure. The second most common failure is genericism: copying a risk register or method statement from a previous, dissimilar project, which HSE inspectors and experienced clients both spot immediately.

• Treating risk assessment as a one-off form rather than a live process reviewed at every stage
• Failing to score risks, so nothing gets prioritised and contingency becomes a flat guess
• No named owner on individual risks, so mitigation actions never actually get actioned
• Ignoring commercial and supply chain risk in favour of safety risk alone
• Site teams and commercial teams keeping separate, unshared risk logs
• Registers that are updated at tender stage and never touched again during delivery

The fix for most of these is structural rather than technical: build the risk register into the standing agenda of monthly commercial and progress meetings, give every risk a named owner who is accountable for updates, and make sure the QS or commercial manager has visibility of the safety risk register just as the site team has visibility of the commercial one. Risk assessment works best as a shared discipline across the whole project team, not a siloed task owned by a single department.

Frequently Asked Questions

What is a construction risk assessment?

A construction risk assessment is a structured process of identifying hazards and uncertainties on a project, assessing how likely they are and how serious their impact would be, and deciding how to eliminate, reduce, or manage them. It covers both legally required health and safety risk and commercial risks such as cost, programme and supply chain exposure.

Is a risk assessment a legal requirement in UK construction?

Yes, for health and safety risk. Under the Construction (Design and Management) Regulations 2015 and the Health and Safety at Work etc. Act 1974, employers must assess risks to employees and others, and record the significant findings in writing where five or more people are employed. Commercial risk assessment isn't a legal duty in the same way, but it's expected practice and increasingly built into NEC4 and JCT contract clauses.

What is the HSE's five-step approach to risk assessment?

The five steps are: identify the hazards, decide who might be harmed and how, evaluate the risks and decide on precautions, record your findings and implement them, and review the assessment regularly. It's the most widely used framework in UK construction because it's simple, repeatable and defensible under inspection.

Who is responsible for risk assessment on a construction project?

Responsibility is shared under CDM 2015. The client ensures time and resources are available, the principal designer manages risk during design, designers eliminate risk arising from their decisions, and the principal contractor and subcontractors manage risk during construction, including producing task-specific RAMS.

What's the difference between a risk assessment and a risk register?

A risk assessment is the process of identifying and evaluating risk; a risk register is the document that records the output - each risk, its likelihood and impact score, an owner, a mitigation plan and a review date. The register should be a living document updated throughout the project, not a one-off deliverable.

How do quantity surveyors use risk assessment in cost planning?

QS teams use risk assessment to set evidence-based contingency rather than an arbitrary percentage, to price provisional sums against genuine ground and design uncertainty, and to assess subcontractor financial risk before packages are let. It also supports early warning and compensation event management under NEC4.

How often should a construction risk register be reviewed?

At minimum, at every major project milestone and as a standing item at monthly commercial and progress meetings. High-risk items - such as ground conditions during early groundworks or subcontractor financial health - may need weekly review during the periods when they are most active.

Final Thoughts

Construction risk assessment only works if it's treated as an ongoing commercial discipline rather than a document produced once and filed away. The projects that consistently hit budget and programme in a sector where delay and overrun are now closer to the norm than the exception are, almost without exception, the ones where risk is actively owned, scored and reviewed by the whole project team - not just the site safety file.

For quantity surveyors and commercial managers specifically, getting comfortable with risk assessment pays off well beyond compliance. It sharpens contingency setting, strengthens your position in contract negotiations and early warning discussions, and gives you an evidence-based answer when a client or director asks why a number in the cost plan looks the way it does.

Want the full picture? Want to sharpen your commercial risk skills further?

For more on the frameworks that shape how risk gets allocated and priced, see our guides to NEC vs JCT Contracts Explained, CDM Regulations 2015 Explained, and Elemental Cost Analysis in Construction for how risk-informed contingency feeds into a robust cost plan.