Implementation of Risk Management in Malaysian Construction Industry : Case Studies

Construction industries are exposed to wide array of risks, such as financial, design, and contractual ones, whichmight have a direct impact on their performance toward achieving the desired objectives. RiskManagement is a proactive decision-making process used to minimize and manage the risks in the most efficient and appropriate manner. However, most construction firms in Malaysia do not apply formal risk management in their projects. Thus, this study aims to identify the actual process of risk management that is being applied in the construction projects and to determine the effects of risk management implementation on the performance of the construction projects in terms of time and cost. The data were obtained from four case studies in Kuala Lumpur, Malaysia, through semistructured interviews. It was found that the implementation of risk management process in Malaysian construction industry is still at a low level, mainly due to the fact that most of the construction employees involved in risk management are not fully aware of the available risk management techniques that can be applied in construction projects.


Introduction
According to Smith et al. [1], risk is an unforeseen event that occurs during the process of construction projects.Studies show that construction industry is subject to more risks and uncertainties than any other industries [2].The reason for that is mainly due to the complex nature of construction business activities, processes, environment, and organization [3].In fact, risk in construction industry has been the object of attention because of time and cost overruns associated with construction projects [4].The construction industry is wellknown for being full of projects that were completed with significant cost overruns [5].It has been reported that many construction projects have exceeded their initial budgets with cost increase in the range of 50-100% and sometimes beyond 100% [6].The risks that occur in construction projects will usually lead to inability to achieve the desired project objectives.Delays, cost overruns, and reduction of quality of projects are the common negative effects of risk inherent to construction projects.Failure to manage such risks might further result in financial loss, damage of reputation, and loss of future business.Thus, a systematic risk management must be implemented to deal with the risk associated with construction projects.
Risk management is an essential part of construction projects which aims at identifying the potential risks associated with a project and responding to those risks to reduce them to an acceptable extent [7,8].Risk management is indeed a dynamic tool which must be continuous throughout the project life cycle, and it is based on intuition and past experience for a high level of judgment.There are three main processes in risk management which are risk identification, risk analysis, and risk response [1,[9][10][11].It should be borne in mind that the main principle of risk management is not about eliminating the whole risks but to control them properly [12].The construction project is overwhelmed by many predictable and unpredictable risks due to different sources of uncertainty, which include the performance of construction parties, resources availability, environmental conditions, involvement of other parties, and contractual relations.The main objectives of risk management in a construction project include completing the project within the specified cost and time and within the required quality, safety, and environmental limits [13].Systematic risk management practices are essential in order to handle and manage risks so that the success of projects can be ensured [14].In fact, having systematic risk management results in the early detection of risks where there is no more need for contingency plans to cover almost every eventuality.Hence, limited resources can only be concentrated on the major risks to achieve maximum effects.Adnan et al. [15] revealed that, for an ideal risk management, a prioritization process should be carried out whereby the risks with greatest loss and the greatest probability of occurring are handled first and risks with lower probability of occurrence and lower loss are handled later.
Construction industry is one of the most challenging and dynamic industries in Malaysia.This industry is different from other industries due to its unique and complex features.The factors of type, size, duration, diversity, players, and location would contribute to such differences which are the reasons for construction industry being exposed to many risks.In Malaysia, risk management has been implemented since early 1990s [16].However, not all companies have established their own risk management departments.Moreover, due to insufficiency of relevant data, most of the Malaysian construction firms still do not apply risk management in their construction projects [17].Given that risks can have major impacts on the outcomes of the construction projects, the objectives of this study are to identify the current tools and techniques used in risk management during the construction and to determine the effects of risk management implementation on the performance of the construction projects in terms of time and cost.

Research Methodology
The methodologies used in this study include comprehensive literature review as well as semistructured interviews.A comprehensive literature review was conducted through relevant books, academic research journals, academic dissertations, and online database.Then, four interviews were carried out in order to obtain information and opinion about the process of risk management implemented in four on-going construction projects in Kuala Lumpur, Malaysia.
The case study is defined as a research strategy or an empirical inquiry that investigates a phenomenon within its real-life context.Case study research includes single or multiple case studies.In multiple case studies, researchers study cases individually in depth as well as looking across cases for similarities and differences [18].In qualitative study, reliability refers to "the degree of consistency with which instances are assigned to the same category by different observes or by the same observers on different occasions" [19].In addition, according to Silverman [20], the reliability of a qualitative method can be enhanced by comparing the analysis of the same data by several observers.Therefore, this research obtained data from four case studies in Kuala Lumpur, Malaysia, through semistructured interviews with four expert observers to ensure the accuracy and reliability of the data.Moreover, this study used information-oriented sampling for the case selection and interviewees were chosen based on a purposive sampling so that the respondents include one site engineer of the project (the first case study) and three project managers (other case studies) who have been directly involved in construction industry for at least some years.

Case Studies Procedures (i) Design Case Studies Protocol. A draft of the protocol was developed as follows:
(a) Overview of the case study projects: this includes project objectives, case study issues, and presentations about the topic under study.
(b) Field procedures: reminders about procedures, credentials for access to the sources, and location of sources.
(c) Case study questions: the questions that should be asked from the interviewees for data collection.
(d) A guide for the case study report: the outline and format for the report.
(ii) Conduct Case Studies.Interview is one of the most important sources of case study information.In open-ended interviews, the researchers have the chance to gain sufficient information as well as personal opinion regarding the topic under study.This could serve to corroborate previously gathered data.In this study, four interviews were conducted for the four case studies.The lists of the case studies are presented in Table 1.
(iii) Analyze Case Studies Data.The collected data from the interviews was documented, and the findings were rationalized with the information from the literature review.

Case Study 1.
The first case study is about the construction of one additional block which consists of 11 storeys including an auditorium and other facilities in the Faculty of Built Environment, University of Malaya.This construction site is located at Lot 5270, Jalan Lingkungan Budi, University of Malaya, Kuala Lumpur.This case study has been conducted through a semistructured interview with the Site Engineer of the project who has been involved in the construction industry for four years.
The Site Engineer stated that, in this project, project manager is the one who is responsible for managing the project including its risks.When the project manager is proactive, the project team will also participate in risk management implementation.In this project, by holding technical site meetings, the project team takes part in managing risks.These monthly meetings use critical path method (CPM) and Scurve to identify risks and uncertainties that might be or have occurred in the project and have saved us time and cost.
Critical path method (CPM) is one of the project management tools that models the activities and events of a project as a network.It shows the sequence in which activities have to be undertaken first and sets out all the individual activities that make up a larger project.Thus, by using CPM, it will be easier for the project manager to monitor the construction works on site.
According to the Site Engineer, CPM becomes really helpful because project manager and project team use CPM in the meeting to detect any problems that may arise during the construction progress especially delay problem.In this project, the project team has made an estimation of the elapsed time for each of the construction activity, which is the time taken from commencement to completion.Thus, CPM helps the project team to depict the various activities that have to be accomplished clearly so that the project can be completed in a timely fashion.
Delay is considered as one of the major risks in construction projects and should be avoided as early as possible because the impact of this risk is very high to both contractor and client.CPM is a tool that combines the principle of risk identification and risk analysis where risk identification is applied by looking at the critical path itself which is a route through the CPM.If there is float which causes delay, project team will analyze the CPM, so they will know the potential impacts of the float on the whole project in case no action is taken.To help catch up on the delayed activity, sometimes, construction employees are switched from another activity to the delayed activity.
According to the Site Engineer, the project team use Scurve to monitor the project as it progresses.He mentioned that S-curve is being used as an indicator in identifying risks and, by using this, we can determine whether the project can be completed within the time and budget limitations.This curve is also being used to determine the possible dangers of any given course of action.In the technical site meetings, which are being held every month, the S-curves are also generated.The various types of S-curves that are being used in this project are (i) Cost versus Time S-curve, (ii) Target S-curve, (iii) Value and Percentage S-curve, and (iv) Actual S-curve.
The S-curve is a well-known project management tool.The name S-curve derives from the S-like shape of the curve, flatter at the beginning and end, and steeper in the middle, as most of the construction projects look like this [21].Generally, S-curve consists in a display of cumulative costs, labour hours, or any other quantities plotted against time.Even though the techniques used in this project are for project management rather than risk management, yet project manager together with the project team could still manage and handle risks in this project rigorously.

Case Study 2.
The second case study is a construction project for an eight-storey complex of Institut Pengurusan Penyelidikan dan Perundingan (IPPP) and also a Research Laboratory in University of Malaya, Kuala Lumpur.This case study has been conducted through a semistructured interview with the Project Manager of this project who has 11 years of experience in the management of construction projects.
The Project Manager claimed that although it is believed that risks are handled by the project manager, in reality, it is not only the responsibility of the project manager alone and everyone involved in the construction project should contribute to risk management.Yet the level of involvement depends on the level of the organization.
The Project Manager also mentioned that the one and only technique used by this project team in identification of risks is SWOT analysis.The outputs of a SWOT analysis provide key inputs for creating the project plans.When the set of activities of the project are being outsourced, project team will use SWOT analysis to determine the risks and also consider any opportunities associated with each outsourced vendor.
First stage of risk management is risk identification.SWOT, which is an acronym for strengths, weaknesses, opportunities, and threats, is a strategic tool used to access a situation or to make critical decisions that are related to planning and risk management [22].SWOT analysis can aid project team in identifying project risks.This analysis is planned and established at the beginning phase of the project, and this tool will be updated with current information during weekly meeting.In the SWOT analysis, a grid template as shown in Table 2 is used.Each part in the grid has one of the SWOT headings: strengths, weaknesses, opportunities, and threats.When there is a meeting, this SWOT analysis will be used where each part of the grid is populated.
The Project Manager stated that after the project risks have been identified, we made a risk analysis during the weekly project meeting.Almost every week we examine the SWOT analysis and produce weekly work programme.Each activity planned in the work programme will then be monitored and if there are any obstacles that prevent the activities from being done, we will examine those obstacles.Beside the weekly programme, we also have a monthly report in which any financial problem is detected.He also uttered that they prepare a recovery plan in response to the risks that might or have occurred in the project.This plan is produced because the technique for risk response being used in their project is risk control/mitigation.They believe that as the probability of risks to occur is still in ambiguities, the best way to respond to the risk is by controlling it.Having recovery plan can absolutely help the project members in mitigating and controlling risks because if anything happens, there will be another backup plan to make sure the project is always on the track and within cost limitation.

Case Study 3.
The third case study is a project to demolish the existing building and reconstruct it to the 17-storey of Menara HEAMP, the Conference Hall, the Rumah Universiti, and some other related construction works.An interview with the Project Manager of this project who has 17 years of experience in construction industry was carried out.
The Project Manager claimed that they do not imply risk management because they do not want to spend time doing an analysis on the project risks as they feel there is another important work that needs more attention.In this project, risk management is not the responsibility of the project manager, but it is the obligation of the safety officer of the project.Safety Department will also take actions to handle risks only when there are admonitions made by the local authority officers.Despite giving these responsibilities to the Safety Department of the project, there are apparently no proper tools or techniques applied for risk management.However, the Project Manager mentioned that they use checklist and guidelines that have been certified by ISO 9000, and since checklist is one of the risk management approaches, it indicates that they have employed some risk management techniques unwittingly.
The Project Manager also stated that the main risk in this project is in dealing with demolition, and, to prevent such risk, they conduct site safety meetings.In these meetings, they highlight and discuss the risk, the action that should be taken, and the effects of the action.Although the Project Manager claimed that this project does not apply any formal risk management, the discussion during the site meetings can be described as one of the techniques in identifying, analyzing, and responding to risk.Generally, the main problem in conducting this project is that the risks are managed when they occur and as a result the impacts affect directly the performance of the project.Given that this project implements risk management in a very low level, the project faced delay for three months.According to the Project Manager the reason for this delay is due to technical drawings problem.He believes that if they have had a formal risk management planning, they would not face such risk today.Moreover, the Project Manager believes that there should be a risk management department in every construction project, and since not every contractor is willing to bear the cost for having extra department for the project, some portion of the cost should be supplemented by the client in the contract.

Case Study 4.
The fourth case study is a government project to construct a few blocks for academic purpose and hostels for Universiti Pertahanan Nasional Malaysia.The site located at Kem Sungai Besi, Kuala Lumpur.For this case study an interview with the Project Manager was conducted to gain useful data about implementation of risk management in this project.
According to the Project Manager, implementation of risk management process in this project, which starts with identifying the risks, followed by analyzing and responding to risks, is effective.They have used workshop approach which is one of the risk management techniques to identify and analyze risks.The workshop was conducted at the beginning phase of the project which is during the planning (precontract) stage.The workshop involved client, consultants, contractor, project manager, and other professionals.The first step was to identify the project risks that might occur in every phase during the life cycle of the project.Then, upon identifying those risks, the second stage of risk management was carried out which is risk analysis.Each risk that has been identified before was analyzed accordingly.The possible causes of the risks and the best way to mitigate them were also discussed.During this stage, the identified risks were prioritized according to their likely impact on the project.The project manager and project team have given the most attention to major risks with higher probabilities and impacts.The risks were then monitored and tracked because it is believed that sometimes the probability and impact of risks can increase during the postcontract stage.The next step taken in risk management was controlling and mitigating the risks.This risk response technique has been used in this project because it could reduce the probability of risk event occurrence.Moreover, risk identification resulted in controlling the project cost, schedule, and resource utilization for the project.
The output from the workshop is the production of Risk Management Plan (RMP).RMP is a robust and transparent risk management methodology composed of clearly identified steps and tools for managing such risks [23].By using RMP, the Project Manager confirmed that all risks are reduced to acceptable levels and managed in a most efficient manner.In every site meeting, the Project Manager uses RMP to monitor the status of the project.Then, a Status Report is produced every three months, and, at the end of the project, a Final Risk Report is produced.

Conclusions
In the first case study, the Site Engineer of the project used CPM and S-Curve, and, in the second case study, the Project Manager used SWOT for risk identification and risk analysis, and, therefore, the level of risk management implementation in these two projects is considered as medium.In the third case study, no risk management techniques were deliberately used, and, as a result, there was a delay and subsequently cost overrun.Therefore, the implementation of risk management in the third case study is considered as low.On the other hand, in the fourth case study, the Project Manager used risk management process including risk identification, risk analysis, and risk response.In fact, the management team has conducted many workshops (RMP) and taken every precaution step in handling the risks.Hence, it can be concluded that this project has implemented risk management at a reasonably high level.
Overall, the results of this study, which are in agreement with the findings of Yusuwan et al. [24] and Siang and Ali [17], revealed that construction projects in Malaysia mostly do not use risk management techniques, and only small group of construction professionals implement risk management in their projects.The reason for that is mainly due to the lack of knowledge about the importance of risk management and its implementation in the construction industry amongst the members of a project team.As a result, risks are mainly managed when they occur, which subsequently induce impacts on the project's performance in terms of cost and time.Moreover, it was found that many project managers do employ some risk management techniques unwittingly which show their lack of awareness about the current risk management tools and techniques.Therefore, there is a need to raise the awareness of construction professionals in Malaysia about the importance of risk management implementation and employing appropriate tools and techniques to identify risks associated with the project.
This study provided significant and potentially influential contributions to the practical knowledge about current tools and techniques used in Malaysian construction industry.It also provided valuable insight into the identification of main reasons for not implementing risk management in Malaysian construction industry.
The limitation of this study is that this study was conducted solely in construction industry in Malaysia.As most construction projects in Malaysia do not have systematic risk management procedures, this study could not find successful examples in conducting risk management in construction projects in the country; thus a comprehensive model for risk management could not be developed for the local construction industry.

Table 2 :
SWOT table for the project.