Project Activities—Phase I

Phase I of the research consisted of Tasks 2 through 5, where the research team gathered valuable information, lessons learned, and successful practices from risk management practitioners across the globe. This approach resulted in a risk management practitioner survey, a targeted literature review and gap assessment, and an industry roundtable of diverse risk management professionals.

Practitioner Survey

The first step in this research was to design a robust risk management practitioner survey to better understand how transportation and similar public sector organizations currently implement and sustain risk management. The survey aimed to collect information on risk management practices, including opportunities and challenges of incorporating risk management within agencies and companies. The practitioner survey provided a basis for understanding the current state of practice and potential gaps for further assessment, which helped support Tasks 3 and 4.

The team used the Google Forms online survey platform to develop the survey, which was 30 multiple-choice or short-response questions and estimated to take 10 to 12 minutes to complete. The team developed a list of potential survey participants that included local agencies, state DOTs, metropolitan planning organizations, utility companies, international agencies, academia, and consultants. In addition, the research team requested surveys from members of various AASHTO and TRB committees. When compiled, the team provided the list to the NCHRP Project 08-151 panel, who provided comments and approved the final list for distribution. Participants included practitioners from a wide range of roles within public and private agencies, with the primary positions being asset manager, performance manager, or enterprise risk manager, as shown in Figure 2.

The research team sent survey invitations to 288 individuals and received 44 completed surveys, which is a 15% response rate. A response rate greater than 10% indicates a good response (Graglia 2023).

Questions covered four themes, which led to the following findings:

1. Building and Sustaining Risk Management
   • – The top three needs identified for building and sustaining risk management within an agency or company were related to processes, organizational culture, and leadership support.
   • – The top three challenges identified for both building and sustaining risk management practices were related to staffing, lack of understanding, and business processes that are unclear or siloed.
   • – The top two knowledge gaps identified for both building and sustaining risk management practices within an agency or company were processes and measurement quantification. The third-most-selected knowledge gap varied between building and sustaining risk management practices: building identified data/tools and sustaining identified communication.

2. Benefits of Risk Management, Which Creates Value Proposition
   • – Identifying uncertainties, estimating consequences, estimating probable occurrences, and estimating system vulnerabilities were overwhelmingly identified as the significant benefits of risk management to transportation agencies. These benefits help to position an agency for future strategy implementation.
   • – Risk visualization tools and estimates of asset replacement costs were also identified as beneficial. Having these visualization tools and replacement costs helps an agency “tell the story.” It also shows the impact of using risk management within an agency.
3. Organizational Culture
   • – Most respondents noted having buy-in from leadership and staff, in addition to well-defined roles to integrate risk management at various levels in their organization, was instrumental in building and sustaining risk management.
4. Business Processes, Policies, and Tools
   • – Many survey participants noted that internal communication and promotion of risk management, integrating risk within existing processes, and tool and data development have occurred at their agency within the past year. This is a positive step toward building and sustaining risk management within agencies.
   • – Most agencies have conducted scenario planning of relevant uncertainties to guide planning for system infrastructure and operations. Scenario planning helps an agency understand and consider uncertainty within the agency on multiple levels.
   • – Agencies vary in using formal risk management policies, but they typically find even informal policies are still effective.

Appendix A presents the practitioner survey summary.

Targeted Literature Review and Gap Assessment

Following the practitioner survey, the research team conducted a literature review to gain a baseline understanding of what is currently known about risk management. The targeted literature review directly supports future tasks in its gathering of valuable information such as lessons learned and successful practices. It also helped identify the gaps in the current state of practice.

Conclusions from the literature review were divided into three sections: risk management implementation successes and gaps; organizational structure; and risk management application, integration, and communication. The following sections present the findings.

Risk Management Implementation Successes and Gaps

The literature review concluded that risk management is being implemented to a certain degree within state DOTs. Many transportation agencies have some type of informal or formal risk management policies or processes established that they consider to be effective, and they often follow a framework with guidance, methodology, policy, and tools to systematically assess risk and adopt strategies and policies to manage it. For some, the lack of clear policy results in inconsistent practices across the agency. To maintain momentum, state DOTs should reassess progress regularly to identify improvements to help sustain the risk management practice.

Additionally, improving a state DOT’s risk management capacity would require improvements in the following:

• Access to and integration of risk management across the state DOT
• Understanding of risk management
• Adequate data to assess and address risks
• Training and capacity building

Organizational Structure

One of the greatest takeaways from the literature review is that a risk management champion and executive leadership support are key to building and sustaining momentum. Champions must be identified and equipped with knowledge of the value of risk management. Additionally, the review showed it is important to understand that establishing or defining risk management within an agency takes time. Risk management must be practical to be effective. Organizations need to prepare staff with the appropriate tools and education and create a culture of risk management that is felt from the top down.

Risk Management Application, Integration, and Communication

The literature review suggested that tools, policies, processes, and programs should be simple, scalable, and rightsized. State DOTs appear to do an adequate job of integrating risk management into areas where it is required, but a consistent risk management approach is still lacking for many. It would be helpful to develop a suite or catalog of risk-based tools to bolster future integration. A culture of risk and tolerance for risk begins with consistent understanding and communication across the agency of the basic principles and terminology of risk management.

Methodology of Literature Review

The research team initially compiled a list of documents that directly or indirectly discussed risk management within state DOTs. Key findings from the compiled literature review are outlined in the following sections.

The search included the following elements:

• Industry knowledge of key publications
• Transport Research International Documentation
• AASHTO Transportation Asset Management Portal
• Internet search using these keywords: integrating risk into state DOT

The research team reviewed each document to identify successes, gaps, value propositions, quantification of risk, organizational change, data and tools, culture of risk, integration with existing processes, and communication and protocols. Appendix B presents the literature review.

Gap Assessment

Using the findings from the risk management practitioner survey and targeted literature review, the research team developed a gap assessment. It describes gaps affecting a state DOT’s ability to build and sustain a risk management program as key needs, challenges, and knowledge gaps. The team used the findings from the gap assessment to craft the industry roundtable discussion to further develop an understanding of what is needed to build and sustain a risk management program with input directly from industry experts. These findings also helped frame the content development in Phase II of this project.

The gap assessment was concentrated on identifying a baseline understanding of practices implemented to assist in building and sustaining risk management practices within organizations or agencies, with a focus on organizational traits and change management strategies needed to overcome barriers to implementing and sustaining formal risk management. The gap assessment

was organized by needs, challenges, and knowledge gaps. The sections are further categorized as follows:

Value Proposition: What is the value of risk management to a DOT? How is it understood, summarized, explained, and measured within a DOT?

Quantification of Risk: How do agencies quantify risk, and how can it be done throughout the agency? What is the impact?

Organizational Change: How have agencies successfully managed major change initiatives? Was it top-down or bottom-up? What was done to prepare the agency for change?

Data and Tools: What are the risk management tools and data that agencies use to help in their risk assessments? How can the data be shared across divisional lines—up and down?

Culture of Risk: What is the tolerance for risk within the agency? How do agencies create a culture that accepts certain failures?

Integration with Existing Processes: What are acceptable methods of considering risk as part of planning, programming, environmental review, asset management, transportation system management and operations, and other existing processes? What concerns do agencies have about ensuring consistency with federal requirements?

Communication and Promotion: What types of communication or promotional material have been used to help educate agencies internally? How do transportation agencies create change agents within their organization to ensure risk management is a key pillar?

Key Needs to Build and Sustain a Risk Management Program

For value proposition, organizational change, and communication and promotion, key needs were identified:

• Risk management champions and executive leadership support
• Clear policies that integrate risk management into strategic planning and performance management processes
• Communication strategies for incorporating risk management within agencies, including basic principles and terminology of risk management

Key Challenges

Key challenges in developing a culture of risk and integration of risk with existing processes were identified:

• Need for dedicated staff and adequate staff to build and sustain a risk management program
• Business processes that hinder integration of risk management practices across state DOTs

Key Knowledge Gaps

Quantification of risk, data, and tools provided the basis for additional needs for knowledge in the following key areas:

• Easy-to-implement preexisting standards and policies regarding collecting and using data, tools, resources, agency structure, personnel, and skills development

• Access to educated, well-trained staff who understand the principles and application of risk management within a state DOT
• Lack of simple online databases, dashboards, and risk procedures for internal agency staff to easily understand how risk is used at agencies

Appendix C presents the gap assessment.

Industry Roundtable

On February 16, 2023, the research team conducted an industry roundtable with 29 risk management professionals who engage in strategic/enterprise risk management, program risk management, project-level risk management, asset management, and communications. The goal of the roundtable was to determine the barriers and constraints of incorporating formal risk management into decision-making at all levels of the organization. Initial findings regarding what agencies have done, lessons learned, and successes were identified in the practitioners survey (Task 2) and targeted literature review and gap assessment (Task 3). The industry roundtable aimed to reaffirm those findings and add to them by exploring additional areas and elements related to communication, value-add, promotion, culture shifts, resources, and integration.

The objectives of the industry roundtable were as follows:

1. Gain insights and examples of concrete, actionable products and content on how to build a risk management program within an agency.
2. Gain insights and examples of concrete, actionable products and content on how to sustain a risk management program within an agency.
3. Gain insights on what content could be developed and posted on the AASHTO Transportation Management Hub to help state agencies build and sustain risk management within their DOTs.

The industry roundtable participants list, developed with NCHRP Project 08-151 panel approval, included risk management professionals from 10 U.S. states and five countries. The roundtable was conducted virtually, using Microsoft Teams and a Mural digital whiteboard for collaboration to promote open discussion.

The research team led participants in a discussion about how they built and sustained risk management within their agencies. Major themes and insights included the following:

• Leadership support is paramount. Without leadership advocating for and supporting the adoption of risk management within the organization, it will likely fail.
• A risk management policy is key and can provide the framework to start and keep the risk management conversation going. Policy requirements can add meaning to implementation methods.
• There is no single methodology for building and sustaining risk management; decisions must be tailored to an organization’s culture and timeline.
• Early and ongoing training is crucial to mitigate turnover and create institutionalized knowledge.
• Organizations should be structured with top-down and bottom-up communication and support, with a culture of risk that encourages discussion on the topic.
• Building risk management into recurring processes and tools allows agencies not to have to rely on leadership to sustain the practice.
• Look beyond what people/staff are comfortable with, and consider potential disruptions with outside insights from stakeholders and thought leaders.
• Discuss lessons learned on small and large scales to manage crises or day-to-day events. This approach should be more than just a postmortem of events. It should also include more robust conversations around anticipating the right risks and what risk managers would do differently in the future.

• Risk should be incorporated into all aspects of an agency and job descriptions.
• Sustaining risk management must be a coordinated effort and thought of as a journey, not a destination.
• Key people need to have the same “ground truth” of what a risk assessment means and what failure is.
• Use the common denominator of money when portraying and communicating risk to external audiences.

Appendix D presents the industry roundtable summary.