How to manage risk in a construction company

To manage risk in a construction company, keep a company-level risk register: list the events that could seriously hurt the business (a bad contract, a customer that does not pay, a serious injury, a key person leaving, a cash squeeze, a downturn), score each by how likely it is and how much it would cost, and decide whether to avoid it, reduce it, transfer it through contracts or insurance, or accept it. Give each risk one owner and a few concrete controls, then review the register every quarter. Most contractor failures trace back to a handful of risks that were visible in advance.

Job-level risk gets plenty of attention: weather, RFIs, late deliveries. Company-level risk is different. It is the risk that one job, one customer, or one bad month takes down the whole business. That is the owner's job to manage.

The main risks a construction company faces

How to build a company risk management process

1. List the risks. Spend an hour with your leadership team asking, "What could put us out of business or cost us a year of profit?" Use the table above as a prompt, and add anything from your own history.
2. Score each one. Rate likelihood and impact on a 1 to 5 scale and multiply. A score of 15 or higher goes to the top of the list.
3. Choose a response. Avoid (do not bid that kind of work), reduce (add controls), transfer (contract language, insurance, bonds), or accept (and set aside cash for it).
4. Assign an owner. One leader per risk. The controller owns cash risk, the operations lead owns subcontractor risk, and so on.
5. Write two or three controls. Specific actions, not intentions. "Every subcontract over $50,000 gets a prequalification form and COI before mobilization" is a control.
6. Track it in a register. One sheet: risk, score, response, owner, controls, status. See risk register.
7. Review quarterly. Rescore, add new risks, retire old ones. After any big loss or near miss, review immediately.

Transferring risk: contracts, insurance, and bonds

Contracts

Read every contract before signing and keep a list of clauses that trigger a closer look: pay-if-paid, broad indemnity, liquidated damages, no-damages-for-delay, and termination for convenience. Push matching protections down to your subs with flow-down clauses. See how to read a construction contract before signing.

Insurance

The U.S. Small Business Administration's insurance guide describes general liability, professional liability, commercial property, and a business owner's policy, and notes that businesses with employees must carry certain coverage such as workers' compensation, with additional requirements that vary by state. Contractors also commonly carry commercial auto, umbrella, and builder's risk, depending on the work. Review limits and exclusions with a broker who writes construction risk every year, and make sure what your contracts require matches what your policies actually cover.

Bonds and lien rights

On public work, payment bonds often stand in for lien rights. On private work, preliminary notices and mechanics lien deadlines protect your ability to get paid. Track them by job, because missing a deadline gives up the right.

Managing cash and customer risk

Cash is where most risks show up first. A slow-paying owner, a disputed change order, or a sub default all end as a hole in the bank account. Build a 13-week cash forecast and update it weekly, keep a line of credit in place before you need it, and bill on time every month. Before taking on a new customer, check payment history with suppliers and other subs, confirm how the project is financed, and agree on billing dates and terms in writing.

Limit how much any single customer can owe you. If one GC already holds $400,000 of your receivables and retainage, the next job with them adds risk even if it looks profitable. See how to manage construction working capital.

Worked example: a risk register for a $15 million GC

As an example, a general contractor doing $15 million a year scores its top risks. A single $6 million warehouse job is 40 percent of next year's revenue (likelihood 3, impact 5, score 15). The owner of that project has a history of slow pay (4 times 4, score 16). The company's only senior estimator is 63 and has hinted at retiring (3 times 4, score 12).

The leadership team responds. For the concentration and slow-pay risks, the controller negotiates monthly billing with a 15-day payment term and confirms the owner's financing with the lender, the PM sends preliminary notices on day one, and the team sets a rule that no new job may exceed 30 percent of annual revenue without the owner signing off. For the estimator risk, the company hires a junior estimator now and records the senior estimator's production rates in a shared database. Each risk has one owner and a date for the next check.

Risk management mistakes to avoid

• Treating insurance as the whole plan. Insurance does not cover bad contracts, slow pay, or bad estimates.
• Signing contracts unread because the job is good. The worst terms show up on the jobs everyone wanted.
• Growing faster than cash. A big new job can drain working capital before the first pay app clears.
• Letting sub compliance slide. An expired certificate of insurance on a sub can leave the GC holding the claim.
• One-time exercise. A risk register written once and filed away does nothing.

Templates and tools that help

A subcontractor COI tracking template and a lien waiver tracking template cover two of the most common day-to-day risks. For cash risk, use the construction cash flow template. Also read how to prequalify subcontractors.

Smart Business Automator tracks subcontractor insurance and compliance documents, flags expirations, and gives risk alerts on projects and paperwork. See subcontractor compliance automation.