← ArticlesRisk Ownership, Allocation and ProcurementProject Delivery · RiskLesson 6/7← PrevNext →
GuidePublished 13 Aug 202611 min readBy Kevin Joginrisk ownershiprisk allocationprocurement riskcontracts

Project Delivery · Project Risk Management

Risk Ownership, Allocation and Procurement

A commercial and governance guide to allocating risk to the party able to control it, while retaining clear project ownership and oversight.

11 min read Handbook guide Reviewed 2026-08-13 De-identified examples

Executive summary

A commercial and governance guide to allocating risk to the party able to control it, while retaining clear project ownership and oversight. The method is intended to improve decisions, not merely complete documentation. Apply it proportionately, preserve the evidence behind judgement and connect every action to an accountable owner.

Learning outcomes

  • Identify control and consequence holders
  • Separate ownership from action assignment
  • Evaluate allocation capability
  • Document contract and register interfaces
  • Monitor retained and transferred exposure
  1. Identify control and consequence holders
  2. Separate ownership from action assignment
  3. Evaluate allocation capability
  4. Document contract and register interfaces
  5. Monitor retained and transferred exposure

Why This Matters: The Default Allocation Trap

In theory, making sure that every source of uncertainty has both a financial owner and a managerial owner is basic good practice. In practice, uncertainty-management sources observe, this worthy ambition is not often achieved. The consequences are severe: uncertainty allocated by default — rather than by deliberate, informed decision — tends to land with whichever party is least able to push back, not with the party best positioned to manage it.

In defence contracting, this problem is magnified by the complexity of multi-party arrangements. A Tier-1 prime contractor may hold the national acquisition authority contract, but the actual uncertainty is distributed across dozens of subcontractors, specialist suppliers, regulatory bodies, and joint venture partners. If the prime contractor's risk register lists "subcontractor delay" as a risk with "mitigate" as the response strategy, but the subcontract terms allocate the schedule risk entirely to the subcontractor without providing them the means to manage it, the result is not risk transfer — it is risk concealment.

The SHAMPU process is unique among major risk management frameworks in providing a separate, explicit Ownership phase positioned between the Structure phase and the Estimate phase. This is not an accident of process design — it reflects the conviction that ownership decisions must be informed by structural analysis but must precede quantification.

What Is Risk Ownership?

The SHAMPU Ownership phase has three distinct purposes:

  1. Distinguish the sources and responses that the project client is prepared to own and manage from those the client wants other parties to own or manage
  2. Allocate responsibility for managing client-owned uncertainty to named individuals
  3. Approve (if appropriate) ownership/management allocations controlled by other parties

Financial Ownership vs. Managerial Responsibility

A critical distinction that many risk management frameworks blur is the difference between financial ownership (who bears the cost if the risk materialises) and managerial responsibility (who is accountable for monitoring and responding to the risk):

Dimension Financial Owner Managerial Owner
Question answered Who pays? Who acts?
Typical allocation Determined by contract terms Determined by competence and proximity
Can be different parties? Yes — and often should be Yes — and often should be
Example The client bears the financial risk of regulatory delay The project manager is responsible for tracking regulatory milestones and escalating early warnings

How It Works: Scope the Strategy, Plan the Contracts

Uncertainty-management sources structure the Ownership phase in two modes:

Mode 1: Scope the Contracting Strategy

This mode addresses three fundamental questions:

Why — Clarify the objectives of contracting strategy. From a client's perspective, the fundamental reason for caring about who owns what is that ownership influences how uncertainty is managed and whether it is managed in the client's best interest. Different parties have different knowledge, perceptions, objectives, and capabilities. Allocating uncertainty to the party best positioned to manage it — not merely to the party with the least contractual leverage — is the central objective. Who — Identify possible issue owners. Starting from the list of key players identified in the Define phase, the analyst identifies parties who could own specific sources of uncertainty: What — Identify the sources requiring allocation. Not all identified sources need explicit ownership allocation. The key question is whether the source involves uncertainty that crosses organisational or contractual boundaries. Sources entirely within a single party's domain can be allocated as part of normal management responsibility. Sources that span boundaries require deliberate allocation.

Mode 2: Plan/Replan the Contracts

Once the strategy is defined, the operational details must be specified:

The Principal-Agent Problem

Uncertainty-management sources draw on economic theory to explain why ownership allocation is structurally difficult. The principal-agent relationship — whether between a client and contractor, or between different levels of the same organisation — is prone to three fundamental problems:

1. Adverse Selection

The agent may misrepresent their ability when hired. The principal cannot completely verify skills or abilities either at hiring or during performance. In project contexts, a contractor may claim capabilities they do not possess, or quote prices that assume unrealistic productivity.

Defence Example: A specialist electronics subcontractor bids on a radar subsystem contract with a team CV showing extensive experience. In reality, the key engineers have since moved to a competitor. The prime contractor discovers the capability gap only when deliverables begin failing integration tests.

2. Moral Hazard

Once appointed, the agent may not act fully in the principal's interest because the principal cannot observe all of the agent's actions. The agent's effort level, quality of decision-making, and allocation of internal resources may diverge from what the principal would prefer.

Defence Example: A cost-plus contractor has limited financial incentive to control costs or find efficiencies. The client bears the financial risk, but the contractor controls the day-to-day management decisions. Without appropriate incentive structures, the contractor may "gold-plate" solutions or tolerate inefficiencies that increase their revenue.

3. Risk Allocation Mismatch

When uncertainty is allocated to a party that does not understand it, cannot manage it, or is not financially resilient enough to absorb it, the allocation is dysfunctional regardless of what the contract says. A fixed-price contract that transfers all schedule risk to a small subcontractor may look like effective risk transfer on paper — but if the subcontractor cannot absorb the loss, the risk returns to the prime contractor as contractor insolvency risk.

Contract Type Risk Allocation Effect Best Suited When
Fixed Price Transfers cost risk to contractor Scope is well-defined and stable
Cost Plus Client retains cost risk Scope is uncertain or evolving
Target Cost with Incentive Shares cost risk between parties Both parties can influence cost outcomes
Fixed Price Incentive Shares upside and downside Contractor can influence cost but scope has some uncertainty

The Competitive Bidding Context

Uncertainty-management sources provide a particularly instructive example of how ownership perspective changes across three closely related but different risk analysis contexts:

Client's Pre-Tender Risk Analysis

The client evaluates uncertainty and develops the project design to manage uncertainty in the client's best interests. Tender documentation may allocate uncertainty to the contractor. However, the client may not be positioned to assess many sources — particularly those that only experienced contractors can evaluate.

Bidding Contractor's Risk Analysis

Each bidder assesses uncertainty about the tasks required, but must also balance the risk of not winning the contract against the risk of losses if they do win. Some key sources are associated with client selection — "Is this client's business secure? Will they honour contract terms?"

Winning Contractor's Post-Tender Risk Analysis

The winning contractor's risk analysis focuses on reducing uncertainty and risk associated with profits. If the client has not provided risk analysis data, two drawbacks arise: (1) the scope for plan modifications is reduced, yielding a less efficient project; and (2) the contractor will only analyse sources relevant to their own financial exposure, potentially leaving client-relevant risks unmanaged.

Ownership Allocation Principles

Uncertainty-management sources derive several principles for effective ownership allocation:

Principle 1: Allocate to the party best able to manage. The party who owns a source of uncertainty should be the one best positioned to influence the probability of occurrence and/or the magnitude of impact. This is not always the party with the deepest pockets. Principle 2: Ensure the owner has appropriate motivation. Allocation without incentive is meaningless. If a contractor is allocated schedule risk but receives no benefit from early completion and no penalty for delay, the allocation is ineffective. Principle 3: Make allocation explicit. Default allocation — where neither party has consciously decided who owns a particular source — is the most common and most dangerous form. Uncertainty-management sources note that allocation can take place "by default" and "need not be explicit, intentional, or clearly articulated."Principle 4: Separate financial and managerial ownership when appropriate. The party best positioned to manage a risk may not be the party best positioned to absorb its financial consequences. Split allocations — where one party manages and another underwrites — can be more efficient than monolithic allocations. Principle 5: Consider the portfolio effect. An individual subcontractor may face a single project risk. The client — running multiple projects — may face the same category of risk across their entire programme portfolio. The client may be better positioned to absorb the variance through portfolio diversification, while the subcontractor provides specialised management attention.

Ownership in Practice: The Risk Register Integration

The practical output of the Ownership phase is the assignment of named owners to each risk in the register. However, effective ownership goes beyond a name in a column:

Register Field Purpose Good Practice
Risk Owner Named individual accountable for the risk Must be a person with authority to act, not a department or role title
Financial Owner Party bearing the cost impact May differ from the risk owner; must be documented in contract terms
Action Owner Person responsible for executing specific response actions May be delegated by the risk owner; must have required resources
Escalation Path Chain of authority if risk exceeds owner's capacity Must be defined before the risk materialises

Pitfalls: Where Ownership Goes Wrong

1. Allocating risk to the party with the least contractual power. Small subcontractors are routinely allocated risks they cannot manage or absorb. When they fail, the risk returns to the prime contractor — now compounded by contractor insolvency and project disruption. 2. Confusing risk transfer with risk elimination. A fixed-price contract transfers the cost variance risk to the contractor. It does not eliminate the underlying source of uncertainty. If the source materialises, someone still bears the consequence. 3. Single-name ownership without authority. Assigning a risk to a junior project controller who has no budget authority, no ability to modify contracts, and no access to senior decision-makers is ownership in name only. 4. Default allocation by omission. The most dangerous ownership failures are risks that nobody consciously owns because they fell between organisational boundaries during the identification process. 5. Ignoring the contractor's risk analysis perspective. If the client does not share their risk analysis with bidding contractors, the winning contractor's subsequent analysis will be incomplete and may overlook sources that only the client's pre-tender analysis would have revealed.

Key Takeaways

Practitioner completion checks

Use these checks before closing the analysis or taking the decision forward. Scale the evidence to the consequence, uncertainty and reversibility of the decision.

Check 01Identify control and consequence holders is defined, owned, evidenced and linked to the relevant project decision.
Check 02Separate ownership from action assignment is defined, owned, evidenced and linked to the relevant project decision.
Check 03Evaluate allocation capability is defined, owned, evidenced and linked to the relevant project decision.
Check 04Document contract and register interfaces is defined, owned, evidenced and linked to the relevant project decision.
Check 05Monitor retained and transferred exposure is defined, owned, evidenced and linked to the relevant project decision.
How much detail is enough?

Use the least complex method that can support a defensible decision. Increase rigour when consequences are high, uncertainty is material, interfaces are complex, evidence is weak or the decision is difficult to reverse.

What should the decision record contain?

Record the objective, scope, inputs, assumptions, method, uncertainties, options, judgement, owner, approval, actions, residual exposure and the trigger or date for review.

When should the work be repeated?

Repeat it when a key assumption changes, new evidence appears, exposure crosses a threshold, a response fails, scope or interfaces change, or the next governance decision requires refreshed information.

Current authoritative reference points

Use the current published documents and the requirements adopted for the project's jurisdiction and contract. Links below support currency checking; they do not reproduce copyrighted standards.

Continue learning

Risk Monitoring, Reporting and ControlGuide · RiskNEXT LESSON →Managing Key-Person and Project Team RiskGuide · RiskRisk Triggers, Contingencies and Early WarningGuide · RiskRisk Controls and Defence in DepthGuide · Risk