PROPERTY JOURNAL

Understanding a property portfolio's risks

How can portfolio managers best understand manage and control the risks their properties face?

Author:

Richard Bond

14 January 2020

Businesses manage diverse property portfolios in complex urban environments. But cities are regularly exposed to various hazards and threats that may damage properties harm building occupants and cause disruption or reputational damage to the property owner and operator. A natural hazard such as flooding may damage the building fabric while an unexpected but disruptive event such as a sit-in protest of the kind Extinction Rebellion staged in London in 2019 may prevent tenants from accessing their workplace. By systematically identifying assessing and tracking hazards and threats to properties portfolio managers can help control the risks.

Risk registers are a well-established tool for identifying managing and treating risks. They are widely used by business, in particular in safety-critical sectors such as rail aviation and oil and gas to help inform decisions on which risks are tolerable and which are not and need controlling.

The task of managing the risks that might affect a large property portfolio is also likely to be helped by developing and maintaining a portfolio-wide register. However, keeping track of and implementing measures to control the diverse hazards and threats will probably be challenging even at the best of times, thanks to the various factors in play.

For instance properties may be situated in a sensitive urban location such as next to a busy transport hub. Or there may be a variety of building types in the portfolio, such as offices retail and food and beverage outlets which are vulnerable to different hazards and threats. Some properties may have dedicated management on site, while others wont. The portfolio may even include iconic buildings, or high-profile tenants, that could attract threats such as terrorism or criminality due to their business operations or corporate behaviour.

Developing and deploying a risk register would provide property portfolio managers with a comprehensive framework to identify assess and track risks, and make informed auditable decisions about which should be controlled and which accepted.

"By systematically identifying assessing and tracking hazards and threats to properties portfolio managers can help control the risks"

Creating context

Creating a risk register means thinking about the broad context and taking into account the many factors that may affect the safety and security of an asset and its occupants

A property portfolio risk register can:

be used to track and monitor risks and control measures that evolve over time if the register is regularly updated
provide a framework on which to base strategic and operational decisions about the management of the portfolio in response to emerging hazards and threats
help evaluate the effectiveness and suitability of an existing control measure such as flood protection kits in buildings, which may be at risk due to budgetary constraints, or support the case for a new measure being implemented
inform a security and operational strategy and a business continuity and crisis management plan
inform dedicated registers for any buildings in the portfolio that require one
demonstrate the businesss proactive approach to risk management which can then be presented to key stakeholders.

To be of value, the risk register needs to be comprehensive and tailored for the portfolio in question. This requires a systematic and structured approach to identifying any threats and hazards to the properties included, and the risks posed by those threats and hazards.

Once the business need and objectives of the risk register have been established the next step should be to identify credible threats and hazards. This identification process could include the following steps:

consultation with stakeholders who are familiar with the external threat or hazard context and understand the internal threats and hazards that have previously affected the portfolio in question
drawing insight from historical data and information such as official public registers including the National Risk Register of Civil Emergencies; for property portfolios in London the London Risk Register is also a valuable reference point
drawing insight from historical data and public threat or hazard information such as the Control of Major Accident Hazards database or local crime patterns available from the police
a review of internal security and health and safety incident logs
if feasible a site walkover to identify threats or hazards that may materialise from the locale for instance is the portfolio located next to a night-time economy area or major transport hub that may expose buildings and their occupants to criminality or nuisance behaviour?

Structuring the risk register

After the credible hazards and threats have been identified, the next task is to develop a structure for the risk register that will enable risks to be assessed. Such a structure must allow for a qualitative or quantitative assessment, or both, of the probability and consequences of the given threat or hazard, and enable the risks to be ordered by priority of tolerance. A competent person reviewing the available relevant information could reach a qualitative judgement on this by themselves, or collective assessment may be involved such as a round-table exercise with appropriate stakeholders.

To make consistent judgements on probabilities and consequences requires a set of clear definitions on what constitutes, for example, a likely hazard or a severe consequence as well as an agreed line between acceptable and unacceptable risks. Additionally, it may help the business to distinguish between physical consequences for property and people from those that affect the managing agent, such as operational disruption or reputational damage. The value of this approach is that it would help inform and guide risk appetite decision-making. The risk register must also record existing control measures that could reduce either the probability, or the impact, of a threat or hazard. These measures could include security guards, CCTV, operational and maintenance procedures, business continuity planning and crisis management response and tabletop exercises based on a crisis scenario, to test the organisations policies plans and procedures. Finally it is vital that the risk register is managed and allows regular updates, as the risks are likely to evolve over time.

Management and stakeholders

The register should be managed by a nominated senior person in the business, one who is well placed to ensure that it is kept up to date, that control measures are implemented and monitored and that reports to key decision-makers are made by those responsible for doing so.

The number and type of individuals involved in creating the risk register could be very broad: the mix is likely to vary depending on the type of organisation, but it may include managers of facilities and workplace health and safety and security. However, clear delegation of roles responsibilities and accountabilities from managing and updating the risk register, to implementing, evaluating and monitoring control measures is key to ensure that risk management is embedded in the day-to-day operation and management of the property portfolio. This will provide the evidence and traceability for senior business leaders who are charged with making decisions on risk acceptability.

Proactively identifying and managing risks to a property portfolio effectively is likely to ensure the risks are controlled, but not necessarily eliminated, both to the portfolio and its managing agent.

Therefore the business benefit of effective property portfolio risk management is ultimately a more resilient business.

Richard Bond is senior consultant resilience security and risk at Arup

richard.bond@arup.com