IMAGE © WAAG
Businesses manage diverse property portfolios in complex urban environments. But cities are regularly exposed to various hazards and threats that may damage properties harm building occupants and cause disruption or reputational damage to the property owner and operator. A natural hazard such as flooding may damage the building fabric while an unexpected but disruptive event such as a sit-in protest of the kind Extinction Rebellion staged in London in 2019 may prevent tenants from accessing their workplace. By systematically identifying assessing and tracking hazards and threats to properties portfolio managers can help control the risks.
Risk registers are a well-established tool for identifying managing and treating risks. They are widely used by business, in particular in safety-critical sectors such as rail aviation and oil and gas to help inform decisions on which risks are tolerable and which are not and need controlling.
The task of managing the risks that might affect a large property portfolio is also likely to be helped by developing and maintaining a portfolio-wide register. However, keeping track of and implementing measures to control the diverse hazards and threats will probably be challenging even at the best of times, thanks to the various factors in play.
For instance properties may be situated in a sensitive urban location such as next to a busy transport hub. Or there may be a variety of building types in the portfolio, such as offices retail and food and beverage outlets which are vulnerable to different hazards and threats. Some properties may have dedicated management on site, while others wont. The portfolio may even include iconic buildings, or high-profile tenants, that could attract threats such as terrorism or criminality due to their business operations or corporate behaviour.
Developing and deploying a risk register would provide property portfolio managers with a comprehensive framework to identify assess and track risks, and make informed auditable decisions about which should be controlled and which accepted.
Creating a risk register means thinking about the broad context and taking into account the many factors that may affect the safety and security of an asset and its occupants
A property portfolio risk register can:
To be of value, the risk register needs to be comprehensive and tailored for the portfolio in question. This requires a systematic and structured approach to identifying any threats and hazards to the properties included, and the risks posed by those threats and hazards.
Once the business need and objectives of the risk register have been established the next step should be to identify credible threats and hazards. This identification process could include the following steps:
After the credible hazards and threats have been identified, the next task is to develop a structure for the risk register that will enable risks to be assessed. Such a structure must allow for a qualitative or quantitative assessment, or both, of the probability and consequences of the given threat or hazard, and enable the risks to be ordered by priority of tolerance. A competent person reviewing the available relevant information could reach a qualitative judgement on this by themselves, or collective assessment may be involved such as a round-table exercise with appropriate stakeholders.
To make consistent judgements on probabilities and consequences requires a set of clear definitions on what constitutes, for example, a likely hazard or a severe consequence as well as an agreed line between acceptable and unacceptable risks. Additionally, it may help the business to distinguish between physical consequences for property and people from those that affect the managing agent, such as operational disruption or reputational damage. The value of this approach is that it would help inform and guide risk appetite decision-making. The risk register must also record existing control measures that could reduce either the probability, or the impact, of a threat or hazard. These measures could include security guards, CCTV, operational and maintenance procedures, business continuity planning and crisis management response and tabletop exercises based on a crisis scenario, to test the organisations policies plans and procedures. Finally it is vital that the risk register is managed and allows regular updates, as the risks are likely to evolve over time.
The register should be managed by a nominated senior person in the business, one who is well placed to ensure that it is kept up to date, that control measures are implemented and monitored and that reports to key decision-makers are made by those responsible for doing so.
The number and type of individuals involved in creating the risk register could be very broad: the mix is likely to vary depending on the type of organisation, but it may include managers of facilities and workplace health and safety and security. However, clear delegation of roles responsibilities and accountabilities from managing and updating the risk register, to implementing, evaluating and monitoring control measures is key to ensure that risk management is embedded in the day-to-day operation and management of the property portfolio. This will provide the evidence and traceability for senior business leaders who are charged with making decisions on risk acceptability.
Proactively identifying and managing risks to a property portfolio effectively is likely to ensure the risks are controlled, but not necessarily eliminated, both to the portfolio and its managing agent.
Therefore the business benefit of effective property portfolio risk management is ultimately a more resilient business.
Richard Bond is senior consultant resilience security and risk at Arup firstname.lastname@example.org
Related competencies include: Asset management Risk management