Risk has been defined (ISO 31000:2018 @ 3.1) as ‘(the) effect of uncertainty on objectives’. All corporate activities, especially the implementation of multi-billion-dollar capital projects, involve risk. Organisations need to deal with many internal and external factors that create uncertainty about whether performance objectives, including key performance indicators (KPIs), for major capital projects will be achieved.

This article presents a contractor’s perspective on managing risk for large capital projects, specifically, how Worley is applying risk management in its role as the Project Management Consultant (PMC) for the engineering, procurement and construction (EPC) activities for a major expansion and upgrade of PT Pertamina (Persero’s) (Pertamina’s) 260,000 barrels/day (bpd) refinery in Balikpapan, Indonesia. The Balikpapan expansion will see production rise to 360,000 bpd and enable the refinery to produce high-quality fuels to meet Euro V emission standards. Total capital cost is estimated to be approximately US$4 billion.


Indonesia is the world’s largest archipelago (approximately 17,000 islands, stretching more than 5,000 km from west to east and 1,800 km from north to south). It is the world’s largest Muslim-majority nation (approximately 90%); the fourth largest country by population (270,000 (2019 est.), after China, India and the United States); and the third most populous democracy (after India and the United States). With a total land area of approximately 1.9 million km2, Indonesia is twice the size of British Columbia and 10 times the size of Great Britain (England, Scotland and Wales).

Indonesia’s crude oil reserves at the end of 2018 were estimated to be 3.2 billion bbl (including gas condensate and natural gas liquids (NGLs)) , ranking the country second behind Vietnam for oil reserves in south-east Asia. Oil production in 2018 was approximately 800,000 bpd , down from a peak of approximately 1.5 million bpd in the late 1990s. Indonesia is still currently the largest oil producer in south-east Asia. Transport fuel consumption in Indonesia is currently approximately 1.6 million bpd, of which approximately 0.7 million bpd (44%) is imported. Oil refining capacity today is roughly the same as it was 15 years ago.

Investment in the Indonesian oil and gas sector has been hindered since the Asian financial crisis and the overthrow of President Suharto in 1998 by an unclear and uncertain regulatory framework, coupled with a complex and rigid bureaucracy.

Balikpapan Refinery

The Balikpapan refinery is located on East Kalimantan, on the island of Borneo (the third largest island in the world), approximately 1,200 km northeast of the capital Jakarta. Pertamina through the Refinery Development Master Plan (RDMP) is upgrading the existing Refinery Unit-V (RU-V) located in Balikpapan to produce high quality fuel products, and to meet Indonesia’s growing transport fuel demand.

All crudes processed in the Balikpapan refinery (the Refinery) are received at the Lawe-Lawe Terminal. The Lawe-Lawe Terminal will be improved by providing new facilities such as an unloading facility from tankers, crude storage tank, utility units and a crude transfer line to the Refinery.

Pertamina is building several new process units in the Refinery including a residual fluid catalytic cracker (RFCC) complex, hydrotreating plants, isomerization unit, alkylation unit and naphtha reforming unit, among others. In addition, the existing main flare stack will be relocated offshore, and the existing acid flare will be relocated within the Refinery.

The legacy WorleyParsons Group (now Worley) was retained by Pertamina as the PMC for the RDMP RU-V project (the Project) in August 2018. Contracts for the main EPC packages for the construction of the Project were issued in December 2018 (for the main process and support units for Refinery) and September 2019 (for the Lawe-Lawe terminal).

Worley’s primary risk management responsibilities include:

  • Managing overall project execution risk
  • Developing, implementing and maintaining the Project risk management plan and supporting guidance documents
  • Maintaining the Project risk register
  • Integrating inputs from the individual risk registers for the EPC contractors into the overall Project risk register, and
  • Providing assurance for the Project risk management function at the overall Project and individual EPC contractor level

Project Risk Management Process

Figure 1 shows the process that is being used for risk management for the Balikpapan Refinery project, based on the framework described in ISO 31000:2018 Risk management – Guidelines (ISO 31000).

risk management honey comb

Step 2: Scope, Context and Criteria

In establishing the Project’s situational landscape, the scope of the risk management process, the internal and external context for Worley as PMC for the Balikpapan project and the context of the risk management process itself are considered. In addition, key trends and possible drivers of change in Indonesia are identified, and external stakeholder relationships are summarized.

The risk criteria for the project are also developed at this stage, including scales for likelihood and consequence (Table 1), considering the risk tolerance or acceptance of the client. In terms of risk tolerance, all project risks, for example, that are rated ‘High’ or ‘Moderate to High’ by Pertamina (Figure 2) require the development and monitoring of a documented risk treatment plan.

Table 1 Project Risk Criteria

risk management table with many columns and rows

Figure 2 Project RISK Matrix

risk management table with many columns and rows

Step 3: Assessing Risk

Following a breakdown of Project risks into various types by category and sub-category, Worley follows ISO 31000 and subdivides risk assessment into: (i) risk identification; (ii) risk analysis; and (iii) risk evaluation.

Risk Identification

The purpose of risk identification is to find, recognize and describe risks that might help or prevent achievement of the Project objectives. Relevant, appropriate and up-to-date information is important in identifying risks.

Risks for the Project are identified primarily by means of risk workshops attended by Project team subject-matter experts from PMC, Pertamina and the EPC contractors, or through face-to-face meetings with risk owners, once assigned. The primary output from the risk identification process is the Project risk register.

Risk Analysis

The purpose of risk analysis is to comprehend the nature of project risks and their characteristics including, where appropriate, the level of risk. Risk analysis provides input for making decisions where choices must be made, and the options involve different types and levels of risk.

For the Project, a qualitative risk assessment approach is being used to obtain a general indication of the level of risk and to reveal the major project risks. This involves ranking Project risks as a combination of the perceived likelihood of a risk event (threat or opportunity) occurring, and the potential worst- or best-case consequence (see Table 1).

Semiquantitative risk analysis using a Monte Carlo approach with the Top Ten Projects risks and quantitative risk analysis using Primavera Risk Analysis® software are also being applied.

Risk Evaluation

Risk evaluation involves comparing the level of risk found during risk analysis, with the Project’s risk criteria. If the level of a Project risk exceeds a “Moderate” ranking, the risk is treated to reduce the level of risk to “Moderate”.

Step 4: Risk Treatment

Risk treatment involves selecting one or more options for modifying risks and implementing those options. Once implemented, risk treatments provide new risk controls or modify existing controls.

Risk treatment plans are integrated with Worley’s PMC processes and communicated to the appropriate Project stakeholders. The residual Project risk is documented in the Project risk register and subjected to monitoring, review and, where appropriate, further treatment.

Step 5: Risk Reporting

The risk management process and its outcomes are documented and reported through appropriate mechanisms, including weekly and monthly Project reports and reports to the Worley Project sponsor group via quarterly meetings. Reporting is an integral part of project and corporate governance. It enhances the quality of dialogue with stakeholders, and supports top management in meeting their responsibilities.

Step 6: Risk Monitoring and Review

Monitoring and review activities for the Project include regular periodic checking or surveillance of the effectiveness of the risk management plan. Progress in implementing the risk treatment plan provides a performance measure for the Project. Results are incorporated into the overall Project performance management, measurement, and external and internal reporting activities.

Lessons Learned

The risk management process must be embedded in both the overall corporate culture and the specific project culture. Attempts to “bolt-on” the risk management function are not usually successful: risk management must be part of the DNA of any project. Worley targets cultural change in a project by focusing on the risk attitudes and behaviours of the project team, and on the way its members approach and manage all aspects of project uncertainty.

All project personnel must understand that project risk management responsibilities need to be taken seriously, and functional managers in engineering, construction, procurement, commissioning, etc., are made responsible for ensuring that this understanding occurs.

Having a strong risk culture within a project is an important part of risk management for large capital projects. However, Worley’s experience indicates that a documented risk management system that conforms to the requirements of ISO 31000 is one of the main contributors to success.

Risk management software is a very useful tool for large capital projects with multiple EPC contractors and contractor joint ventures. Worley is using an internal risk management software product customised for use on the Balikpapan project. In addition, there are several commercially available software products that can be used for project risk management. To be successful, however, risk management must involve the application of a practical, hands-on, common-sense approach that is understood by all members of the project team.

As with safety and quality not being the responsibility of the HSE or QA/QC groups within a PMC assignment, the key message is that risk management is not the risk management group’s responsibility, it is the responsibility of all project team members.

Readers are cautioned not to rely upon this article as legal advice nor as an exhaustive discussion of the topic or case.  For any particular legal problem, seek advice directly from your lawyer or in-house counsel.  All dates, contact information and website addresses were current at the time of original publication.

Dr. Andrew Gillam, PGeo, RMP

Dr. Andrew Gillam, PGeo, RMP brings more than 40 years of experience in academic research, management consulting and engineering and environmental services to his current position as Senior Risk Manager for Worley’s PMC contract for the Balikpapan Refinery project.

Prior to moving to Indonesia in January 2019 he served for five years as the Senior Risk Manager for Wood Group’s (formerly Amec Foster Wheeler’s) PMC contract for the greenfield 615,000 bpd Al-Zour Refinery project in Kuwait.

Dr. Gillam, a Professional Geoscientist (PGeo) and Risk Management Professional (RMP), joined Amec Foster Wheeler in 2008 after spending 10 years as a director with the Global Risk Management Practices of PricewaterhouseCoopers and KPMG in Canada. His areas of specialization include risk management and assurance, auditing, and due diligence in mergers and acquisitions.