SUSTAINABLE RISK MANAGEMENT IN THE CONSTRUCTION INDUSTRY: LESSONS LEARNED FROM THE IT INDUSTRY

<jats:p>Risk management is a tool used by the construction industry to reduce cost and time overruns. Its implementation in Singapore has remained low, however. This study aims to draw attention to the lack of risk management implementation and to make recommendations for increasing implementation levels in the Singapore construction industry. To accomplish these objectives, the Information Technology (IT) industry was selected to serve as a comparison group. A questionnaire was developed and distributed to companies in both the IT and construction industries. The results from the study established that practitioners in the IT industry tend to be risk takers who want to be trained and equipped with risk management skills while construction industry practitioners tended to be risk avoiders who resisted the changes required to implement risk management. Also, when compared to the IT industry, the construction industry respondents did not seem to have an adequate understanding of the benefits of risk management. Providing some recommendations for the construction industry, the findings from this study will contribute to increasing awareness of the benefits of risk management and its implementation.</jats:p>

section_content: According to the Singapore Budget 2014 (Singapore Government 2014), a study that was intended to provide recommendations that would drive Singapore towards a more advanced economy with superior skills, quality jobs, and higher incomes, the construction industry is a key sector that needs to be improved. As a result, the government has injected more than S$250 million into the industry to aid its advance. As the population of Singapore continues to grow, an efficiently functioning construction industry that provides housing and infra-structure in which all may work, play, and live in is an important priority for sustaining the future development of Singapore. It is therefore imperative to tackle the challenges facing the industry to enhance its long-term competitive edge and business sustainability. 

It is widely recognized that during the construction process, project managers face a variety of unexpected, undesirable and unpredictable risks. Risk management is a critical tool for managing projects. Failure to properly manage risks can lead to overall project failure. Moreover, a single construction project often involves a large number of players including designers, contractors, sub-contractors and consultants. 

Both the Information Technology (IT) and the construction industries came into prominence in the early 1980s under the initiatives of the Singapore Government to transform its civil services into a world-class example of information technology excellence by automating many work functions. Lientz, Larssen (2006) argued that the IT industry has had a long history of implementing project management. This strong motivation to implement project and risk management likely arose as a result of the industry's reputation for its many earlier failures. Because so many IT projects have failed, substantial research has been conducted over the last few decades with the aim to improve their likelihood of success through the implementation of risk management. As a result of these early developments and increased awareness, the industry has since enjoyed a higher success rate, significantly decreasing overruns on budget and schedules (The Standish Group 1995). 

However, the construction industry has a very poor reputation for managing risks, despite many major projects failing to meet deadlines and cost targets (Mills 2001). This was further supported by Smith et al. (2006) and Azhar et al. (2008) who argued that the construction industry has not had a good track record of coping with risks and has had a poor reputation for dealing with risks that produce cost and schedule overruns. In order to distinguish existing deficiencies in the implementation of risk management in the construction industry, it would be prudent to perform comparative case studies with the IT industry. This process should stimulate the construction industry to recognize the importance of risk management and to improve their capabilities to manage risks, ultimately helping to deliver more successful projects. Therefore, this study aims: (1) to identify organizational attitudes towards risk management (RM) in sense of benefits, status and barriers of RM implementation; and (2) to recommend practices that could be adopted by the construction industry from the IT industry in order to increase implementation levels of risk management in the construction industry.
section_name: Introduction

section_name: Background

section_content: The International Organization for Standardization (ISO/DIS 31000:2009) defines risk as a combination of the probability of the occurrence of a defined hazard and magnitude of consequences of the occurrence. Likewise, the Royal Society (1983, 1992) defines risk negatively as the probability that an adverse event occurs during a stated period of time. In addition, the Project Management Institute (2004) defines risk as an uncertain event or condition that, if it occurs, has a positive or a negative effect on at least one project objective, such as time, Technological and Economic Development of Economy, 2015, 21(2): 216-231 cost, scope, or quality. A comparison of the definitions illustrates that on the one hand, the perception of risk tends to be towards its negative outcomes while some definitions do acknowledge that it may also produce a positive bearing on a project outcome if it is mitigated and managed properly. In fact, the spectrum of risk can be viewed as a matter of perception. 

There is general consensus among scholars that risk identification and analysis are the most crucial elements in the process of risk management (Mills 2001; Hwang et al. 2012 Hwang et al., 2014)). Ebrahimnejad et al. (2009) insisted on the importance of risk identification, stating that its major purposes are: (1) to avert possible events that could lead to safety contraventions; and

(2) to attach the relative importance on the risks. Lyons and Skitmore (2004) and Hlaing et al. (2008) identified common risk identification techniques such as brainstorming, analysis of historical data, the case-based approach, use of intuition/judgment/experience, checklists, the financial statement method, hazard and operability study, flow charts, scenario building, and physical inspection. It was recognized however, that risk identification is a difficult process and might require a certain degree of creativity and imagination (Chapman, Ward 2003, 2008). 

The essence of risk analysis is to quantify the effects of major risks that are identified (Mills 2001). Hayes et al. (1986) pointed out however, that project risk analysis is often subjective, which impedes the prospective benefits of risk management from being realized. Effective risk analyses require a neutral and unbiased approach, though that is understandably difficult due to the potential for conflicts of interest. The research conducted by Ahmed and Azhar (2004), Lyons and Skitmore (2004), and Mills (2001) listed techniques for risk analysis, including direct judgement, expert systems, code optimization, sensitivity analysis, probabilistic analysis, Monte Carlo simulation, kinetic tree analysis, expected monetary value, risk adjusted discount rate, and risk premium. While various risk analysis methods are available and have their advantages, Edwards and Bowen (1998) argued that the difficulties in using probability techniques for risk analysis cause professionals to rely more on presentiment than probabilistic techniques. 

There are many benefits that can be gained from the application of systematic risk management. Mills (2001) summarized them as follows: (1) a cost-benefit assessment of actions that can control risks effectively; (2) the removal of unnecessary contingency as project resources are limited and should be focused more on major risks to achieve the best results; (3) the clear recognition and acceptance of risk at an early stage to avert risks with the minimum cost; and finally, (4) the achievement of realistic cost estimating by itemizing and quantifying risks. Liu and Low (2009) added that managing risks is crucial in ensuring the accomplishment of project objectives, especially in international projects.
section_name: Risk management

section_content: IT businesses provide project solutions that deliver new functionality for existing systems as well as create new systems for processing, storing and manipulating confidential data. To deliver products on time and at minimal cost, players in the industry have to be concerned with systematic invention, production and maintenance. Controlling and managing risks in this industry does not end with the completion of projects and are indispensable throughout the lifetime of the constructed systems. Risk management to the IT environment is an essential management responsibility rather than a technical function carried out by the IT experts who create, operate and manage the IT system (IT Governance Institute 2005). Therefore, to survive in such a dynamic environment, risk management in the industry is not a choice, but a necessity. 

According to The Standish Group (1995), formal managerial processes should be applied to the IT industry because when IT projects fail, it is usually due to the lack of management rather than technical mistakes. It is difficult to implement a standardized process however because the IT industry supports the many varied business functions required by other industries, each of which require the application of different knowledge and skills based on the characteristics of the particular industry. For instance, a project to build a communication infrastructure would differ greatly from a project to develop a tax collection system. This aspect has triggered debates over the importance of risk management in the IT industry (Mcmanus 2004). Taylor (2004) and Schwalbe (2009) stated that IT projects are usually linked to business processes and organizational systems that often involve a complex hierarchy of a large number of stakeholders. This requires a high level of coordination and becomes one of the most common risks faced by the IT industry. 

IT project managers tend to address risk management as a standalone process but they do feed the results into their company integrated project management system (Marks 2011). Many IT firms use integrated systems in order to balance the operational and economic cost of protective measures, minimize the negative impacts that may occur, and provide a sound basis for the decision-making process. Furthermore, IT professionals are trained and educated in terms of skills, tools, software, and technical and managerial techniques that can be used for risk management.
section_name: Information Technology (IT) industry and risk management

section_content: The construction industry involves large-scale, complex assembly of components on-site, often requiring significant coordination of team members such as architects, structural engineers, M&E engineers, quantity surveyors, contractors, and sub-contractors (Geddes 1996). The need for construction activities to satisfy all statutory legislation and other requirements is another characteristic of the industry. 

While the industry often confronts more risk and uncertainty than other industries, it does not have a good track record of coping with such risks (Azhar et al. 2008). Smith et al. (2006) argued that the industry has had a poor reputation for dealing with risks that result in cost and schedule overruns and failure to meet desired quality and operational requirements. Furthermore, Taroun and Yang (2011) asserted that construction firms make business decisions relying more on intuition, personal judgment, and experience than from formal and systematic processes. The deficiency of risk management implementation in the Singapore construction industry might be due to the lack of familiarity with techniques, concepts and methods of risk management (Taroun, Yang 2011). This may explain why the industry has been so slow to realize the potential benefits of risk management (Flanagan, Norman 2003). Uher and Toakley (1999) reported that the use of IT in the construction industry was at the time, limited primarily to the storage of historical data and producing schedules. He also argued that the lack of integrated IT systems geared for management contributed to the lag in the adaptation of risk management by the construction industry. More recent research conducted by Taylor (2004) and Han et al. (2006) suggested that the same issues still existed and proposed the use of intelligent risk management system in the industry. Ward et al. (1991), and Akintoye and MacLeod (1997) regarded cultural issues as one of the major barriers to risk management adoption. They argued that lack of knowledge, negative attitudes and mistrust towards risk analysis and management in construction firms prevented its greater implementation. Akintoye and MacLeod (1997) summarized the causes as: (1) lack of expertise in the techniques; (2) lack of information and knowledge; (3) time constraints; (4) doubts on applicability; (5) reliance on experience; (6) doubts of its benefits; and (7) lack of client commitment. 

Because the construction industry is exposed to a high degree of risk due to the complex nature of the construction environment and its associated activities, processes and organizational structure, greater emphasis should be placed on risk management. However, despite a considerable body of literature addressing this issue, principles of risk management are poorly addressed and are one of the major causes of poor performance in the construction industry (Akintoye, MacLeod 1997).
section_name: Construction industry and risk management

section_content: In order to achieve the objectives of this study, a comprehensive literature review was first carried out. After gaining an understanding of the body of knowledge in risk management in both the IT and construction industries, it was recognized that input from industry practitioners was needed in order to provide a comparative basis that evaluates their respective implementation status. As a result, a survey questionnaire was developed and distributed to IT and construction firms. Details about the participating firms are provided below in the section where the results of the analysis are discussed. 

The survey consisted of sections capturing: (1) the profile of participating firms and respondents; (2) the implementation level of risk management; and (3) suggestions to increase the implementation. To evaluate the implementation status, organizational attitudes towards risk, years of experience, commitment to projects, degree of agreement on benefits from risk management, and types of benefits were investigated. 

The survey was distributed to IT firms that were referred by the National Computer System Private Limited (NCS) and Inland Revenue Authority of Singapore (IRAS). The construction firms were randomly selected from the Contractor's Registry administered by the Building and Construction Authority (BCA). Each firm was required to complete the questionnaire by assigning a representative with sufficient knowledge and experience in the operations and work processes of the firm. 

To quantify the degree of agreement regarding implementation barriers and suggestions for implementing risk management, a five-point Likert scale ranging from "1" (Strongly Disagree) to "5" (Strongly Agree) was used. Then, mean scores were calculated and statistically tested by the one-sample t-test to see if the mean scores and the hypothesized mean, which is "3" (Neutral) are significantly different. Also, mean scores from the construction industry were compared against the IT firm scores using the two-sample t-test to test for statistical difference. The results from the statistical analyses as well as the descriptive analyses are presented and discussed in subsequent sections.
section_name: Research methodology

section_name: Data analysis and discussions

section_name: Information technology industry

section_content: A total of 43 completed questionnaires were returned from the IT industry. Work types of the surveyed companies were comprised as follows: project management (72%), development (12%) and design (16%). Most surveys originated from large firms with headcounts of more than 500 (See Table 1 ). This may imply that most of the surveyed IT companies have capacity for the engagement of risk experts as well as development, training and education of risk management processes. In terms of working partners, 70% of the companies reported working with both domestic and international companies. Table 1 provides the profile of the respondents from the IT companies.
section_name: Data presentation

section_content: A set of questions were asked to collect each IT company's position towards risks that they faced in their business operations, processes and activities. The respondents were advised to answer the questions in accordance with their organizational cultures and policies. An attempt was then made to assess their firm's attitude towards risks by asking if management could be regarded as risk takers, risk avoiders, or neutral to risk. 

As shown in Table 2, most respondents (67%) considered their firms to be risk takers rather than risk avoiders (19%) or neutral to risks (14%). When those who identified their firms as risk takers were asked about the reason for their selection, most reported that because their organization had established organizational risk management policies and processes, their firms were not afraid to take on risky projects. The majority of the IT firms reported that they had been implementing risk management for a relatively long span of time (72% for greater than 5 years). Because the practice is well-established, it is likely one of the reasons that the firms were proactive on taking risks. Furthermore, as shown in Table 2, 63% of the IT firms stated that they implemented risk management on all of their projects. Of course, for a firm that considers itself a risk taker, implementation of risk management would be a logical "must" on most of their projects. Next, the respondents were asked to rate their assessment of the benefits of risk management. As shown in Table 2, 74% of the respondents chose either "4" or "5", indicating that the implementation of risk management was perceived as beneficial to their firms. The survey questionnaire listed possible benefits that can be gained through risk management implementation. Most respondents reported that time saving (23%), better cost control (23%), and better utilization of resources (19%) were the main benefits yielded by risk management. Efficient risk management allows organizations to develop contingency and mitigation plans that help them to manage potential risks and activate plans to address risks quickly when they occur. Also, as contingency plans are reviewed regularly to monitor and control risks, project managers can better predict cash flow and available budget for work to be completed. When implemented, risk management can prevent cost and time overruns and support more efficient utilization of available resources. Despite its potential benefits, the implementation of risk management can be challenging due to various reasons. The next section discusses the obstacles that IT firms reported as impediments to gaining the benefits from risk management.
section_name: Organizational attitudes towards risk management

section_content: A total of 11 statements, listed in Table 3, were included in the questionnaire to identify plausible obstacles hindering the implementation of risk management in IT firms. Interestingly, more than 90% of the respondents believed that the benefits of risk management were neither properly captured nor recognized by their companies (Lack of Belief in Benefits: mean = 4. 093; one sample T-test P-value = 0. 000). On the other hand, none of the rest of the barriers listed in Table 3 (Comfortable with the Current Operations, Not Requested by the Client, Not Approved, Insufficient Budget, Time Constraints, No Tools and Systems, PMs Not Trained, Staff Not Trained, No Risk Management Culture in the Company, and Not Much Risk to be Managed) were identified as significant obstacles in their firms. The findings suggest that if an IT firm does not implement risk management, it is more likely due to the lack of recognition of the benefits of risk management rather than limitations of time and budget or resources such as tools and trained project managers and employees. This result may imply that most IT firms have policies, systems, and processes for risk management, and their employees have been educated and trained in the area of risk management. 

The statistical analyses performed for this study revealed that the barriers reported by the construction industry were significantly different from those experienced by the IT industry. The differences are discussed following presentation of the results from the construction industry.
section_name: Barriers of risk management implementation

section_content: According to Ward et al. (1991) and Akintoye and MacLeod (1997), organizational culture cannot be ignored for risk management to be effectively implemented. As a result, the respondents were asked to select methods that could improve their current organizational environment towards adapting better risk management. As summarized in Table 4, about 90% of the respondents agreed that risk management implementation in IT firms can be improved by: (1) educating staff on the importance of risk management (mean = 4. 116; P-value for one sample T-test = 0. 000) (2) conducting training sessions covering the knowledge, skills and tools of risk management (mean = 4. 140; P-value for one sample T-test = 0. 000); and (3) enforcing the use of risk management through appropriate measures (mean = 4. 023; P-value for one sample T-test = 0. 000). 

Technological and Economic Development of Economy, 2015, 21(2) : 216-231 Lack of Tools and Systems 0 0% 0 0% 43 100% 7 22% 0 0% 0 0% 0 0% 25 78% 0 0% 0 0% 2. 000 3. 563 0. 000 0. 001 0. 000

PMs Not Trained 0 0% 0 0% 43 100% 7 22% 0 0% 0 0% 0 0% 25 78% 0 0% 0 0% 2. 000 3. 563 0. 000 0. 001 0. 000

Staff Not Trained 0 0% 0 0% 43 100% 5 16% 0 0% 2 6% 0 0% 25 78% 0 0% 0 0% 2. 000 3. 625 0. 000 0. 000 0. 000

No Culture in the Company 0 0% 0 0% 43 100% 11 34% 0 0% 8 25% 0 0% 13 41% 0 0% 0 0% 2. 000 3. 063 0. 000 0. 690 0. 000

Not Much Risk to be Managed 1 3% 0 0% 38 95% 4 13% 1 3% 4 13% 0 0% 24 75% 0 0% 0 0% 2. 000 3. 625 0. 000 0. 000 0. 000 for Risk Management 0 0% 0 0% 43 100% 2 6% 0 0% 7 22% 0 0% 23 72% 0 0% 0 0% 2. 000 3. 656 0. 000 0. 000 0. 000

Educate Staff on the Importance of Risk Management 0 0% 0 0% 0 0% 10 31% 1 2% 4 13% 36 84% 18 56% 6 14% 0 0% 4. 116 3. 250 0. 000 0. 133 0. 000
section_name: Improvement of risk management implementation

section_content: Knowledge. Skills. and Tools of Risk Management 0 0% 0 0% 0 0% 14 44% 0 0% 2 6% 37 86% 16 50% 6 14% 0 0% 4. 140 3. 063 0. 000 0. 721 0. 000

Bring in Relevant Experts to Perform Risk Management 0 0% 0 0% 42 98% 8 25% 1 2% 0 0% 0 0% 24 75% 0 0% 0 0% 2. 023 3. 500 0. 000 0. 003 0. 000

Enforce Use of Risk Management through Appropriate Measures 0 0% 0 0% 0 0% 11 34% 1 2% 9 28% 40 93% 12 38% 2 5% 0 0% 4. 023 3. 031 0. 000 0. 839 0. 000

This may infer that IT firms have already established processes and systems for risk management but they recognize that continuing opportunities for education and training should be given to their employees in order to maximize the positive impact of risk management at their firms. 

As shown in Table 4, the results from the methods for improvement cited by the construction industry were significantly different from IT. These differences are discussed later in more detail.
section_name: Conduct Training on

section_name: Construction industry

section_content: Thirty-two complete questionnaires were received from construction industry firms. A summary of the company profiles are presented in Table 5. Forty percent of the responding construction industry firms identified that their firm was involved in project management while the others were developers, contractors and subcontractors. About 60% of the firms were relatively small with headcounts of between 50 and 150. Small companies might be limited in their ability to implement comprehensive risk management systems due to the lack of financial capabilities and expertise. With regard to the job titles of the representatives from the 32 firms, the three largest groups were project managers (34%), quantity surveyors (22%) and architects (22%). A total of 75% of the respondents have experience of between 5 to 15 years while 10% of them had less than 5 years of experience in the industry. In contrast to the IT industry, 94% of the construction respondents declared that they did not possess any project management-related certification whereas only 19% from IT had no such certification. This may imply that the respondents from the construction industry have not received formal training in management, possibly in preference to enhancing technical skills and knowledge.
section_name: Data presentation

section_content: As shown in Table 2, 28% of the respondents regarded their firms as neutral to risk and 44% reported being risk avoiders. It is of interest that these respondents were mainly from development and contractor firms. Given the extent of the uncertainties they encounter in their projects, this passive attitude to risk is surprising. However, this result may correspond with the research conducted by Smith et al. (2006), indicating that the lack of risk management has persisted in the construction industry even though this industry is bound by a high degree of risk from complicated activities. In fact, 94% of the construction industry respondents reported that they had less than 3 years of experience implementing risk management. 

Table 2 shows that the degree of implementation of risk management is quite low when compared to the IT industry with a total of 66% reporting that their firms did not implement risk management at all on their projects. Although 31% of the firms indicated that they practiced risk management on some of their projects, and 3% did so on all their projects, the benefits from risk management implementation are apparently not well recognized. The majority, 88% were neutral about its benefits and 3% disagreed that there were benefits. Nonetheless, the survey respondents did indicate that proper implementation of risk management may produce better identification and management of risks that affect cost and schedule performance (time saving -44%; better cost control -44%). 

Based on the results discussed above, it can be inferred that in the firms from the construction industry, there are doubts about the benefits of risk management and those attitudes hinder its implementation. The potential obstacles are discussed in the next section.
section_name: Organizational attitudes towards risk management

section_content: As shown in Table 3, 94% of the respondents believed that insufficient budget was one of the major obstacles hindering implementation of risk management in their organizations (mean = 3. 938; one sample T-test P-value = 0. 000). This may not be a surprise as the respondents originated from relatively small to medium-sized companies with limited financial capabilities for investment, development and implementation of risk management. Furthermore, 78% of the respondents agreed that untrained staff (mean = 3. 625; one sample T-test P-value = 0. 000) and project managers (mean = 3. 563; one sample T-test P-value = 0. 001), as well as the lack of tools and systems (mean = 3. 563; one sample T-test P-value = 0. 001) were barriers in their companies. This may imply that risk management in the Singapore construction industry remains in its infancy and therefore the adaptation of key players to appropriate risk management tools and systems is not yet common. It is also possible that insufficient financial support for risk management discourages development Technological and Economic Development of Economy, 2015, 21(2): 216-231 and implementation of tools and systems, further contributing to the lack of opportunities for training project managers and other project players. This may also explain why the potential benefits from risk management are not fully recognized. 

Considering that the mean scores of the listed barriers are statistically different between the IT and construction industries (reference the P-values of the two sample T-test in Table 3 ), it can be concluded that the firms from the construction industry face more barriers to risk management than the IT industry. In other words, due to active implementation of risk management, IT firms have likely overcome most of the listed obstacles while the firms from the construction industry have not. These results suggest that different strategies for increasing implementation in the two industries are required, as discussed in the next section.
section_name: Barriers against implementation of risk management

section_content: As shown in Table 4, 72% of the respondents in the construction industry agreed that their firms should develop internal systems to improve the degree of risk management implementation (mean = 3. 656; one sample T-test P-value = 0. 000). This strategy was not recommended by the IT firms however, (mean = 2. 000; one sample T-test P-value = 0. 000) suggesting that such systems might already be in place. The mean difference of the responses between the IT and construction industries was found to be statistically significant (two sample T-test P-value = 0. 000). In addition, the construction firms felt that bringing in relevant experts would be important to encouraging more implementation of risk management (mean = 3. 500; one sample T-test P-value = 0. 003) while this method was not one of the top priorities of the IT industry (mean = 2. 023; one sample T-test P-value = 0. 000; two sample T-test P-value = 0. 000). 

The results imply that to increase implementation levels in the construction industry, proper internal tools and systems should first be deployed. Meanwhile, experts should be engaged with sufficient financial investment to support the effort. With a proper infrastructure, better implementation of risk management can be established and intensive education and training can be held to train employees.
section_name: Improvement of risk management implementation

section_content: Due to the relatively small sample size, it may not be appropriate for the results of this study to be generalized for broader interpretation of the entire construction and IT industries. Another limitation is that the lack of risk management implementation observed in the construction industry might be due partly to the small size of the firms that participated in the survey. It might be especially challenging for small firms to allocate sufficient resources to the development and implementation of rigorous risk management.
section_name: Limitations

section_content: This study aimed to examine and compare the status of risk management performed by the IT and construction industries. One major difference discovered in comparing the profiles of the firms from the two industries is that most of the managers/leaders from the IT industry were formally educated in management while those who were from the construction industry were not. It is important to note however, that having formal training or certifications does not necessarily imply a high level of expertise in risk management; rather, this merely ensures that risks are being managed by applying management skills. 

The two industries displayed wide differences in terms of organizational attitudes towards risk. The firms in the construction industry displayed the characteristics of risk avoiders while the respondents from the IT industry regarded their firms as risk takers that undertake the necessary steps to reduce the impacts of adverse risks. The principle of "Risk-Return Tradeoff " is that low levels of uncertainty are associated with low potential returns while high levels of uncertainty are associated with high potential returns (Investopedia 2011). When this is interpreted in the context of attitudes towards risk, IT firms exhibiting the characteristics of risk takers may benefit from more opportunities to generate higher payoff. Caution is warranted here because the assertion is true only when highly productive and effective risk management measures are in place such that risks are successfully mitigated or eliminated. The analyses performed in this study identified that the IT industry has been implementing risk management more and longer than the construction industry. 

While both IT and construction firms surveyed for this study tended to agree that risk management is beneficial and may produce better schedule and cost performances, more barriers were reported by the firms from the construction industry (Table 3 ). As a result, the most plausible methods recommended for the construction industry to improve risk management implementation were different from the IT industry. The firms from the IT industry reported that they have established systems and tools for risk management and thus need to focus more on education and training. On the other hand, the firms from the construction industry indicated that proper systems needed to be deployed and should be used with the engagement of risk management experts (Table 4 ). Following that, it would also be imperative to educate and train staff on the importance and processes of risk management, eventually enhancing the company's capability to mitigate risks and exploit opportunities. 

Furthermore, in order for firms in the construction industry to achieve long-term success in the area of risk management, more investment should be made to establish a competent risk management structure with proper IT solutions and training programs for employees. Governmental and statutory requirements could also increase risk management levels, in a similar manner as safety and management issues have been regulated and subsequently improved. Lastly, it may be practical to develop a series of certifications focusing on risk management and to devise a scheme for giving benefits to companies achieving such certifications.
section_name: Conclusions and recommendations