Keeping Projects On Track with Effective Risk Mitigation Plans
January 28, 2026
26 min listen
Podcasts/Keeping Projects On Track with Effective Risk Mitigation Plans

In this episode, hosts David Tibbetts and Shayne Gaffney break down risk mitigation plans and why they’re a critical part of managing both safety and financial risk. Using real-world examples, they discuss when corrective action plans, exception management plans, and other mitigation strategies are necessary, and how they should function as active tools, not paperwork that sits on a shelf.

They explore how to set the right tone when engaging contractors, what effective plans should include, and why follow-through and performance monitoring are essential to preventing serious incidents or project disruption.

Whether you’re evaluating contractors or managing active projects, this episode offers practical guidance on turning identified risks into meaningful action.

Transcript

[00:00:13] Shayne Gaffney: Alright, well today's episode of Beyond Prequalification, we're gonna be covering risk mitigation plans, uh, which should include CAPS, include exception management plans, and all that good stuff.

Dave, I know we had this pre-call, and you talked to me a lot about this roofer at Harvard. Tell me a little bit about that, and really, how you came to actually get them onto a risk mitigation plan.

[00:00:38] David Tibbetts: Yeah, absolutely. So when it comes to interacting with, engaging with, and sort of managing contractors that work across your projects or at your sites, this is a, a critical component of that. I think this story came to mind when we were preparing for the podcast.

And you know, in some ways, the story that I'm gonna tell kind of leads into a bit of the topic of conversation today as well, around how do we make this process a little more formal, do it a little more consistently.

So, you know, back 15, 20 years ago, when I was at Harvard, we had, uh, this roofing contractor, and this roofing contractor did really great work from a sort of quality of work perspective, the ability to deliver the scope of work that they were hired to do. Harvard has a lot of really intricate roofs, steep roofs, lots of pitches, lots of peaks, lots of lots of valleys, slate roofs, copper roofs, you know, really complex work. And this contractor was able to deliver that work, quality work, consistently across Harvard's campus. They got a lot of work at Harvard.

The challenge was that they just weren't quite where we needed them to be from a safety perspective. That type of work is really high-risk work. Some of the highest risk work that will happen on any project or on any campus or at any facility, right? Fall exposures all day, every day that need to be well thought out, planned, and we need to be able to execute against those plans.

Well, unfortunately, we had a number of fall exposures, significant exposures that just kept occurring across our projects with this particular roofer. And so it all sort of boiled over one day, where, uh, I was walking the job with a superintendent from a general contractor, and we went up to the roof, and there was a roofing cart, a fall protection cart on the roof, which was great that that piece of equipment was there.

If it's used effectively, it can be a great means of providing fall protection, but everything about the way that they were using the fall protection cart was wrong. Every single thing about it. From the anchor points that they were using to how far, uh, away from the roofing cart, uh, horizontally they had traveled before they descended to the level below. Everything about it was, was wrong. Right? And so as you would typically do, you make contact with the supervisor, you, you know, have the supervisor come up to talk to you, and that supervisor came up, ready to, argue, upset that his day was interrupted, his work was interrupted, wanted nothing to do with the conversation, despite the fact that everything they were doing with that fall protection cart was wrong.

And so at that moment, you know, the work was stopped for the day, and it had just gotten to the point where, you know what? I, I'm not in the business of, you know, removing a contractor from campus. That's not what we were trying to do, but it was like, okay, we can't continue down this path, or something really bad is gonna happen. And so we all got together. Harvard, myself, others from my team, the general contractors that consistently worked with this contractor.

And we asked the roofing contractor to come in for a meeting to talk about the things that we had observed, some of the significant issues that, that we had seen. And, you know, in the end, it was really productive. However, at that moment, during that meeting, it became a bit confrontational, although that was not the intent.

The owner of the company was defensive right from the beginning. Did not want to sort of take any accountability or responsibility. And so that was a challenge. And I think it's something we'll talk about a little bit as we get further in this conversation today. How do you approach those meetings as an owner, as a general contractor?

How do you approach those meetings as a trade contractor who might be asked to participate? That's important. And while the conversation that day didn't go exactly as we had hoped from a sort of collaboration perspective, I do think the message was received. A plan was put in place around having increased safety coverage on site, putting some job hazard analysis in place for the highest risk activities, and even hopefully improving their culture, safety culture, or the way that they interact and respond to, to things like that. In the end, it was very successful. But that is a, a story of kind of how you might end up in a place where you're putting a corrective action plan in place. But I think that's a good story to kind of anchor the conversation that we're gonna have today.

[00:05:12] Shayne Gaffney: Yeah, that's a good segue too, 'cause I know there's many different types of these risk mitigation plans. So you have corrective action plans or CAPS, uh, financial mitigation plans, maybe, uh, exception management plans, things like that. So from your perspective, maybe from your experience, when would you use one versus the other, and like, why is that the case?

[00:05:34] David Tibbetts: Yeah, I think that there are a lot of different names for these things, right? When you think of it through the lens of safety, A very common term for them is corrective action plans.

Through the lens of financial or default risk, oftentimes risk mitigation plan or exception management plan might be used.

There's all different names, but all of these are trying to accomplish the same thing. Essentially, if you think about it through the lens of the story I just told. That's a case where we decided to kind of get together and put a plan in place based off of performance on our projects or at our sites.

In other cases, the need to put one or the driver behind putting a plan together, a CAP for safety, might be just that contractor's history of performance as a company, right? Maybe they've had a fatality in the last three years. Maybe they've had a willful OSHA violation in the last three years. As the owner, as the general contractor, I wanna understand, what did you learn from that as a company? How did you address what led to that fatality? What led to that OSHA violation in the short term? And what have you done as a company to improve your programs, your management system, your planning, whatever it is? What did you do as a company to try to prevent those things from happening again in the future?

When we think about it from a kind of a default risk or financial risk perspective. It's very similar, right? As a company, when you, you know, you're looking at financials, uh, you're looking at liquidity access to to, to capital, right? You're looking at a contractor's debt-to-equity ratio. Have they taken on a lot of debt to fund their operations?

Is their backlog really bloated and large, which gives you some pause? Can this contractor deliver on my scope of work? So when you look at whether it's through prequalification or it's because of your experience with a company and their performance, there are gonna be different things that drive the need to have a conversation and put a risk mitigation plan in place.

And those are some examples.

[00:07:42] Shayne Gaffney: For sure. And yeah, to go back to that story, that roofer, you know, you did see a risk, and that risk was, you know, fall prevention and fall protection. So from there you created a CAP, and then ideally that CAP, to your point, should prevent further risk, 'cause that's the whole goal of either one, is to either prevent a default from a financial perspective or to prevent any safety incidents or safety risk from occurring.

That's kinda the whole goal. And in terms of why do they matter? Well, that is why they matter, right?

[00:08:14] David Tibbetts: Just like you said, a big picture, like why would we put a corrective action plan in place? It's to make sure that the work on this project, or on this site, is delivered safely without significant incident. Right. And then, from a financial risk perspective, the outcome that we want to prevent is a default, right?

By putting a risk mitigation plan in place, the goal is to make sure that the contractor is able to deliver that scope of work. A default would be the worst-case outcome, significant schedule impact, significant cost impact. And you know, that's what we wanna avoid.

[00:08:52] Shayne Gaffney: For sure. Okay, so let's go one step, I guess, further then. So again, going back to that roofer, the first thing you need to do in actually creating these plans is creating a meeting or creating some form of touch base between either the, uh, client and contractor or whomever it may be. So. You know, talk to me about how important it is to set the tone of that meeting, both from a contractor perspective, but also from the client slash owner perspective too.

'cause I'm, you may have been involved in both, and definitely you've been involved from the client's perspective.

[00:09:27] David Tibbetts: It's critical. I mean, big picture, it's important to understand that the process of creating a corrective action plan or a risk mitigation plan it's not meant to be, you know, punitive. It should not come with like a negative perception. The whole idea of it, in my mind, is to be able to facilitate a conversation. To drive some collaboration. That results in an actionable plan that delivers the desired outcome.

If you are the hiring client, let's say, and you might be the asset owner, or you might be the general contractor. And you have identified some risk, and you're gonna ask a contractor to develop a CAP or participate in the process. The way that you approach that contractor, the way that you prepare the contractor for that meeting or that initial meeting, or the way you kick off that discussion is really important. If you do it the wrong way. It can be perceived as very negative. So it's, it's important to just think about the way that you approach that as the hiring client. And from a contractor, I feel like it's equally important.

Are you immediately on the defensive? Are you upset that you were asked to participate in this, or do you realize and view this as an opportunity? An opportunity to kind of strengthen your relationship with the client that's hiring you. Maybe an opportunity for you to learn something that can help you make your business operate more safely. If you don't understand the reason why you're being asked to participate in this, ask questions before you, before you get there, before you get to the meeting.

If you're asked to respond to something in writing and you don't understand what, what the client is looking for, ask Right? There's no reason that, that you shouldn't ask those questions. So I think it's important, from both personas there, the hiring client and the contractor, um, to really think about, Big picture, what is the purpose of this? If you understand and recognize that the purpose of this is continuous improvement, delivering work safely, meeting project schedule, being successful together, I think that the, the process will be much more productive.

I.

[00:11:40] Shayne Gaffney: Agreed. And yeah, it's important, I guess, in any real-life meeting, right, to not come in, guns a blazing, profanity slinging, as soon as you walk in the meeting, right.

[00:11:50] David Tibbetts: Yeah. Yeah. Which unfortunately does still happen in construction and in other industries more so than, than in other, uh, places of work. So I think, you know, we want to try to avoid that kind of mindset where it's sort of like combative, right?

You know, the, the, the way that I've seen it be most successful is when everyone recognizes that they have an important role to play. So if every member of that team is successful, everybody's successful together, right? And I think it's a really important mindset to have.

[00:12:20] Shayne Gaffney: I agree. Yeah. I mean, if I could trigger back to when I was doing physical therapy, same thing. I would create these things called HEP's, which is another, we've love three-letter acronyms. I'm realizing in all industries, but a home exercise program or at HEP, again, it was a piece of paper that basically said.

Do these exercises or these stretches x times per day, right? But that wasn't really important. What was important was the relationship with the patient, being understanding of if things were too hard or maybe too easy, and having follow-through. Having follow-ups and making sure that you know, the plan was bought in from both Parties, but also something that the party who's doing the exercises could actually accomplish on a regular basis.

And these seem to be very similar in terms of broad strokes and very similar to the approach that you're taking, which is great.

[00:13:11] David Tibbetts: Yeah. I think it helps us transition to maybe our next kind of main topic here, but like if you had put that plan in place with the athlete. And then never followed up with them to help them improve their performance. What did you really accomplish? Right?

You've lost the opportunity to really make that a meaningful exercise. And that is a place where, when it comes to creating corrective action plans for safety or risk mitigation, plans for finance, that's where a lot of people fall down. We've gotta be able to follow through. Because if you just put a plan together on a piece of paper and it sits on a shelf or sits in a file and nobody monitors to see if it's, you know, giving us the desired result, then we, we sort of wasted our time.

[00:13:53] Shayne Gaffney: Correct. Yeah. And I'm curious to, before we get to that point, 'cause like, you know, very simple example, if I'm a cyclist and I want to improve my endurance, I would say, okay, great. Ride your bike 55 miles instead of 50 miles this weekend, right? But I'm curious, like in the construction industry, if maybe we use the roofer as an example, what was on their plan to then make sure that, objectively, they were following through with that?

Or if you have a better example, I'm just curious of what things you would find on an actual plan.

[00:14:26] David Tibbetts: So I think it all depends on what is uncovered during that initial conversation.

What the initial risk factors were that kind of drove that need to create the corrective action plan? Let's imagine that a contractor had a willful OSHA violation for failure to provide fall protection. They basically blatantly disregarded the rule, which could result in a willful violation. So that's a big deal. Right?

If you think about the example of the, the roofer that I mentioned, just consistent Issues with providing and using fall protection correctly. What are some of the things that, that you might do, or incorporate, into that corrective action plan?

You should, you should be thinking about being able to monitor performance against those actions as well. Right? So some, some simple things that you might say that are a pretty common, kind of, uh, an action, is, we wanna increase safety presence on site for at least 10 hours a week or 20 hours a week, or maybe full-time, depending on how many workers are on site, right?

That's something we can monitor. Make sure that the resource is there, that safety professional is showing up. Um, we might say, we want that safety professional to do at least one inspection per day focused on fall prevention and protection, and we can review the, the aggregated data from those inspections on a weekly basis. And we can see, are we implementing fall protection measures effectively? Is there any type of risk that is emerging that we should make an adjustment to our plan? Right?

On a biweekly basis, we might say, okay, let's sit down as a team, review the, uh, schedule for the next month, identify the high risk work that we're gonna have to do, and let's make sure that we have plans in place to do that work and let's revise existing plans as necessary based on the data. Those are some things that we can do to drive a successful outcome on that project.

Now, I think this is kind of to, to take it big picture. Hopefully, we deliver the, the right outcome on that project or for that scope of work. But that whole process of having the conversation, collaborating to make sure that a plan is in place that works for everybody, monitoring performance against that plan, and then seeing that plan be successful.

It doesn't just stop at that project. There are lessons to be learned. There are things that can be incorporated into that company's business so that they become a safer business as a whole going forward. So, uh, I, I, I think that if people just think of it as a, a, a document or a piece of paper that yep, we've put this in place because, you know, we wanted to check that box, you're, you're missing the point.

And there's so much value that comes from, from just the whole process.

[00:17:21] Shayne Gaffney: These things should not be collecting dust on a shelf somewhere. You should be ideally, to your point, biweekly, monthly, or even daily if the risk is high enough. Doing some form of evaluation or inspection of work to make sure that the contractor is following through and they're not making the same mistakes of the past.

[00:17:40] David Tibbetts: yeah, definitely, and, and, you know, We talk to our clients, all the time about just different best practices and ways to manage risk and interact with contractors and, and one of the most consistent things that we heard in terms of like where we need to get better in this regard, just as an industry, is that, too often the plans are developed. They are put in place, and they do sit on a shelf. We had a conversation with the project team before work begin. We put what we thought was this great plan in place, but nobody references it again. There were no actions defined of like, okay, how are we gonna take a look at the work and actually make sure that this plan is working?

So one of the most, uh, you know, there were several themes that we heard, but one of the most common themes that we heard is that the plan gets developed. It sits in a binder. It sits in somebody's local, on somebody's local computer. They store it in a local drive or folder, and there's no central repository for them, and they just aren't actionable documents.

And that's where this can fall down, and that is consistent. Whether we're talking about trying to manage safety risk or trying to manage default risk.

[00:18:56] Shayne Gaffney: Okay, so we talked about, again, having the meeting, right, make sure everybody's prepared. Nobody is ideally angry. We talked about having it be a coming together moment, more communication, what these things are included, how they shouldn't be on a dusty shelf. They should have still a lot of follow-up and evaluations.

Now, kind of the terminal state of these is eventually the project will conclude, and at that point, the risk mitigation plan will essentially be also concluded. So what's the next step from your perspective in terms of, okay, we did this great, uh, risk mitigation plan. We learned a lot about each other ways of working.

We learned a lot about some of the common things this contractor does. How do I then take that and apply that to the next projects I award this same contractor?

[00:19:48] David Tibbetts: Yeah, so I think, like you said, when a contractor completes their scope of work, right, we had put a corrective action plan or a risk mitigation plan in place. Their scope of work was four months, five months on the project. If we've monitored performance against that plan, we've aggregated some data, right? And in the end, we should be able to make a determination by looking at that, that data, and that documentation to say, was that corrective action plan successful? Right?

What's important is, and an and another sort of gap that we hear consistently across clients is that there's no kind of central repository for those corrective action plans. If I worked with that roofing contractor, or if I worked with ABC company on three or four or five projects over the course of the last year or 18 months, and we had put a project-specific or scope-specific corrective action plan for each one of those things, that's important context to have.

And when I go and look, and I consider, Hey, I, I'm thinking about working with that company on this next project, I should have all of those corrective action plans accessible at my fingertips. I can look at what some of the key elements of those were, and I can use those to, to have a conversation, an even more effective conversation with that contractor going forward.

The other thing is like, hopefully, over the course of those three or four projects, that contractor delivered the work successfully, and they, they became a really, a contractor that I could trust to be able to execute. And maybe we don't need a corrective action go plan going forward because they have all of this data. Right?

[00:21:31] Shayne Gaffney: You know, that's actually a great point, is the whole reason of doing these things is to, Hey, we identified a problem, here's how we're gonna work together to correct it and ideally make you a more successful business or, uh, a safer business in the process.

I think that's a really, really good call for sure.

[00:21:48] David Tibbetts: Yeah. I think, you know, we, we've spent, uh, a fair amount of our focus has been on the safety side here. I, I want to

[00:21:54] Shayne Gaffney: Yeah.

[00:21:54] David Tibbetts: You know, just take an opportunity to talk about, we talked about what some of the specific actions are that you might outline in a corrective action plan for safety. I think, you know, you and I have spent a lot of time, focused on financial risk and default risk over the course of the last two years here, right?

[00:22:12] Shayne Gaffney: I sure have.

[00:22:13] David Tibbetts: Talking to clients, talking to brokers, talking to carriers, and we hear something very similar on the default risk side, which is that companies do a good job of, of identifying the risks. Hey, this contractor isn't in the greatest position from a liquidity perspective, or they've taken on a lot of debt, or their backlog seems pretty large, and it could present a risk. So they do a good job of identifying risks like that and identifying what they should do to address those risks in the plan.

But they often fall down in the follow-up and, and just like safety with, with default risk, if we are not monitoring Things during the course of construction, and we're not maintaining visibility into whether or not, you know, there's some increasing financial strain. We are, again, we are falling down from a default risk perspective. So when your plan calls for things like, Hey, execute a joint check agreement, and then issue joint checks when your plan calls for, requesting quarterly updates of backlog or quarterly, um, financial statements. But you don't have a mechanism to follow through to, Hey, did we actually execute a joint check agreement? Okay, we did. Did are we actually issuing joint checks, you know, when we're making payments? Are we collecting quarterly backlogs and taking a look at them to make sure that, okay, things still look, look good? Are we monitoring, you know, manpower projections, versus actual manpower that's being delivered to the site?

So I just wanted to take an opportunity to talk about some of the actions and some of the performance monitoring that should be done as part of, uh, you know, kind of default risk and exception management plans.

[00:24:02] Shayne Gaffney: That's great. Yeah. Awesome. Well, I guess anything in closing or in summary, I think we did a pretty good job this episode.

[00:24:11] David Tibbetts: Yeah, I mean, I think we covered it all. I think, you know, uh, I think there's a lot of, uh, energy around this idea of like, Hey, you know, we do a good job of pre-qualifying contractors to, uh, identify potential risk. We do a pretty good job of monitoring their work in the field. But our process for like putting plans together when we identify risk, it's kind of informal. It's kind of all over the place. We don't have a standard way to do it. We don't have a standard way of storing them.

So I think there's a real opportunity to kind of formalize this process so that when we pre-qualify contractors, identify potential risks, put plans in place to address those risks, and then monitor execution against those plans, that's when the best outcomes can be delivered. And so it's just really exciting to, to think about, you know, how to kind of close some of those gaps and deliver the best outcomes.

[00:25:06] Shayne Gaffney: Well, we also want to hear from everybody listening too, of course. So you know, any disagreements you can send 'em to Dave, anything you loved, you can send them to me. That's always appreciated. I'm just kidding. But seriously, if you did disagree with anything today, let us know. And also, you know, what from your perspective would make risk mitigation plans more valuable or make the process better?

Or how, what are the, some of the, uh, lessons that you've learned as you've actually executed these plans? We wanna learn 'cause we also wanna hear from you and see what we can do better. Uh, and again, Shane, S-H-A-Y-N-E@highwire.com is me, and then dave@highwire.com is Dave. Thanks for tuning in, and we'll see you guys on the next one.