vaayaa Inclusive Education
Professional risk assessment

Engineering, Architecture and Construction Consulting Risk Assessment: Licensing, Data, Scope and Design Control Risks

A worked example of how a consultancy serving engineering, architecture and construction projects finds, scores and controls risks to designs, client data, budgets, approvals and the public.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Engineering, Architecture and Construction Consulting course

Executive summary

This assessment shows how a consultancy serving engineering, architecture and construction projects can find, rate and control the risks that matter most to its designs, clients and reputation. Eight risks were chosen because they are plausible in everyday consulting work, from licensing and confidential data to budget pressure and design defects. Confidential data exposure is the most severe inherent risk, and design defects reaching site carry serious safety consequences even though they are less frequent. Each risk is scored before controls and again after existing and added controls, and most fall to Medium or Low once the added controls are in place. The first actions are a single controlled register for documents, a written scope change process, a second check on safety relevant calculations and encrypted client file sharing. Every score is a teaching illustration of method rather than a judgement about a real firm.

Focus area
Engineering, architecture and construction consulting
Setting
Consultancy supporting design, engineering and construction projects for clients and contractors
Method
Five by five likelihood and impact risk register with residual review

Scope

This assessment covers a mid-sized consultancy that provides design, engineering review and construction advice on building and infrastructure projects, from brief and concept to handover. It considers intellectual property, confidential client data, budget and schedule control, document approval, design defects, usability, ethics and scope. Assumptions: jurisdiction, project types, contract forms and software are not specified, so general practice is described and all duties are treated as a teaching example.

Context

The practice has a principal consultant, project leads for architecture and engineering, a document controller, a commercial manager and a small team of designers and analysts. Work is shared through cloud folders, design software, email and a project tracker, and clients include owners, developers and contractors. Each risk is first scored as inherent, before controls, and then as residual, after the existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to deliver sound designs and advice on time and within budget, protect the intellectual property and confidential information entrusted to the practice, meet professional and contractual duties, and keep the trust of clients and the public. The assets in scope are design drawings and models, calculations, specifications, client data, licence and reuse terms, the project schedule and budget, and the reputation of the practice. Stakeholders include the consultants and designers, the principal consultant, clients, contractors, end users such as occupants and the public, regulators and insurers. Each risk has one owner role, and the principal consultant reviews the register each quarter with the project leads.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain Likelihood 5, impact 4, score 20, critical: H02
4 Likely Likelihood 4, impact 3, score 12, high: H03 Likelihood 4, impact 4, score 16, high: H04
3 Possible Likelihood 3, impact 4, score 12, high: H01 H05
2 Unlikely Likelihood 2, impact 4, score 8, medium: H07 H08 Likelihood 2, impact 5, score 10, high: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H03 Likelihood 3, impact 3, score 9, medium: H04
2 Unlikely Likelihood 2, impact 2, score 4, low: H07 Likelihood 2, impact 3, score 6, medium: H01 H05 H08 Likelihood 2, impact 4, score 8, medium: H02
1 Rare Likelihood 1, impact 5, score 5, medium: H06
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Intellectual property and licensing misuse 12 High 6 Medium Legal adviser
H02 Confidential client data exposure 20 Critical 8 Medium IT lead
H03 Unclear brief and scope creep 12 High 6 Medium Commercial manager
H04 Schedule and budget overrun 16 High 9 Medium Project lead
H05 Approval and version control failure 12 High 6 Medium Document controller
H06 Technical design defect reaching site 10 High 5 Medium Principal consultant
H07 Usability and accessibility failure 8 Medium 4 Low Architect lead
H08 Ethical conflicts and cultural or community impact 8 Medium 6 Medium Principal consultant
H01

Intellectual property and licensing misuse

Legal and compliance Before 12 After 6

Drawings, models, standard details or software are reused on another project, shared with a third party or used beyond the licence without permission, so the practice breaches ownership or licence terms.

Who or what is affected: Practice, clients and design team members

Causes

Reuse of past designs, unclear contract terms and pressure to deliver quickly.

Consequences

Claims for infringement, fees repaid, loss of client trust and forced withdrawal of work.

Existing controls

  • Reuse terms are stated in the standard proposal template.
  • Project files are stored in a shared folder with named access.

Control gaps

Licence terms for third party details and software are not recorded centrally.

Additional controls

  • Prevent: Confirm ownership and licence terms in writing before any design file is shared outside the team.
  • Detect: Review outgoing files each month against the register of licence terms.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Legal adviser Target: Within 60 days Early warning: An outgoing file sent without a recorded licence or reuse check.
H02

Confidential client data exposure

Technology and data Before 20 After 8

Client plans, tender prices, personal data of occupants and security sensitive building layouts are copied to personal devices, sent by unencrypted email or shared through public links, so they reach people who should not see them.

Who or what is affected: Clients, occupants, staff and contractors

Causes

Email attachments, personal devices and tight deadlines.

Consequences

Loss of commercial advantage, legal claims, harm to occupants and loss of clients.

Existing controls

  • Files are stored on managed devices with passwords.
  • Staff sign a confidentiality clause in their contracts.

Control gaps

Access to old project folders is not reviewed after the project closes.

Additional controls

  • Prevent: Use encrypted shared workspaces with named access and expiry dates for every client folder.
  • Respond: Run a written breach response plan and rehearse it with the IT lead each year.
Likelihood 5 x impact 4 before; 2 x 4 after Owner: IT lead Target: Within 30 days Early warning: Client files shared through unapproved channels or with public links.
H03

Unclear brief and scope creep

Strategic Before 12 After 6

The client brief is incomplete, contradictory or changed informally, and extra tasks are added without agreed fees or time, so the work expands beyond what was priced and planned.

Who or what is affected: Project team, client and commercial manager

Causes

Client uncertainty, verbal instructions and a wish to keep the client happy.

Consequences

Unpaid work, overrun, team fatigue and disputes over the final deliverable.

Existing controls

  • A written proposal sets out the agreed scope.
  • Project leads hold a kickoff meeting with the client.

Control gaps

Verbal requests are accepted without a record or a fee check.

Additional controls

  • Prevent: Agree a signed brief with measurable requirements and exclusions before design starts.
  • Detect: Log every request outside the brief and compare the log with the fee each month.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Commercial manager Target: Within 45 days Early warning: A scope change requested verbally without a written change note.
H04

Schedule and budget overrun

Financial Before 16 After 9

Design reviews, approvals or site information arrive late, and the programme and budget rest on optimistic estimates, so the project finishes late and costs more than the client was promised.

Who or what is affected: Client, contractors, project team and funders

Causes

Optimistic estimates, late client decisions and dependencies on other designers.

Consequences

Penalties, reduced fees, cost disputes and a damaged relationship with the client.

Existing controls

  • Monthly progress reports compare actual cost with budget.
  • Key milestones are shown on a shared programme.

Control gaps

Estimates are not revisited when scope changes and dependencies are not mapped.

Additional controls

  • Detect: Track critical path tasks and cost every two weeks and flag variances above an agreed level.
  • Respond: Hold a recovery workshop when a milestone slips and agree a revised plan with the client.
Likelihood 4 x impact 4 before; 3 x 3 after Owner: Project lead Target: Within 60 days Early warning: Forecast cost or completion date moved by more than 10 percent from baseline.
H05

Approval and version control failure

Operational Before 12 After 6

Drawings, specifications or calculations are issued without the right approval, or an old revision is used on site, so the work built does not match the design that was checked.

Who or what is affected: Contractors, site staff, clients and the public

Causes

Multiple copies, email distribution and urgent late changes.

Consequences

Rework, construction to a superseded design, disputes over liability and delays.

Existing controls

  • Drawings carry a revision number and title block.
  • A lead designer signs off each issue.

Control gaps

Superseded revisions are not marked or removed from shared drives.

Additional controls

  • Prevent: Issue documents only from a controlled register that blocks release without a recorded approval.
  • Detect: Compare site copies against the current register at each site visit.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Document controller Target: Within 30 days Early warning: Drawings or models issued without a recorded approval and revision number.
H06

Technical design defect reaching site

Safety Before 10 After 5

A calculation error, missing load case or wrong material assumption in a design passes into construction, creating a risk of structural, fire or service failure that could injure workers or occupants.

Who or what is affected: Construction workers, occupants, the public and the practice

Causes

Time pressure, reliance on a single software model and incomplete site information.

Consequences

Injury, structural repair, prosecution and loss of professional standing.

Existing controls

  • Calculations are checked by a second engineer for major elements.
  • Design reviews follow a written checklist.

Control gaps

Checks are not repeated when designs change late, and specialist review is not always documented.

Additional controls

  • Prevent: Require an independent qualified check on every safety relevant calculation before issue.
  • Respond: Stop work on any element with an unresolved concern and inform the principal consultant the same day.
Likelihood 2 x impact 5 before; 1 x 5 after Owner: Principal consultant Target: Within 45 days Early warning: A design change made after the independent check without a repeat review.
H07

Usability and accessibility failure

Operational Before 8 After 4

A building, interface or wayfinding design is hard for users to operate, or excludes people with disabilities, because user needs were not tested and the design was not reviewed against accessibility needs.

Who or what is affected: Occupants, visitors, staff and the client

Causes

User needs assumed rather than tested, and late changes to layouts.

Consequences

Costly redesign, complaints, legal duties and reduced usefulness for occupants.

Existing controls

  • Designs are reviewed against the client brief.
  • Client sign off includes a basic layout review.

Control gaps

Testing is planned late and results do not feed back into the design brief.

Additional controls

  • Detect: Test prototypes or mock ups with a range of users before design freeze.
  • Recover: Record usability defects in a corrective iteration log and fix them before handover.
Likelihood 2 x impact 4 before; 2 x 2 after Owner: Architect lead Target: Within 90 days Early warning: Usability test failures or repeated site queries about access routes.
H08

Ethical conflicts and cultural or community impact

Reputational Before 8 After 6

Consultants face conflicts of interest, pressure to approve unsafe or non compliant work, or designs that disregard local cultural heritage or community needs, damaging trust in the practice and the project.

Who or what is affected: Local communities, clients, staff and the practice

Causes

Close ties with suppliers, pressure to win work and limited consultation with communities.

Consequences

Loss of licence or standing, public objection, withdrawn approvals and reputational harm.

Existing controls

  • A code of conduct is signed by all staff each year.
  • Staff declare outside interests when joining a project.

Control gaps

Declarations are not compared with supplier lists or current project teams.

Additional controls

  • Prevent: Check each engagement for conflicts of interest and record the result before work starts.
  • Respond: Provide a confidential route for concerns and record how each was handled and reported.
Likelihood 2 x impact 4 before; 2 x 3 after Owner: Principal consultant Target: Within 60 days Early warning: A declared interest linked to a supplier on the current project.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic, covering safety, cost, delay, legal exposure, data loss and reputation. Multiplying the two gives a score from 1 to 25, placed in one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. Low risks are accepted and monitored by the owner. Medium risks need routine controls with a named owner and a review date. High risks need senior attention and a dated treatment plan, and Critical risks stop the related work until controls are in place. Inherent risk is the score before any controls, and residual risk is the score after existing and added controls. Residual scores must never exceed inherent scores, and any safety relevant item keeps its impact high even when likelihood falls. Ratings are challenged in three ways: a peer reviewer checks the scores, the project lead explains any downward change, and the register is revisited whenever a monitoring indicator reaches its escalation threshold or a project changes scope. Scores guide the order of work and are not measurements of the actual world.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Drawings or models issued without a recorded approval and revision number.Escalate to the document controller at once, and to the principal consultant if the same issue recurs within a month.
Scope change requests agreed verbally or without a cost and time update.Escalate to the commercial manager when any change is agreed without a written record, and hold further work until it is recorded.
Forecast cost or completion date moved by more than 10 percent from baseline.Escalate to the project lead within 2 working days, and to the principal consultant if the variance is not recovered within a month.
Client data shared through unapproved channels or unencrypted attachments.Escalate to the IT lead immediately, isolate the channel and report to the principal consultant the same day.
Site queries or defect reports on issued designs, or usability test failures.Escalate to the relevant project lead within 24 hours, and to the principal consultant for any safety relevant defect.

Contingency arrangements

If a serious event occurs, such as a confirmed data breach, a design defect found on site or a claim of copyright misuse, the principal consultant pauses the affected work and informs the client and insurer as the contract requires. The document controller freezes the affected drawings and restores the last approved revision from backup. The commercial manager agrees a revised programme and cost position with the client, and legal advice is sought through the qualified adviser in the relevant place. Staff and clients receive clear, early and factual updates.

Prioritized action plan

  1. Set up one controlled document register with revision approval, owner document controller, within 30 days.
  2. Encrypt client file sharing and enforce multi-factor sign in, owner IT lead, within 30 days.
  3. Introduce a written change request process for every scope change, owner commercial manager, within 45 days.
  4. Add a second qualified check on safety relevant calculations before issue, owner principal consultant, within 45 days.
  5. Review licence and reuse terms in every contract before drawings are shared, owner legal adviser, within 60 days.

Conclusion

Sound consulting depends on a few steady habits: a single controlled set of documents, written scope and change control, second checks on safety relevant work, protected client data and honest reporting of budget and schedule. The highest scores sit with confidential data, schedule pressure and document approval, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified professional advice for any real design, licensing, legal or safety question.

Assumptions and limitations

Assumptions

  • The practice works on building and infrastructure projects, and the jurisdiction and licensing regime are not specified.
  • Design work is reviewed by a licensed or chartered professional before issue, and the review outcome is recorded.
  • Clients supply briefs in writing, but these are often incomplete or changed during the project.

Limitations

  • The scores are examples for learning and do not describe any real practice or project.
  • Professional, design, safety and licensing duties vary by place and change over time, so specialist review is needed.
  • This is educational content and is not engineering, architectural, legal or contractual advice.

Related frameworks to study

  • Risk register with likelihood and impact scoring
  • Hierarchy of controls
  • Design review and verification checkpoints
  • Document control and revision management
  • Requirements traceability matrix
  • Plan, do, check, act improvement cycle

Professional Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Engineering, Architecture and Construction Consulting course Read the best practices for this course

More Professional risk assessments

Hourly Active: 45,552 Learners