GUIDELINES TO RISK MANAGEMENT MATURITY IN CONSTRUCTION PROJECTS

Purpose – This article aims to provide the guidelines to assess the risk management maturity (RMM) of construction projects. Design/methodology/approach – This article presents a literature review of the main risk management models, which aims to support a survey research to define, according to experts, the market preference and knowledge of RMM models. Findings – We pointed out in this article a set of guidelines to direct the maturity analysis of RM in the Construction Industry and proposed a model matrix to help companies to evaluate the maturity of the RM of a whole project or each activity separately. Research limitations/Implications – Limitations of this article include the search options originally defined by the researches in literature review and concepts and measures chosen to be evaluated by experts in the survey. Other approaches could explore the implementation of a RMM model considering quantitative measures in others areas. Practical Implications – The article provide to construction companies a way to measure their risk management capacity against four standard levels of maturity, allowing them to make benchmarking and to improve and increase their ability to manage risk. Originality/value – We highlighted to professionals and academics which factors were essential seeking to improve the risk management continuously.


INTRODUCTION
The environment in which organizations operate today is rapidly becoming more complex and competitive.Major technological changes and constant changes in the business scenario have many opportunities but also many challenges for organizations looking to thrive in a sustainable way (Bouer et Carvalho, 2005).
For Tomas et Alcantara (2013), risk management has been an important tool with regard to the search for an effective reduction of vulnerabilities and in this context, some researchers have suggested models that can serve as guidelines for the practice of this management.
According to Frederico (2012), maturity is a theme extensively explored in recent years by researchers in business management area, focusing on various areas.Siqueira (2005) points out that the company's management maturity has an impact on competitiveness both for obtaining new contracts and for business continuity, from the ripening of internal initiatives to improve the consistency of planning, implementation and monitoring their processes.In this respect, the management maturity assessment allows objectively identify and plan the three basic types of process improvement actions: • improvement of predictability: the first expected result of a mature organization is to decrease the difference between desired and actual outcomes (time, cost and quality).
• improvement of Control: organizations more mature become more effective in control of your performance within acceptable limits.
• improvement of effectiveness: with the evolution of maturity, the organization eliminates waste, failures and rework.Cost and time are reduced, quality and productivity grow.
The Construction sector has strategic importance in the Brazilian economy, because of its multiplier effect on other economic sectors and consequently, on employment, income and taxes (Noro et al. 2008).This sector is very different compared to other sectors due to its features, making it a very subject to the risk area (Fortunato, 2013).According to Silva (2011) sector specificities are due to the following factors: • Each project which begins is treated as a virtually new project, and often there is no repetition of the characteristics of enterprises ; • The place where the project is developed is different from the place where the work takes place, which in itself creates uncertainty that can determine the final quality of the project ; • The work to be performed under precarious conditions, since the construction phase takes place in contact with the external environment and are often people, materials, equipment and the work itself exposed to situations that may cause damage and, consequently, costs variances and work delays;There is the necessity of the intervention of several people, in most cases, from different areas, originating conflicts, information breaks and communication difficulties.
Ehsan et al. (2010) states that the construction industry is highly prone to risk and their complex and dynamic project environments create a climate of high uncertainty and risk.Zou et al. (2007) states that the various interests of stakeholders in a construction project further aggravate the changeability and complexity of the risks and according to Nasirzadeh et al. (2008), the occurrence of one risk may exacerbate other risks or portfolios of risks due to their highly complex interrelated structures and existing interactions.
According to Akintoye et MacLeod (1997), the construction industry and its customers are widely associated with a high degree of risk due to the nature of activities, processes, environment and organization of the construction business.If the risks are not treated satisfactorily there is a maximum probability of exceeding costs, generate delay and low quality, resulting in customer and community dissatisfaction (Ehsan et al. 2010).
Also according Ehsan et al. 2010, the risk in the construction industry is perceived as a combination of activities that negatively affect the objectives of the project time, cost, scope and quality and in accordance with Kartam et Kartam (2001), risk analysis and risk management passed to be considered as important parts of the decision-making process in construction companies.
Such aspects may point out that in the context of construction, companies need to implement the risk management consistently and systematic, but there is not a maturity model aimed at Risk Management in Construction to measure or assess the maturity level of this process within organizations according to the requirements of a management system and therefore applicable to companies of different sizes and market segments.
It is in this context that the risk management has emerged as a major strategic force, as it helps to predict and prevent potential economic and financial losses due to the shutdown of the business or by contractual aspects, either by damage to health and physical integrity or environmental impacts inherent in the processes, services or products that compromise the organization's image as a whole.
In this sense, the aim of this article is to answer the question: What are the guidelines in the assessment of risk management maturity in construction projects?Thus, the article was organized into five sections in order to answer this key question.The first presents a background of management competitive scenario and the construction sector.Section 2 starts a literature review on the topics Risk Management Maturity Models and Risk Management.Section 3 will be a survey in key risk management institutes to identify the usual instruments applicable for these institutes.In section 4 the application of a questionnaire will be held to detect from the experience of experts, the different perceptions of the models under construction, in addition to presenting the results of the framework generated for the management of construction and the guideline proposal through three steps.Finally, in section 5 will be presented the analysis and conclusion of the studies presented before, answering the central research question and presenting the benefits of a risk management conceptual model to construction projects.

The Context of Risk Management (RM)
The risk is inherent in all construction projects and the assessment of maturity in risk management in this sector is useful to understand the significant risks in order to anticipate the negative effects of these on the projects.
According to Lowe (2013), the risk is an important issue in today's society and its management is a key feature of the marketing function.While there has always faced threats, the concept of risk is relatively new and is concerned about the time and the belief in control of the future.ABNT (2005a) states that the risk is the probability of threats exploit vulnerabilities, leading to loss of confidentiality, integrity and availability, possibly causing impacts (consequences) in business, while the risk management process comprises a set of coordinated activities to drive and control an organization with regard to risk.
Currently risk management is a central element in the management of any organization's strategy.In this sense, risk management should be a continuous process and in constantly develop applied to the strategy of the organization and implementation of this strategic process.For this, must be analyzed methodically all the risks involved in past activities, present and future of an organization, and be aligned with the culture of the organization with an effective policy and a program led by top management.Thus, the main elements of a sound risk management are related to the identification of risk and treatment of them (Ferma, 2003).
Risk management should not be seen only as a means to reduce the threats, but also as a means to identify opportunities that enable an organization to improve its performance (Ferreira, 2008) and a effective risk management is a central function in the successful planning and execution of construction projects (De Zoysa et Russell, 2003).
According Loosemore et al. (2006), it is increasingly important to adopt a joint strategy of risk management by all stakeholders in order to achieve the project objectives.Although stakeholders have different project objectives and even competitors, the joint risk management can ensure that the project objectives are more transparent and thus can be achieved efficiently (Choudhry et Iqbal, 2013).
According to Jia et al. (2013), the analysis of RM processes in project management reveals a key issue on their quality.Thus, the use of effective tools and measures to deal with this process is important, since the RM maturity aims to address these processes and measures in order to make effective and aligned with the overall objectives of the organization or project.
According Kutsch et Hall (2005), the risk management objectives are to reduce the impacts of adverse or unexpected events and not foreseen in the project.However, Raz et al. (2002) asserts that projects tend to suffer unwanted results.In this sense it is essential to learn to accept these results as part of reality and prepare to reduce risk, whenever possible, in a systematic and methodological manner, through risk management techniques (Fortunato, 2013).
Risk management is not a simple concept, because normally each organization develops its own unique structure consisting of different practices and activities.To Mullai (2009 apud Tomas;Alcantara, 2013), the variation in activities that make up the existing risk management models in the literature can be attributed to factors such as: a) influence of different contexts (political, economic and social, for example) in the perceptions of the authors about the risks or; b) different needs (about risks) by distinct segments, i.e. each country or region has its priorities and each company has different interests, which ultimately, according to the author, influencing the proposition of such models.Thus, the organizational risk maturity is in the determination of the quality and quantity of activities to be implemented in order to determine whether the risks are properly managed in accordance with the wishes of its board of directors and senior management, and if the process risk management is aligned with what is communicated with its stakeholders (Coetzee et Lubbe, 2013).

Risk Management Maturity (RMM)
Öngel (2009) states that if the concept of maturity is adopted by an organization, it is in perfect condition to achieve their goals.The author (Öngel, 2009), also states that maturity can best be described to the business community by combining three different dimensions: action (ability to act and decide), attitude (willingness to engage) and knowledge (understanding the impact of will and action).
According to Junior (2010), maturity acquires an aspect of diagnosis and although representing the achievement of a level where management practices and projects control to be "institutionalized" in the organization, it should be remembered that repetitive or institutionalized processes and systems are not guarantees of success, only increase their probability.
The definition of maturity is linked directly to processes and efficiency with respect to fulfilling it, so Siqueira (2005) defines mature and immature organizations in different aspects adapted in the table below:

Objetives
The process is explicitly defined, managed, measured, controlled and effective; Achieve their results thanks to the heroic efforts of individuals using approaches that they create more or less spontaneously; Planning Do things in a systematic way; In many cases, the quality is not required, and the time and costs can be much greater than the planned;

Achievement of targets
Achieve their quality goals, deadlines and costs in a consistent and efficient manner; Create goals, but too often lose them by wide margins of error;

Processes
Have systematized processes and documented methods to do their work; Do not think in terms of processes and their methods vary depending on the circumstances and the people doing the work;

Results
Data are systematically collected and used to analyze, control, predict and plan for their performance; Their results are unpredictable and inconsistent; Source: Adapted from Siqueira (2005) This table shows the different aspects of the organization as a function of maturity, it is possible to realize its importance in the results and quality expected by any organization.The maturity models, also called structured models in stages, enable organizations to assess their evolution as a given content (Lin, 2007).
The risk management maturity reflects the sophistication to understand the portfolio risk of an organization and how to manage these risks as well as internal business continuity systems needed to face this eventuality and to recover (Zou et al., 2010).
According to Jia et al. (2013), it is considered that the maturity models can effectively help organizations understand the current level of their RM practical skills as well as their strengths and weaknesses in relation to future practice of RM in order to take the appropriate measures to improve its performance in this management process.
According to Coetzee et Lubbe ( 2013), a risk maturity model is mainly used by risk managers to assess how advanced is its risk management process and to communicate this information to senior management and the board of administration, which in turn, can incorporate this information in their decisions concerning risk management.
As Mokgoantle (2012), the risk maturity models are typically qualitative models, which aim to describe the current state of implementation of the Enterprise Risk Management (ERM), and typically consist of attributes which are intended to describe the essential characteristics for the ERM such as management's commitment to RM. Different maturity stages are assigned to the attributes to describe the level of progress.
Several authors conducted approaches of different views related to maturity in risk management and it was in this sense that the research in this article was performed.

RESEARCH METHODOLOGY
The understanding and comparison of RM process of projects and risk management maturity models studied in the literature, allowed the analysis of similarities and differences and raised questions about its applications, knowledge and aspects relevant to the market.For this, the search in question was used in the following logic sequence shown in Figure 1.The first stage of the methodology consisted in the literature review of the main risk management models as well as standards and guidelines in order to support a survey research.It is intended to serve organizations that want to implement a formalized risk management or improve their existing approach.The model helps organizations assess their current level of capacity and maturity of risk management, to identify targets for improvement and to create strategies to develop or improve their level of maturity of the risk management capacity.It is a tool for organizations to assess the level of maturity in the business risk management.Proposes help an organization assess whether their approach to risk management is adequate or not, to compare its approach to best practices or in contrast to its competitors and create a benchmark accepted for organizational risk management.The model provides a framework for complex system projects for products to benchmark the current approach to risk management in contrast to standard five maturity levels.The tool allows the assessment of the current level of the organization, to identification of realistic goals to be improved and the development of action plans to enhance their risk management maturity.
Level The need to manage risks is important for all professionals and industry groups, who are concerned about cost, time and quality.Thus, from the literature review, it was possible to verify the main maturity models in risk management applied to projects and organizations, as shown in Table 2.
The models listed in Table 2 show that there are similarities between the maturity classification levels used by models and some models have been refined from others.It is also observed that there are models that are better for certain sectors and enabling the improvement of the RM maturity in accordance with the types of risks observed.
From the study of the models dimensions and the perception of attributes related to different levels, were raised 25 critical aspects of maturity models in construction projects.
The second stage of the research involved collecting information needed to define, according to experts, the market preference, as the use and knowledge of: relevant maturity models and descriptors of RM maturity in order to propose guidelines for the analysis of the maturity of risk management in construction projects.The collection was developed as follows: • Research Instrument: The collection of survey data was developed through the electronic questionnaire, which has been used to send the Google Drive site (https://drive.google.com).
• Sample: The questionnaire was sent to about 100 professionals working in project management area, having been obtained answers of 36 experts.
• Period and application process: The survey was conducted during the period from July to October 2014.
• Analysis Tools: The development of analysis and management of knowledge was gathered through the use of excel application.This model, as a sector model may be useful to improve the development of "internal control systems" between mutual insurance companies and also among the companies, being an especially powerful tool for the larger insurance companies.The objective model find a way to adapt the Scrop (capital requirement for operational risk) to the state of the entity's management system.With that, objectively measures the level of quality of the organization's management system.In order to organize the questionnaire in a logical sequence and better understand the subject studied, the questionnaire was divided into three blocks, well structured: • Block A: featured as the "Participant Profile", consists of three closed questions with multiple choice.We tried to understand the main characteristics of the respondents, as training area, training time and experience in risk management theme.
• Block B: featured as "RM maturity models", consists of fourteen maturity models used for risk analysis, in which the expert should select, based on their experience, RM maturity models best known for specialized market.It was tried to set a preference order of the models in order to classify them according to its relevance to the industry and choose the most applicable to the construction industry.
• Block C: characterized as "descriptors of a mature RM", consists of 25 descriptors chosen from the theoretical review of existing maturity models, in which the expert should evaluate, according to their perception, the key practices that a mature organization must possess to effectively manage the risk.We tried to set up a ranking and choose the main descriptors to define the critical aspects for a RM maturity model in construction projects.
For the survey responses was used Likert scale presented below in Table 3.The last stage of the research was the analysis of the results obtained in the survey, in which we sought to compare the state of the art with expert opinion.Based on the responses was verified which models or descriptors an organization of construction sector should make use as a guideline to improve its RM maturity.

Survey Results
From the data received from respondents, it was implemented an analysis of the results of the four blocks related to research in order to answer the questions raised by this article.The profile of respondents was the theme of the research questioned in the first block and Figure 2 shows the results based on the academic education.It can be seen that the engineers formed 72% of the total body of respondents being this data extremely important when analyzing the results of other information found, as the central focus of the article is a survey to determine the guidelines of risk for the construction sector.Furthermore, it is observed that 34% of the sample has more than five years training time, which implies relative level of knowledge of participants in risk management.In addition, the mix of respondent body experiences brought to the search result an important heterogeneous vision for the analysis of results with opinions of professionals from various profiles.
To validate the responses of blocks B, and C of the study, Cronbach's alpha was applied.The Cronbach's alpha was presented by Lee J. Cronbach, in 1951, as a way to estimate the reliability of a questionnaire in a search.Alpha measures the correlation between responses in a questionnaire through the profile analysis of the answers given by respondents.According to Da Hora (2010), this is an average correlation between questions, since all the items of a questionnaire using the same scale of measurement, the α coefficient is calculated from the variance of individual items and the variance of sum of items in each rater using equation ( 1): where: (1) • k is the number of questionnaire items; • s²i variance corresponding to each item; • s²t total variance corresponding to the questionnaire, determined as the sum of all the variances.Número 3, 2016, pp. 372-385 DOI: 10.14488/BJOPM.2016.v13.n3.a14Table 4 shows the scale used to check the reliability of alpha and Table 5 shows the degree of accuracy or precision of the results.It was found from Table 5 that all search blocks showed high validity in view of the high Cronbach's alpha values.
The following analysis was based on the responses of the third block was evaluated the level of knowledge of experts in relation to each of the 14 risk maturity models.The results showed that as the moda analysis, they are all very little known.The graph below represents become two frequency bands: known to very much known models on the right side and little or very little known on the left side.Based on the results shown in Figure 3, it can be seen that among the studied models, the RMM / PMI model was named as the best known, because up to 60% of people considered it at least known.Thus, the RM maturity model of PMI was considered the most applied in the Construction Industry.This result is directly related to the previous block, because it shows the relationship of knowledge and applicability of the best practices of PMI when it comes to projects.Moreover, this result proves the increased use and knowledge of PMBOK in construction sector projects.
The central focus of the fourth block was the relevance of the descriptors of the main models of Risk Management Maturity studied.This phase of the research directly addresses the most relevant processes in the RM.The responses clarify the direct opinions on which RM process is most relevant to each expert, making it possible to conclude what should be the focus taken by the organization or project management in order to obtain the expected result.
The Figure 4 below shows the result of the relevance of each one of the 25 scored descriptors from the RM models.From the moda of responses was generated a radar graph representing the relevance of each descriptor.
The result shown in Figure 4 defines the most relevant descriptors: support senior management, RM knowledge, communication with stakeholders and contingency plan, in order to establish a mature risk management.
Thus, the results found with these descriptors bring important elements to be able to understand the most important processes for the RM maturity and covered important layers of an organization.In a mature process of RM is necessary to find, understand, monitor and control the expectations of each stakeholder involved, as each element connected to the organization or project can positively or negatively influence throughout the service life and RM lifecycle thus communication with stakeholder proved to be very important tool for planning risks.
It is clear to point out that in order to have success in a Risk Management process should be necessary to know and disseminate this culture, as well as the requirements and processes that make up the RM, with the knowledge of highly relevant RM processes related to the initially planned objectives.
For this to be effective it is necessary that this spread be initiated and defined by the senior management of the organization or project causing it to be part of the process as a whole and has its importance attached directly to the result expected by senior management.Thus, another very important descriptor punctuated by respondents was the support of senior management.
As a conclusion of greater weight descriptors, the Contingency Plan also had great weight, as it is directly related to the descriptors presented earlier because it sets requirements and what actions may or may not be taken in the event of anything that could cause deviations in goals previously defined.
Other items were also quite punctuated by experts, but two items of little relevance deserve analysis, a bit more detail: Dedicated Resources to RM and Stakeholder Management.The answer of the first proved to be interesting, because in contrast with the RM Knowledge descriptor, this item had lower relevance weight.With this, it can be concluded that the perception of respondents is that the spread of risk management culture is a more important resource on which or how many resources are working directly in the RM process.
The second less relevant descriptor that needs to be analyzed is the stakeholder management, since the process of communication with stakeholders had greater relevance.One reason for this is related to the fact that in the communication process with Stakeholder are already defined what relevant information and how it should be managed and treated to every stakeholder connected to RM thus it is understood that, from requirements set out in the Communication process, the management of stakeholders can be performed within other management processes as the own Communication management of project or organization.It is important to underscore that this does not demonstrate that the stakeholders management has little relevance to the success of an organization or project, but it has less relevance compared to other descriptors within the Risk Management process.
As results of the blocks analyzes, it was possible to extract relevant information which may contribute to the development of descriptors that can generate risk management maturity related to organizations and projects.

Proposal Guidelines
Based on the analysis and discussion of survey results, the following guidelines have been proposed in order to achieve the maturity of RM in construction projects:

Maturity Dimensions
As seen in the article, is a competitive advantage be the implementation of a maturity model to assess the processes and project RM levels.
Identifying which attributes are most relevant to the industry or its adaptation for construction projects are the choice of dimensions, in other words, the model descriptors.
In addition, the identification of the most qualified descriptors for the sector is also essential because it allows allocate RM activities for each attribute, better scaling risk levels.
However, the risk manager must have the necessary knowledge and skills for understanding the maturity models and their most applicable existing dimensions, it is his responsibility to make a market analysis and conduct scientific research.Thus, in this study it is observed as the Figure 5 the most relevant attributes for construction projects.Thus, it is presented as the first guideline: using the dimensions (i) RM knowledge, (ii) support from senior management, (iii) Contingency Plan, and (iv) Communication with stakeholder.

Maturity Levels
According to Bramont (2012), an inherent feature of any maturity model component refers to the maturity levels, forming basically the logical-sequential structure whereby the entities sometimes observed evolve and on which certain practices are distributed.
As with all models, it is expected that some organizations cannot fit in a proper way in these categories, but the RMM levels are defined differently enough to accommodate most organizations, without ambiguity.It was felt that provide more than four levels, would increase the ambiguity without bringing any additional refinement to the model.
Then took up the PMI's RMM model, considered best known and aspects of other most famous models in the literature as a reference to develop a conceptual model using attributes as the four most relevant descriptors for the sector.

Conceptual RMM Model for Construction Projects
Based on the analysis and comparison of maturity models reviewed in Table 2 and after analysis and discussion of the survey results, advantages and disadvantages in the models were perceived in terms of content and usability for The following Table 6 shows the theoretical model created in the form of a matrix, formed by four attributes that represent the most relevant descriptors according to the specialist market, and will be expressed in dimensions for each maturity level.
With the matrix model , it is proposed that companies evaluate the maturity of the RM of a whole project or each RM activity separately.Activities should be determined in accordance with its four attributes in order to see what level they are.Thus, as Hillson (2006), the evaluated level of RMM can be used by organizations that wish to increase their level of competence in risk through the development of strategies to enable more effective management of the risk or, alternatively, may serve as a way to evaluate against its main competitors, in order to gain advantage in the market.
Once the current risk maturity level is determined, action plans to advance to the next level can be developed as shown in the following table: Establish social networks and community relations Source: The authors own According to Fischer (2004), companies who progress to the top of the mountain, through each process maturity state, have the opportunity to gain efficiencies, reduce costs, improve customer satisfaction, become the market reference, and achieve competitive advantage.So as Hillson (2006) states are different obstacles faced by organizations in each of the different RMM levels and these will be overcome if progress has been made to the next level of risk maturity.

CONCLUSIONS
This work has a lot to evolve both in terms of methodology, as the content and can be a stimulus for further studies be made, in order to better parameterization and implementation of management tools in an area so critical and important as Risk Management.
It is expected that the results will be of professionals and academics interest, as this research may be useful to guide companies in the construction sector seeking a proactive and mature RM and can serve for future research.
One of the challenges of this work was to define concepts and objective measures to evaluate the events associated with risk management and project success.Based on literature review on the subject and other similar research was done a survey that was instrumental in defining the descriptors that represent the key dimensions of a mature RM and also verify the applicability of the standards most often cited in the literature on specialist market.After collection and sample data validation were applied some statistical techniques to analyze the behavior of choices as to the frequency and variability, testing its reliability.
The results reproduced much of the knowledge obtained from the literature review, but the level of detail provided by the use of statistical techniques allowed unravel some aspects that were not readily apparent.Each descriptor is an aspect to be evaluated and is proposed to further study the application of project RMM / PMI model and Risk Management Standard to some companies in the construction sector or the improvement of PMI model based on the observed dimensions.The findings presented in this paper can be considered by planners, project managers, supervisors and other key members of the project, as well as government organizations and business administrators, in order that to take stock of their current and future projects in the light of the risk management aspects raised in the study.
Finally, the main benefits of the model presented in this article are: • Allow construction companies to measure their risk management capacity against four standard levels of maturity; • Allow to identify what needs to be done in order to improve and increase their ability to manage risk; • It will allow customers, suppliers and other areas of the organization determine how well a project or organization is implementing the RM; • Assist in the development of specific strategies to go to a higher level of maturity.

Figure 2 .
Figure 2. Academic education of participants Source: The authors own

Figure 3 .
Figure 3. Best known RM maturity models Source: The authors own

Figure 4 .
Figure 4. Relevance of descriptors for the RM maturity Source: The authors own

Figure 5 .
Figure 5. Attributes for construction projects Source: The authors own

Table 1 .
Mature Organizations X Immature Organizations

Table 2 .
Key Risk Management Maturity Models

Author Model Description (What it is and where it is applied?) Maturity levels Dimensions
The RIMS Risk Maturity Model is a tool used for risk management and used by other executives with risk management responsibilities to develop sustainable business risk management programs.This online resource for ERM enables risk professionals to rate their risk management programs and receive a report in real time.The analysis, based on the guidelines established in the model serves as a road map for improvement of organizations.

Table 3 .
Likert scale used to evaluate guidelines of RM

Table 5 .
Values of alpha per block
Source: The authors ownBrazilian Journal of Operations & Production Management

Table 7 .
Activities and maturity transition strategies of RM Continue to involve customers and suppliers in the risksharing process Continually improve multiple skills of the organization, processes, software tools and technological applications of Project Management and Risk Management.