Risk management

11 Main risk areas

Risk is inherent to any business venture and the risk to which the Group is exposed is not unusual or different from what is considered acceptable in the industry. The Group’s risk management system is designed to identify and manage risks. Effective risk management enables BAM to capitalise on opportunities in a carefully controlled way.

Risk profile and appetite

The focus areas of BAM’s new strategy ‘Building the present, creating the future’ have a positive impact on the risk profile of the Group. In the current project and business portfolio, BAM has a more disciplined focus on market segments and projects where the company can use either scale or expertise as a critical success factor. For the future business portfolio, BAM is rationalising its propositions and developing new solutions for clients and is investing in digitalisation to be an industry leader in how and what BAM builds. The new strategy also brings a stronger focus on cultural values, further supporting the BAM brand and strategy.

Risk appetite is defined as the level in which BAM is willing to accept risks in the ordinary course of business in order to achieve its objectives. Key factors in determining risk appetite are the risk categories: 

Strategic: Based on knowledge and experience in the home markets, BAM tenders on complex multidisciplinary projects, which involves the controlled allocation of risk between the client and BAM. Outside the home markets, BAM operates worldwide in niche areas, provided they are in line with the Group’s business principles. In PPP investments, BAM only invests in projects based on contractual availability (i.e. fixed compensation) and not on volume (i.e. variable compensation). BAM invests in property development projects provided they are profitable and have a clear and profitable exit strategy that has been defined in advance.

Operational: BAM aims to limit the risks that could jeopardise the execution of its business activities.

Compliance: Adherence to all applicable laws and regulations including the BAM Code of Business Conduct is fundamental to BAM.

Financial: BAM is committed to maintaining a solid financial position to guarantee access to financial markets and to maintain the trust of its clients, supply chain and other partners. BAM is averse to reporting risks that could impact the reputation of the company.

Risk management framework

The Supervisory Board oversees and advises the Executive Board, which has the overall responsibility for enterprise risk management in the Group. BAM’s framework, which is based on COSO (Committee of Sponsoring Organisations of the Treadway Commission), is integrated into the regular planning and control cycle, creating a Group-wide focus on risk management. There is a strong focus on developing employees’ risk awareness and risk attitude in a changing environment, for example by including the risk management philosophy in the curriculum of the BAM Business School, the in-house training institute.

The risk management and monitoring system provides a platform for sharing knowledge and expertise among the operating companies in a structured manner, making risk management a key enabler in achieving the strategic objectives. Corporate functions and subject matter communities across the Group accelerate the process of acquiring and sharing knowledge and expertise through a consistent risk management language and approach.

The 2016-2020 Group strategy was defined by the Executive Board and representatives of the operating companies and the corporate functions. In the strategic planning process, the strategy was translated into strategic objectives and initiatives at Group, operating company and corporate function levels, considering the risk appetite specified above. The main risks to achieving the objectives were assessed and prioritised through dialogue sessions. 

The Executive Board receives progress updates on the status of the strategic objectives, initiatives and leading indicators through dashboards in quarterly reports and in management meetings. This is also shared periodically with the Supervisory Board.

General management measures

Besides a variety of specific management measures, the following general management measures as part of its risk management and monitoring system.

Business principles 
The business principles (see page 37) represent the Group’s beliefs and key do’s and don’ts and are connected to our values. Along with the Code of Conduct, these principles form a key part of the internal environment in which risk management is conducted.

Management guidelines
The Group provides guidelines and instructions to the management of the operating companies. The guidelines define the levels of responsibility of the operating companies and set requirements for the quality of vital management measures and include, among other things, limits for entering into risks and commitments related to investments and bidding on projects. The guidelines are assessed – and amended if necessary – based on changes in the risk appetite for achieving the objectives, the risk profile, or changes in the internal organisation.

In addition to the management guidelines, there are more detailed instructions for external reporting, information security, tax and treasury- related matters.

Budgeting, reporting and (internal) controls 
The Group uses uniform guidelines and accounting policies which serve as the basis for all financial, non-financial and management reporting. As part of the detailed monthly and quarterly reports, the operating companies report on changes in (projected) company revenues, financial results, working capital and liquidity, order book and sustainability.

Main risk areas

Several risk areas and measures have been identified in relation to BAM’s strategic objectives. Follow-up and feedback are part of the regular management reporting cycle. The main risk areas are specified on the following pages.

Market risk

Risk description
The markets where BAM operates are subject to macro- economic volatility and are affected by government investment programs, economic downturns and political developments. In most of the Group’s home markets, there is intense competition.

Possible impact
Limited availability of capital may lead to cancellation and deferral of property development, construction and PPP projects, putting pressure on the value of BAM’s portfolio. Intense competition may lead to a buyer’s market, which will impact margins, lead to a shift of design and contract risks to the contractor and compromise the pre-financing of projects by clients.

Management measures 
As market conditions vary per country, BAM aims to keep a diversified geographical footprint. Based on the new strategy, BAM applies a more disciplined focus on market segments and projects where it can use either scale or expertise as a critical success factor. For the future business portfolio BAM is rationalising its propositions and developing new solutions for clients and are investing in digitalisation to be an industry leader in how and what BAM builds. BAM invested in the required capabilities to support the achievement of the strategic objectives, for example by creating or reinforcing corporate functions in the areas strategy, digital construction and innovation, but also by harmonising processes and procedures. 

The updated tender stage gate procedure is key in managing a healthy order intake for the Group and guides a tender through various stage gates based on the complexity and size of the tender, before the company enters into a contract. The progress on the realisation of the strategic objectives is monitored through monthly and quarterly reports and meetings in which the leading indicators to effectively compete in the rapidly changing environment are key.

Reputation risk

Risk description
The trust placed by clients, shareholders, lenders, construction partners and employees in the Group is vital in order to be able to ensure the company’s continuity. The Group’s main fraud risk with reputational impact is corruption.

Possible impact
BAM’s reputation may be damaged if it fails to successfully mitigate the main risks, including fraud.

Management measures 
For BAM, it is fundamental to adhere to generally accepted standards and values and comply with local statutory and other rules and regulations, particularly with respect to the acquisition and performance of contracts. This is set out in the Group’s business principles, code of conduct and related policies such as those relating to bribery, corruption and competition. All employees are required to act fairly, to honour agreements and to act with care towards clients and business partners, including suppliers and subcontractors. Compliance is promoted by the Executive Board and this is kept under constant review in order to make integrity a fundamental part of day-today activities. The Group has a whistle-blower policy in place so breaches of the code and policies can be reported. 

The Group believes it is important that employees can report any suspicion of wrongdoings within the Group and that they are able to report such matters without fear of reprisals. Both the code of conduct and the whistle-blower policy are easily accessible to employees. For example, they can be found on the Group’s intranet site and on its corporate website. Compliance officers monitor compliance and provide advice on issues involving integrity.

People risk 

Risk description
Attracting, training and retaining talented people is critical for BAM as it allows the Group to respond more effectively to changes in the market by using its full potential. It is essential that BAM remains a preferred employer.

Possible impact
BAM’s unique culture is underpinned by its values that guide its behaviour. Failing to establish a culture based on predictable performance, scalable learning, ownership and open collaboration will negatively impact the success.

Management measures 
BAM aims to foster an open culture of learning and exchanging knowledge in the form of training and education, building on the knowledge and expertise available. BAM increases the mobility of employees in core businesses. This is facilitated by the international recruitment site, which publishes all vacancies and career opportunities within the Group. BAM works together with recruitment agencies, through advertising and by collaborating with various training institutes to attract top talent. The Group invests in further developing employees through various training programmes, including a management trainee programme and prepares candidates for key positions aiming to improve (inclusive) leadership.

Project risk

Risk description
Construction activities are BAM’s core business, which include tendering, procurement, contract management, project management and the corresponding value chain. BAM is active in thousands of projects in which it is exposed to a large variety of risks in a sector that is known for having an asymmetrical risk profile. Selecting the right projects under balanced contractual conditions is critical. 

Possible impact
Failing to achieve a healthy order intake and flawless project execution leads to fluctuations in the project results and eventually to BAM not achieving its strategic objectives.

Management measures
BAM implemented the following measures to control project risk.

Tender stage gate procedure and peer reviews
The results of projects are mainly determined during the tender stage. Effective 2016, the Group launched the updated tender stage gate procedure. See the separate section on page 43. 

Project team composition
The composition of the project team is critical for the success of a project. BAM strives to select project teams based on the right capabilities in areas such as leadership, ownership, combined experience and collaboration. 

The Group’s industry is at the forefront of major technological changes. BAM invests heavily in implementing concept and process innovation related to sustainability, virtual building, digital and lean construction.

The comprehensive knowledge and extensive experience of its operating companies enable the Group to complete major projects successfully on its own. Nonetheless, it can be advantageous – also from the point of view of spreading the risks – to work in a joint arrangement when dealing with larger projects. In projects that exceed €300 million, BAM in principle bids together with partners. This usually involves establishing a general partnership (a legal form in which all parties are jointly and severally liable for mutual commitments connected with the performance of the project). The Group enters only into joint arrangements with solid and solvent partners. If the risk to which the partner is exposed is nevertheless assessed to be too high, BAM demands other securities which can take the form of a bank guarantee or of the partner leaving sufficient cash invested in the joint arrangement.

Project monitoring
During the execution, the project team periodically and systematically assesses the opportunities and risks attached to the project. If necessary, the project team implements measures to reduce newly identified risks, focusing mainly on the quality of the construction work to be completed and the avoidance of construction faults. Regular progress reports are submitted to regional, operating companies’ and Group management. 

Contract risk
To limit contractual risks, BAM uses standard contracts for projects wherever possible. Where a non-standard contract is used, BAM’s (in-house) lawyers and other specialists will assess the contract beforehand. Standard contracts include for example clauses that provide that price increases in wages and materials may be charged on to the client during the construction period. 

Subcontractors and suppliers
On an annual basis, the Group procures more than 70 per cent of its revenue from suppliers and subcontractors. These companies have a major impact on the projects, both in financial and in technical terms. The Group aims to build strong partnerships with its suppliers and subcontractors to ensure that the construction process runs as smoothly as possible and to achieve the optimum lowest possible costs and high quality of products. Suppliers need to be involved in the project at an early stage. The Group strives to set up partnerships and framework contracts, which contain agreements about fees and conditions (such as delivery times, invoicing, risks and bonus discounts). Project-specific orders can then be placed under these framework contracts. The performance of subcontractors and suppliers on the above mentioned criteria is periodically measured in a 1-4 scale and actively monitored and engaged.

Payment risk
Operating companies limit payment risks of projects as much as possible by agreeing on contractual payment schedules. This ensures that the client’s payments are at least in balance with the progress of the work performed. For projects completed in emerging markets and developing countries, adequate security is agreed or export credit insurance is purchased prior to the start of the project in order to hedge political and payment risk. When entering into financing arrangements, BAM performs a credit check on clients. The Group focuses in particular on security provided by banks and the payment systems used by government bodies.

In the construction industry, clients commonly demand guarantees by way of security that the project will be completed successfully. This guarantee may be provided by the parent company or, alternatively, by external parties such as banks and surety institutions. The Group has strict procedures in place to ensure that the contractual terms of the guarantees provided comply with the company’s specific guidelines. 

Tender stage gate procedure

12 Stage gate tender procedure

Financial risk

Risk description
The attractiveness of BAM as trusted partner to work with or invest in is strongly influenced by its financial position and ability to control financial risks.

Possible impact
Failing to achieve the trusted partner status may prevent BAM from working with preferred parties and lead to restrictions in access to financial markets. 

Management measures 
BAM financing strategy is based on long-term relationships with reputable financial institutions and a well-spread debt maturity schedule. A strong centralised focus on cash and working capital (including financing by clients and suppliers) limits the need for additional capital. The company enters ‘equity-light’ in property development projects and in PPP investments. The company’s intention is to sell these projects to investors. 

Specific financial risk management measures, including those in the area of interest rate risk, foreign exchange risk, price risk, credit risk and liquidity risk are stated in note 3 of the financial statements. 

Property development risk

Risk description
BAM is involved in property development on its own account. The level and timing of both revenues (sale/rent) and costs (site acquisition and building costs) of these projects may deviate from the initial expectations as a result of divergent market and process (planning/permits) conditions. BAM’s capital employed position is important to satisfactory fund the projects. 

Possible impact
Property development projects may be delayed or completed at a cost higher than budgeted. This in turn will affect the financial results (level and duration of capital employed, profit).

Management measures 
If the Group intends to take on property development risks, this requires the prior consent of the Executive Board. The latter takes a decision based on the project proposals from the operating company concerned and associated analyses performed by the Group’s Property Investment function. The general rule is that construction does not start until a substantial number of properties have been sold or, for non-residential, a large part of the project has been let or sold. However, the UK – where BAM only operates in the non-residential property sector – is an exception to this. There, the inventory risk is mitigated by a system of phased project execution. The Dutch property portfolio still includes a number of legacy residential construction projects where there is an unconditional obligation to build.

Technology risk

Risk description
The Group’s industry is at the forefront of major technological changes. Digital technology starts to change value creation within the construction industry where traditional capabilities may become commoditised.

Possible impact
Competitors or new entrants to the market may marginalise BAM’s differentiating capabilities and thus endanger the existing business model.

Management measures 
Digital construction initiatives focus both on transformational and incremental innovations. These innovations are build on new digital technologies and should improve the clients experience as well as optimised construction processes. 

> See chapter 2 Strategy and chapter 3.2 Stakeholder engagement and material themes. 

Information technology risk

Risk description
Digitalisation, data, communication and connectivity are essential to BAM. A global presence also leads to cyber security challenges that require us to have the agility to constantly adapt. 

Possible impact
IT is crucial in supporting and safeguarding the core and supporting processes. BAM relies more and more on digital communication, connectivity and the use of technology. The Group has to remain alert to prevent the use of compromised data and the unavailability, loss or theft of critical strategic, financial and operational data.

Management measures 
BAM has strengthened its security strategy and policy with a clear governance structure and uses the latest technology to protect its environment. This includes implementing and testing of confidentiality and continuity measures as well as the integrity of data. Training and communication increase awareness around safe IT usage by BAM’s people and partners, as this is considered essential. 

Sustainability risk

Risk description
The construction industry heavily relies on natural resources, these deplete when consumption rates are faster than natural replenishment. Global warming and climate change cause more frequent extreme weather events including storms, heat waves, droughts, heavy rainfall with floods and heavy snowfall.

Possible impact
Failing to deliver more sustainable and innovative further may impede BAM’s position towards clients and supply chain partners. Extreme weather events and material shortages may lead to disruption of the construction process. 

Management measures
BAM has strengthened its corporate team responsible for sustainability during 2016 to support achieving continuous improvement and puts significant effort in reducing its environmental impact with an ambition of achieving a net positive result. To limit BAM’s impact on resource consumption, the company works together with supply chain partners and clients to explore circular economic business models. 

> See chapter 2 Strategy and chapter 4.3 Environmental performance. 

Health and safety risk

Risk description
The nature of BAM’s business may impose health and safety risks to its people. The well-being and safety of the people of BAM is vital to the company.

Possible impact
Health and safety incidents may lead to serious injuries or even fatalities and may lead to project disturbance. Incidents may lead to loss of time, additional costs and as a result impact BAM’s performance.

Management measures 
BAM has established several health and safety policies to provide guidance in this area. A central department, together with representatives at operating company level, supports the business to maintain and further improve a culture of healthy and safe behaviour. In this culture, prevention of incidents and the openness to discuss dilemmas are paramount. Several reporting processes monitor BAM’s performance in this area. 

> See chapter 3.2 Stakeholder engagement and material themes. 

Claims and procedures 

Companies operating in the construction industry are involved in discussions on the financial settlement of construction projects, including contract variations, the time of completion and the quality level of the work. Most of these discussions are concluded to the satisfaction of all concerned. However, in some cases it is impossible to avoid a discussion ending in legal proceedings. BAM is also involved in a number of lawsuits. Financial claims that the Group has pending against third parties are generally not capitalised unless it is reasonably certain that the amount in question will be paid. The Group takes great care to prevent such legal proceedings by implementing quality programmes and providing training for its employees. Examples of major legal proceedings involving BAM are given briefly below.

In 2005, during the construction of a drilled tunnel for the SMART North tunnel project in Kuala Lumpur, engineering firm Wayss & Freytag Ingenieurbau was faced with ground conditions that varied from the information provided by the client. Wayss & Freytag Ingenieurbau terminated the contract early 2006 as a result of the client’s failure to fulfil its payment obligations and refusal to deal with Wayss & Freytag’s claims for an extension of the construction period and reimbursement of costs. The client, in turn, also terminated the contract in January 2006. Wayss & Freytag Ingenieurbau lodged a claim against the client for more than €20 million as compensation for costs incurred. The client lodged provisional counterclaims of €5 million. An independent dispute adjudicator, in the contractually prescribed procedure, has ruled that Wayss & Freytag Ingenieurbau was entitled to terminate the contract. This verdict has been confirmed by an arbitration. The client appealed before the Federal Court, but meanwhile the parties initiated negotiations for settlement. These negotiations were successful. A full and final settlement was reached in January 2017. 

On 3 March 2009, during the construction of a section of the Cologne metro system, several adjacent buildings, including the building of the City Archives of the City of Cologne, collapsed. Two persons were killed as a result of this accident. Wayss & Freytag Ingenieurbau is a one-third partner in the consortium carrying out this project but was not directly involved in the work performed at the site of the accident. The client has instituted a judicial inquiry (known as a Beweisverfahren) before the district court (the Landgericht in Cologne). As part of these proceedings, a number of specialists are investigating the cause of the accident. Only when their investigation is complete will it be possible to determine if and to what extent the consortium might be held responsible for the accident. The German Public Prosecution Service is also carrying out its own investigation to determine whether any criminal offences have been committed. The damage to property is considerable and the parties involved have claimed under several different insurance policies.

What impacted BAM in 2016?

Despite all the measures BAM has taken and the focus and attention given by its people, some risks that are related to the nature and complexity of the market and business environment impacted BAM in 2016. In this section some examples are demonstrated. 

Transition to new organisation (market risk/people risk)

The re-focus within BAM following the 2016-2020 strategy programme ‘Building the present, creating the future’ impacted the way BAM wants to work. The transition to a new organisational model (which already started during the Back in Shape period) includes rationalisation of business models and businesses. This needs to be more collaborative, harmonised and agile so BAM can keep up with industry developments and be a frontrunner in its selected markets. Restructuring impacts BAM’s business performance financially by one-off charges but also may create temporary uncertainty for the people of BAM. The Group strives to limit this period of uncertainty by implementing changes rapidly and providing clarity about the direction for the future. BAM also communicated extensively about the new strategy.

Brexit (market risk)

On 23 June 2016, the UK voted for Brexit. The UK is BAM’s second largest home market after the Netherlands. BAM’s UK activities are split between three operating companies: BAM Construct UK in non-residential construction and property development, BAM Nuttall in civil engineering, and the UK operations of BAM PPP. They are widely diversified by location (strong regional presence across the UK), client base (public and private) and market (retail, office and industrial construction, and across all civil sectors.) The operating companies are among the leaders in their markets. 

The translation of the devaluated pound into euro reduced the reported revenue, results, closing cash balance and order book for the UK. A significant percentage of the revenue for 2017 is secured in projects which are already underway. Moreover, since the vote BAM has won several new orders. Further impact of Brexit remains uncertain, which is why BAM will continue to monitor developments closely, maintain tender discipline and adapt its organisation and operations if required.

A-symmetric risk profile in combination with public tendering (market risk/project risk)

BAM’s performance in 2016 was still impacted by the phase-out of projects that were awarded in an economically difficult period. Considerable efforts were made to turn around those low-margin projects, but this could not prevent part of BAM’s portfolio from contributing less than the company needs to achieve its strategic objectives. At the end of 2016, the de-risking of the project backlog was largely completed. At the same time there are still projects, especially when publicly tendered, that impose an a-symmetric risk profile on BAM. The healthy order intake for the future therefore continues to be top priority, supported by data driven project selection, flawless execution and state-of-the-art supporting processes. 


Although the focus on safety is stronger than ever before, the company is still facing incidents at project sites. The loyalty of the people of BAM towards meeting clients’ schedules or meeting financial targets sometimes impacts the safety of the working environment. Besides having the knowledge and tools to work safely, it is crucial that employees can always openly communicate about unsafe situations with each other and with their manager. 

Improvements to the risk management and monitoring system 

The improvement of BAM’s risk management and monitoring system is an ongoing process. The risk management function, operational audit and the external auditor all provide input for further enhancements. The improvement potential relates to developing and sharing better practices and the harmonisation of risk management processes throughout the Group. 

Governance, Risk and Compliance (GRC)
Early 2017, enterprise risk management and the interconnected pillars related to governance and compliance have been further enhanced by establishing a new Governance, Risk and Compliance (GRC) function. The main responsibility for this new role is to further evolve the GRC areas in line with the strategy 2016-2020. 

The GRC areas relate to the implementation and periodically recalibrating of BAM’s governance structure in line with market trends and strategic development of the Group, enhancing the enterprise risk management (ERM) programme and further develop compliance (including privacy) in accordance with social standards and relevant laws and regulations. 

Reporting external auditor
The independent auditor assesses BAM’s internal control environment as an integral part of its audit procedures, mainly focusing on the key (financial) processes and reporting systems underlying the information contained in the financial statements. 

BAM transitioned from PwC to EY as its external auditor in 2016.
In their first year audit, the external auditor concludes that no material weaknesses or significant deficiencies have been found. 

The external auditor describes areas of improvement that mainly relate to the clarification of central and decentral responsibilities and further formalisation of:

  • BAM’s business control framework;
  • IT controls and procedures (logical access , security settings);
  • Integrity and compliance framework (set minimum group standards, updating procedures).
  • The Group carries out appropriate actions to follow up on the recommendations.

In control statement

BAM can reasonably state that the risk management and monitoring systems, in respect of financial reporting risks, worked adequately during the year under review and no deficiencies were identified in relation to these systems and their operation that could have potential material implications on the financial reporting in 2016. The Group cannot guarantee that no risks will materialise and no system and procedures provide absolute certainty for the realisation of business objectives.