Risk Management at State DOTs
Building Momentum and Sustaining the Practice
Website last updated in June 2024.
What is Risk Management?
Risk Management is the process to identify, evaluate, respond, and prioritize threats and opportunities through various strategies and tools, which allows individual risk events and/or overall risk to be proactively understood.
Risk management can take place at different levels of the organization supporting different objectives. Below are definitions from FHWA.
Enterprise Risk Management
Is the responsibility of transportation agency executives. Executives benefit from the process, but they are also responsible for defining and championing the process. Agency risks are the uncertainties that can affect the achievement of the agency’s strategic objectives, such as agency reputation, data integrity, funding, safety, and policy.
Program Risk Management
Involves managing risk across a network or multiple projects, such as risks inherent in city or regional transportation planning, material price escalation, design standard changes, climate change and structures.
Project Risk Management
Involves risks that may be unique to a specific project. Staff familiar with the specifics of a project and other technical experts and stakeholders manage project risks, which can include utility relocation coordination, right-of-way purchase delays, geotechnical issues, and community issues. Project risks are evaluated most often, and project risk management is most common in practice today.

Why Does Risk Management Matter?
Risk management identifies and mitigates potential threats, ensuring business continuity and protecting assets. It’s crucial for informed decision-making and long-term success.

How Can This Website Help You?
Discover how our website can assist you in finding valuable resources, updates, and information tailored to enhance your experience.
What do you want to do today?
This step-by-step tour through current thought and practice provides insights into how you can have a positive impact on Risk Management efforts in your agency, based upon your role and needs.

I’m An Executive
I manage Agency-Level Risks that impact achievement of agency goals and objectives and involve multiple functions.
I need to manage risks in a way that optimizes the success of the whole organization rather than the success of a single business unit or project.

I’m A Program Manager
I manage Program-Level Risks that impact the ability of the DOT to deliver on performance objectives of capital programs.
I need to set program contingency funds and allocate resources to projects consistently to optimize outcomes of the whole program

I’m A Project Manager
I manage Project-Level Risks that manages risks that impact the DOT’s ability to deliver a particular project within schedule and budget.
I need to use advanced analysis techniques, contingency planning, and consistent risk mitigation strategies to ensure the successful delivery of my project.
Where do I start if I want to build a risk management practice?
Outlined below are several core elements of risk management intended to guide the beginning stages of building a risk management practice.

Establish Common Understanding
- Outline benefits of risk management
- Align goals across organization

Build Organizational Support
- Establish leadership buy-in
- Empower staff to make decisions

Develop Processes
- Provide Training
- Follow-up on outcomes
- Be nimble

Create Tools
- Develop Project Risk Registers
- Create a glossary of terms
Examples of each of these steps can be found in the step by step tour below. To summarize, here is a link to a checklist for building a new risk management practice.
NCHRP 08-151: Risk Management at State DOTs
Building Momentum and Sustaining the Practice
NCHRP 08-151 was a research task on Building and Sustaining Risk Management Practices at State DOT’s. The research concluded with the development of this website to cull together resources from a variety of sources across the country that may be helpful for practitioners to review. Another deliverable included a PPT, Executive Summary and Project Article. These deliverables can be tailored to facilitate conversations around risk management at your DOT.