Risks mapped before they become losses

Month fourteen on site, a developer's meeting room. The head of engineering reports that steel for the next package came in well above budget. The lawyer reminds everyone that the occupancy permit depends on an environmental licence still awaiting an opinion. Finance asks who pays the difference, and nobody answers, because the contract does not say. The scene is an illustration, but anyone who has run a development will recognise the room.

The arithmetic is real. According to SINAPI, the construction cost index published by IBGE, the average cost per square metre of construction in Brazil rose 7.03% in the twelve months to August 2026. In December 2021 the same measure reached 18.65%. In December 2023 it stood at 2.55%. A budget that treats cost escalation as a fixed number is betting on a single point in a range of sixteen percentage points.

Risk intelligence is the work of turning that range into a decision before it turns into an argument. It runs in three tempos: anticipate, mitigate and monitor. Reactive management lives only in the third, discovering risk once it has become a cost.

Good risk management starts with a clause, not a spreadsheet

The most useful Brazilian definition of a risk matrix sits in a public procurement statute. Law No. 14,133 of 2021 describes the matrix as the clause that defines risks and responsibilities between the parties and sets the contract's initial economic and financial balance. Its minimum content: the post-signature events that could upset that balance, and a provision for an amendment if they occur.

A private development is not bound by that law, but the reasoning holds for any construction, supply or service contract. Without a matrix, every surprise becomes a negotiation from scratch, with the site running and the bargaining power on the side of whoever can stop work. With a matrix, the event already has a destination: who absorbs it, up to what amount, with which document and within what deadline.

The difference does not show on signing day. It shows in the month steel goes up. That is why the risk list and the draft contracts have to be read side by side. Every material risk needs a contractual address: retained, transferred, insured, shared by formula or consciously accepted. A risk that lives in the spreadsheet and in no contract lands on whoever has the weakest paper trail.

The method is a cycle, not an annual form

The international reference is ISO 31000:2018. Its second edition came out in February 2018 and was reviewed and confirmed by ISO in 2023. ISO presents the standard as principles and guidelines for identifying, analysing, evaluating, treating, monitoring and communicating risk across an organisation. A working discipline, then, not a questionnaire filled in once a year.

COSO, the committee that published an enterprise risk management framework in 2004, updated it under a title that reads almost like a manifesto: Integrating with Strategy and Performance. The emphasis is on weighing risk both when setting strategy and when driving performance. Risk is not a department sitting next to operations. It is a way of deciding inside them.

What the method changes is the order of the questions. Without it, risk shows up after the decision, as a justification. With it, risk comes first: what could knock the result off course, what it would cost, what to do now, who follows up. The meeting that approves a works package approves, on the same agenda, the treatment of that package's risks.

A risk with no owner, no price and no written trigger is not being managed. It is being hoped away.

116

Development law has already priced part of the problem

Before building a matrix, it pays to know which risks the legislator has already allocated. For anyone selling off-plan, the main one is time. Article 43-A of Law No. 4,591 of 1964, added in 2018, allows handover up to 180 calendar days after the scheduled date. Within that window there is no penalty and no right to rescind, provided the grace period is agreed in a clear and prominent way. Beyond it, and through no fault of the buyer, the buyer may unwind the purchase and recover everything paid, plus the contractual fine.

For the developer, schedule slack therefore has a legal ceiling, and it only works if it is drafted properly. A grace period buried mid-contract is delay risk with no protection. From day 181 onward, delay has a known price that can be estimated and provisioned.

The same law governs the opposite direction. When a buyer cancels, the developer may keep the brokerage commission and a penalty capped at 25% of the amount paid. The cap rises to 50% when the project sits in a ring-fenced estate, the patrimônio de afetação. That regime is itself a mitigation tool. It separates land and works from the developer's general assets and requires quarterly progress reporting to the buyers' representative committee.

The Civil Code adds a clock that gets less attention. The builder answers for five years for the soundness and safety of the work. The owner, however, loses that right if no claim is filed within 180 days of the defect appearing. Without a routine of post-handover inspection and record-keeping, the developer's right expires by calendar.

Construction cost swings, and the official index measures by how much

In the SINAPI series, the twelve-month change in cost per square metre was 10.16% in December 2020 and 18.65% in December 2021. It eased to 10.90% in 2022 and 2.55% in 2023, then moved back up to 3.98% in 2024 and 5.63% in 2025. By August 2026 it was 7.03%.

A budget built on one escalation assumption is a point bet. A budget built on base, adverse and severe ranges, calibrated against the official index, turns uncertainty into decisions. How much contingency to hold, which packages to lock at a fixed price, which inputs to buy early, when to revisit the plan. The index does not forecast the future. It stops the budget from pretending the range is not there.

Owner, trigger and date separate a matrix from an inventory

A useful matrix carries four fields beyond probability and impact. The owner is a person with the authority and resources to treat the risk, not a department. The trigger is the observable signal that forces action, such as a permit opinion late beyond a set date or an index above a set band. The plan is the response already written, with an estimated cost. The review date says when the risk comes back to the table.

Who checks that treatment actually happened? Article 169 of the procurement law organises risk management into three lines of defence. The first is whoever executes; the second brings together legal advice and internal control; the third is the central control body, alongside the audit court. A private development has the same skeleton. The first line is the site and commercial curation team. The second combines risk, legal and controllership. The third is independent audit. It only does its job if it does not report to whoever executes and if it confirms, with evidence, that a risk was treated and not merely ticked off.

Integrity is a schedule risk too

Licences, permits and the occupancy certificate keep a development in frequent contact with public authorities. Decree No. 11,129 of 2022, which regulates Brazil's Anti-Corruption Law, requires each company's integrity programme to follow the current risks of its activities. Its assessment criteria include periodic reassessment of risk and specific procedures for dealing with the public sector, including when obtaining licences.

The project's risk matrix and the company's integrity programme need to talk to each other. A licensing delay is not treated with a shortcut. It is treated with early filing, complete documentation and a record of every interaction. The shortcut, besides being unlawful, swaps a schedule risk for a far larger one.

A worked example: five risks treated before they happen

A risk register is the list. Intelligence is when the list changes decisions, and that requires separating an event's maximum impact from its expected loss, which weights that impact by probability. The figures below are InnovaSphere assumptions, not market data. Premises: a hypothetical R$ 60 million build over 24 months; expected loss equals probability times impact; cost escalation set at 7% of budget, close to SINAPI for August 2026; values in R$ thousand.

Expected loss falls from R$ 4.505 million to R$ 1.660 million, a reduction of R$ 2.845 million. Net of the R$ 900 thousand spent on treatment, the expected gain is R$ 1.945 million. The summed maximum impact, R$ 16.2 million, is 3.6 times the initial expected loss: that is why the potential impact in the simulator that accompanies this article is a ceiling, not a likely loss. And the R$ 1.66 million residual has to be accepted by a named person and held in contingency.

Now the stress test. If the treatments deliver only half the projected reduction, expected loss falls by R$ 1,422.5 thousand and the net gain shrinks to R$ 522.5 thousand, still positive. Break-even sits at 31.6% effectiveness; below that, the programme costs more than it saves. And if cost escalation repeats the 18.65% of December 2021, that line's maximum impact rises to R$ 11.19 million. Untreated, its expected loss reaches R$ 4.476 million, almost the total of all five risks in the base case.

When it does not pay off

Three situations break the case for the full structure. The first is the small, short, repetitive project the team has delivered many times in the same place. A short list of critical risks, reviewed at the pace of the works, captures almost all the benefit for a fraction of the effort.

The second is a risk whose treatment costs more than the loss it avoids. Spending R$ 80 thousand to mitigate an event with a 10% probability and an impact of R$ 500 thousand does not add up: the avoided loss is no more than R$ 50 thousand. The rational move is to accept the risk, document the acceptance and hold contingency.

The third is the matrix turned into ritual: dozens of rows with no real owner, reviewed out of obligation and cut off from contracts and budget. The cost doubles, because the organisation starts to believe it is protected. Better a smaller, living matrix than a complete, decorative one.

A checklist for putting risk intelligence in place

Inside the group, the lines of defence have known addresses. C&S Engenharia, which handles management, design and execution of medium and large-scale works, operates on the first. Valida Auditoria, dedicated to independent audit and technical validation, only makes sense on the third.

1. List the project's risks with probability, impact and expected loss, reviewing the list with engineering and commercial curation.
2. Assign each critical risk a named owner with authority, confirming with the board that the owner has resources to act.
3. Set observable triggers and review dates, agreeing a shorter cadence for critical risks with the committee.
4. Check the contractual address of every material risk, reading the matrix next to the draft contracts with legal counsel.
5. Map the statutory deadlines that already allocate risk, such as the 180-day handover grace period, with legal counsel and the registry.
6. Calibrate the budget with cost ranges based on the official index, adjusting contingency with the controllership.
7. Submit the declared treatment to independent verification, choosing an auditor that does not report to whoever executes.

Frequently asked questions

Is ISO 31000 mandatory for private developments?

There is no general obligation. ISO presents the standard as principles and guidelines that apply to any organisation.

How many risks should a matrix contain?

There is no right number. Our criterion is that every critical risk has an owner, a trigger and a plan. A matrix that grows beyond the team's capacity to review it loses its usefulness.

What is the difference between potential impact and expected loss?

Potential impact is what the event would cost if it happened. Expected loss is that cost weighted by probability. Prioritisation uses the second; reserves for extreme scenarios may look at the first.

Does the ring-fenced estate eliminate the buyer's risk?

It does not eliminate it, but it segregates it. Under Article 31-A of the development law, the assets of a ring-fenced project answer only for that project's debts, and the developer reports quarterly to the buyers' representative committee.

Who should validate that a risk was actually treated?

Someone independent of whoever treated it. The three lines of defence in the procurement law illustrate the logic: execution, internal control and external verification.

Legal basis

• Law No. 14,133/2021: Article 6, XXVII (risk matrix), Article 22, paragraph 1 (efficient allocation) and Article 169 (lines of defence).
• Law No. 4,591/1964: Articles 31-A and 31-D (ring-fenced estate), Article 33 (registration), Article 43-A (grace period) and Article 67-A (cancellation).
• Law No. 13,786/2018: added the grace-period and cancellation rules.
• Civil Code: Article 618 (soundness of the works).
• Decree No. 11,129/2022: Articles 56 and 57 (integrity programme).