Thames Water

Thames Water + Sword GRC

By analyzing the data since implementing ARM, Thames Water has been able to identify risks and associated costs across their 300 plus projects


Water Services


United Kingdom



Risk Management integral to business

Thames Water is the UK’s largest water and wastewater services provider, supplying water and waste services to 15 million people across London and the Thames Valley.

To achieve greater efficiency in the delivery of its strategic business plan, Thames Water operates an alliance model, eight2O, to deliver infrastructure development and maintenance projects. The alliance includes two design and build joint-ventures consisting of Costain, Atkins and Black & Veatch (CABV) and Skanska, MWH Treatment (now Stantec) and Balfour Beatty (SMB).

The £1.7bn portfolio of infrastructure projects form part of Thames Water’s capital investment for its 2015-2020 program. Setting out guidelines for delivery, the organisation identified a requirement for a robust software tool to manage risk across the projects. Following a rigorous evaluation process in which a total of six organisations were shortlisted, and three products demonstrated in detail, Active Risk Manager (ARM) from Sword GRC was selected for its ease of use and its cross-industry pedigree.

We were clear how the organisations work in the alliance, and this includes providing ‘professional tools for professionals’. We needed an industry-standard tool to manage risk and chose Active Risk Manager. We wanted to manage all aspects of risk. We are not just managing a funding pot, but actively identifying and managing risk at the appropriate level. Using ARM is now driving a maturity in our approach to risk.

Steve Wilson, Risk Lead, Eight20

Cloud-based – easy to access, easy to use

The ability for ARM to be hosted in the cloud was important for the organization, with the project managers spread across a wide geographical area. ARM Apps is an easy-to-use web application that can be accessed through an intranet or via mobile devices. The deployment of ARM Apps enables all project managers, as the main owners of risk, to use the software, populating it with data and running reports.

Since deploying ARM in early 2017, the use of the solution has become embedded into the project management process. Project managers use ARM to provide risk data to the central risk team who are responsible for corporate risk and reporting to the executives and board. The corporate risk managers provide an overview of risk practices and for the more complex projects, carry out detailed risk analysis using Monte Carlo simulations to make sound investment decisions.

Each project has a leadership team covering specialist areas such as design, environment, commercial, health & safety, operational, and customer management. The project managers work with their leadership teams to understand and manage the unique risk profile on each project.

Steve Wilson, Risk Lead for Eight20 commented, “The ease of use was one of the biggest drivers. If a product isn’t easy to use then people won’t use it and the best reports are only good if they are populated with accurate data. Using ARM Apps means that there’s no need for the project managers to become risk management experts. It is intuitive to use and we liked how configurable it is – it enables us to give our managers the right tools for the job and there has been a real recognition of this.

The project managers have to administer complex commercial and technical data. As project managers, engineers, and commercial experts, we have always managed risk as a matter of routine. However, we wanted a tool like ARM to systemise risk management to drive compliance, visibility, and best practice.”

The reporting capability is really where the ARM solution shows its pedigree, at a touch of a button we can report upon any aspect of a project, effectively providing me with a priority list on where to focus our time.

Steve Wilson, Risk Lead, Eight20

Enhanced visibility and simplicity of reporting

At any time the corporate risk team can be overseeing the whole programme, currently we have 350 live projects. The centralised visibility and extensive reporting capability in ARM provides the team with a suite of reports that are designed in line with industry standards and best practice.

The reporting functionality provides a plethora of options to report upon any facet of a project. From examining the overall risk performance of an individual project to looking at programs managed by a single joint-venture or project manager, the team is able to slice and dice the data to suit their needs.

The increased visibility and reporting automation have also improved productivity resulting in significant time savings. The ARM solution can be proactively set with various parameters to prioritise when projects should be reviewed, for example when projects are coming up to full governance. This enables the niche team of centralised risk managers to actively conduct timely reviews and interventions across all projects.

The reporting functionality has given us the ability to review and tighten the KPI’s to improve compliance. The reports are easy to produce and their graphical nature makes them easy to understand. The enhanced reporting and increased visibility have driven the right kind of behaviours, the teams are more cognizant of compliance and have been overwhelmingly positive about the solution. ARM has helped to drive a culture of compliance across all projects.

Steve Wilson, Risk Lead, Eight20

Improving compliance

Through the consistent use of ARM across all projects, the company has complete visibility of compliance and can ensure project managers are adhering to the high standards of risk management.

The ARM solution also allows eight2O to structure all projects into a suitable hierarchy that allows the corporate risk team to roll up data and make like for like comparisons across projects, programs, and joint ventures. The company has 4 key performance indicators (KPIs) that apply not only across the 15 integrated program teams but also the two joint ventures. The standard dashboard reports have been enhanced to allow the central corporate team to measure comparative performance against previous performance across the organisation.

A qualitative and quantitative approach to managing risk

Risk profiles by nature change during the project lifecycle due to new risks being identified and others mitigated or managed, reducing their exposure. As a result of deploying ARM Thames Water is managing risk both quantitatively and qualitatively. Risk scoring has been configured within ARM to manage cost and time, as well as risks for health & safety, environment, Thames Water operations, regulation, customers, and reputation. With the scoring configured in the system, the risk team are able to review monthly the top risks across all projects and compare month on month, enabling the team to help prioritise deep-dive reviews on projects when needed.

Identifying ‘Black Swan’ events

‘Black Swan’ events are, by their very nature, rare but carry an extreme impact, they do have some level of predictability. eight2O is using the scoring mechanisms within ARM to identify high impact low likelihood events. Monthly reports are run and presented to stakeholders to remove the reliance on project managers alone to highlight the risks.

Early warning notification

In addition to risk management, eight2O is using ARM for early warning notices to the Programme Managers, and hence Thames Water. Originally the company looked at a separate solution but the cost was prohibitively expensive. However, the inherent flexibility and configurability of ARM have enabled the team at eight₂O to develop the capability for early warning notices within ARM itself, resulting in a fully integrated solution. Today, eight2O has a defined escalation path for the administering of early warning notices, such as a change in defined costs beyond the approved threshold or any impacts on planned completion.

Wilson comments, “We have enabled the escalation functionality within ARM for risks and early warning notices. We were able to achieve this after a small amount of in-house development work on the solution and it has been so successful that we have extended our original license order so we can roll out wider across the organisation.

For us risk is inherently simple – it’s about identifying the right risks and making sure the right responses are being managed. ARM gives us the scalability we need to do just that.

Steve Wilson, Risk Lead, Eight20

Driving a learning culture

The ARM solution has provided intelligence that has benefited the company in understanding future funding requirements. By analyzing the data since implementing ARM, eight2O has been able to identify risks and associated costs across the 300 plus projects. This information has been beneficial when reviewing the next round of funding for 2020 – 2025, informing the process with accurate, evidence-based data and encouraging a learning culture in Thames Water and eight2O.

Wilson concludes “We have bought into the ARM product roadmap which will be helpful as we look forward to the next five-year strategic plan. The functionality is there and we are looking at how we can integrate other aspects of uncertainty management.”

Want to save this for later?

Download the case study.