Seen from the outside, contract management suffers from two stubborn misconceptions. The first reduces it to a largely administrative support function, devoted to producing and updating documents. The second casts it as a discipline whose only purpose is to protect, to cover and to prevent. Both describe the same thing: a defensive function, defined by what it preserves rather than by what it builds.
What is most surprising is not that these views circulate outside the contract management community. It is that they have taken root inside it, in a more presentable but equally stubborn form: the idea that risk-based management is the lens through which contract management should be read.
This approach has the advantage of simplicity, and of being generic enough that it cannot really be called wrong. The drawback is that it locks the profession into a defensive posture and masks what, in the eyes of a project as much as of senior executives, gives it its real value. In short, risk-based management is part of the bedrock of contract management, but it is neither its summit nor its purpose.
Risk-based management, an essential of contract management
Defining “risk management”
First of all, one clarification is needed: risk-based management as we practise it in contract management is not, strictly speaking, risk management. Risk management is a profession in its own right, standardised by ISO 31000 and structured within organisations around dedicated roles (such as the risk manager). Risk management seeks, notably through a group-wide risk map, to “identify, analyse, evaluate, treat and monitor risks within an organisation and communicate about them.” Its logic is statistical and probabilistic, aimed at aggregation, prioritisation, treatment and communication at organisation level.
The risk-based management practised in contract management follows a completely different approach; were it otherwise, contract management would be no more than one component of risk management. Even though we contract managers borrow a few of its tools and formulations, it is not an end for us but rather a means of continuously grasping a project’s contractual exposure: what the contract requires, what it permits, what it prohibits, and where the reality of the project comes into tension with those provisions. The relevant reference is therefore not so much ISO 31000 as the NCMA’s CMBOK, which devotes an entire section to risk management from an operational and contractual angle. The contract manager fits squarely within it, bringing a specific reading: the contractual prism through which the events that arise are observed.
The risk and opportunity matrix, a tool borrowed from risk management
Contract management practice draws on a well-known toolkit borrowed from various disciplines such as risk management, and first among those tools is the risk and opportunity matrix. This matrix is one of the mainstays of the contract manager’s toolbox. Central as it is, it nonetheless stops serving the project’s interests as soon as maintaining it becomes an end in itself.
The inherent flaw of this instrument is that it is static by design, since a matrix is nothing more than a snapshot taken at a given moment. It freezes a contractual reading of a project that, by definition, changes every day. This is not a criticism of the tool; it is its nature. The contract manager’s added value therefore lies not in producing that snapshot but in turning it into a living instrument: updating it at the pace of the project, using it as a basis for dialogue with operational teams, and folding it into a broader understanding of the contractual situation so that it becomes a genuine decision-making aid. Without that movement, a perfectly maintained matrix remains a document whose usefulness stops at compliance with a quality process.
From register obsession to value creation
“Register obsession”, the hallmark of defensive contract management
What I call “register obsession” is the drift visible in a good many organisations, where the risk and opportunity matrix, designed as a reading tool, becomes the main performance indicator for the contract manager. The matrix is up to date, owners are assigned, deadlines are tracked, reporting arrives on time: everyone is happy, including the quality process. Except that, if we stop there, we are confusing the means with the end.
As noted above, the risk and opportunity matrix is only a dated snapshot, not a dynamic picture of the results a project team manages to achieve in an operational setting where stakeholders, hazards and other unforeseen events coexist (see the war in the Middle East in recent weeks). The contract manager appears there among other contributors. The matrix is therefore only one of the tools to be used, and not a steering instrument as such. Managing a contract on the basis of what a matrix says amounts, more or less, to driving while staring at a satnav. It can give the illusion of control, but it hides a large part of reality.
Behind this obsession lies a deeper stance, which we might call defensive contract management. That stance defines the profession by what it avoids rather than by what it creates. The contract manager becomes the person who helps avoid risks, cover liabilities and anticipate disputes. That is part of the role and its duties, and it is perfectly legitimate. But reducing our profession to that defensive function alone means locking it permanently into a support box, the very box we are trying to get it out of when we argue for an operational contract management that acts as an interface and creates value.
Going beyond risks: opportunities, ecosystem and relationships
A contract manager who merely manages risks is doing, at best, half the job. What separates a contract manager from a good contract manager is the ability to add to risks everything that the phrase “risk-based management” precisely tends to obscure: opportunities, the ecosystem in which the project unfolds and, of course, the quality of relationships between stakeholders.
Seeing opportunities is harder than seeing risks. David Hillson, one of the most cited authors on opportunity management, helped theorise this point: opportunities are positive risks that deserve to be managed with the same rigour as negative risks, but that call for a more demanding cognitive effort. Identifying an opportunity means reading a context, anticipating a shift in the ecosystem, understanding the unstated needs of a client or a supplier, spotting an untapped angle in a clause. It is an exercise in perception before it is an exercise in method, and in practice it is a fairly reliable marker of seniority in the role.
This dimension overlaps closely with the question of relationships. Anglo-Saxon work on contract management, in particular that of World Commerce & Contracting, which brings a “commercial” dimension to the discipline, has insisted for years that the value created by a contract manager is measured not by the disputes avoided but by the quality of the results obtained with the other party (and not against it). There is a parallel here with what commercial management brings to a business relationship. It is no accident that, in the Anglo-Saxon world, the role frequently combines both dimensions, in job titles such as “commercial and contract manager” that explicitly tie contract management to its transactional side. We find here the idea that the higher interest is not the defence of a legal position but the durability of a value-generating relationship. A contract manager who thinks in these terms goes further than strict risk-based management. Such a manager does not set relationships against risks but brings the two into a common logic.
One objective only: project performance seen through its outcome
There are, however, a few reference points that make it possible to draw an unambiguous line between what belongs to the profession and what belongs to it less; one of them is what the PMI identifies as a project’s “triple constraint” (scope, time and cost). From this angle, effective contract management is the kind that contributes to a project delivered according to the quality, cost, time (QCD) triptych, that is, one that meets its schedule, its budget and the expected specifications. This lens is not a contract management invention; it sits at the heart of project management theory, formalised in particular by the PMI.
Systematically bringing contract management back to this triple constraint is probably the best way to lift it out of internal self-justification. As long as a contract manager’s value is measured by the diligence with which the matrix is updated, the function will continue to be seen as a defensive support role. Once the deliverables produced feed into the economic and technical performance of the project, the contract manager’s value rises in the eyes of the company’s various stakeholders, decision-makers included.
Conclusion
Is risk-based management the alpha and omega of contract management? It may well be the alpha, since it is one of the entry points, one of the foundations, one of the elements without which the function cannot exist. It is certainly not the omega. The omega of good contract management is the value delivered to a project and to its stakeholders. And between the alpha and the omega lies everything that separates a contract manager from a good contract manager, namely the ability to move from snapshot to steering, from a defensive posture to that of a value creator, and from the exhaustiveness of a register to an active contribution to a project’s performance.