7. Operational Risk, Safety and Business Continuity

Introduction and Context

Real estate assets create value only when they remain safe, functional, accessible and capable of supporting their intended use. A well-located building can still suffer financial and reputational damage if lifts fail repeatedly, a fire-protection system is neglected, utilities are interrupted, or a security incident exposes occupants to harm. Operational risk management therefore connects physical asset performance with business performance.

Operational risk in real estate refers to the possibility of loss, disruption, injury, damage or legal exposure arising from inadequate or failed processes, people, systems, facilities or external events. It differs from development, market and financing risk because it is embedded in the everyday operation of buildings and property portfolios. Nevertheless, operational failures can trigger those other risks: a prolonged utility outage may reduce rental income, a safety incident may generate litigation, and poor maintenance may accelerate capital obsolescence.

This chapter examines the management of facilities, maintenance, utilities, fire protection, occupational health and safety, security, tenants, vendors and service continuity. It treats safety and continuity not as isolated compliance functions, but as components of an integrated real estate risk system. The central managerial task is to move from reactive response to anticipatory control while retaining the capacity to respond effectively when prevention fails.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain the nature and sources of operational risk in real estate.

2. Distinguish preventive, predictive, corrective and emergency maintenance.

3. Design risk-based controls for utilities, fire safety, health, security and contractor activities.

4. Apply incident-management and business-continuity principles to property operations.

5. Evaluate the roles of owners, facility managers, tenants, vendors and emergency authorities.

6. Use performance indicators, technology and scenario analysis to improve operational resilience.

7. Identify ethical, governance and regulatory issues in safety and continuity decisions.

The Operational Risk Environment of Real Estate

A property is a socio-technical system. Its performance depends on the interaction of physical components, operating procedures, human behaviour, information systems and external infrastructure. Typical risk sources include mechanical failure, electrical faults, water ingress, poor indoor air quality, fire, extreme weather, cyber disruption, infectious disease, unauthorised access, contractor error and tenant misuse.

Several characteristics make real estate operational risk distinctive. First, assets are fixed in place and often have long lives; decisions made during design or construction influence operational risk for decades. Second, buildings contain multiple stakeholders whose activities may conflict. A retail tenant, a residential occupant and a facilities contractor may have different risk perceptions and operating practices. Third, failures are interconnected. Loss of power can disable pumps, lifts, access control, fire detection interfaces and information systems simultaneously. Finally, safety outcomes are partly dependent on behaviour. A technically sound emergency plan may fail if occupants do not understand it or if managers suppress bad news.

A useful distinction is between hazards, events and consequences. A hazard is a source of potential harm, such as exposed wiring or stored combustible material. An event is an occurrence, such as an electrical short circuit. Consequences are the resulting effects, including injury, fire, business interruption, environmental damage and liability. Risk assessment must consider both likelihood and consequence, while recognising that low-frequency events may deserve substantial attention because their consequences are severe.

A Risk-Based Operating Model

The traditional hierarchy of controls provides a sound basis for property operations. Risks should first be eliminated where practicable, then reduced through substitution, engineering controls, administrative controls and, finally, personal protective equipment. For example, removing an obsolete fuel source is stronger than merely warning staff about it; installing a physical guard is stronger than relying only on a procedure.

An operational risk register translates this principle into managerial action. Each material risk should have a defined cause, event, consequence, existing controls, risk rating, control owner, action plan and review date. Risk ratings should not become mechanical scores detached from evidence. Managers should examine control effectiveness, exposure duration, vulnerability of occupants, dependence on single systems and the speed with which consequences may escalate.

The three lines model is also useful. First-line personnel and facility teams own and manage risks in daily operations. A second line, such as risk, compliance or health and safety functions, establishes standards, provides challenge and monitors performance. Internal audit or an equivalent independent assurance function forms the third line. The model does not transfer accountability away from operational managers; it clarifies responsibility and assurance.

Maintenance as a Risk-Control Process

Maintenance is not simply a cost centre. It preserves safety, availability, asset value, energy performance and tenant experience. A maintenance strategy should be based on asset criticality rather than equal treatment of every component. Criticality reflects the consequences of failure, redundancy, repair time, regulatory importance, safety implications and replacement difficulty.

Corrective maintenance occurs after failure. It may be appropriate for non-critical, low-cost components, but excessive reliance on it produces emergency call-outs, secondary damage and unpredictable expenditure. Preventive maintenance is scheduled according to time, use or manufacturer guidance. It is appropriate where deterioration can be anticipated and where planned intervention is less costly than failure.

Predictive or condition-based maintenance uses evidence about actual equipment condition. Vibration, temperature, pressure, energy consumption and alarm data can indicate deterioration before breakdown. Reliability-centred maintenance goes further by asking what each asset must do, how it can fail, what the consequences are and which maintenance task most effectively controls the failure mode. These approaches should be combined rather than treated as competing doctrines.

A mature maintenance programme includes asset registers, documented maintenance standards, job plans, competent personnel, spare-parts policies, permit-to-work procedures and quality verification. Work-order closure should record what was done, by whom, what defect was found and whether follow-up is required. A high percentage of closed work orders is not proof of good performance if work is closed without solving the underlying problem.

Useful indicators include planned-maintenance compliance, emergency work as a percentage of total work, mean time between failures, mean time to repair, repeat defects, backlog age, critical-system availability and maintenance cost per area. Indicators must be interpreted together. For example, low maintenance expenditure combined with increasing failures may indicate deferred maintenance rather than efficiency.

Utilities and Critical Building Systems

Electricity, water, heating, ventilation, air-conditioning, drainage, vertical transportation, communications and waste systems are operational dependencies. A continuity assessment should identify which services are critical, the maximum tolerable period of disruption, available alternatives and restoration priorities.

Resilience is strengthened through redundancy, diversity and recoverability. Redundancy provides an additional component; diversity avoids dependence on the same technology, supplier or route; recoverability enables rapid restoration. Examples include dual electrical feeds, emergency generation, water storage, alternative communication channels and manual operating procedures. Redundancy is not automatically effective: two systems sharing the same cable route or control panel may fail together.

Utility management also has a sustainability dimension. Poorly maintained equipment can increase energy and water consumption, while uncontrolled backup generation can create emissions and noise. Energy-management systems, sub-metering, leak detection and automated fault alerts can link operational resilience with environmental performance. However, automation must not create hidden dependence on a single digital platform.

Fire Safety, Health and Security

Fire safety is a layered system involving prevention, detection, alarm, containment, suppression, evacuation and emergency response. Building owners and managers must understand applicable law and technical standards, maintain fire doors and escape routes, control hot work, manage combustible storage, test alarms and suppression systems, and ensure that emergency plans reflect actual building use. A certificate or inspection report is not a substitute for continuous control.

Health and safety management extends beyond visible accidents. It includes slips and falls, work at height, confined spaces, electrical isolation, chemical exposure, manual handling, indoor air quality, legionella or other water-system hazards, asbestos and occupational stress where relevant. Contractors must receive induction, use suitable permits and provide evidence of competence. The duty of care cannot be outsourced merely because a vendor is contractually responsible.

Security risk includes unauthorised entry, theft, violence, vandalism, terrorism, workplace conflict and information compromise. Controls may include access zoning, visitor management, lighting, surveillance, guarding, physical barriers and clear escalation procedures. Security design should be proportionate and rights-sensitive. Excessive surveillance can damage privacy and trust, while poorly designed access controls may impede evacuation or discriminate against particular users.

Emergency arrangements should identify command roles, alarm methods, assembly or shelter arrangements, assistance for persons with disabilities, communication protocols and liaison with emergency services. Drills should test decisions and coordination rather than merely demonstrate compliance. Findings must be converted into corrective actions with owners and deadlines.

Incident Management and Learning

An incident is any event or near miss that causes, or could have caused, harm, loss or disruption. Near misses are valuable because they expose weak controls before a severe consequence occurs. A sound incident process includes immediate protection of life, stabilisation of the scene, notification, evidence preservation, investigation, corrective action and formal closure.

During the response phase, managers should establish an incident commander, define priorities and maintain a reliable log. The normal priority order is life safety, emergency stabilisation, environmental protection, preservation of critical operations and asset recovery. Communication should be timely, factual and coordinated; speculation can increase liability and reputational harm.

Root-cause analysis should look beyond the individual who made the final error. Methods such as the five whys, fault-tree analysis and barrier analysis can reveal design weaknesses, inadequate training, unrealistic schedules, poor supervision or conflicting incentives. Corrective actions should follow the hierarchy of controls. “Retrain staff” is often insufficient when the system itself encourages unsafe behaviour.

Business Continuity and Resilience Planning

Business continuity is the capability to continue or recover priority activities following disruption. It differs from disaster recovery, which often focuses more narrowly on restoration of technology or specific assets. In real estate, continuity concerns the building, its occupants, essential services, management information, suppliers and the organisations that depend on the property.

A continuity planning cycle normally includes:

• business-impact analysis to identify critical activities, dependencies and maximum tolerable downtime;
• risk and scenario assessment for credible disruptive events;
• strategy selection, such as redundancy, relocation, workarounds, mutual aid or stockpiling;
• plan development, including roles, contact information, procedures and communication;
• training, exercises and testing; and
• review after tests, incidents, organisational changes or major works.

The business-impact analysis should distinguish critical activities from convenient services. It should examine financial, safety, regulatory, contractual and reputational consequences. Recovery time objectives state how quickly an activity should resume, while recovery point objectives indicate the acceptable loss of data or transaction information. These concepts are particularly important where property operations depend on building-management systems, access databases or tenant communication platforms.

Continuity plans should be usable under stress. They require current contact lists, alternative communication methods, maps, isolation points, vendor escalation routes, authority notifications and clearly defined decision rights. Plans that exist only in a cloud system unavailable during a power or network failure are inherently weak. Exercises may include tabletop discussions, functional tests and full simulations, each suited to different objectives.

Managing Tenants, Vendors and Interfaces

Many operational failures occur at organisational boundaries. Tenants may alter layouts, overload electrical systems, store hazardous materials or ignore reporting procedures. Vendors may work across multiple properties, subcontract tasks or prioritise contractual output over broader safety. Effective management therefore requires clear interface controls.

Lease documents and service contracts should allocate responsibilities for maintenance, statutory inspections, access, permits, emergency cooperation, reporting and insurance. Allocation must be understandable and operationally realistic. Managers should maintain tenant handbooks, induction processes, change-control procedures and channels for reporting defects or unsafe conditions.

Vendor governance should include prequalification, competence verification, insurance, safety records, financial capacity, cybersecurity expectations where relevant, service-level agreements, key-person requirements and business-continuity capability. Performance reviews should examine leading indicators such as inspection quality, near-miss reporting and action closure, not merely response times. Lowest price is not equivalent to lowest lifecycle risk.

Technology, Data and Analytics

Computerised maintenance-management systems support asset registers, work orders, preventive schedules, inventory and performance reporting. Building-management systems can monitor HVAC, energy, alarms and equipment status. Internet-of-Things sensors may identify leaks, abnormal temperatures, occupancy patterns or vibration changes. Digital twins can support scenario modelling and capital planning where the underlying data is reliable.

Artificial intelligence may assist with anomaly detection, predictive maintenance, document analysis and prioritisation of work orders. Its usefulness depends on data quality, explainability and human oversight. A model trained on incomplete historical records may reproduce maintenance bias or miss rare but serious events. Automated decisions affecting safety should have clear accountability, override arrangements and audit trails.

Digital systems also create cyber-physical risk. Access controls, backup generators, lifts and HVAC systems may be connected to networks. Cybersecurity therefore requires asset inventories, least-privilege access, patch management, network segmentation, tested backups, incident playbooks and vendor controls. Operational technology cannot always be patched like ordinary office software; changes must be tested to avoid unsafe interruption.

Illustrative Case: Riverside Exchange

Background

Riverside Exchange is a fictional mixed-use complex containing offices, retail units, a health clinic and underground parking. It has a central cooling plant, two electrical feeders, a diesel generator and outsourced facilities management. The property had experienced repeated cooling failures and several minor water leaks. Management measured vendor performance mainly through monthly response-time reports.

Situation and Analysis

During a heatwave, a chilled-water pump failed. The backup pump was unavailable because its isolation valve had seized. Temperatures rose in the clinic and several office areas. At the same time, a leak from a poorly maintained valve affected an electrical room, requiring partial shutdown. Investigation showed that preventive-maintenance tasks were frequently deferred, asset records were incomplete and the vendor’s continuity plan depended on one specialist technician. No integrated exercise had tested simultaneous utility and occupancy impacts.

The immediate incident was mechanical, but the deeper causes were weak criticality assessment, inadequate spare-parts planning, poor contractor assurance and a reporting system focused on response speed rather than risk reduction. The common-cause vulnerability of equipment located in the same service zone had also been overlooked.

Strategy and Solution

The asset manager classified systems by safety and business criticality, created a risk-based maintenance schedule and required verification of critical work. The cooling system was redesigned with accessible isolation points and a tested spare-pump arrangement. Water-leak detection was installed near electrical infrastructure. Contracts were revised to require trained backup personnel, escalation timelines, incident reporting and continuity evidence. A tabletop exercise involving the clinic, tenants, security team, utility provider and emergency contractor tested communications and prioritisation.

The property also introduced leading indicators: overdue critical tasks, repeat failures, near misses, alarm-testing quality and time to communicate incidents. Capital planning included resilience improvements rather than treating them solely as maintenance expenses.

Outcome and Learning Points

The case demonstrates that continuity depends on prevention, design, contracts, information and coordination. A backup component is valuable only when it is accessible, maintained and supported by competent people. It also shows why operational risk should be assessed across systems rather than asset by asset. Resilience investments may appear to increase short-term expenditure, but they protect safety, tenant confidence, income and long-term asset value.

Challenges, Governance and Professional Judgement

Operational risk management faces recurring difficulties. Budgets are often cut because benefits are avoided losses rather than visible revenue. Responsibility may be fragmented between owner, manager, tenant and contractor. Data may be incomplete, and statutory compliance can create a false sense of security. Managers may also face pressure to keep buildings open despite unsafe conditions.

Professional judgement requires a willingness to stop unsafe work, disclose material weaknesses and escalate deferred maintenance. Governance bodies should receive transparent information about critical risks, overdue actions, incidents, near misses and residual exposure. Safety reporting must not be manipulated to produce favourable statistics. Confidentiality and data protection must be respected when handling surveillance, health or incident information.

Regulatory duties vary by jurisdiction, but commonly involve building safety, fire protection, occupational health, accessibility, environmental protection, electrical systems, lifts, water quality, emergency planning and contractor control. Organisations should identify applicable requirements, assign accountable owners, retain evidence and monitor regulatory change. Compliance is a floor, not the complete definition of good risk management.

Emerging Directions and Best Practices

Climate-related heat, flooding, storms and wildfire conditions are increasing the importance of site-specific adaptation and continuity planning. Electrification, distributed energy, battery storage and smart buildings create new opportunities but also new fire, cyber and operational dependencies. Hybrid work changes occupancy patterns and may alter security, energy demand and emergency assumptions. Supply-chain volatility makes critical spares, specialist skills and vendor substitution more important.

Best practice is characterised by the following principles:

• manage safety as a core value rather than a documentation exercise;
• maintain an accurate register of critical assets, dependencies and responsibilities;
• prioritise controls according to consequence and vulnerability;
• combine preventive, predictive and corrective maintenance intelligently;
• test emergency and continuity arrangements with the people who must use them;
• learn from near misses and verify that corrective actions work;
• integrate tenants and contractors into the operating model;
• use technology with cybersecurity, data-quality and human-oversight controls; and
• report residual risk honestly to decision-makers.

Chapter Summary

Operational risk in real estate arises from failures of facilities, people, processes, technology and external dependencies. Effective control begins with hazard identification, criticality assessment and clear ownership. Maintenance strategies should combine corrective, preventive, predictive and reliability-centred approaches according to asset consequences. Utilities, fire systems, health and safety controls, security arrangements and contractor practices require layered and continuously verified safeguards.

Incident management prioritises life safety, stabilisation, communication, investigation and learning. Business continuity extends beyond disaster recovery by protecting critical property activities, occupants, information and service relationships. Business-impact analysis, recovery objectives, alternative strategies, exercises and review create practical resilience. Digital systems and AI can improve visibility and prediction, but they introduce cyber, privacy and accountability risks. Ultimately, operational resilience depends on governance, professional courage, competent people and investment decisions that recognise the full lifecycle value of safe and reliable buildings.

Key Terms

Operational risk: The possibility of loss or disruption caused by failed processes, people, systems, facilities or external events.

Hazard: A source or condition with the potential to cause harm.

Incident: An event that causes, or could cause, injury, loss, damage or disruption.

Near miss: An event that caused no harm but had the potential to do so.

Preventive maintenance: Planned maintenance performed to reduce the likelihood of failure.

Predictive maintenance: Maintenance triggered by evidence about an asset’s actual condition.

Corrective maintenance: Maintenance performed to restore a failed or defective asset.

Reliability-centred maintenance: A method that selects maintenance tasks according to functions, failure modes and consequences.

Asset criticality: The relative importance of an asset based on failure consequences and recovery characteristics.

Business continuity: The capability to continue or recover priority activities after disruption.

Business-impact analysis: An assessment of critical activities, dependencies, impacts and recovery needs.

Recovery time objective: The targeted time within which an activity should be restored.

Recovery point objective: The acceptable amount of data or transaction loss after disruption.

Redundancy: Provision of additional capacity or components to support continued operation.

Common-cause failure: Failure of multiple supposedly independent elements because of one shared cause.

Root-cause analysis: Structured investigation of underlying conditions that produced an incident.

Permit to work: A formal authorisation and control process for hazardous tasks.

Leading indicator: A forward-looking measure of control activity or emerging risk.

Computerised maintenance-management system: Digital software used to plan, record and analyse maintenance.

Residual risk: Risk remaining after controls have been implemented.

Review Questions

Short Answer Questions

1. Why is operational risk in real estate described as socio-technical?

2. Distinguish preventive maintenance from predictive maintenance.

3. What is the purpose of an asset criticality assessment?

4. Define a recovery time objective.

5. Why are near misses important in safety management?

Long Answer Questions

1. Explain how a risk-based maintenance programme can protect safety, asset value and business continuity.

2. Discuss the layered nature of fire safety and the responsibilities of property managers.

3. Describe the stages of a business-continuity planning cycle for a mixed-use property.

4. Analyse the role of tenants and vendors in operational risk management.

5. Evaluate the benefits and limitations of building-management systems, sensors and AI in property operations.

Analytical / Application Questions

1. A commercial building has low maintenance expenditure but rising emergency repairs and repeated equipment failures. Diagnose the likely management problem and recommend indicators and actions.

2. A property loses power, access control and communications during a storm. Develop an incident-response and continuity strategy, identifying priorities, dependencies and recovery decisions.

3. A contractor repeatedly closes work orders without resolving defects. Analyse the governance failure and propose contract, assurance and performance-control improvements.

22. Multiple Choice Questions with Answers

Question 1

Which maintenance approach is most directly based on evidence of an asset’s actual condition?

A. Corrective maintenance

B. Predictive maintenance

C. Emergency maintenance

D. Deferred maintenance

Correct Answer: B. Predictive maintenance

Question 2

A building has two generators, but both depend on the same fuel-delivery system. What risk does this illustrate?

A. Perfect redundancy

B. Common-cause failure

C. Risk transfer

D. Demand forecasting

Correct Answer: B. Common-cause failure

Question 3

Which activity is the primary purpose of a business-impact analysis?

A. To calculate annual rent escalation

B. To identify critical activities, dependencies and recovery needs

C. To replace all manual procedures with software

D. To certify contractor insurance

Correct Answer: B. To identify critical activities, dependencies and recovery needs

Question 4

During an incident, which priority should normally come first?

A. Protecting life and stabilising the emergency

B. Restoring tenant convenience services

C. Completing monthly performance reports

D. Calculating depreciation

Correct Answer: A. Protecting life and stabilising the emergency

Question 5

Why is retraining an employee sometimes an inadequate corrective action after an incident?

A. Training is never relevant to safety

B. The underlying system or design weakness may remain

C. Incidents cannot be investigated

D. Corrective actions should only address equipment

Correct Answer: B. The underlying system or design weakness may remain

Question 6

Which indicator would most clearly suggest deferred maintenance risk?

A. Increasing emergency work and repeat failures

B. A current tenant directory

C. Higher visitor registration

D. More completed induction sessions

Correct Answer: A. Increasing emergency work and repeat failures

Question 7

What is the principal limitation of relying only on a fire-safety certificate?

A. Certificates eliminate the need for alarms

B. Certification does not replace continuous operational control

C. Certificates apply only to financial systems

D. Certification prevents emergency drills

Correct Answer: B. Certification does not replace continuous operational control

Question 8

Which contractual provision best strengthens vendor continuity?

A. A requirement for the lowest possible price only

B. A requirement for trained backup personnel and escalation procedures

C. A prohibition on incident reporting

D. An agreement to omit performance reviews

Correct Answer: B. A requirement for trained backup personnel and escalation procedures

Question 9

What does a recovery point objective describe?

A. The acceptable loss of data or transactions after disruption

B. The number of emergency exits

C. The maximum number of maintenance workers

D. The time required to inspect a fire door

Correct Answer: A. The acceptable loss of data or transactions after disruption

Question 10

Which is an important control when AI is used for safety-related operational decisions?

A. Removing all human oversight

B. Using undocumented automated decisions

C. Maintaining accountability, audit trails and override arrangements

D. Ignoring data quality because algorithms self-correct

Correct Answer: C. Maintaining accountability, audit trails and override arrangements