Transferring risk is not the same as managing it, and government contracts keep proving it
There is a line in the Cabinet Office guidance on risk allocation and pricing approaches that ought to be pinned above every commercial team's desk: the objective of risk allocation is not to transfer as much risk as possible to suppliers. It reads as obvious. It is also the exact opposite of how a great many public contracts are still built, which is why inappropriate risk allocation keeps turning up in National Audit Office reporting as a leading cause of contracts underperforming or failing. The guidance is not asking for softer contracts. It is asking for accurate ones.
The risk you transfer comes back as a price
Risk does not disappear when you push it down the contract. It comes back as a risk premium, and you pay it whether or not the risk ever materialises. The guidance is unusually direct about this: where transferring a risk will cost more in premium than the expected loss of retaining it, the authority should consider retaining it. That is a calculation, not a preference, and it requires you to have some honest estimate of probability and consequence rather than an instinct.
The bill arrives in other forms too. A supplier managing an unreasonable balance of risk shifts focus to cost cutting, which shows up as underperformance. In the worst case the contract becomes onerous and the supplier exits or fails, at which point the authority owns the problem anyway. The guidance points at high profile contracts where risk was transferred through the pricing mechanism, with payment linked to outcomes the supplier could not control, and where the supplier ended up exposed to not being paid for work it had actually done.
And some risk was never transferable in the first place. Reputational risk cannot be moved. The public sees a failing public service, not a contractual allocation table. Any risk strategy that quietly assumes otherwise is fiction.
Where teams actually go wrong
The most common mistake is specifying outputs and inputs at the same time. An authority decides it wants outcome based pricing, transfers delivery risk on that basis, then writes a specification prescribing how the service must be delivered. The supplier now carries risk for results while following someone else's method. The guidance calls this out plainly: overly descriptive specifications for output based contracts lead to poor performance and hold suppliers accountable for things not truly within their control.
The second is treating risk as a one off exercise. A risk register gets built for the business case, a matrix gets pasted into the commercial case, and neither is touched again. Risks change through a procurement and through a contract, and new ones appear. The guidance frames risk management as continuous, running from identification through analysis, evaluation, treatment and allocation into monitoring and reporting.
The third is a payment mechanism nobody stress tested. If bidders do not understand how they get paid, they price defensively or get it wrong, and you inherit both problems. Worked examples during market engagement and in the tender pack cost very little. Scenario analysis at multiple activity and performance levels costs a little more and tells you whether your mechanism accidentally rewards the wrong behaviour. Involving the people who will manage the contract before it is signed costs nothing at all.
The fourth is inflation by default. Escalation factors get chosen because they are simple, which quietly hands every bit of inflation risk to the supplier. Annual uplifts get chosen because they feel flexible, which buys an annual negotiation you did not need. Where prices are genuinely uncertain, indexation against a published ONS output index does the job automatically and, as the guidance notes, removes any justification for an inflation risk premium.
What good looks like in practice
Start earlier than feels comfortable, and engage the market before your approach hardens. The guidance ties poor contracts directly to a lack of early engagement and a lack of clarity about what is being bought. Sharing a draft risk allocation matrix with the market is not weakness. It is the cheapest way to find out that the risk you were about to transfer is one nobody in the market can price.
Get visibility of the premium. The guidance suggests risk pots where the value of each risk is set out, and allowable assumptions that only release value if an assumption proves inaccurate. Both turn an invisible loading in the bid price into something you can negotiate line by line.
Be proportionate on liability and insurance. Suppliers should not be asked to accept unlimited liabilities beyond the agreed cross-government list. Insurance requests should reflect the contract's risks and value and standard market practice, not a template. Being named as principal, per claim limits and blanket demands are often impractical, and where an SME sub-contractor cannot get cover the risk simply moves back up the chain.
Finally, keep the record. Every judgement here, why a risk was retained, why an index was chosen, what the base period was, what the market said, is a judgement someone will question later, often after the people who made it have moved on. A decision you cannot evidence is a decision you will end up making again under pressure.
The takeaways
- Maximum transfer is not the goal. Risk belongs with whoever can genuinely control it.
- Every transferred risk you cannot justify comes back as a risk premium you pay regardless.
- If you pay for outputs or outcomes, stop dictating inputs.
- Choose the inflation mechanism deliberately: escalation factors hand the risk to the supplier, indexation keeps it with you.
- Test the payment mechanism with the market and with your contract managers before you sign, not after.
Want the full breakdown?
The complete explainer covers the key facts, the requirements in detail and a practical action list, free and printable in the Procurement Library.