Building at Scale: Governing Risk in Major Capital Projects

Executive takeaway: Major capital projects are becoming a board-level risk issue. As construction spending, infrastructure demand, data center growth, equipment constraints, and labor shortages converge, organizations need stronger capital project governance, concurrent construction assurance, and tighter project controls to protect budget integrity and return on invested capital.

Across the economy, organizations are pouring capital into physical assets such as new factories and semiconductor fabs, power generation and grid upgrades, logistics and distribution networks, hospitals, and the data centers behind the AI build-out. U.S. construction spending now runs at roughly $2.2 trillion (U.S. Census Bureau, Construction Spending, January 2026) a year, much of it flowing through complex, multi-year capital programs of exactly the kind that have a long, well-documented history of finishing late and over budget.

For the executives, audit leaders, and risk officers who greenlight and oversee these programs, that history is not an abstraction. Construction risk is one of the most consistently underestimated exposures in the capital budget, and it is intensifying as projects across every sector compete for the same transformers, switchgear, skilled trades, and grid capacity.

Capital is not the bottleneck. Execution is.

A majority of large infrastructure projects run over schedule, and the primary causes in this cycle — power procurement, equipment lead times, and the availability of specialized commissioning talent — are not the kind of risks that civil construction expertise alone can manage. When capital is abundant and physical capacity is scarce, organizations make a predictable error, treating the funded budget as the measure of progress, when the real measure is whether each committed dollar is being productively deployed on schedule.

The risks that get underestimated

Schedule and budget overruns are the visible risks that make it into board reporting. The more dangerous exposures are the ones that rarely surface until they have already cost money. The following areas deserve more attention than they typically receive.

Change-order leakage and pay-application integrity. On large builds, value erodes quietly through change orders and the contractor’s bill applications, including inflated or duplicated charges, billing for work not yet complete, unallowable costs under cost-plus and guaranteed-maximum-price contracts, and re-billing of scope already covered in the base contract. Most of this is ordinary disorganization rather than fraud, yet it is real money. Industry audits commonly find 1–3% recoverable, and where controls are weak, recoverable amounts can rise to 5–10%, producing eight- to nine-figure impacts on major builds. Some leakage is deliberate, and the warning signs are recognizable: subcontracting funneled to a small circle of suppliers, unusually close ties between vendors and the project owner’s staff, idle materials and equipment accumulating on site, and hotline tips left uninvestigated.

• Schedule-of-values and contingency manipulation. A schedule of values that is not updated as buyouts occur, or a contingency account that is drawn down without scrutiny, creates room for cost to migrate where it is hardest to see. These are not exotic schemes; they are mundane controls failures that compound over a multi-year program.
• Procurement concentration and single points of failure. When an entire delivery schedule depends on a handful of long-lead components from a narrow supplier base, the program inherits a concentration risk that belongs in enterprise risk reporting, not buried in a procurement tracker. A single transformer slip can outweigh several months of operating performance.
• Counterparty solvency and the governance shortcuts of speed. In an overheated market, contractors and subcontractors are stretched thin, and the financial fragility of a key trade partner can become the project owner’s problem, often surfacing when a paid general contractor fails to pay down the chain. Compounding this, the urgency of completion creates pressure to compress approvals, waive audit rights, and accept contract terms that quietly shift overcharge risk onto the owner.

What rigorous construction assurance looks like

The initial instinct in many organizations is to commission a construction audit at the end, a rearview-mirror exercise to find out what went wrong. That is the least valuable form of the discipline. Rigorous capital project assurance is concurrent, embedded, and built on four foundations.

1. First, it begins before anything is signed. Consequential audit work happens at the front end by reviewing project documentation and challenging the underlying assumptions, when changing course still costs nothing, rather than after the assumptions have been ratified. This is also where the governing chain starts. On a major program, the originating document is not the contract but the authorization to spend itself, an Authorization for Expenditure (AFE), and often several AFEs across a large, phased project.
2. Second, it carries through to the contracts and purchase orders that flow from those authorizations. One of the most effective controls the project owner can establish here is a strong, explicit right to audit written into every construction agreement, paired with transparent change-order procedures that require independent review and documented cost justification before approval. Audit rights cost nothing to include and are nearly impossible to retrofit once a dispute is underway. Framing periodic audits as routine vendor hygiene keeps these rights usable without damaging the relationship.
3. Third, it runs in parallel with the build, not after it. Effective programs combine three audit types across the project lifecycle: cost audits that verify charges against contract terms under cost-plus and GMP structures; compliance audits that test adherence to contractual, regulatory, and policy requirements; and close-out audits that confirm deliverables and final payments are justified before the file is closed and recovery becomes impractical. Concurrent review turns assurance into preventive medicine.
4. Fourth, it treats project controls as the real risk mitigation, supported by genuine visibility. Projects slip because the delivery system cannot detect slippage early enough to act. Schedules are often updated manually, siloed by trade, and disconnected from procurement and commissioning. The organizations that will navigate this cycle well are those that design their programs to see risk forming, rather than confirming it after the fact.

Durable principles beyond the boom

These dynamics show up most vividly in the data center surge, but they are not specific to it. Any organization undertaking a major capital program, such as a plant expansion, a hospital, a transmission upgrade, or a logistics network, faces the same underlying truth. Construction risk is a key component of enterprise risk, and it behaves differently from the financial risks most governance frameworks were built to handle. It accumulates quietly, it is actionable early yet too often paid for late, and it resists oversight that arrives only in summary form at period-end. Runaway construction cost overruns have plagued the industry for decades, and cost containment deserves to be a first-order priority for owners, developers, and lenders alike. Owner-side construction auditing has been a recognized professional discipline since the 1980s. What has changed is the scale and speed that now make it indispensable.

The boards and management teams that treat capital projects as a first-class governance issue will protect budget integrity, recover value that would otherwise leak away, and preserve the credibility of the returns they have promised investors. Those that treat construction as an operational detail beneath board attention will keep learning, project after project, that the most expensive risks were the ones no one was watching.

At Sirius Solutions, we help boards, audit committees, CFOs, and chief audit executives bring the discipline of internal controls and capital project assurance to their most significant investments. The organizations that govern construction risk with intention will be the ones that optimize their return on invested capital.

To discuss how a concurrent capital project assurance program could strengthen oversight of your critical infrastructure buildout and value chain, contact the Sirius Solutions Financial Advisory team or request our overview of construction risk management at Solutions@Sirsol.com.

Frequently asked questions about construction risk governance

What is construction risk governance?
Construction risk governance is the oversight structure that helps owners, boards, audit committees, CFOs, and risk leaders identify, monitor, and control the financial, contractual, schedule, procurement, and compliance risks embedded in major capital projects.

Why should construction risk be treated as enterprise risk?
Major capital projects can create material exposure through budget overruns, schedule delays, supplier concentration, contractor billing errors, change-order leakage, and counterparty solvency issues. These risks can affect cash flow, operational readiness, investor credibility, and return on invested capital.

When should a construction audit begin?
The most valuable construction assurance work begins before contracts are signed. Reviewing AFEs, assumptions, audit rights, contract terms, change-order procedures, and procurement dependencies early helps prevent value leakage instead of trying to recover it after close-out.

What is concurrent capital project assurance?
Concurrent capital project assurance runs in parallel with the build. It combines cost audits, compliance audits, close-out audits, and project-controls visibility so issues can be corrected while there is still time to act.