Risk is an uncertain event which will cause deviation in pre-defined objectives, if it occurs. Risk management aims to identify risks, quantify their impacts and develop strategies to mitigate them to ensure project success. Within the context of risk management studies, risk models are usually designed to simulate the project performance under various scenarios. For risk modeling, the statistical link between the risk events and their consequences is scrutinized. However, this approach has a limitation as the influence of the &ldquo / system&rdquo / is neglected during modeling the relation between risk sources and consequences. The term &ldquo / vulnerability&rdquo / is used to describe internal characteristics of a system which influence this relationship. Management of vulnerabilities in addition to risks is essential for the success of risk management. However, there is no consensus on an appropriate definition of vulnerability parameters and their influence on construction projects. One of the aims of the study is to identify the vulnerability factors for construction projects and to propose a framework which portrays the relationship between risk and vulnerability. For this purpose, a detailed literature survey is performed to define the determinants influencing the level of vulnerability. In addition, case studies were conducted with Turkish contractors to explore the relationships between risk events, project vulnerabilities and project performance. Another objective of the study is to propose a risk and vulnerability ontology which provides a definite vocabulary and machine-comprehensible common understanding of the developed framework. Developed ontology will further be used to form a database for risk and vulnerability management.