Attachment 0010 Type I FOATC Program Risk Management Plan (RMP).PDF

UNCLASSIFIED / FOUO

UNCLASSIFIED / FOUO i

Type I Family of All Terrain Cranes (FOATC)Acquisition Category (ACAT) III

Risk Management Plan (RMP)

Version 1.0

Supporting Milestone C (MS C) And

Full Rate Production (FRP) Phase

Prepared by:

Project Manager Force Projection (PM FP), Product Manager Combat Engineer / Material Handling Equipment (PdM CE/MHE) 24 August 2020

DISTRIBUTION STATEMENT C: Distribution authorized to U.S. Government Agencies and their contractors to protect information and technical data that advance current technology or describe new technology in an area of significant or potentially significant military application or that relate to a specific military deficiency of a potential adversary. Date of determination: 21 Jun 2012. Other requests for this document will be referred to Program Executive Office Ground Combat Systems, ATTN: Assistant Product Manager, Bradley (SFAE-GCS-FV), 6501 E. 11 Mile Road, Bldg. 229, MS 506, Warren, MI 48397-5000.

WARNING: This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C. Sec 2751 et seq.) or the Export Administration Act of 1979, as amended, Title 50, U.S.C., App. 2401 et seq. Violations of these export laws are subject to severe criminal penalties.

Disseminate in accordance with provisions of DoD Directive 5230.25.

DESTRUCTION NOTICE: Destroy by any method that will prevent the disclosure of contents or reconstruction of the document.

UNCLASSIFIED / FOUO ii

Type I Family of All Terrain Cranes (FOATC) Risk Management Plan Signature Page

SUBMITTED BY:

PAUL T. CROWLEY

CPT, LG/51A

Assistant Product Manager/Risk Manager, Combat Engineering / Material Handling Equipment

SIBILA FREDERICK

Systems Engineering Lead, CONCURRENCE

VERONICA M. JOHNSON

Project Officer, CHRISTOPHER M. UPTON

Deputy Product Director, APPROVAL

TONY A. JONES

LTC, LG/51A

Product Manager, UNCLASSIFIED / FOUO iii

Table of Contents

1. INTRODUCTION AND OVERVIEW

1.1 PURPOSE OF THE RISK MANAGEMENT PLAN

1.2 PROGRAM BACKGROUND

1.3 RISK MANAGEMENT APPROACH

2. ORGANIZATION, ROLES, AND RESPONSIBILITIES

2.1 RISK MANAGEMENT TEAM STRUCTURE

2.2 ROLES AND RESPONSIBILITIES

3. RISK MANAGEMENT OVERVIEW

3.1 OVERVIEW

3.2 RISK IDENTIFICATION

3.3 RISK ANALYSIS AND RANKING

3.4 RISK MITIGATION

3.5 RISK MONITORING

3.6 RISK REVIEW BOARD PROCESS

3.7 DETAILED PROCESS WORKFLOW FOR RISK MANAGEMENT

3.8 RISK CLOSURE

3.9 RISK REPORTING

3.10 INTEGRATION WITH OTHER PROGRAM MANAGEMENT PROCESSES

4. RISK MANAGEMENT TRAINING

5. APPENDIX 1: ACRONYMS

6. APPENDIX 2: DEFINITIONS

7. APPENDIX 3: RISK MANAGEMENT LEVEL OF EFFORT GUIDELINES

8. APPENDIX 4: RISK INFORMATION WORSHEET

9. APPENDIX 5: RISK ATTRIBUTES GUIDANCE FOR CONTRACTOR

10. APPENDIX 6: RISK HANDLING ACTIVITY EXAMPLES

11. APPENDIX 7: RISK WATERFALL REPORT EXAMPLE

12. APPENDIX 8: DETAILED RISK REPORT EXAMPLE

13. APPENDIX 9: RISK MATRIX REPORT EXAMPLE

14. APPENDIX 10: TOP 5 RISK REPORT EXAMPLE

15. REFERENCES

Table of Figures FIGURE 1 RISK ELEVATED STRUCTURE / TIERS .................... ERROR! BOOKMARK NOT DEFINED.

UNCLASSIFIED / FOUO iv

FIGURE 2 HIGH LEVEL RISK MANAGEMENT PROCESS

FIGURE 3 RISK RANKING MATRIX

FIGURE 4 RISK APPROVAL WORKFLOW WITHIN RISK RECON

FIGURE 5 RISK REVIEW LEVELING ..................................... ERROR! BOOKMARK NOT DEFINED.

FIGURE 6 RISK MEETINGS AND PLAN REVIEWS

FIGURE 7 DETAILED PROCESS WORKFLOW FOR RISK MANAGEMENT

Table of Tables

TABLE 1 ROLES AND RESPONSIBILITIES

TABLE 2 LIKELIHOOD/PROBABILITY OF RISK OCCURRENCE GUIDANCE

TABLE 3 CONSEQUENCE/SEVERITY OF RISK IMPACT

Document Change History

Version Details

No.

Date Approved Sections Updated

1.0

2.0

3.0

4.0

5.0

UNCLASSIFIED / FOUO RMP Version 1.0

UNCLASSIFIED / FOUO pg. 1

1. INTRODUCTION AND OVERVIEW

1.1 Purpose of the Risk Management Plan

Risk is a measure of future uncertainties in achieving program performance goals and objectives within defined cost, schedule, and performance constraints. Risk can be associated with all aspects of a program (e.g., threat, technology maturity, supplier capability, design maturation, performance against plan), as these aspects relate across the Work Breakdown Structure (WBS) and Integrated Master Plan (IMP). Risk addresses the potential variation in the planned approach and its expected outcome. This Risk Management Plan was developed based on the “PM FP Risk, Issue and Opportunity Management Plan (PM FP RIO RMP), and “Department of Defense Risk, Issue and Opportunity Management Guide for Defense Acquisition Programs” issued on January 2017.

The objectives of the risk management process are to:

• Identify program uncertainties and minimize the effect of these uncertainties on program cost, schedule, and performance.

• Inform technical and programmatic decisions.

• Manage risk through effective risk mitigation planning and control.

• Identify and quantify cost-effective and controllable risk mitigation alternatives.

• Update leadership on program risk and mitigation plan progress visible.

• Ensure awareness and participation of all team members in the risk management process.

The Product Manager (PdM), Combat Engineer / Material Handling Equipment (CE/MHE) uses an Army developed and owned risk management tool called Risk Recon to manage Type I FOATC program risks. The program’s organizational structure is loaded into Risk Recon.

This Risk Management Plan (RMP) provides an outline of how PdM CE/MHE will manage risk and apply the principles of risk management throughout the entire lifecycle for the Type I FOATC program. This RMP, and the processes described herein, applies to all phases of the planning and execution across all phases of the acquisition life cycle.

This Risk Management Plan addresses the following concepts:

• Establish the basic approach and risk management working structure.

• Define the framework within which all TYPE I FOATC team members can communicate and collaborate amongst each other.

• Define the Roles and Responsibilities for risk management at the leadership, management and working levels.

• Document an organized, comprehensive, and integrated approach for managing risks.

• Define the goals and objectives of the RMP.

• Define an approach to identify, analyze, handle, and monitor risks across the program.

• Define the means to monitor the effectiveness of the risk management process.

• Define the frequency of risk reviews and reporting mechanism.

• If needed, document the integrated risk management processes as they apply to contractors, subcontractors, and teammates.

UNCLASSIFIED / FOUO pg. 2

1.2 Program Background

The Type I FOATC supports the National Defense Strategy (NDS) by ensuring common domains remain open and free. With its mobility, survivability and lift capacity the Type I FOATC is positioned to support our allies, strengthen alliances and partnerships with infrastructure support.

The Type I FOATC enables Horizontal Construction, Vertical Construction, Engineer Construction and Engineer Support Companies with the capability necessary to conduct overhead lift, container moving, pile driving, resupply activities and general construction tasks. It is also capable of supporting and operating a clamshell bucket, a pile driver, a concrete bucket, and a grapple for shaping, upgrading and repairing facilities, airfields, roads, survivability/force protection and river crossings.

The Type I FOATC employs by organizations within the Combatant Command’s Army Service Component Command (ASCC) mission command structure. It supports Army, Joint, Inter-agency and International (JIIM) Forces. It employs in all phases of Joint Operations to overcome anti-access strategies and area denial environments by enabling the rapid movement of forces engaged in Unified Land Operations.

The program is scheduled to obtain Full Material Release (FMR) by FY2023. Two Hundred and Sixty Two (262) Type I FOATCs are required by 2025 with the first being fielded in 2023.

1.3 Risk Management Approach

The basic risk management strategy for the Type I FOATC program intends to identify future risk events and handle them before they have the chance to affect cost, schedule, or performance. It intends to be a repetitive and iterative process conducted by each individual on the Type I FOATC Program Team. DoD Instruction 5000.2 states: “Risks must be well understood, and risk management approaches developed, before decision authorities can authorize a Program to proceed into the next phase of the acquisition process.” The Type I FOATC Program uses a centrally developed risk management strategy throughout the acquisition process to conduct risk identification and analysis. The strategy also includes risk mitigation planning, implementation, and tracking. The Program Office is responsible for the implementation of the risk management strategy. Revisions to the RMP are concurred by the APM (Risk Manager) and Lead Systems Engineer and approved by the PdM.

Other than the risk the Government is tracking, the Type I FOATC Contractor, by contract, will present their risks during the quarterly Program Management Review. The Government will advise and recommend risk actions The Government will monitor the progress of the contractor’s risk.

UNCLASSIFIED / FOUO pg. 3

2. ORGANIZATION, ROLES, AND RESPONSIBILITIES

2.1 Risk Management Team Structure

The Type I FOATC risk management process operates through an elevated structure led by the Risk Review Board (RRB). The RRB consists of the Type I FOATC Product Manager (PdM), Deputy Product Manager (DPdM), Chief Engineer, APM (Risk Manager), and various Functional Leads. The PdM chairs the RRB. The RRB reviews all risks put forth by the Risk Integrated Product Team (RIPT) and prioritizes how resources are allocated for risk handling/mitigating across the program. Figure 1 illustrates the elevation path of risk from the working level to PdM.

The RIPT is chaired by the APM (Risk Manager) and own the Risk Management Plan (RMP). The RIPT includes the lead SE, various functional leads, and the APM (Risk Manager). The RIPT reviews all risks put forth by the RWG. They discuss and determine if the proposed risk is scored accurately and can go forward to the RRB. They review/approve all red & high yellow risks.

The Risk Working Groups (RWG) is also chaired by the APM (Risk Manager). It is comprised of the Lead SE, APM (Risk Manager) and any Type I FOATC member submitting a risk. The purpose of the RWG is to review the submitted risk for proper format and ensures they are actually risks with associated mitigation plan if they are yellow or red risks.

2.2 Roles and Responsibilities

This section explains the roles and responsibilities of those teams and personnel within the Type I FOATC group that have risk management duties. The Type I FOATC risk management process is

UNCLASSIFIED / FOUO pg. 4 contingent upon every person assigned to the Type I FOATC Program doing his or her part. Best practice indicates involvement and participation should be continuous and considered a part of the program management process. Table 1 outlines the key risk management roles and responsibilities for Type I FOATC staff.

Table 1 Roles and Responsibilities

Role Responsibility

Product Manager (PdM) / Deputy Product Manager (DPdM)

• Chairs the RRB

• Owns the Risk Management Process Owner

• Communicate and reinforce the Risk Management Process across the entire program’s lifecycle

• Accountable over the PdM CE/MHE program

• Prioritizes and decides how major resources are allocated for risk handling/mitigation across the program

• Reports high level risks to Project Manager (PM) and Program Executive Office (PEO)

Leadership

• Reviews all risks and handling/mitigation plans for the program

• Reviews and approves Risk Management Plan (RMP)

Risk Manager

(RM) /

Assistant Program Manager

(APM) /

• Risk Management Plan Owner

• Chairs RIPT and RWG

• Facilitates RRB

• Maintains Risk Recon

• Reviews risks for proper format and to ensure they are actually risks

• Reviews/approves all red & high yellow risk handling/mitigation plans during the RIPT meeting

• Validates candidate risk assessment values for likelihood and consequence o Ensures all risk information from the Risk Leads is updated and accurate in Project Recon for risk report outs and meetings.

o Review risk mitigation plans

• Collaborate with team to Identify, assess and analyze risks and define and monitor risk mitigation progress (RWG Level)

• Guide leadership, Subject Matter Experts (SME) and team members on best approach to mitigate yellow and red risks

• Recommends how major resources are spent allocated for risk handling/mitigation across the program

• Develops and maintains the risk management plan.

• Coordinate risk management training.

• Provides risk reports to convey status.

• Assists in the implementation of risk/ risk mitigation tasks into the project Integrated

Master Schedule (IMS).

• Creates and/or approves RRB, Bi-Monthly Reviews and Program Status Review

(PSR) briefs and report outs with the support of the Risk Leads.

o Organizes and supports risk assessments to support decisions, Project Plan quarterly reviews and technical reviews.

o Develops and tracks risk management metrics

• Organizes and supports risk assessments to support decisions, Project Plan quarterly reviews and technical reviews.

Systems Engineering Lead

• Provide direction, assistance and guidance for the risk management effort

• Co Chairs Risk IPT

• Advises PdM/DPdM on how major technical resources should be allocated for risk handling/mitigation across the program

UNCLASSIFIED / FOUO pg. 5

Role Responsibility

• Reviews all red & high yellow risks risk handling/mitigation plans for the program

• Reviews and concurs all contractor risks (CDRL XXXX – Risk Tracking Reports

• Reviews and approves Risk Management Plan

• Reviews and approves the Contractor Risk Management Plan (CDRL XXXX –

Contractor RMP)

Risk Review Board

• Reviews risks elevated by the RIPT

• Resolves conflicts

• Recommends/confirms risk closeout during RRB meetings o Confirms if risk has become issue with defined next steps; approve transfer to Issue Tracking

• Reviews mitigation plans, & resource decisions for approval

• Approves changes to the program baseline for cost, schedule and performance

• See APPENDIX 3: RISK MANAGEMENT LEVEL OF EFFORT GUIDELINES for additional guidance

• Members include: PdM and DPdM, PO, APM (Risk Manager), Systems Engineering

Lead , Functional Leads, Master Scheduler and other key stakeholders

Risk Integrated Product Team

(RIPT)

• Reviews program risks entered into Project Recon by Risk Working Group

• Conducts ongoing reviews of newly opened risks or changed risks

• Resolves conflicts and consolidate similar risks

• Reviews approved risks & determines if changes are necessary

• Reviews mitigation plans, and confirms staffing resources for action plan

• Closes and archives risks

• Reviews risks for closure approval

• Meets at least once every month

• Members include: Risk Manager/PSEL, IPT Risk Leads, Risk Leads

Risk Working Group

• Reviews initial program risks. Includes Risks from the Initial Phase Risk Process

• Conducts ongoing reviews of newly opened risks or changed risks

• Approves risks for elevation to RIPT

• Develops mitigation plans, and confirms staffing resources for action plan

• Reviews risks for closure approval

• Meets at least once every 2 weeks

• Members include: AMP (Risk Manager). Functional Leads, and SMEs

Risk Leads

• Identifies new risks

• Attends & supports the contractors risk meetings to assist in their risk management process

• Ensures IPT risks are fully developed and ready for RIPT submission

• Supports risk assessment and appropriateness for Type I FOATC program

• Assists in comparison of contractors risks for program risk trends

• Identifies and assesses program risks based on risk commonality between contractors

• Provides support to meetings and SME as needed

Subject Matter Expert

(SME) /

Stakeholders

• Consults APM (Risk Manager), PO, SE Lead, other Functional Leads and RRB on best approaches to mitigate risk.

• Monitors approved risks for changes in rating and/or definition

• Supports RWG, RIPT and RRB meetings

• Helps with risk analysis

Risk Originator • Any Type I FOATC member can identify a new risk.

UNCLASSIFIED / FOUO pg. 6

Role Responsibility

Contractor

• The contractor shall manage risks to the program and technical baselines through examination of each element in the Contract Work Breakdown Structure (CWBS).

• The contractor shall conduct formal risk assessments, interview SMEs, and utilize lessons learned from similar programs and products.

• The contractor shall develop mitigation and closure strategies for each risk that shall be reviewed and coordinated with the Government during the monthly Risk IPT.

• The contractor shall update these throughout the performance of the contract In Accordance With (IAW) the Government Risk Management Plan, Attachment 000X.

• The contractor shall conduct monthly Risk Management IPT meetings with Government RIPT leader participation. The Risk Management IPT shall decide which risks are accepted, approved, and tracked at the system level.

• The contractor shall provide a Contractor RMP that includes their subcontractors and outlines the processes and procedures for establishing and managing risks for the program IAW Contractor Risk Management Plan, CDRL AXXX.

UNCLASSIFIED / FOUO pg. 7

3. RISK MANAGEMENT OVERVIEW

3.1 Overview

The Type I FOATC risk management process assesses and mitigates risks to program cost, schedule, performance objectives, and to support evaluation of the alternative approaches if required.

Risk is relative to the program plan. Consequently, risks develop in terms of uncertainty relative to specific cost, schedule, and/or performance parameters of the program or plan whenever possible.

The Type I FOATC team uses the Army’s Project Recon risk management database within Project Recon to manage risks for this program. Project Recon is a web based system for Unclassified/FOUO information processing located at the following URL:

https://projectrecon.army.mil/tardec.

At a high level, the risk management process consists of five activities: planning, identification, analysis, handling, and monitoring, summarized by Figure 2. For medium and high level risks, RWGs, and RIPTs develop an initial mitigation. The mitigation concept follows a detailed mitigation plan that includes steps or tasks assigned to individual owners for execution. The team places risks that do not have a mitigation plan at the time of submission in a “Candidate” status, pending receipt of a mitigation plan from the Risk Lead. See Section 3.6 for the Risk Management Process.

https://projectrecon.army.mil/tardec

UNCLASSIFIED / FOUO pg. 8

Figure 1 High Level Risk Management Process

The risk, once it is approved and baselined, goes into a monitor cycle where the status of risks update as mitigation steps are completed. The Risk Lead or Mitigation Plan Lead is responsible for updating the risk as this occurs and reporting on the results of the plan. The RRB reviews and approves risks for closure.

3.1.1 Program, Contractor, and Stakeholder Risk (Joint Risk)

The program manages joint risks between the program, contractor and/or other stakeholders through Project Recon or a jointly shared risk management tool depending on the subject matter of the risk and the mitigation plan. The Type I FOATC Program uses an IPT to facilitate joint risk management and the transfer of information between Government and contractor personnel supporting the Type I FOATC program. The use of IPTs promotes consistent risk management.

3.2 Risk Identification

Risk identification is the first step in the risk management process. The objective of risk identification is to uncover and capture those uncertainties that have the potential to result in significant cost, schedule, or performance deviations from the program plan.

The Type I FOATC risk identification process begins with a definition of the team’s process and product responsibilities. Artifacts that identify risk may be a Gantt chart showing key decision points and deliverables, a process flow chart, and a work breakdown structure. The intent is to ensure that everyone fully understands the team objectives, success criteria, and processes by which they derive and measure in order to identify uncertainties relative to the plan.

UNCLASSIFIED / FOUO pg. 9

Risk identification is part of an organized assessment process aimed at establishing a total program risk baseline. The program continue assessing risks based on the results of developmental activities and progress relative to the program plan, and periodically to support major program events and decisions, such as technical reviews.

Team members should work toward a proactive process versus a reactive risk identification process.

A reactive process responds to problems when they are already near certainty to occur. A proactive risk identification process identifies risks far enough in the future to allow time for mitigation action before the consequence becomes a certainty.

Product team members identify risks based on their cost, schedule, and performance responsibilities and the uncertainties surrounding the associated objectives.

Any team member can submit a risk at any time to the Risk Manager or within the appropriate risk folder in the Project Recon database. A risk information sheet in Project Recon is required for each new risk. See APPENDIX 4: RISK INFORMATION WORSHEET for a sample of this form. The initial submitter, or risk lead, should fill out as many fields of information as possible, recognizing that further analysis may be required to support mitigation strategies. The purpose of the initial risk submission is to provide enough information to determine if the risk uncertainties and their potential cost, schedule, and performance consequences warrant management within the formal risk management process.

3.2.1 Risk Categorization

For Type I FOATC risks, cost, schedule, and performance impact categorizes by source and grouped into these categories:

• Contracting / Legal

• Logistics

• Program Management

• Quality Assurance

• Security – Force Protection/CyberTechnical – Systems Engineering

• Technical – Test & Evaluation Risk categories support risk identification by providing a way to assess whether interrelated program categories, sub-areas within a category, influence a potential activity or event. Example: A software modification proposes to address a recently discovered exploit. Implementation has a potential negative supportability cost because new training, engineering support, and manufacturing processes may be needed. In this example risk handling impacted logistics, systems engineering / configuration management, test & evaluation and logistics.

3.3 Risk Analysis and Ranking

The risk identification process identifies uncertainties that have the potential to adversely affect cost, schedule, and performance relative to a team’s plan. The risk analysis process quantifies the

UNCLASSIFIED / FOUO pg. 10 likelihood and impact of a risk to determine the risk level (high, medium, or low) and to determine if formal management is required to support mitigation and control planning.

3.3.1 Risk Analysis

The purpose of risk analysis is to provide a prioritization of the risk by quantifying, to the degree practical, the probability (likelihood) and consequence in terms of impact on cost, schedule or performance.

Assessing Probability (Likelihood) of Occurrence

Particularly when far in the future, it may be difficult to predict the likelihood of a risk event occurring.

Likelihoods define in terms of a scale of probability of occurrence such as the one listed in Table 2.

The probability (likelihood) rating for each risk is determined by asking the question “What is the probability the root cause will happen?” This rating is determined choosing one of the five levels of probability set by the TYPE I FOATC Program. Table 2 shows these levels and their likelihood of occurrence. The risk originator and SME assign one of these values to each identified risk event based on their analysis of the event.

Assessing Consequence (Severity of Risk) The consequence analysis should identify cost, schedule, and/or performance impacts of the risk event, and when the risk impact occurs. The impact should be determined and understood well in advance of its occurrence, as is the case for a design decision where the potential cost impact may not affect the program until testing, or even until after fielding. There may be multiple consequences of a risk event occurrence. If they are significantly different, especially if the impacts require different mitigation strategies, each define as separate risks. For guidance on assessing the consequence of a risk, see Table 3. Table 3 assesses the consequence in terms of impact to cost, schedule, and or performance:

Cost: Key Stakeholders may set the percentage criteria that best reflect their situation. However, when costs rolled up to the Program level, the definitions shown are used.

Risk Leads and SME(s) evaluate each risk event in terms of these areas, and assign a level of consequence (1, 2, 3, 4, or 5) in the areas of performance, schedule, and cost as defined in Table 3.

The highest of the three determines the overall risk score. Once the risk forwards to the RM, the RM shall coordinate with the Risk IPT Leads to assess further the impact across the scope of the Program.

Schedule: The risk impact on the schedule reflects the adequacy of time allocated for performing the Program’s tasks. Impact in this area measure and report in terms of days or months of schedule slip.

Performance: Performance risks deal with the impact on technical performance and to what level, and address operational, technical and management considerations.

3.3.2 Risk Ranking

Once analysis is complete, the risk ranks or assigns a risk rating that defines its risk level (high, medium or low) or its potential to adversely affect the program. Table 2 and Table 3 below provide

UNCLASSIFIED / FOUO pg. 11 guidelines for appropriately ranking the consequence and likelihood of a risk. Risk analysis and ranking is coordinated with contractors when the risk requires their action for mitigation.

Table 2 Probability Levels

Note: The probability score is ALWAYS rated against the ROOT CAUSE! This is very important because it will ensure that all risks are consistently rated against the same criteria. Decoupling the probability of the root cause from the severity and probability of a given consequence prevents poor ratings.

UNCLASSIFIED / FOUO pg. 12

Table 3 Severity of Consequence

Rating Description

Se ve rit y

Le ve l

Performance Schedule Cost

Reference system unit cost Reference requirements in PD and

SOW

Catastrophic Program jeopardized

5 Failure to meet KPP/KSA requirements. System requires a complete redesign of one or more major subsystem prior to fielding.

Cannot meet next major milestone in a timeframe of +18 months.

Impacted X ≥ 25%

Critical Program success in doubt

4 Failure to meet non-KPP/KSA requirements. System requires an improvement of one or more subsystem design prior to fielding.

Cannot meet next major milestone in a timeframe of greater than 6 or up to 18 months.

Impacted 15% ≤ X < 25%

Moderate Limited impact on Program success

3 Not meeting safety requirements. Perceived non-compliance by stakeholder organizations.

Cannot meet next major milestone in a timeframe of up to 6 months.

Impacted 5% ≤ X < 15%

Marginal Minor impact on Program success

2 Failure to meet non-KPP/KSA requirements. Government willing to accept the proposed design.

Schedule slip impacting another program, with no impact to a major program event or milestone.

Impacted 1% ≤ X <5%

Negligible No impact on Program success

1 System design will require minor performance trades or have minimal consequence in technical performance.

Schedule slip with no impact to another program, with no impact to a major program event or milestone.

Impacted <1%

The consequence and likelihood rating criteria intends to be a general guideline for ranking a risk, as depicted in Figure 3. However, the primary determinant of risk level is the level of management attention given.

Generally, the RRB formally manages risks with ranking ≥ 16 with documented mitigation plans and regular progress reviews provided to leadership. The APM/PO reviews risks with ranking < 16. The team or RWG manages these risks. See mitigation planning in Section 3.4 for more details on the management of low risk items.

UNCLASSIFIED / FOUO pg. 13

Figure 2 Risk Ranking Matrix

3.4 Risk Mitigation

The intent of risk mitigation is to reduce the likelihood and/or consequence of a risk. Risk mitigation may require compromise. Generally, mitigation involves making cost, schedule, and/or performance trades in order to reduce risk. Consequently, it is important that the program staff both the risk and the proposed mitigations to ensure the mitigation is worth the effort.

Risk Leads along with Subject Matter Experts (SMEs) develop risk mitigation plans in order to address risks in their particular program areas of expertise. The plans address:

• The Risk Lead responsible for monitoring and controlling the identified root cause

• Possible alternatives to mitigate the risk

• Detailed description of events & activities intended to mitigate the risk, the success criteria for each event, risk triggers, & the resulting residual risk level once the strategy is implemented

• Resources required to implement the mitigation plan

• Recommendations to Type I FOATC senior leadership on whether budget or time is to be allocated in order to mitigate the risk

Once the risk mitigation plan is developed and baselined, the assigned risk lead implements the plan.

Implementation of risk mitigation plans address:

• How to implement the planned risk mitigation strategy

• Resource requirements as well as any required contract modifications

• Methods of coordination between management and other stakeholders

• Assignment of appropriate IPTs to execute the defined (approved) risk mitigation plans

• The risk reporting requirements for risk tracking

• Change history in program documents

The Risk Lead who is responsible for the risk coordinates the plan implementation.

Negligable

Marginal

Moderate

Critical

Catastrophic

Near Certainty 9 16 20 23 25

Highly Likely 6 13 18 22 24

Moderate 4 10 15 19 21

Low 2 7 11 14 17

Not Likely 1 3 5 8 12

Pr ob ab ili ty o f O cc ur re nc e

Severity of Consequence

UNCLASSIFIED / FOUO pg. 14

3.4.1 Risk Mitigation Planning Process

The risk leads develop and implement mitigation plans through WGs and IPTs. For medium and high level risks, RWGs, and RIPTs develop an initial mitigation. The mitigation concept follows a detailed mitigation plan that includes steps or tasks assigned to individual owners for execution. For low-level risks, a mitigation concept or summary for how the risk is usually sufficient.

The team documents the following items for medium and high level risks in the risk database for each task/step of a detailed risk mitigation plan:

• Task/step title and description

• Task/step due date

• Task/step progress/completion date

• Task/step owner

• Expected new likelihood and consequence upon completion of each task/step

3.4.2 Risk Mitigation Techniques

The goal of a risk-handling plan (Risk Mitigation Planning) is to determine what type of strategy the program pursues in order to handle the risk. There are four mitigation options for the handling of risk, defined below:

• Avoid: Develop a strategy to avert the likelihood and/or consequence by selecting a different approach or not pursuing the option at all. Consider this technique when multiple design or programmatic options are available.

• Transfer: Develop a strategy to place the risk with the party most able to do something about it.

• Assume: Accept the consequences of the risk, with frequent monitoring to determine if the risk actually occurs, and that the impact is as predicted (and is tolerable) if it does. Also known as Accepting risk.

• Control: Develop a strategy to lower the risk by reducing its likelihood, consequence, or both components with tasks in the IMS. This approach refers to as Handle or Mitigate.

The SME provides a recommendation to mitigate the risk. The Risk Lead and RWG review and approve the handling plan and modify as necessary. All red and yellow risks have recommended mitigation steps regardless of the suggested handling plan. APPENDIX 6: RISK HANDLING ACTIVITY EXAMPLES provide examples of different risk mitigation activities.

3.4.3 Risk Mitigation Plan Requirements

The Risk Leads with SMEs shall develop detailed risk mitigation plans that:

• Reduce HIGH and MODERATE risks to LOW risks (objective).

• Reduce HIGH risks to MODERATE risks and MODERATE risks to LOW risks (threshold).

• There shall be one or more contingency plans identified in the event that the recommended mitigation plan fails to reduce the risk to the acceptable level at the required date.

UNCLASSIFIED / FOUO pg. 15

• Mitigation plans shall demonstrate a methodical process, and include measurable events and expected dates for reducing and/or controlling risk to acceptable levels. See APPENDIX 7:

RISK WATERFALL REPORT EXAMPLE for an example of a mitigation plan that illustrates how risks reduce with the execution of detailed steps.

3.5 Risk Monitoring

Risk Leads or Mitigation Plan Leads are responsible for managing progress of mitigation plans and for identifying any changes in the risk status. This includes completion of mitigation steps, changes in the risk likelihood or consequence expectations, and identification of risk consequences that have occurred or have become certain to occur (transitioned to an issue).

The Risk Leads or Mitigation Plan Leads track progress of mitigation plans by coordinating with APM/Risk Manager/PSEL, providing regular reports of mitigation progress relative to plan, and supporting assessment of mitigation effectiveness throughout the mitigation plan process and when plans are complete.

The intent of risk tracking is to ensure that the program reviews risks at regular intervals to determine if the risk is still applicable, or if risk ratings have changes due to successful risk mitigation efforts.

The program evaluates low risks at all design reviews to ensure the severity and/or probability has not increased to reclassify it as high or moderate.

The program evaluates closed risks every six months to ensure success of mitigation.

3.5.1 Risk Metrics

To assist with risk tracking and reporting, the program utilizes the following risk metrics:

• Risk Trend Chart o Monthly and yearly charts to illustrate risk trends

• Current Risks o Percentage of risks that are current and not overdue

• Current Mitigations o Percentage of mitigation plans/steps that are current and not overdue

3.5.2 Risk Status

Risk status undergo the approval workflow for Type I FOATC as described in Figure 4. The description of each workflow status is:

• In Candidate Level 1 RWG Status: Risk entered into system, not yet approved

• In Approval Level 2 RIPT Status: Risk and mitigation plan awaiting APM/PO approval

• In Approval Level 3 RRB Status: Risk and mitigation plan awaiting PdM/DPdM and RRB approval

• Baselined Status: Risk and mitigation plan has been reviewed and approved

• Closed Status – Became Issue: Risk has been realized and transfer to Issues Database

• Closed Status – Canceled: Risk is overcome by events; risk is no longer active

• Closed Status – Mitigated: Risk has been mitigated to a level accepted by the RRB

• Rejected: Risk is rejected and sent back for re-work

UNCLASSIFIED / FOUO pg. 16

• Watch: Risk is being monitored, but not actively mitigated

Figure 3 Risk Approval Workflow within Risk Recon

UNCLASSIFIED / FOUO pg. 17

3.6 Risk Review Board Process

A risk undergoes three levels of review prior to baselining the risk. Figure 5 shows risk review leveling.

3.6.1 Level 1 Risk Working Group Meeting

The purpose of the Risk Working Group meeting is to review initial program risks; including, but not limited to, risks from the Work Breakdown Structure (WBS), and the risks identified at major design reviews. These meetings accomplish:

• Risk leads fine-tune by conducting analysis/weighting and define risk mitigation plan/steps for candidate risks

• Conduct ongoing reviews of newly opened risks or changed risks

• Resolve conflicts and consolidate similar risks

• Review approved risks and determine if changes are necessary

• Review mitigation plans and confirm staffing resources for action plan

• Track progress of mitigation plans against baselined risks

• Review risks for closure recommendation

• Approve initial risks for next phase of the program

• Review all risks at least bi-weekly to identify any status changes

UNCLASSIFIED / FOUO pg. 18

Submit each risk needs to for review in Risk Recon prior to scheduled Level 2 Risk Integrated Product Team RIPT Review Meeting.

The attendees include Risk Leads, Team Members and SMEs.

3.6.2 Level 2 Risk Integrated Product Team (RIPT) Meeting

The APM/PSEL/RM/PO hold a RIPT meeting at least once a month prior to the Risk Review Board meeting. The purpose of this meeting is to review new risks and mitigation plans that are ready for approval, and to review risks that are ready for closure. The RIPT meetings accomplish:

• The APMs/PO/PSEL review/concur for risks to go before the RRB.

• Review for clarity

• Concur with risk weighting

• Concur with mitigation plans Each risk approved to go before the RRB requires submission through Risk Recon at the APM/PO Level. The RRB reviews any risk weighted 16 or higher.

The attendees include APM/Risk Manager, PSELs, Functional Leads, IPT Leads and Risk Leads

3.6.3 Level 3 Risk Review Board (RRB) Meetings

The PdM/DPdM hold a Risk Review Board Quarterly. The purpose of this meeting is to approve new risks, mitigation plans, and to review risks that are ready for closure. The RRB should be able to make decisions based on recommended paths forward and be able to allocate the resources required to work the mitigation plans.

The RRB meetings accomplish:

• Review risks elevated by the RIPT

• Review risk levels, risk trends, and projections

• Approve risk level change by mitigation steps

• Resolve conflicts

• Confirm closeout recommendations from RWG

• Review mitigation plans, fallback positions, and resource decisions for approval

• Confirm if risk has become issue with defined next steps; approve transfer to Issue Tracking

• Approve and baseline risks and their mitigation plans

The attendees includes PdM, DPdM, APM/RM/PSELs, Functional Leads, IPT Leads and Risk Leads

3.6.4 Technical Reviews

The Risk Manager/Project Officer coordinates reporting efforts for all Technical Reviews with the IPT leads and be responsible for submitting the required risk materials for the review. Additionally, the

UNCLASSIFIED / FOUO pg. 19

APM/Risk Manager and PO attends and support all Technical Reviews described in the following sections.

Program Status Review (PSR) Semi-Annual event that builds on bi-monthly metrics to take a more thorough look at the entire portfolio of each product office within PM FP. Cost, Schedule, Performance, & Risk remain the focus with additional discussion on personnel/manpower, LOG & Engineering updates, stakeholder review, accomplishment review of previous six months and forecast of major activities for the next six month period.

3.6.5 Bi-Monthly Metrics

Used by the PM to monitor cost, schedule, performance of all programs and maintain visibility on program risks & opportunities. Additionally, used as a forum to discuss and agree, between PMs and PdDs, on Program priorities.

Figure 6 provides a summary of the expectation for each meeting.

Figure 4 Risk Meetings and Plan Reviews

UNCLASSIFIED / FOUO pg. 20

3.7 Detailed Process Workflow for Risk Management

Figure 5 Detailed Process Workflow for Risk Management

UNCLASSIFIED / FOUO pg. 21

(Refer to Figure 7 for graphical illustration the steps below) Step 1: Risk Lead and Risk Working Group (RWG) Identify and Analyze Program Risk (LEVEL

1 CANDIDATE STATUS)

Inputs:

• New Risk, which contains title, Risk Lead, impacted functional groups, description of risk condition, original consequence, original likelihood, current consequence, current likelihood, risk impact areas (cost, schedule, performance), context, and consequence if realized

• Programmatic Contractor Risk, which contains title, Risk Lead, impacted functional groups, description of risk condition, original consequence, original likelihood, current consequence, current likelihood, risk impact areas (cost, schedule, performance), context, and consequence if realized

Outputs:

• Completed risk entry in Risk Recon approved by the Risk Manager (See APPENDIX 4: RISK

INFORMATION WORSHEET for details of the minimum required information necessary)

• Approved risk description, scoring, root cause, consequence and mitigation plan/steps:

o Proposed mitigation step SME o Rationale for mitigation step o Completed mitigation steps/handling plan entry in Risk Register o Proposed schedule for mitigation completion o Update IPT affected list, if necessary

• Submit risk in Risk Recon

• If Risk Ranking ≥ 16 – Move to Step 2.

• If Risk Ranking < 16 - Move to Step 4.

Contributors:

• Type I FOATC Members, SMEs, IPT Risk Leads.

Step 2: APM/PO and Risk Integrated Product Team (RIPT) Review (LEVEL 2 APPROVAL

STATUS)

Inputs:

• Completed risk entry in Risk Recon Outputs:

• Approved risk description, scoring, root cause, consequence and mitigation plan/steps o Determination of risks that need to be elevated for RRB review

If Risk Ranking ≥ 16 – Move on to Step 3

UNCLASSIFIED / FOUO pg. 22

• Confirmed assignment of Risk Lead to risk

• Confirmed affected IPT

• Confirmed Risk Type based on severity scoring for cost, schedule, and performance

• Confirmed root cause, consequence and mitigation plan/steps

• Confirm assignment of Risk Lead to mitigation

• Confirm rationale for mitigation

• Confirm schedule for mitigation completion

• Determine if mitigation needs to be tracked in IMS

If Risk Ranking < 16 – Move on to Step 4

• Confirmed assignment of Risk Lead to risk

• Confirmed affected IPT

• Confirmed Risk Type based on severity scoring for cost, schedule, and performance

• Confirmed root cause, consequence and mitigation plan/steps

• Confirm assignment of Risk Lead to mitigation

• Confirm rationale for mitigation

• Confirm schedule for mitigation completion

• Determine if mitigation needs to be tracked in IMS o Updated program metrics

• Risk, description, and scoring not approved – Move back to Step 1, advice Risk Lead and RWG to modify the risk information.

Contributors:

• APM/PO and Risk IPT

Step 3: PdM/DPdM and Risk Review Board Review (LEVEL 3 APPROVAL STATUS) Inputs:

• APM/PO/PSEL + RIPT approved risk description, scoring, root cause, consequence and mitigation plan/steps , and estimated resources o Risks that need elevation and priority are reviewed (Red and Yellow) All Red risks are reviewed in the meeting All Yellow risks are provided to the RRB in a read-ahead package; only Yellow risks designated by the RRB from the read-ahead are discussed in the meeting

UNCLASSIFIED / FOUO pg. 23

Outputs:

• Approved risk description, scoring, root cause, consequence and mitigation plan/steps

• Risk, description, and/or scoring not approved, advise Risk Lead and RWG to modify risk information o Go to Step 1

• PdM, DPdM, APM/PO/PSEL, IPT Leads, Risk Lead, IMS Lead

Step 4: Risk baselined and Mitigation Plan Approved

• Approved risk description, scoring, root cause, consequence and mitigation plan/steps

Outputs:

• Trigger to implement mitigation steps/handling plan in Risk Recon

• SMEs, IPT Risk Leads, Risk Manager

Step 5: Execute Mitigation Plan

• PdM/DPdM/ RRB approved mitigation steps/handling plan

• PdM/DPdM/RRB approved resources for mitigation

• Baselined risk and approved risk mitigation plan

• Updated Risk Register risk and mitigation register

• Authorization to start implementing risk mitigation plan and tracking the mitigation plan

Step 6: Track/Evaluate Risk and Adjust Mitigation

• Mitigation steps/handling plan status

• Risk status

• If changes to mitigation steps/handling plan are necessary o Repeat Step 1

• If no changes to mitigation steps/handling plan are necessary o Update mitigation steps/handling plan status o Return to Step 6 when mitigation steps/handling plan are executed

UNCLASSIFIED / FOUO pg. 24

• If a Green risk has elevated to a Yellow or Red risk o Repeat Step 1

• Updated individual risk metrics

Step 7: Close Risk or Identify Risk Realized (More detail in Section 3.8)

• Risk realized as an issue

• Successfully executed mitigation steps/handling plan

• Closure of risk in Risk Register o Transfer of risk to issue tracking system o Documentation of completed mitigation steps/handling plan

• Capture any residual risk that may exist

Contributors:

• SMEs, IPT Risk Leads, Risk Manager, RWG, PdM/DPdM and RRB (for transfer to Issue Tracking)

3.7.1 Contractor Risk Tracking Process

Government program management and functional area teams work with the contractor to identify possible programmatic risks that apply to the program as a whole. The government program management and functional area team members look for and analyze the contractor’s risks by attending contractor meetings and program reviews and by reviewing the CDRLs. The Risk Manager and Risk Leads conduct regularly scheduled reviews of all contractor risks; the Type I FOATC program candidate risks are managed in accordance with the Type I FOATC Risk Management Process outlined in this section.

The contractor submits a Contractor Risk Management Strategy, as a deliverable item. The risk manager updates Government Risk Management Plan with final approved contractor data.

3.8 Risk Closure

The PdM/DPdM directs risk closure for yellow and red risks through the RRB process. A risk item closes by meeting one of the following criteria:

a.) Mitigated Risk: The risk mitigation plan was successful by eliminating the consequence/likelihood or the risk score has reached its acceptable level.

b.) Risk is cancelled: Risk is cancelled for the following reasons:

• Other events eliminated the risk.

UNCLASSIFIED / FOUO pg. 25

• The risk is not required for administrative reasons o the risk is redundant with other risks o the risk is combined with other risks o The risk is invalidated/rejected by the RM and/or RRB

• The risk no longer applies to the program.

c.) Risk became an issue: The risk mitigation plan has been unsuccessful to the point of realization and the risk transfers to the issues register.

The Risk Lead or Risk Manager recommends risk level changes, which the RRB approves.

RWGs/RIPTs/RRBs consider high and moderate risks for level changes as mitigation plans progress and risk leads execute steps to reduce risk.

In order to close a risk, the Risk Lead must first get approval from the Risk Manager. The Risk Manager and Risk Lead should discuss the situation with the stakeholders. If the stakeholders agree, the risk closure is determined at the next Risk Review Board meeting. The RRB designee then closes the risk.

3.9 Risk Reporting

Risk and risk mitigation progress is summarized in reports. Various types of reports generate from Project Recon depending on the level of detail needed, the type of information desired, and the intended audience. This section defines the types of reports generated for the Type I FOATC, the frequency in which they generate, and the audience to whom the reports are distributed/presented.

Examples of reports generated are as follows:

Detailed Risk Report For bi-weekly IPT meetings, a “Detailed Risk Report” is available through Project Recon/Risk Recon that consists of all high and medium level risks. Some of the information this report contains is as follows: risk title and description, consequence if realized, current consequence and likelihood rating, status, risk lead, and potential mitigation plan summary. This report exports to Excel for modification if so desired. An example of this type of report depicts in APPENDIX 8: DETAILED RISK REPORT

EXAMPLE.

A “Detailed Risk Report” consists of the following:

• New risks that require baseline approval.

• Risks that require approval for closure.

• Risks in a baselined status that need mitigation plan approval.

Risk Matrix Report A Risk Matrix report is available through Project Recon/Risk Recon for monthly RRB meetings from to show a summary of all risks that are in a baselined status for Type I FOATC on a single risk matrix.

This allows the number of baselined risks and their distribution by level (high, moderate, and low) be viewed for the program. In addition, an option exists to compare historical data by entering in two dates and viewing the change in the number of Baselined risks from one date to another. An example of this type of report is depicted in APPENDIX 9: RISK MATRIX REPORT EXAMPLE.

UNCLASSIFIED / FOUO pg. 26

Top Five Risks Report APPENDIX 10: TOP 5 RISK REPORT EXAMPLE provides a sample of top five risks along with status of the risk mitigation plan and ranking. This report is useful during program status reviews with leadership.

3.10 Integration with Other Program Management Processes

The risk management process should be closely integrated with regular program and technical management processes so that it is executed as a by-product of regular cost, schedule, and performance management rather than as an after the fact procedure. This is important so that mitigation plans integrate into the program plan rather than after the fact. Risk management integration is included in the following processes:

3.10.1 Systems Engineering

Risk assessment and mitigation planning is conducted as a regular part of the systems engineering process. Systems engineering evaluations such as technical reviews and technology readiness assessments are the primary mechanism for identifying technical risk. Implementation of the risk management process focus on critical events and decisions to eliminate or minimize impact to the program. Each element of the Work Breakdown Structure (WBS) evaluates as a source for risk.

3.10.2 Technical Performance Measures (TPM)

The TPMs compare estimated values of essential technical performance parameters with achieved values, and…