FY 2024 Risk Assessment and Security Plan Template (1).docx

RISK ASSESSMENT AND SECURITY PLAN TEMPLATE

Note: Instructions, suggested format examples, helpful links, and table examples should be deleted from your submission.

Risk Assessment Instructions The purpose of the risk assessment is to identify the internal and external risks associated with the proposed program in the application, assess the likelihood of the risks, assess the potential impact of the risks on the program, and identify actions that could help mitigate the risks. PRM partners should not consider a risk assessment a one-time exercise or a static document. PRM expects partners to conduct risk analysis and remediation throughout the life of a program, as well as revise risk-related analysis and processes, and promptly share updates with PRM. The safety and security of recipients and program participants are of utmost importance. The risk assessment should describe risk mitigation strategies (including for any sub-recipients) to include conflict of interest policy, whistleblower procedures, ethics training, cyber/digital security, and data protection procedures, including how organizations protect program participants’ personal data broadly and in the given local context, banking protocols, procurement and logistics policies, human resources policies including Sexual Exploitation and Abuse and context-specific strategies to mitigate against host/de facto government or local authority interference in pre- or post-distribution of assistance. Additional analysis is required if programs operate in locations where U.S. designated terrorists or sanctioned actors, live, operate, or control territory (see “Analysis for Environments with Sanctions or Terrorist Actors” below).

Suggested Risk Assessment Format The risk assessment should address the risk for fraud, waste, and abuse associated with the proposed program including, but not limited to the categories in the table below. Under “Description of Risk,” the risk analysis must explain each risk and rate the “Likelihood of Risk” and “Potential Impact of Risk” as “High,” “Medium,” or “Low.” Partners should include a risk mitigation plan/action for every risk described.

Table: Suggested Risk Assessment Format

of Risk Potential Impact of Risk Risk Mitigation Plans/Actions

Analysis for Environments with Sanctioned or Terrorist Actors PRM recognizes that some programs provide support in locations where groups or individuals designated as terrorists under the U.S. Material Support statutes and/or sanctioned under programs administered by the U.S. Department of Treasury Office of Foreign Assets Control (OFAC) live or operate. Applicants should provide additional information regarding safeguards and risk mitigation strategies where these conditions exist.

The annex should include details on the applicable prevention measures including:

An analysis of the operating environment in the geographic area(s) in which the organization proposes to work, including identification of sanctioned groups and individuals that have a presence in or control territory and how those groups and individuals operate vis-à-vis humanitarian partners and programming.

The controls and systems the organization has in place to ensure that procurement and hiring do not benefit sanctioned groups and individuals, or Designated Terrorist Organizations (DTOs). This should include searches of public databases, such as SAM.gov, the Department of the Treasury’s Office of Foreign Assets Control’s (OFAC) Specially Designated National List, UN Security Council Sanctions List, the Department of State’s Designated Foreign Terrorist Organizations (FTO) list and commercial screening software. Please also describe internal processes used to screen staff and vendors.

Information on applicable sanctions programs (e.g., Afghanistan-Related Sanctions, Syria, Counter Terrorism Sanctions) in your targeted geographic areas, and the potential effects these may pose to programming.

An explanation of the safeguards the applicant intends to put in place to prevent interference or influence by, transactions with, or provision of benefits to groups and individuals sanctioned by the USG or designated as terrorists during all phases of program implementation. The applicant should clearly articulate triggers for action and specify organizational processes for decision-making.

How the applicant will prevent direct or indirect benefits to sanctioned groups and individuals through commercial activities that result in the payment of taxes, fees, tolls, etc., to a sanctioned group or individual.

If the host government is a sanctioned actor, description of applicant’s plans to avoid or limit to the greatest extent possible incidental provision of salaries, stipends, per diem, import/export or other taxes or tolls, security escort fees, other fees, or provide incentive payments to, or purchase in-kind goods or services from, the host government (including ministries, local affiliates, government security actors, or de facto government authorities).

Risk mitigation plans for moving equipment or supplies into proposed areas, including whether a sanctioned group or DTO could potentially benefit from fees or taxes paid during any stage of program implementation or could seek to divert equipment or supplies.

Measures to mitigate the risk that a sanctioned group or terrorist would receive reputational benefit from the proposed program, such as a sanctioned group claiming credit for the assistance or services provided.

How participant and recipient targeting, and registration ensures that program participants are not sanctioned group members or affiliates, or designated terrorist organizations.

How the applicant will verify that assistance reaches the intended participants and is not diverted following distribution or service.

Any additional internal controls and oversight mechanisms the applicant will put in place.

Security Plan Instructions In FY 2024, to minimize the number of attachments submitted, PRM requests that applicants also provide their security plan together with the risk assessment.

Applicants are required to submit a location-specific safety and security plan for proposed operational areas. This requirement applies to new applications and funded modifications in which you propose additional operational areas. The plan must cover all personnel and operations, including all partners and sub-recipients with substantive programmatic contributions. You must also directly address the unique threats and vulnerabilities faced by national staff in your plan.

One of PRM’s primary programming concerns is ensuring its partners take all reasonable precautions to minimize risks to all staff and operations. While no one can eliminate all risks, PRM expects your organization to be adequately prepared to work in any environment for which you submit an application. You must incorporate operational security management systems, appropriate to your organization and operational area(s), into all activities.

Geographic units for contextual, threat, and vulnerability analyses may be as specific as a village, town, city, or neighborhood where you will implement activity interventions. Submitting global security handbooks or policy documents does not satisfy PRM requirements.

There is not a set format for the security plan, but it must include and clearly address the following for each location where you propose activities:

1. Contextual analysis

2. Threat analysis

3. Vulnerability analysis (relating to personnel and operations)

4. Contingency planning for relevant emergency situations such as:

· Abductions or illegal detention

· Evacuation

· Emergency medical care

· Psycho-social support for staff impacted by serious crimes or personal violence.

· Sexual assault

· Armed attack

· Reporting and prosecution options

5. Risk mitigation measures to reduce identified vulnerabilities, which must address the threats in your analysis of proposed activity areas.

Definitions of these technical terms can be found in the Overseas Development Institute Humanitarian Practice Network’s Good Practice Review 8, Operational Security Management in Violent Environments, December 2010.

If the safety and security plan is in a language other than English, you must submit an accompanying summary of the plan in English that demonstrates it meets the above criteria.

PRM will not explicitly or implicitly evaluate the merit of any safety and security plan(s) submitted but will ensure the submitted documents meet the requirements described above.

PRM strongly recommends that organizations be aware of any relevant travel advisories issued by the State Department; ensure that all U.S. citizen employees register at the relevant U.S. embassy while working overseas; adhere to the UN’s security guidelines in any given location; and use InterAction’s suggested guidance for implementing the Minimum Operating Security Standards (MOSS). Security requirements should be included in the proposed budget. Failure to maintain adequate security precautions may result in suspension of PRM funding.

Helpful Links General Services Administration’s System for Award Management (SAM) U.S. Department of the Treasury OFAC Resources UN Security Council Sanctions List U.S. Department of State Foreign Terrorist Organizations (FTO) Designations