INITIAL PROJECT RISK ASSESSMENT WORKBOOK

VERSION:

1.0

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

REVISION HISTORY
REVISION NUMBER 1.0 2.0 2.1 2.2 DATE August 15, 2007 COMMENT DoIT Project Management Office Revision

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

Table o Co!"e!"#
REVISION HISTORY................................................................................................................................... 2 RATIONALE -PROJECT RISK ASSESSMENT REPORT PROJECT INCEPTION.................................4 RISK EVALUATION FOR THIS PROJECT................................................................................................ 7 INITIAL RISKS IDENTIFIED IN PROJECT CHARTER AND/OR PROJECT MANAGEMENT PLAN......18 ATTACHED PROJECT RISK LOG AFTER INITIAL ASSESSMENT....................................................1 RISK CALCULATION E!AMPLE............................................................................................................. 2" APPENDI! A# A FRAME$ORK FOR PROJECT RISK MANAGEMENT PLAN.....................................21

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

RATIONALE $PROJECT RISK ASSESSMENT REPORT % PROJECT INCEPTION

Ris)* +An uncertain event or con,ition t-at, if it occurs, -as a .ositive or negative effect on a .roject/s o0jectives. PM'O$1*

DEPARTMENT O& IN&ORMATION TECHNOLO'Y RE(UIREMENT

+Pre.are a 2ritten ris) assessment re.ort at t-e ince.tion of a .roject an, at t-e en, of eac.ro,uct ,eve3o.ment 3ifec4c3e .-ase or more fre5uent34 for 3arge an, -ig-6ris) .rojects. !acris) assessment s-a33 0e inc3u,e, as a .roject activit4 in t-e .roject sc-e,u3e. )PROJECT OVERSI'HT PROCESS *e*o+a!,-*

WHY AN INITIAL PROJECT RISK ASSESSMENT WHEN WE HAVE JUST STARTED.

T-e 0est time for ,oing ris) assessment is at t-e ince.tion of a .roject. T-in)ing a0out t-e ris)s of 4our .roject s-ou3, 0e -e3.fu3 in .3anning -o2 t-e .roject can avoi,, or 3essen t-e ris)s. T-is 2or)0oo) an, t-e Initia3 Project Ris) Assessment Tem.3ate is structure, to -e3. 4ou ,iscover 2-at mig-t im.act t-e success of t-e .roject. $ee. in min, t-at t-e constraints t-at 4our .roject 2i33 -ave to ,ea3 2it-, t-e 0asic assum.tions t-at 4ou 2i33 0e 2or)ing un,er ,uring t-e .roject are a33 ris) factors. Ris) management runs t-e entire 3ife c4c3e of t-e .roject.

WHAT I& WE CAN NOT ANSWER YES TO ALL THE (UESTIONS/ OR NO TO WHERE APPROPRIATE.
It is 5uite 3egitimate an, acce.ta03e to state t-at 4our .roject -as not 4et covere, t-e to.ic, or ,ea3t 2it- it sufficient34. T-ere is no target score for t-is assessment. T-e .ur.ose of t-e ,ocument is to ,eve3o. a2areness in t-e steering committee, .roject team an, 2it-in t-e DoIT Project Oversig-t an, "om.3iance team of 2-at t-e .roject nee,s to co.e 2it- as it .rogresses t-roug- its 3ife c4c3e. P3ease use t-e +I& No % P+o01,e a! E23la!a"1o!4 o+ )I Ye#/ 3+o01,e a! e23la!a"1o! 7 0o8 to .rovi,e information as to -o2 an, 2-en t-e .articu3ar item 2i33 0e ,ea3t 2it-.

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

RISK ASSESSMENT AND THE IV5V PROCESS

T-is Initia3 Project Ris) Assessment s-ou3, 0e use, as in.ut into t-e I:;: :en,or Ris) assessment .rocess an, ,ocument. A res.onsi03e .roject 2i33 uti3i<e t-e In,e.en,ent :erification an, .:a3i,ation Process to target t-ose areas of greatest ris) to t-e .roject. Reference to t-e I:;: target areas 2i33 0e ma,e as t-e e8.3anations are given for eac- of t-e items in t-is ris) assessment 5uestionnaire.

RISK ASSESSMENT AND RISK MANA'EMENT

Ris) Management is a critica3 .art of Project management an, is ,ea3t 2it- in t-e Project Management P3an ,ocumentation. Project Issues s-ou3, 0e i,entifie, an, trac)e, 04 t-e .roject manager 2it- t-e DoIT Ris) an, Issue =og tem.3ate. > > > > Project Management is Ris) Mitigation. It is a0out -o2 2e create an, manage a "e*3o+a+6 organi<ation to ,e3iver t-e uni5ue .ro,uct, service or resu3t? Project Management 04 .rovi,ing structure to t-e tem.orar4 organi<ation an, t-e so3ution ,eve3o.ment@,e.3o4ment .rocess re,uces t-e ris) of counter.ro,uctive c-aos. '4 communicating Ris)s 2it- sta)e-o3,ers 2e )ee. t-em in t-e 3oo., an, often invo3ve t-em in ris) mitigation or 3essening its im.act '4 ac)no23e,ging t-at t-ere is ris), 2e can structure 2a4s of avoi,ing or effective34 ,ea3ing 2it- s.ecific ris).

E0e+6 P+o7e8" 9a# +1#:#. P+o7e8"# a+e !o" 7-,;e, o! "9e !-*be+ o +1#:#/ b-" +a"9e+ o! 9o< "9e6 1,e!"1 6 a!, *a!a;e "9e#e +1#:#.
THE RISK % ISSUE % CHAN'E MANA'EMENT TRIAN'LE
PM'O$1* Ris)* +An uncertain event or con,ition t-at, if it occurs, -as a .ositive or negative effect on a .roject/s o0jectives.7 Issue* +A .oint or matter in 5uestion or ,is.ute, or a .oint or matter t-at is not sett3e, an, is un,er ,iscussion or over 2-ic- t-ere are o..osing vie2s or ,isagreements.7 Both Risks and Issues can significant impact a projects success, and both should be handled in similar ways.

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

"-ange Management is a Ris) an, Issue Management #trateg4. 'ot- Ris) an, Issue management .rocesses ma4 invo3ve ma)ing c-anges to t-e .roject. "-ange management re,uces .roject ris) 04 .rovi,ing 0ot- au,it trac)ing an, a..ro.riate ,ocumentation.

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

RISK EVALUATION &OR THIS PROJECT

T-e initia3 ris) assessment is focuse, on five )e4 areas, Im.act, Project Organi<ation, Re5uirements, Tec-nica3 Ris)s an, P3anning Ris)s. T-ese areas an, t-eir 5uestions e8.3ore t-e )in,s of .itfa33s t-at ot-er .rojects -ave face,, some successfu334 ot-ers not. In man4 cases t-e 0iggest .roject ris) is not ,oing t-e .roject, 0ut t-at is no e8cuse for s3o..iness. RELATED DOCUMENTATION &OR RISK (UESTIONS* Project Document A00reviation Oversig-t "ertification Re5uest "-arter PMP I:;: Project Document IT Project Oversig-t Process Memoran,um IT Project "ertification Process Memoran,um Re5uest for "ertification an, Re3ease of Bun,s Project "-arter for "ertification Project Management P3an !8-i0it A #co.e of &or) I:;: CIT "ontract Tem.3ate, I:;: "ontract Tem.3ateD

IMPACT RISK
T-ese 5uestions ,ea3 2it- -o2 even a .roject t-at is successfu3 interna334 mig-t im.act or 0e im.acte, negative34 04 ot-er factors. R1#: Eas t-e .roject 3ea,ers-i. rea, an, .3anne, for com.3iance 2itt-e DoIT Project Oversig-t Memoran,um an, Project "ertification Memoran,umF Eave a33 t-e cost E23la!a"1o! "om.3iance 2it- 0otis re5uire,G non6 com.3iance can im.act certification an, continuation of t-e .roject. Rela"e, Do8-*e!"a"1o! 9""3:==<<<.,o1".#"a"e.!*.-#=3+o7e8".9"*l>Ce+"1 18a"1o!

"ost im.act of a

"-arter #ection 5.0G PMP 5.(G A.9G Re5uest*

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

im.acts to t-e agenc4@state 0een ,ocumente,

.roject is not 3imite, to 'u,getG I:;: 'usiness Process Reengineering t-e cost of t-e PM612 to PM619 -ar,2are, soft2are or e8terna3 ven,or@contractor fees. T-e costs of interna3 staff .roject team mem0ers 2i33 nee, to 0e accounte, for, as 2e33 as an4 interna3 .roject management .artici.ation as 2e33. #taff training costs are not on34 t-e ven,or costs for ,e3iver4 of t-e training, 0ut t-e costs of -aving staff a2a4 from t-eir norma3 ,uties as 2e33. Transition to o.erations is a .3anning item t-at must 0e accounte, for 2it-in t-e .roject. Among t-e areas to 0e t-oug-t a0out is t-e staffing re5uire, to su..ort t-e so3ution, t-e 3ocation of t-e a..3ication@server, -o2 it 2i33 0e su..orte,. &i33 t-ere 0e a nee, for trainingF Bor a,,itiona3 staffingF &-at is t-e interaction@intero.era0i 3it4 2it- ot-er agenc4 a..3ications 0e manage, H 2-at a0out 0usiness continuit4 an, recover4F Re5uest* Maintenance #trateg4, Intero.era0i3it4G "-arter 2.9 Im.act on Organi<ationG 2.5 Transitions to O.erations. I:;: O.erations Oversig-t sectionG Training, es.ecia334 )no23e,ge transfer for maintenance an, o.erations of t-e ne2 s4stem.

Eas t-e im.act to ,ai34 o.erations 0een ,ocumente,

Eave t-e im.acts !ven 2-en t-e .ur.ose

"-arter 2.9 Im.act on Organi<ationG I:;:

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

to e8isting .rocesses 0een ,ocumente,

of a .roject is to im.rove an, stream 3ine e8isting .rocesses, t-e .roject must .3an for t-e transitions to t-ose 0etter .rocesses. Eo2 2i33 en, users 0e traine, to un,erstan, an, .3an for t-ese transitionsF !ven 2-en t-e .roject/s sc-e,u3e is 0ase, on t-e necessit4 to meet a target ,ate 0ecause of e8terna3 ,ate re5uirements, a .roject must .3an for contingencies. Pre6 e8isting sc-e,u3es mig-t a3so im.act t-e ,e.3o4ment of t-e so3ution. T-e 0enefits of a .roject must not on34 0e use, in t-e se33ing of t-e .roject for fun,ing, for certification, an, for en, users, 0ut must 0e ma,e as e8.3icit as .ossi03e to uneartassum.tions, an, or furt-er re5uirements t-at 2i33 s.e33 out success. T-is e8.3icit .rocess mig-t a3so uneart- items t-at are out of sco.e for t-e .roject. Interna3 agenc4 staff time is usua334 not

'usiness Process Reengineering PM612 to PM619

Eave t-e sc-e,u3e im.acts to state or agenc4 activities 0een i,entifie,F

T-is 2ou3, 0e covere, in ,e.3o4ment .3anning.

Eave t-e 0enefits of t-e .roject 0een fu334 i,entifie,F

"-arter an, PMP* Project 'ac)groun,G 'usiness an, Tec-nica3 o0jectives

&i33 t-e .roject re5uire fun,ing

"-arter #ection 5.0G PMP 5.(G A.9G Re5uest* 'u,get

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

0e4on, t-at origina334 a33ocate, to t-e .rojectF

t-roug- a0out as re5uire, fun,ing 0e4on, t-at origina334 a33ocate, to t-e .roject, 0ut agenc4 management 2i33 nee, to .3an aroun, t-is a,,itiona3 use of staff time. Interna3 o.erationa3 fun,s mig-t 0e use, to su..3ement a33ocations, or t-ere ma4 0e a,,itiona3 ne8t 4ear fun,ing re5uire,. Project sc-e,u3e .3anning nee,s to 0e rea3istic an, 2it-in e8terna3 .rocesses t-at im.act t-e .roject. !ac- of t-ese e8terna3 .rocesses ma4 -ave its o2n ca3en,ar of meetings, ,ea,3ines an, revie2 .roce,ures t-at must 0e met an, 2-ic- cou3, im.act t-e .roject/s time 3ine. "-arter 9.0G "ertificationG PMP* 5.2 #c-e,u3e A33ocationG A.J Procurement P3anG I:;: Procurement CPO61 to PO65DG I:;: #tate Oversig-t PM6(I to PM690

Eas t-e .roject inc3u,e, t-e #tate .rocurement Processes an, time frames as 2e33 as t-e Project certification@re3e ase of fun,s .rocess in its sc-e,u3e .3anningF

PROJECT OR'ANI?ATION RISKS

10

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK Project Management 04 .rovi,ing structure to t-e tem.orar4 organi<ation an, t-e so3ution ,eve3o.ment@,e.3o4ment .rocess re,uces t-e ris) of counter.ro,uctive c-aos. T-e fo33o2ing 5uestions re3ate to -o2 t-e .roject itse3f is organi<e, to ,e3iver t-e so3ution. R1#: Eas sufficient fun,ing 0een a..rove, for t-e .roject E23la!a"1o! &-i3e t-e .roject mig-t -ave sufficient fun,s for t-e ac5uisition of re5uire, Ear,2are, soft2are or "OT# so3ution, ,oes it -ave sufficient fun,ing for an4 a,,itiona3 s.ecia3i<e, tas)sF Are a33 re5uire, staffing areas covere, 04 eit-er .roject or o.erationa3 fun,ingF Eave a33 re5uire, staffing .ositions 0een i,entifie,F Initia334 a .roject mig-t not -ave a 5ua3ifie, .roject manager 0ecause t-e .roject nee,s to -ave its .3anning fun,s re3ease, t-roug- certification .rocess. A va3i, res.onse 2ou3, 0e t-at a .roject manager -as 0een 3ine, u. .en,ing t-at certification? &-et-er interna3 or contractua3, it is vita3 to t-e .roject success t-at t-e .roject manager -as t-e time to manage t-e .roject. T-e Project s.onsor an, 0usiness o2ner team 2i33 nee, to ,etermine 2-at +sufficient time7 means for t-e .roject. Rela"e, Do8-*e!"a"1o! "-arter #ection 5.0G PMP 1.2G 5.(G A.9G Re5uest* 'u,getG I:;: Project !stimating an, #c-e,u3ing PM625 to PM627 Oversig-tG "-arter A.(

Eas a 5ua3ifie, .roject manager 0een assigne, to t-e .roject

Does t-e 5ua3ifie, .roject manager -ave sufficient time to manage t-e .rojectF

PMP* 5.0

Eas t-e .roject i,entifie, A33 re3evant sta)e-o3,ersF

To avoi, sur.rises, sta)e -o3,ers nee, to 0e "-arter A.1G PMP 2.1G invo3ve, some2a4 from t-e outset of t-e I:;: Project .roject. #.onsors-i. PM61 to T-e PM'O$1 of t-e Project Management PM62 Institute ,efines .roject sta)e-o3,ers* Project sta)e-o3,ers are in,ivi,ua3s an, organi<ations t-at are active34 invo3ve, in t-e .roject, or 2-ose interests ma4 0e affecte, as a resu3t of .roject e8ecution or .roject com.3etion. T-e4 a3so e8ert

11

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

inf3uence over t-e .roject/s o0jectives an, outcomes. T-is a33 encom.assing ,efinition 2ou3, -ave us t-in) a0out suc- sta)e-o3,ers as* "a0inet #ecretaries Agenc4 Division ,irectors "IO6IT =ea,s Project Manager IT o.erations staff 'usiness .rocess o2ners #4stem user re.resentatives $e4 .roject team mem0ers Training staff

In #-ort an4one 2-o ma)e 0e at a33 im.acte,. Is t-e sco.e of t-e .roject 2it-in t-e agenc4 mission Are t-ere 0usiness o2ners assigne, to t-e .roject 2-o -ave t-e time an, un,erstan, res.onsi0i3ities for t-e .rojectF Eas a .roject steering committee 0een esta03is-e, 2it-in a .roject governance .3anF T-is goes to t-e -eart of 2-4 t-e agenc4 is "-arter 2.1 ,oing t-e .roject, s.en,ing #tate resources. #-ou3, t-is .roject 0e mu3ti6agenc4 or ,one 04 t-e DoIT organi<ationF If a 0usiness o2ner ,oes not -ave t-e time to meet 2it- t-e .roject manger an, sta4 a0reast of t-e .roject, ,e3a4s cou3, ,eve3o. an, a3so t-e 0usiness o2ner cou3, 0e in an em0arrassing .osition of not )no2ing 2-at is going on. A )e4 e3ement of t-e .roject, t-e steering committee sets t-e sco.e of t-e .roject an, t-e aut-orit4 of t-e .roject manager. T-e .roject 2i33 suffer if t-ere is not an imme,iate ans2er to +2-o gave 4ou t-e aut-orit47 to ,o? "-arterG PMP c-oice of 0usiness o2ners an, "-arter 2.2 Kovernance #tructureG PMP A.2 Kovernance P3an "-arter* 2.2.2G PMP* A.2

Is t-ere a,e5uate agenc4 P3anning for a .roject t-at invo3ves agenc4 staffing resources ma,e staffing resources means coor,inating sucavai3a03e for t-e .rojectF resources 2it- agenc4 management. T-ere

"-arter A.9G PMP 5.9G 5.5G I:;: Project !stimating an,

12

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

a3so ma4 0e a nee, for a s.ecia3 s)i33 set #c-e,u3ing PM625 to not norma334 avai3a03e 2it-in t-e agenc4 PM627 an, nee,ing to 0e secure, from outsi,e, i.e. from anot-er agenc4 or a ven,or, or 04 -iring. Is t-ere a +c-ange management7 .rocess esta03is-e,F A forma3 c-ange management .rocess fi33s t-e ga. 2-en sco.e, time, 0u,get areas nee, to 0e a,juste,. It .rovi,es t-e trai3 so t-ere can 0e an ans2er to7 &-en ,i, t-is ,ecision get ma,eF +&-at -a..ene, to suc- an, suc- a featureF PMP A.(.1 G I:;: "-ange Management PM61A

RE(UIREMENT RISKS
Re5uirements justif4 an, ,rive t-e .roject. Re5uirements a3so .rovi,e measura03e means of ,efining an, eva3uating .roject success. &-i3e some2-at covere, in .roject sco.e an, .ro,uct ,e3ivera03es as 2e33 as c-ange management, re5uirements s-ou3, 0e ,eve3o.e, as a series of .ro,uct ,eve3o.ment ste.s H 'usiness6 #4stem H Design H O.erations an, De.3o4ment6 eac-aving its s.ecific ,ocumentation. T-e 3ast 5uestion in t-is section is es.ecia334 critica3 to .roject an, .ro,uct acce.tance success. T-ere is a 2-o3e section 2it-in I:;: ,e,icate, to re5uirements* 2.A Re5uirements Management. !ac- Item RM61 t-roug- RM61J a,,resses .roject an, .ro,uct ris)s. R1#: Eas t-e .roject team ,ocumente, t-e initia3 0usiness re5uirements for t-e .roject 0e4on, t-e 0usiness o0jectives 3iste, in t-e .roject c-arterF E23la!a"1o! 'usiness re5uirements sim.34 state, are a -ig- 3eve3 ,escri.tion of 2-at t-e s4stem must ,o. 'usiness Re5uirements are 3iste, as major features t-at are nee,e, to satisf4 t-e state, goa3s, o0jectives, an, strategies for t-e .roject. T-e 'usiness Re5uirements .rovi,e t-e gui,ing ,irection for t-e .roject, an, 0ecome t-e foun,ation for t-e Lser Re5uirements Rela"e, Do8-*e!"a"1o! "-arter 2.2 an, 2.( 'usiness an, Tec-nica3 O0jectives.

1(

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

Eave t-e sta)e-o3,ers a..rove, a33 ,ocumente, 0usiness re5uirementsF

'u46in from a33 sta)e-o3,ers is vita3 to t-e success of t-e .roject. A )e4 .roject tas) is to ana34<e re5uirements to 0a3ance sta)e-o3,er nee,s an, constraints. &it-out measura03e o0jectives an, re5uirements success is su0jective 2it-uge .otentia3 for conf3icting vie2s of sta)e-o3,ers, .roject teams an, ven,ors.

Re5uirements sign off ,ocumentation

Are ,ocumente, re5uirements ,efine, in measura03e termsF

#tarting 2it- "-arter 2.262.(, PMP (.1 an, Pro,uct re5uirements ,ocumentation

Are re5uirements .rioriti<e, H i.e. essentia3, con,itiona3, or o.tiona3F

'4 .rioriti<ing re5uirements Pro,uct re5uirements from t-e start, t-ere is a 0asis ,ocumentation for ,ecision ma)ing 2-en con,itiona3 or o.tiona3 re5uirements .rove cost34 eit-er in time, ,o33ars or so3ution com.3e8it4. Anot-er 2a4 of as)ing t-is is 2-et-er t-e 0usiness re5uirements are in63ine 2itagenc4 financia3 resources, e8isting staffing etc. Pro,uct DocumentationG "-arter 5.0 'u,get estimateG I:;: Project !stimating an, #c-e,u3ing PM625 to PM627

Eas an initia3 im.act ana34sis 0een .erforme, on t-e 0usiness re5uirements H i.e., cost, o.erations, su..ort Is t-ere a 2e33 ,efine, an, institutiona3i<e, c-ange contro3 .rocess for re5uirementsF

A forma3 c-ange PMP A.(.1 management .rocess fi33s t-e ga. 2-en sco.e, time, 0u,get areas nee, to 0e a,juste,. It .rovi,es t-e trai3 so t-ere can 0e an ans2er to7 &-en ,i, t-is ,ecision get ma,eF +&-at -a..ene, to suc- an, suc- a featureF T-is -o3istic a..roac- to re5uirements is meant to 0e .rotective of t-e state/s investment in t-e .roject. I:;: RM 9

Eas t-e .roject esta03is-e, t-e a0i3it4 to verif4 t-at 0usiness re5uirements can 0e trace, t-roug- tec-nica3 ,esign, s4stem 0ui3,ing or soft2are co,ing@ configuration an, test .-ases to

19

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

verif4 t-at t-e s4stem .erforms as inten,e, an, contains no unnecessar4 e3ementsF

TECHNICAL RISKS
T-is set of 5uestions re3ate to t-e un,er34ing tec-no3og4 for t-e .roject an, covers as.ects t-at s-ou3, 0e s.e33e, out in t-e PMP Tec-nica3 #trateg4 #ection. T-e 'usiness "ontinuit4 5uestion is a3so covere, e3se2-ere. T-e I:;: !8-i0it A contains a ,etai3e, tec-nica3 ris) section 2.7 O.erating !nvironmentG Ot-er sections are 2ort- revie2ing 2it- soft2are ,eve3o.ment or even customi<ation .rojects* 2.I Deve3o.ment !nvironmentG 2.J #oft2are Deve3o.mentG 2.10 #4stem Acce.tance TestingG 2.11 Data Management. R1#: Is t-e .roject .3anning to use an e8isting tec-no3og4F Is t-e .roject .3anning to im.3ement a "OT# C"ommercia3 Off t-e #-e3f7D so3utionF E23la!a"1o! T-ere is 3ess ris) to 2or) 2it- )no2n tec-no3og4 T-e 0ui3, or 0u4 5uestion is a significant one for .rojects. &it- s.ecia3i<e, agenc4 0usiness re5uirements a 2e33 esta03is-e, "OT# .ac)age use, 04 ot-er state or government agencies cou3, 3essen t-e ris) of t-e .roject. "ustomi<ation of a ven,or/s "OT# .ac)age great34 a,,s to t-e com.3e8it4 an, ris) of a .roject. !m0ar)ing on a .roject 2-en an agenc4/s staff is not e8.erience, in t-e tec-no3og4 .rovi,es ris). "ritica3 s4stems s-ou3, -ave t-ree environments, a ,eve3o.ment environment, a test environment an, a Rela"e, Do8-*e!"a"1o! PMP* 9.2.1 Tec-nica3 #trateg4 PMP* 9.2.1 Tec-nica3 #trateg4

If "OT# so3ution is antici.ate, 2i33 it re5uire significant customi<ation, ot-er t-an 0ui3t in set6u.@start u. configurations Does t-e agenc4 or #tate CDoITD -ave e8.erience 2it- t-e un,er34ing tec-no3og4 or -ar,2are@o.erating s4stem environmentF Is a test environment .art of t-e .roject or is t-ere an e8isting test environment t-at mirrors t-e .ro,uction environmentF

PMP* 9.2.1 Tec-nica3 #trateg4

PMP* 9.2.1 Tec-nica3 #trateg4

PMP* 9.2.1 Tec-nica3 #trateg4

15

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

.ro,uction environment. Lnteste, c-anges s-ou3, never 0e a..3ie, to a .ro,uction environment. Is t-ere at 3east a tentative .3an for 'usiness "ontinuit4F Once esta03is-e, a so3ution s-ou3, -ave a 0ac)6u. an, 0usiness continuit4 .3an, an, t-is .3anning s-ou3, start from ,a4 one of t-e .roject. Re5uest* #ecurit4 #trateg4C#ummari<e P3an for #ecurit4, 'ac)u. an, Disaster Recover4DG "-arter* 2.5 Transition to O.erations

PLANNIN' RISKS
Res.onsi03e .roject .3anning inc3u,es 0ui3,ing ris) management in t-e .rocess an, a3so inc3u,es an estimation .rocess, contingenc4 .3anning, .ro,uct .3anning met-o,o3og4, an, a,e5uate i,entification of assum.tions, constraints, ,e.en,encies an, ot-er suc- ris) factors. R1#: Does t-e .3an inc3u,e t-e a..ro.riate time an, cost contingenc4F Does t-e .3an inc3u,e t-e a..ro.riate time an, cost estimatesF E23la!a"1o! T-e 3ac) of sc-e,u3e f3e8i0i3it4 or contingenc4 fun,s can a,, ris) to t-e .roject. A 2e33 ,efine, 2or) 0rea),o2n sc-e,u3e faci3itates estimation of time an, costs of a .roject. T-e .roject t-at 2or)s 0ac)2ar, from a 0u,get or a..ro.riation is at some ris). Rela"e, Do8-*e!"a"1o! "-arter* 9.0G 5.0G PMP 5.1, 5.2, 5.(G I:;: Project !stimating an, #c-e,u3ing PM625 to PM627 "-arter* 9.0G 5.0G PMP 5.1, 5.2, 5.(G I:;: Project !stimating an, #c-e,u3ing PM625 to PM627

Eas a .ro,uct .3anning met-o,o3og4 0een c-osen a..ro.riate for t-e com.3e8it4 of t-e so3ution an, t-e )no23e,ge of t-e .roject teamF

Re5uire,* +During t-e PMP* 9.2 .roject management 3ifec4c3e, agencies s-a33 se3ect an, im.3ement a .-ase .ro,uct ,eve3o.ment 3ifec4c3e met-o,o3og4 a..rove, 04 t-e De.artment.7 PRO !"T O:!R#IKET PRO"!## Memoran,um

1A

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

Eas t-e .roject a,e5uate34 i,entifie, t-e constraints an, assum.tions of t-e .rojectF

"onstraints an, Assum.tions "-arter 7.0GJ.0 PMP 1.(G 1.5 are ris) factors. T-e more t-ese are ma,e e8.3icit t-e more t-e .roject is a03e to ,ea3 2it- an, aroun, t-em. T-is is an on6going .rocess, 0ut es.ecia334 critica3 at t-e outset of t-e .roject. T-is ,ocument is .art of t-at .rocess. Re5uest* #ignificant Ris)s an, Migration #trateg4G "-arter 10.0G PMP 1.A an, #ection A.1

Eas t-e .roject a,e5uate34 i,entifie, t-e .roject ris)s, 2it.ro0a0i3it4, im.act, mitigation an, or contingenciesF Are t-ere significant ,e.en,encies on ot-er .rojects or staff resourcesF

De.en,encies can im.act "-arter I.0G PMP 1.9 sc-e,u3e an, cost of .rojects, an, nee, to 0e s.e33e, out from t-e outset. T-ese are es.ecia334 im.ortant to raise 2it- #.onsors, 'usiness O2ners an, #teering "ommittees

17

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

INITIAL RISKS IDENTI&IED IN PROJECT CHARTER AND=OR PROJECT MANA'EMENT PLAN

INSTRUCTIONS &OR COMPLETIN' THE RISK IDENTI&ICATION TABLE
R1#: Na*e H s-ou3, eas4 ref3ect t-e c-a33enge 2it-out ,etai3 De#8+13"1o! 6 Descri0e t-e ris)/s c-aracteristics an, e8.3ain 2-4 t-is ris) is .erceive, to -ave t-e .otentia3 to affect t-e outcome of t-e .roject. P+obab1l1"6 a!, I*3a8" $ Pro0a0i3it4 s-ou3, 0e measure, as t-e 3i)e3i-oo, of t-at t-e ris) 2i33 occur. Im.act s-ou3, 0e measure, in terms of ,eviations from t-e sc-e,u3e, effort, or costs from t-e sc-e,u3e if ris)s occur. P+obab1l1"6 Le0el#* "ertain, !8.ecte,, =i)e34, Possi03e, Ln3i)e34 I*3a8" Le0el#* :er4 Eig-, Eig-, Me,ium, =o2, :er4 =o2

M1"1;a"1o! S"+a"e;6 6 I,entif4 2-at actions can 0e ta)en in or,er to re,uce t-e .ro0a0i3it4 of t-e ris), or to re,uce its im.act on t-e .roject. Co!"1!;e!86 Pla! I,entif4 2-at actions 2i33 0e ta)en 2-en t-e ris) materia3i<es an, t-reatens t-e sco.e, 0u,get, or t-e sc-e,u3e of t-e .roject. @RISK 1 NAMEA Descri.tion 6
Pro0a0i3it4 Im.act

Mitigation #trateg4 "ontingenc4 P3an

@RISK B NAMEA Descri.tion 6

Pro0a0i3it4 Im.act

Mitigation #trateg4 "ontingenc4 P3an

1I

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

ATTACHED PROJECT RISK LO' % A&TER INITIAL ASSESSMENT

After t-e initia3 .roject ris) assessment, .3ease attac- t-e .roject/s Ris) =og 2it- t-e revise, re.orts ,uring t-e .ro,uct ,eve3o.ment .-ases as .er* +Pre.are a 2ritten ris) assessment re.ort at t-e ince.tion of a .roject an, at t-e en, of eac.ro,uct ,eve3o.ment 3ifec4c3e .-ase or more fre5uent34 for 3arge an, -ig-6ris) .rojects. !acris) assessment s-a33 0e inc3u,e, as a .roject activit4 in t-e .roject sc-e,u3e. )PROJECT OVERSI'HT PROCESS *e*o+a!,-* T-e DoIT Ris) an, Issues Tem.3ate s-ou3, 0e use, 04 .rojects to trac) ris)s an, re.ort t-em to DoIT as re5uire, 04 t-e Project Oversig-t Process.

1J

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

RISK CALCULATION ECAMPLE

T-is is a ta03e from t-e DoIT Ris) an, Issues =og Tem.3ate s.rea,s-eet t-at ca3cu3ates Ris) P+obab1l1"6 Le0el#* "ertain, !8.ecte,, =i)e34, Possi03e, Ln3i)e34 I*3a8" Le0el#* :er4 Eig-, Eig-, Me,ium, =o2, :er4 =o2

T-e DoIT Ris) an, Issues =og Tem.3ate uses t-ese ca3cu3ations for Pro0a0i3it4 an, Im.act 2-ic- are usua334 -i,,en fie3,s. Number Risk 1 Risk 2 3 $ 5 6 7 ) 9 10 11 12 13 1$ 15 16 Legend+ !ini#"# risk , -ccepta' e .&#e risks , !&nit&r at %!/0ea# Le1e Risk Risk Risk Risk Risk Risk Risk Risk Risk Risk Risk Risk Risk Risk Risk Probability Certain Expected Like y %&ssi' e Certain Expected Like y *n ike y Certain Certain Expected Expected %&ssi' e Like y %&ssi' e Like y Impact Very High High !edi"# L&( High !edi"# L&( Very L&( L&( Very L&( !edi"# L&( Very High High !edi"# !edi"# Rating 0.9025 0.5625 0.3025 0.1225 0.7125 0.$125 0.1925 0.0225 0.3325 0.1$25 0.$125 0.2625 0.3325 0.$125 0.1925 0.3025 Probability 0.95 0.75 0.55 0.35 0.95 0.75 0.55 0.15 0.95 0.95 0.75 0.75 0.35 0.55 0.35 0.55 Impact 0.95 0.75 0.55 0.35 0.75 0.55 0.35 0.15 0.35 0.15 0.55 0.35 0.95 0.75 0.55 0.55

20

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK High risks , -cti1e #&nit&ring (ith &ng&ing C&ntingency/!itigati&n acti1ity .h&( st&ppers , -cti1e participati&n (ith steering c&##ittee t& #itigate

APPENDIC A: A &RAMEWORK &OR PROJECT RISK MANA'EMENT PLAN

T-e DoIT Project Management P3an contains section A.1 Ris) an, Issues Management 2ite3ements of a Ris) management P3an. T-e fo33o2ing section contains significant e3ements of a Project Ris) Management of 2-ic- t-is 2or)0oo) an, t-e Initia3 Project Ris) assessment is a .art.

1. DOIT PROJECT RISK PROBABILITY AND IMPACT MEASUREMENT CATE'ORIES

P+obab1l1"6 Le0el#* "ertain, !8.ecte,, =i)e34, Possi03e, Ln3i)e34 I*3a8" Le0el#* :er4 Eig-, Eig-, Me,ium, =o2, :er4 =o2

Cal8-la"e, R1#: Ra"1!;: Ris) rating to 0e use, for action6fo33o2ing as s-o2n 0e3o2* Legend+ !ini#"# risk , -ccepta' e .&#e risks , !&nit&r at %!/0ea# Le1e High risks , -cti1e #&nit&ring (ith &ng&ing C&ntingency/!itigati&n acti1ity .h&( st&ppers , -cti1e participati&n (ith steering c&##ittee t& #itigate

B. INITIAL PROJECT RISK ASSESSMENT TEMPLATE WITH WORKBOOK

DEPARTMENT O& IN&ORMATION TECHNOLO'Y RE(UIREMENT +Pre.are a 2ritten ris) assessment re.ort at t-e ince.tion of a .roject an, at t-e en, of eac.ro,uct ,eve3o.ment 3ifec4c3e .-ase or more fre5uent34 for 3arge an, -ig-6ris) .rojects. !acris) assessment s-a33 0e inc3u,e, as a .roject activit4 in t-e .roject sc-e,u3e. )PROJECT OVERSI'HT PROCESS *e*o+a!,-*

21

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK T-e initia3 ris) assessment is focuse, on five )e4 areas, Im.act, Project Organi<ation, Re5uirements, Tec-nica3 Ris)s an, P3anning Ris)s. T-ese areas an, t-eir 5uestions e8.3ore t-e )in,s of .itfa33s t-at ot-er .rojects -ave face,, some successfu334 ot-ers not.

D. DOIT RISK AND ISSUE LO' TEMPLATE

T-is DoIT Ris) an, Issue =og Tem.3ate 2i33 0e su0mitte, 2it- t-e .erio,ic 2ritten ris) assessment re.ort to 0e su0mitte, at t-e en, of eac- .ro,uct ,eve3o.ment 3ifec4c3e .-ase or more fre5uent34 for 3arge an, -ig- ris) .roject.

T-is Ris) an, Issue =og Tem.3ate 0ui3,s on t-e DoIT .ro0a0i3it4 an, Im.act categories an, ca3cu3ates t-e Ris) Rating for 2-ic- t-e 3egen, in item M1 s-ou3, 0e use, to ,etermine t4.e of action to 0e ta)en. THE DOIT RISK REPORTIN' LON' &ORM TEMPLATE T-is tem.3ate is inten,e, for .rojects t-at 2ou3, 3i)e to co33ect an, manage more ris) an, ris) mitigation information t-an is su..orte, in t-e DoIT Ris) an, Issue =og Tem.3ate.

E. PERIODIC RISK ASSESSMENT REPORTS DURIN' PRODUCT DEVELOPMENT LI&E CYCLE

T-is re5uirement of t-e DoIT Project Oversig-t Process memoran,um is 0ase, on t-e assum.tion t-at as a .roject 2or)s t-roug- its .-ases an, es.ecia334 t-e .ro,uct ,eve3o.ment 3ife c4c3e it 2i33 a,,ress t-e i,entifie, ris)s, an, most .ro0a034 0ecome a2are of ne2 ris)s. It is a3so assume, t-at t-e .roject 2i33 ,eve3o. a ris) matri8 for t-e .i3ot an, ,e.3o4ment .rocess. T-ese transitions to o.erations or go63ive ris)s are a su0set of t-e .roject ris)s an, s-ou3, 0e use, for t-e ,etai3e, .3anning for t-is critica3 3ast .-ase of t-e .roject an, .ro,uct so3ution .rocess.

F. IV5V INITIAL RISK ASSESSMENT AND PERIODIC REPORTS

&-i3e +"on,uct Initia3 Ris) Assessment7 is a man,ator4 I:;: activit4, +Ris) Management7 activit4 is a ,esire, activit4 as .art of an overa33 .roject ris) management .3an

Co!,-8" I!1"1al R1#: A##e##*e!"

IM$B

Pre.are an, ,e3iver an Initia3 Ris) Assessment re.ort on t-e re5uire, activities. Re.ort on status of eac- activit4 an, on t-e effectiveness of Project management an, 2-et-er t-e Project activities are meeting t-e

22

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

o0jectives set fort- 04 t-e Project. Csee Deliverables for more ,etai3sD

R1#: Ma!a;e*e!"

PM$1F

:erif4 t-at a Project Ris) Management P3an is create, an, 0eing fo33o2e,. !va3uate t-e Projects ris) management .3ans an, .roce,ures to verif4 t-at ris)s are i,entifie, an, 5uantifie, an, t-at mitigation .3ans are ,eve3o.e,, communicate,, im.3emente,, monitore,, an, com.3ete.

G. RISK MANA'EMENT REPORT LON' &ORM TEMPLATE

&-i3e t-e DoIT Ris) an, Issue =og Tem.3ate com0ines a ris) 3og 2it- summar4 treatment of t-e contingenc4 an, mitigation .3ans, a .roject mig-t 2e33 e3ect to use t-e fu33er DoIT Ris) Re.ort Tem.3ate s-o2n 0e3o2

RISK REPORT HTO BE USED WITH DOIT RISK AND ISSUES LO' TEMPLATEI

PROJECT:
SECTION I: INITIAL NOTI&ICATION
REPORTED BY: DESCRIPTION: REPORTED DATE:

PROBABILITY O& OCCURRENCE:

SEVERITY O& IMPACT ON PROJECT:

2(

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

MITI'ATION STRATE'Y:

INITIAL CRITICALITY: HMARK ONEI

LOW RISK/ 'REEN MEDIUM RISK/ YELLOW HI'H RISK/ RED

SECTION II: STATUS TRACKIN' IN&ORMATION

NAME O& RISK: RISK CLASSI&ICATION: ASSI'NED BUSINESS OWNER: CURRENT CRITICALITY: HMARK ONEI
LOW RISK/ 'REEN MEDIUM RISK/ YELLOW HI'H RISK/ RED

TRACKIN' ID: TAR'ET DATE: ASSI'NMENT DATE:

29

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

SECTION III: ANALYSIS

NAME O& RISK: DETAILED SEVERITY O& IMPACT: TRACKIN' ID:

ESTIMATED DOLLAR VALUE O& IMPACT:

BASIS &OR ESTIMATED PROBABILITY:

ESTIMATED PROBABILITY O& OCCURRENCE:

MITI'ATION STRATE'Y:

CONTIN'ENCY PLAN:

SECTION IV: EVENT TRACKIN'

DESCRIPTION O& EVENT:
INITIAL ANALYSIS COMPLETED:

DATE TAKEN:

RESULTIN' DECISION:

&IRST PROJECT STATUS REPORT MADE:

25

PRO !"T RI#$ A##!##M!%T &OR$'OO$

INITIAL PROJECT RISK ASSESSMENT WORKBOOK

CLOSED:

2A

PRO !"T RI#$ A##!##M!%T &OR$'OO$