DoDI 5000.2 requires that “PMs and other acquisition managers shall
continually assess program risks.” Further, the Interim Defense
Acquisition Guidebook (IDAG) states that for ACAT I Programs, “The PM
shall identify the risk areas of the program and integrate risk management
within overall program management.” Although the need for a risk management
program and a risk management process are addressed throughout this
regulation, there is no requirement for a formal Risk Management Plan (RMP).
However, Program Managers (PMs) have found such a plan necessary to focus
properly on the assessment and handling of program risk, a core acquisition
management issue that Milestone Decision Authorities (MDAs) must rigorously
address at appropriate milestones before making program decisions.
Attached is a sample format for a RMP that is a compilation of several good
risk plans and the results of the DoD Risk Management Working Group Study. It
represents the types of information and considerations that a plan, tailored
to a specific program, might contain. There are also two examples of Risk
Management Plans—one for an ACAT I or II Program, the other for an ACAT III or
IV Program. The Defense Acquisition Deskbook, Section 2.5.2, has
general guidance and advice in all areas of risk management. Section 188.8.131.52
of the Defense Acquisition Deskbook contains information concerning
the development of a risk management plan. The information in this Guide is
consistent with, and in most cases identical to, the Defense Acquisition
There is a danger in providing a sample document. First of all, because it
is written as a guide for a general audience, it does not satisfy all of the
needs of any particular program. Second, there is the possibility that some
prospective user will simply adopt the plan as written, despite the fact that
it does not fit his or her program. We discourage this.
The reason for providing this sample format is to give PMs and their staffs
a starting point for their own planning process. It should stimulate thought
about what has to be done and give some ideas on how to begin writing a plan.
The sample plan contains more information than most program offices should
need. Few PMs have the resources for a dedicated risk management effort as
depicted in the plan. The key to using the sample plan is to keep things
simple and tailor the plan to suit your needs, focusing on the management of
risk in the key critical areas of your program.
The following text reflects the outline of a risk management plan found in
the Defense Acquisition Deskbook section