DoDI 5000.2 requires that "PMs and other acquisition managers shall continually assess program risks." Further, DoD 5000.2-R (Interim) states that for ACAT I Programs, "The PM shall identify the risk areas of the program and integrate risk management within overall program management." Although the need for a risk management program and a risk management process are addressed throughout this regulation, there is no requirement for a formal Risk Management Plan (RMP). However, Program Managers (PMs) have found such a plan necessary to focus properly on the assessment and handling of program risk, a core acquisition management issue that Milestone Decision Authorities (MDAs) must rigorously address at appropriate milestones before making program decisions.
Attached is a sample format for a RMP that is a compilation of several good risk plans and the results of the DoD Risk Management Working Group Study. It represents the types of information and considerations that a plan, tailored to a specific program, might contain. There are also two examples of Risk Management Plans- one for an ACAT I or II Program, the other for an ACAT III or IV Program. The DoD Acquisition Deskbook, Section 2.5.2, has general guidance and advice in all areas of risk management. Section 184.108.40.206 of the Deskbook contains information concerning the development of a risk management plan. The information in this Guide is consistent with, and in most cares identical to, the Deskbook.
There is a danger in providing a sample document. First of all, because it is written as a guide for a general audience, it does not satisfy all of the needs of any particular program. Second, there is the possibility that some prospective user will simply adopt the plan as written, despite the fact that it does not fit his or her program. We discourage this.
The reason for providing this sample format is to give PMs and their staffs a starting point for their own planning process. It should stimulate thought about what has to be done and give some ideas on how to begin writing a plan. The sample plan contains more information than most program offices should need. Few PMs have the resources for a dedicated risk management effort as depicted in the plan. The key to using the sample plan is to keep things simple and tailor the plan to suit your needs, focusing on the management of risk in the key critical areas of your program.
The following text reflects the outline of a risk management plan found in the DoD Acquisition Deskbook section 220.127.116.11, Figure 18.104.22.168-2.