The Department of Defense (DoD) recognizes that risk management is critical
to acquisition program success (see the Defense Acquisition Guidebook
(DAG), Section
11.4). The purpose of addressing risk on programs is to help ensure
program cost, schedule, and performance objectives are achieved at every stage
in the life cycle and to communicate to all stakeholders the process for
uncovering, determining the scope of, and managing program
uncertainties. Since risk can be associated with all aspects of a
program, it is important to recognize that risk identification is part of the
job of everyone and not just the program manager or systems engineer.
That includes the test manager, financial manager, contracting officer,
logistician, and every other team member.
The purpose of this guide is to assist DoD and contractor Program Managers
(PMs), program offices and Integrated Product Teams (IPTs) in effectively
managing program risks during the entire acquisition process, including
sustainment. This guide contains baseline information and explanations
for a well-structured risk management program. The management concepts
and ideas presented here encourage the use of risk-based management practices
and suggest a process to address program risks without prescribing specific
methods or tools. (Note: this guide does not attempt to address
the requirements of DoDI 5000.1 to prevent and manage Environment, Safety, and
Occupational Health (ESOH) hazards. The reader should refer to MIL STD
882D, Standard Practice for System Safety, for guidance regarding ESOH
hazards).
Since this is a guide, the information presented within is not mandatory to
follow, but PMs are encouraged to apply the fundamentals presented here to all
acquisition efforts—both large and small—and to all elements of a program
(system, subsystem, hardware, and software). Risk management is a
fundamental program management tool for effectively managing future
uncertainties associated with system acquisition. The practice of risk
management draws from many management disciplines including but not limited to
program management, systems engineering, earned value management, production
planning, quality assurance, logistics, system safety and mishap prevention,
and requirements definition in order to establish a methodology that ensures
achieving program objectives for cost, schedule, and performance. PMs
should tailor their risk management approaches to fit their acquisition
program, statutory requirements, and life-cycle phase. The guide should
be used in conjunction with related directives, instructions, policy
memoranda, or regulations issued to implement mandatory requirements.
This guide has been structured to provide a basic understanding of risk
management concepts and processes. It offers clear descriptions and
concise explanations of core steps to assist in managing risks in acquisition
programs. Its focuses on risk mitigation planning and implementation
rather on risk avoidance, transfer, or assumption. The guide is not laid
out in chronological order of implementing a risk management program, but
rather in a sequence to facilitate understanding of the topic. For
example, the discussion on planning / preparation for overall risk management
is in Section
8 of the guide to keep it separate from the risk management process.
The planning / preparation function deals with planning to execute the risk
management process, but is not part of the execution of the process
itself.
There are several notable changes of emphasis in this guide from previous
versions. These changes reflect lessons learned from application of risk
management in DoD programs. Emphasis has been placed on:
- The role and management of future root causes,
- Distinguishing between risk management and issue management,
- Tying risk likelihood to the root cause rather than the
consequence,
- Tracking the status of risk mitigation implementation vs. risk tracking,
and
- Focusing on event-driven technical reviews to help identify risk areas
and the effectiveness of ongoing risk mitigation efforts.
The risk management techniques available in the previous version of this
guide and other risk management references can be found on the Defense
Acquisition University Community of Practice website at https://acc.dau.mil/rm, where risk managers
and other program team personnel can access the additional information when
needed. This guide is supplemented by Defense Acquisition University
(DAU) Risk Management Continuous Learning Module (key words: “risk
management” and course number CLM017).
The Office of the Secretary of Defense (OSD) office of primary
responsibility (OPR) for this guide is OUSD(AT&L) Systems and Software
Engineering, Enterprise Development (OUSD(AT&L) SSE/ED). This office
will develop and coordinate updates to the guide as required, based on policy
changes and customer feedback. To provide feedback to the OPR, please
e-mail the office at ATL-ED@osd.mil.
