Docstoc

Risk Management Plan for the System

Document Sample
Risk Management Plan for the System Powered By Docstoc
					 Louisiana Statewide
  Automated Child
 Welfare Information
  System (SACWIS)


 Risk Management Plan




Due Date: November 17, 2000
                                                     Table of Contents

1         Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .    3
          1.1    Objective                                                                                                                      3
          1.2    Goals                                                                                                                          4
          1.3    Approach                                                                                                                       4
          1.4    Identifications of Risks, Issues, and Change Requests                                                                          6

2         Roles and Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
          2.1   Risk Management Discussions                                                                                     10
          2.2   Role of AMS Deputy Project Manager                                                                              10
          2.3   Role of the Steering Committee                                                                                  10

3         Identifying and Evaluating Risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .                   11
          3.1     Defining Expectations                                                                                                        11
          3.2     Identifying Risks                                                                                                            11
          3.3     Evaluating Risks                                                                                                             13

4         Analyzing Risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
          4.1   Classification of Risk Impact                                                                                         14

5         Avoidance and Mitigation Strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

6         Reporting and Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
          6.1   Reporting                                                                                                      16
          6.2   Monitoring                                                                                                     18

7         Methods, Tools and Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

8         Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

9         Revision History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

APPENDIX A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

APPENDIX B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
1       Introduction

Risk management is the process of identifying events or situations that can adversely
affect a project’s ability to achieve stated goals or objectives and development of
strategies to avoid or minimize these negative outcomes. The Risk management
methodology presented in this document identifies the process of categorizing risks to
support risk analysis and the selection of valid risk avoidance or risk mitigation plans.

The following definitions are taken from Managing Risks on Projects by Milton Hess and
will be used in this Risk Management plan:

Threat – What can cause you to fail to stay on plan and/or fail to meet a target; also may
be called a problem; most often caused by assumptions and dependencies.

Risk – The chance that a threat will cause the project to fail.

The Louisiana SACWIS project, like all projects, will experience risks that can impact or
threaten the success of the project. Some risks will be identified during project initiation,
whereas others will emerge during subsequent phases. Therefore, an effective risk
management plan is a critical element of the overall project management approach. As
stated in the AMS proposal, this risk management plan will document the methods and
procedures for risk identification and documentation, risk mitigation or risk management
strategy to be applied, and the risk status and reporting procedures.
This plan will also address the initial risks and mitigation strategies that are already
defined through a brainstorming session held together with AMS and State Project Teams
and it will be used throughout the project life span.

1.1     Objective

The primary objective of risk management is to increase the likelihood of success by
recognizing and acting upon threats to success. By defining risk in terms of what may
jeopardize expectations, and by integrating risk management into project management,
AMS identifies and monitors risks proactively rather than reactively.

Objectives of the Risk Management Plan are to:

        •        Articulate a process for the identification of risks;
        •        Identify both the State’s and AMS’s expectations for the project;
        •        Articulate a process for assessment of risks;
        •        Establish a process for the development and appropriate selection of risk
                 mitigation strategies;
        •        Define the processes to monitor and report risks.
American Management Systems                                                    Page 3 of 36
Louisiana SACWIS                                                                         11/17/00
Risk Management Plan
1.2     Goals

The goals for risk management must focus on building risk discovery and mitigation into
day-to-day management activities. This ensures that the Project Management Team
identifies risks early, builds explicit steps toward mitigation into project plans, and monitors
progress towards risk mitigation as a routine component of the management process.

The goals of the Risk Management plan are to:

        •        Establish a documented process for risk identification;
        •        Establish a standard format for communication of risk status; and
        •        Provide definitions of project roles and responsibilities.

1.3     Approach

AMS has extensive experience managing SACWIS projects and understands the
complexities associated with the design and development of SACWIS solutions. The
basic overall strategy and approach is to leverage the experience of the SACWIS team to
work with the State of Louisiana for implementing a process to monitor and report risks.

This section outlines AMS project management’s approach to risk management and
consists of three key elements:

        •        Defines expectations for a successful project;
        •        Defines risk in terms of the results of unmet expectations; and
        •        Integrate risk management into overall project management (including the
                 project plan).

This approach encompasses not only those risks that are identified as issues through the
formal reporting path, but also potential risks. The past experience of the Project
Management Team and open project communication will encourage dialogue facilitating
overall project risk reduction.

The process begins when a risk has been identified and brought to the attention of the
project team. The risk will be given an initial impact classification during the project team
discussion. Risk impact classifications are described in Section 4.1 of this plan. Next, the
AMS Deputy Project Manager assigns the risk for complete analysis, with an associated
due date, to a project staff member.
American Management Systems                                                      Page 4 of 36
Louisiana SACWIS                                                                           11/17/00
Risk Management Plan
During analysis, the staff member will complete a Risk Stoplight report, the tool used to
track risks. The Risk Stoplight report format is outlined in Section 6.1. At the conclusion of
the analysis, a mitigation strategy is proposed to address the identified risk. Many risks
begin as previously identified issues that have been thoroughly discussed in the Weekly
Issue Resolution Group meeting. If this is the case, then only a summary review of the risk
will be captured including the associated issue number. The AMS Deputy Project
Manager, who “owns” the original hardcopies of the Stoplight Reports, will present the
completed Risk Stoplight report at the weekly project status meeting for review.

Review of project risks is a key focus area for the Louisiana SACWIS project team.
Identified risks will be included on the agenda of the weekly project status meetings. The
Project team should review the status of risks to ensure that the appropriate avoidance
and mitigation strategies are in place. These reviews act as a vehicle to inform
stakeholders about alternatives or trade-offs to consider, build consensus on appropriate
strategies and identify expectations associated with strategies.

The AMS Project Team uses the AMS Best Practice approach for Risk Management, to
support a task-based approach to identifying and resolving risks. This task-based
approach consists of five key activities:

        •        Define measures of success and set targets; In the Louisiana SACWIS
                 project, success will be measured by on time design delivery of the
                 Louisiana SACWIS system, enabling the state to meet their business
                 objectives;

        •        Identify and analyze risks that threaten the ability to achieve success
                 targets; An effective risk statement describes tasks that can prevent the
                 project from achieving success targets. Stated properly, each risk should be
                 defined with enough precision to allow the project team to set priorities,
                 consider alternatives and take useful actions to mitigate the critical risks.
                 Risks and related information are recorded in a tool to facilitate
                 communication and tracking efforts;

        •        Develop an avoidance or mitigation strategy for each risk; The
                 mitigation strategy should focus on identifying specific actions that must be
                 taken to help keep the project on track to meet the success targets. There
                 need not be a one-to-one correlation between risks and risk mitigation
                 activities. Sometimes, the risk management discussions will define several
                 tasks to mitigate a critical risk. At other times, the team will define a single
                 task that address several risks concurrently;


American Management Systems                                                        Page 5 of 36
Louisiana SACWIS                                                                             11/17/00
Risk Management Plan
        •        Specify tasks to implement the mitigation strategy; Once the mitigation
                 strategy is defined and documented, it should be applied to the risk in the
                 form of specific tasks, with due dates and assignment to an appropriate staff
                 member; and,

        •        Monitor and report risks; The actions taken to mitigate risks must be
                 monitored and their status reported. Communicate with the stakeholders to
                 provide feedback necessary to determine if the actions have resulted in the
                 desired effect of reducing or eliminating the risk, or whether additional action
                 might be required.

1.4     Identifications of Risks, Issues, and Change Requests

The following diagram illustrates the flow between the Issue Management Plan, Change
Request Management Plan and the Risk Management Plan. Project Staff identify either an
issue, risk or change request and enters them into the Issue Management Database. The
Issue Resolution Group and optionally the Steering Committee meet to analyze the issue,
risk or change request to determine which process will be applied. The Issue Resolution
Group may initiate and track the change request process using the Change Request
Management Plan, establish and monitor a risk using the Risk Management Plan or
determine that the issue will follow the issue tracking procedures in the Issue Management
Plan.




American Management Systems                                                       Page 6 of 36
Louisiana SACWIS                                                                            11/17/00
Risk Management Plan
                                                 EXHIBIT 1.4.1
                                Issue, Risk, and Change Request Flow Diagram



                                                                   Issue Identification




                                                                            Identifies Issue
                                                                               Manager
                                                                     Issue Database
                                                          st
                                                       que
                                                 e   Re                                         Ma
                                                                                                  nag
                                              ang                                                    er I
                                            Ch                                                           den
                                      ifies                                                                 tifie
                                  dent                                                                           s
                              er I                                                                                   Ris
                                                                                                                        k
                           nag
                         Ma


                                                                           Issue
                                                                         Resolution
       Change Request
                                                                         Group and                                          Risk Identification
        Identification
                                                                          Steering
                                                                         Committee
                                      Change
                                                                                                   Risk
                                     Request
                                                                                               Management
                                    Management
                                                                                                 Process
                                      Process



                               Deferred                   Change Order
                                                                                               Resolved




                                                                            Issue
                                                                         Management
                                                                          Process




                                                                           Resolved




American Management Systems                                                                                                    Page 7 of 36
Louisiana SACWIS                                                                                                                         11/17/00
Risk Management Plan
2       Roles and Responsibilities

This section identifies the roles and responsibilities for the Louisiana SACWIS project
staff, who will be actively involved with risk management. Table 2.1 describes
responsibilities for each of the identified roles.

                                            Table 2.1
                              Risk Management Roles and Responsibilities
        Role                      Typical Responsibilities                      Comments
 AMS Deputy            The AMS Deputy Project Manager is               There is not a Risk Manager
 Project               responsible for monitoring the Risk             title on the project. The
 Manager               process throughout the project.                 Deputy Project Manager
                       Responsibilities include:                       assumes the role of Risk
                       •      Monitoring risks in the issues           Manager.
                              tracking tool; ensuring that staff
                              members are tracking, updating
                              and escalating risks as appropriate;
                              and
                       •      Generating risk status reports and
                              presenting new Stoplight reports for
                              review at Project Status meetings.


 Staff Member          Each risk is assigned to an appropriate         The assignment of a staff
                       staff member. Responsibilities include:         member ensures that
                       •        Identifying project risks;             someone, besides the
                       •        Add the risk to the issue              Deputy Project Manager, is
                                management database;                   accountable for ensuring that
                       •        Creation of a risk mitigation          a risk mitigation plan is
                                strategy and formatting the strategy   created, implemented and
                                into a Stoplight report;               monitored.
                       •        Implementation of the risk
                                mitigation strategy;
                       •        Monitoring of a risk mitigation
                                strategy and tracking the status of
                                “owned” risks every week; and
                       •        Recommend changing the risk
                                impact classification, as needed.




American Management Systems                                                            Page 8 of 36
Louisiana SACWIS                                                                                 11/17/00
Risk Management Plan
 Steering              The Steering Committee is responsible for        Only risks classified as
 Committee             reviewing any risks or risk mitigation           “High” or “Critical” impact will
                       strategies classified as “High” or “Critical”.   be reviewed by the Steering
                       Responsibilities include:                        Committee.
                       •       Concurring with or modifying the
                               Impact and planned mitigation
                               steps;
                       •       Concurring with or modifying the
                               resources identified and time
                               frames;
                       •       Set expectations and following
                               monthly status review/analysis;
                       •       Announce satisfaction or
                               recommend alternative strategies,
                               and
                       •       Alert Project team to potential new
                               risks to assess and manage.


 Issue                 The Issue Resolution Group is comprised          The members of this group
 Resolution            of managers who are empowered to make            will include the State
 Group                 decisions, to address risks and to monitor       Project Director, State
                       progress of risk mitigation strategies.
                                                                        Deputy Project Director,
                       Responsibilities include:
                       •      Identifying new risks;                    State QA Manager, AMS
                       •      Re-classifying project issues or          Project Manager, AMS
                              risks if there is a threat to project     Deputy Project Manager,
                              success;                                  AMS Technical Group
                       •      Assignment of risks to an                 Manager, and Maximus
                              appropriate staff member;                 Project Manager.
                       •      Initial assignment of risk impact
                              classification;
                       •      Reassigning the risk to a different
                              staff member;
                       •      Changing the risk impact
                              classification as necessary; and
                       •      Ensure that a risk mitigation plan is
                              created and implemented.



2.1     Risk Management Discussions

Risk Management will be one of the topics on the agenda for the weekly project status
meeting. The primary purpose of the risk discussion will be to coordinate tasks required to
develop, implement, monitor and report on risk management activities. The meeting

American Management Systems                                                               Page 9 of 36
Louisiana SACWIS                                                                                    11/17/00
Risk Management Plan
attendees will decide: (1) a clear definition of the risk; (2) classification of the risk as low,
medium, high, or critical and (3) when a risk should be escalated.

Specific responsibilities of the Risk Management discussions are to:
       •      Identify risks either directly or through input from project members or
              stakeholders;
       •      Classify each risk as critical, high, medium or low based on the severity of
              the threat of the risk to the Louisiana SACWIS project;
       •      Discuss any risk mitigation plan(s); and
       •      Report status to review and monitor progress on ongoing risk mitigation
              plans.

2.2     Role of AMS Deputy Project Manager

The AMS Deputy Project Manager will administer the risk management process by
assigning the risk to a staff member. Each risks status and targeted mitigation date will be
discussed at the weekly meeting. The assigned staff “owns” the risk and is responsible for
ensuring that a risk mitigation plan is in place and that the status is tracked and
documented.

2.3     Role of the Steering Committee

The Steering Committee (SC) is responsible for facilitating the implementation of all risk
mitigation plans as they require the cooperation of a broad group of stakeholders and/or
have significant impact upon the success of the Project. The SC provides the pivotal point
for assessing and approving strategies for mitigating identified project critical risks. In
order to capture the significant insight of the SC and to provide timely feedback as to plans
associated with individual risks identified as high/critical, the SACWIS Project Team will
use the Risk Stoplight Format. At each SC monthly meeting the status of each high/critical
risk will be reviewed.




American Management Systems                                                        Page 10 of 36
Louisiana SACWIS                                                                            11/17/00
Risk Management Plan
3     Identifying and Evaluating Risks

3.1     Defining Expectations

Expectations are set in many ways during the life of a project. Specific tasks are
established and articulated in the project work plan. Factors that may influence the ability to
meet scheduled work plan tasks are regularly defined. Properly recognized, these factors
define the risks associated with the project. If these factors indicate high risk, then the
overall project success may be at risk. Structured design review meetings, ongoing
weekly status meetings, Steering Committee meetings, and the formal sign-off process for
deliverables all contribute to a clear definition of expectations.

3.2     Identifying Risks

During the startup phase of the project, the Risk Management discussions will focus on
identifying and managing risks, which might threaten the success of the project. A joint
meeting was held during the second week of November to discuss the outline of the Risk
Management plan. The primary goal was to identify the initial set of risks identified by the
State at the outset of the project, and to develop risk mitigation plans that will be used in
the ongoing process for risk management.

The State of Louisiana project team members along with AMS project team members will
use their combined knowledge of SACWIS projects to identify issues specific to the State
of Louisiana. Subsequently, they will define and address the first set of risks. This will
continue to be a collaborative effort between members of the Louisiana SACWIS project.

Exhibit 3.2-1 presents the workflow for the risk identification, analysis and classification
processes. Workflow tasks correspond with the steps in the five-step risk management
methodology. For Phase1, the process starts with the identification of potential risks to the
Louisiana SACWIS Project. Appendix A lists Initial Risks identified by the State of
Louisiana and discussed in a joint team meeting.




American Management Systems                                                     Page 11 of 36
Louisiana SACWIS                                                                         11/17/00
Risk Management Plan
                                             EXHIBIT 3.2-1
                                  Risk Management Process Workflow



                                                                 Identify potential risks for
                                                                  the LA SACWIS Project




                                                                    Analyze Each Risk



                                                                   Categorize the risk as
                                                                 critical, high, medium, or
                                                                             low




                               If there is no agreement on                   Meeting
                               the classification of risk, the               Agrees                         State Project Director
                                                                                                Disagrees
                               State Project Director,                         or                           AMS Project Manager
                               Maximus Project Manager,                     Disagrees
                                                                                                              Maximus Project
                               and the AMS Project                           on Risk
                                                                                                                 Manager
                               Manager make a decision
                                                                                   Agrees

                                                                  Assign each risk and status
                                                                    reporting due date to a
                                                                  Risk Management meeting
                                                                           member


                                                                   Risk Assignee Develops
                                                                                                            Steering Committee
                                                                  Risk Management Plan for
                                                                                                            provides direction to
                                                                 each risk using Risk Support
                                                                                                            project management
                                                                     Stoplight Report and
                                                                                                              when necessary
                        Risk Monitoring                           provides updates on status
                            Process

                                                                   Submit Risk Management
                                                                   Plan for each risk to Risk
                                                                    Management Meeting
                                                                   members and review status


                                                                     Steering Committee is
                                                                      informed of all risks
                                                                     classified as high and
                                                                             critical




American Management Systems                                                                                                          Page 12 of 36
Louisiana SACWIS                                                                                                                              11/17/00
Risk Management Plan
Through review and discussion of each potential risk during the weekly status meetings,
members should reach consensus on the proposed classification for the specific risk. If
consensus cannot be reached, the State Project Director and AMS Project Manager will
classify the risk. The State Project Director may request input and guidance from the
MAXIMUS Project Manager in classification of risks.

3.3     Evaluating Risks

Evaluating risks involves determining the impact the risk may have related to objectives
and project schedule. Risks are categorized as events or potential events, and are
reviewed and evaluated against associated expectations.

AMS’ project management approach is based on continually reviewing, refining and
updating the expectations and identifying associated risks and their causes. Risks are
therefore tied to expectations. Risk statements are defined in detail, allowing project
management to set priorities and to establish an effective action plan.




American Management Systems                                                  Page 13 of 36
Louisiana SACWIS                                                                      11/17/00
Risk Management Plan
4       Analyzing Risks

AMS also characterizes risk through two essential attributes – probability and severity.
Probability is defined by measuring the likelihood that a target is in jeopardy; severity is
defined as the potential consequence. Risks are prioritized with the highest priority
assigned to those that are most likely to cause important gaps between success targets
and predicted results (expectations) – the risks with relatively high severity and probability.
Summaries of risk are prepared and presented to the appropriate committees for
discussion, decision and recommended action.

Risk management discussions included in the weekly project status review meetings
involve the State, MAXIMUS and AMS project management. These discussions,
facilitated by AMS, utilize the Best Practices of AMS to identify and analyze risks.
Updates on risks are reported via the Stoplight Reports that summarize the threat,
expectations affected, mitigation strategy, status, and assessment of the current situation.

4.1     Classification of Risk Impact

Once a risk is identified it is classified according to its likelihood to impact success of the
project. The risk classifications are the same terms used in the Issue Management Plan for
the Louisiana SACWIS project, with additional clarification in regards to risk management.
Levels of risk impact are as follows:

        •        Low – Minimal impact but still needs to be tracked and resolved. The risk
                 mitigation plan is achieving desired results successfully.

        •        Medium – Possible moderate negative impact to one or more deliverables
                 or project tasks or success targets. It could be that the success of the risk
                 mitigation plan is problematic.

        •        High – Possible significant negative impact to a major deliverable or
                 specific success targets. There is not a risk mitigation plan in place or the
                 plan is not achieving desired results.

        •        Critical – Possible adverse impact to the overall program success. There is
                 not a risk mitigation plan in place or the plan is not achieving desired results
                 and the level of risk has escalated.




American Management Systems                                                        Page 14 of 36
Louisiana SACWIS                                                                            11/17/00
Risk Management Plan
5       Avoidance and Mitigation Strategies

After the analysis and impact classification of a risk, the next step is developing an
avoidance or mitigation strategy. Avoidance and mitigation strategies are not exclusive of
one another, and many times are both used in reducing or eliminating the impact of risks.
These strategies will include the specific steps that must be accomplished to address the
identified risk. Associated with each step are resources, date and time frames and
success criteria. Identification of success criteria will provide the target for monitoring the
progress of the risk mitigation.

Risk mitigation is a strategy minimizing the threat that a success target has not been met.
Examples of primary strategies for mitigating risks are:

        •        Prevent and Reduce Impact - These strategies deal directly with sources
                 of the risk. Lack of end user buy-in, for example, can be addressed directly
                 with regularly scheduled communications from the Project to the end-user
                 community. These communications could include e-mails, newsletters, and
                 outreach design demos in regional areas of the State.

        •        Determining that a risk has low probability - This strategy can be as
                 valuable as acting directly to reduce risk. The project might reduce
                 uncertainty by establishing interim milestones in a risk mitigation plan.
                 Although it may not change the cause, it reduces risk by updating the project
                 status at each milestone. A design review with external experts or a proof of
                 concept completion at the early stages of the project adds value in validating
                 or changing key decisions early enough to develop viable alternative
                 strategies, and subsequently reduces risk.

        •        Generate Options - This strategy provides the project with the flexibility to
                 deal with risks that cannot be eliminated directly. If the project staff is
                 concerned about the outcome of a project activity, they can generate options
                 by proposing alternative strategies. The team will determine what options
                 are viable and review the trade-offs of each.

        •        Adjust Expectations - If it is unlikely that an expectation will be satisfied, it
                 may be possible to adjust expectations so that it can be met. A common
                 example is revising a design when it becomes clear that the original design
                 has significant technical impact. Although adjusting expectations is the least
                 desirable approach to managing risk, it is sometimes the only one available.



American Management Systems                                                        Page 15 of 36
Louisiana SACWIS                                                                            11/17/00
Risk Management Plan
6       Reporting and Monitoring

6.1     Reporting

One of the key tools used by the project to report on the overall status of the project risks is
the Risk Stoplight Report. This report is illustrated in Exhibit 6.1-1. The Risk Stoplight
Report contains the following eleven elements:

1.      Issue Number: Issue number from the issue tracking report (if applicable).
2.      Impacted Functional Area: The functional area that is principally impacted by this
        risk. (Services/financial/provider/infrastructure/process/organizational).
3.      Initial Date: The date the risk was first identified.
4.      Risk Description: A description of the problem that places the success of the
        project at risk.
5.      Impact: The targets, dependencies and deliverables that are at risk, and the
        current estimate of the result.
6.      Impacted Dependencies: Any deliverables/dependencies that are at risk, to a
        lesser degree, usually in another functional area.
7.      Planned Mitigation Steps: The strategy to eliminate the risk or minimize the
        impact.
8.      Responsibility: The staff member responsible for implementing the mitigation step.

9.      Time: The time frame to implement the mitigation step.
10.     Status: The current assessment of the situation.
11.     Traffic light model: A visual indicator of the current risk level, and the previous
        level.




American Management Systems                                                       Page 16 of 36
Louisiana SACWIS                                                                           11/17/00
Risk Management Plan
                                                 Exhibit 6.1-1
                                             Risk Stoplight Report
 Current          Issue Number:                                               Initial Date:

                  Impacted Functional Area:

                  Risk Description:




    RED           Impact:                                                     Impacted Dependencies:


 Previous         Planned Mitigation Steps                   Responsibility                   Status



 YELLOW           1.

                  2.

                  3.


Stoplight model definitions:
            Red      Ž Critical or High. Current, serious threat to the success of the
            project. There is no feasible mitigation plan in place, or the current mitigation
            plan has failed.

                 Yellow Ž Medium. Potential threat to the success of the project if not
                 addressed soon. There is a feasible mitigation plan in place, but it has not
                 yet been successful.

                 Green Ž Low. Unlikely to threaten the success of the project. The
                 mitigation plan has been successful. (Drop from list after one time as green.)

The Risk Stoplight Report is a proven valuable tool to:
      •      Build consensus on appropriate mitigation strategies;
      •      Enlist support for mitigation steps that are outside of the Project Manager’s
             direct control;

American Management Systems                                                               Page 17 of 36
Louisiana SACWIS                                                                                   11/17/00
Risk Management Plan
        •        Highlight expectations on upcoming decisions concerning risk mitigation
                 steps; and
        •        Demonstrate momentum on risk mitigation steps.

When the Stoplight reports are created and updated, the red, yellow or green will be used
as an easily recognizable classification of risk impact. After a risk has been classified as
low impact, assigned the green light and its status has been communicated to the project
staff, it will only be discussed during the weekly status meetings as time permits.


6.2     Monitoring

The Risk Management Stoplight reports, jointly reviewed by AMS, MAXIMUS and State
project staff are continuously reviewed and updated. This reporting tool is utilized in the
weekly project status meeting to assist in developing strategies for mitigating risk and to
resolve issues resulting from identification of possible risks. The AMS Deputy Project
Manager is responsible for presenting the Stoplight reports at the weekly status meetings.
The Risk Stoplight Report forms are also the information vehicles for the Steering
Committee meetings.

Once the plan is executed, it is also necessary to determine whether the expected risk
mitigation results are achieved. If not, the risk analysis and mitigation plan must be
reconsidered to determine if alternative steps are needed. If the actions are successful,
the results are documented and the risk level is lowered to the appropriate level or closed.
The responsible staff will document risk mitigation activities using the Risk Stoplight report
template. In addition to documenting the risk, the responsible staff will:

        •        Monitor the mitigation plan – as the plan is put into action, monitor the
                 progress;
        •        Monitor the assumptions, if any – when assumptions are included in a risk
                 mitigation plan, the validity of the assumption must be monitored. If the
                 assumption proves to be invalid, assess the impact and adjust the mitigation
                 plan.




American Management Systems                                                     Page 18 of 36
Louisiana SACWIS                                                                         11/17/00
Risk Management Plan
7       Methods, Tools and Techniques
The Louisiana SACWIS Project, particularly the Risk Management discussions, will use
the following methods, tools and techniques to support the risk management process:

        •        AMS Best Practices: Staying on Target: A Task-Based Approach to
                 Risk Management. The strategy described in this paper transforms ill-
                 defined concerns about what can go wrong into well-defined tasks for
                 dealing with them. This approach to risk management has three key
                 elements:

                 <        Establishing targets for key measures of success;
                 <        Defining risks in terms of what can cause the project to fail to meet
                          the targets; and
                 <        Integrating risk management into the project plan rather than treating
                          it as a separate activity.

        •        Issue Management Database: Risks will be tracked in the Issue
                 Management Database. The risks will be assigned an issue number, the
                 status of “Risk Stoplight Created”, a risk impact level and identification date.

        •        Risk Stoplight Report template: A tool to report on the overall status of the
                 identified project risks is in a user-friendly color code format.




American Management Systems                                                        Page 19 of 36
Louisiana SACWIS                                                                            11/17/00
Risk Management Plan
8       Summary
In summary, the key purpose of this Risk Management plan is to identify, track and mitigate
risks that could pose a threat to the Louisiana SACWIS project. Risks are dynamic; they
change over time and can be influenced by external forces. Risk Management is not a hard
science, but it requires a proven strategy. As outlined in the previous sections of this plan,
AMS Best Practices provides a task-based approach to Risk Management with a history
of success.

By applying the approach presented in this plan, risk mitigation and risk avoidance will be
managed. With a clear definition of expectations and diligent communication regarding
risk, the Louisiana SACWIS project team will reduce the impact of risk and increase
project achievements.




American Management Systems                                                    Page 20 of 36
Louisiana SACWIS                                                                        11/17/00
Risk Management Plan
9       Revision History

As updates are made to the Issue Management Plan, a record is inserted into the table
below to track the changes. This table provides a revision history for the document.

The “Description of Updates” field should contain the page number of the change, the
reason for the change, and the name of the person initiating the change.

    Approval                  Updated By              Description of Updates
      Date




American Management Systems                                                 Page 21 of 36
Louisiana SACWIS                                                                     11/17/00
Risk Management Plan
                                  APPENDIX A

                              Initial Identified Risks




American Management Systems                              Page 22 of 36
Louisiana SACWIS                                                  11/17/00
Risk Management Plan
Risk Impact Classification: High

Impact of previous funding problems on future funding – AMS will support mitigation
of this risk by providing the State officials and stakeholders continual information on the
following: progress of the Louisiana SACWIS project, confirmation that the project is on-
time and on-budget, statistics from the parishes and state OCS office that demonstrate the
need for SACWIS automation for the State. Additionally, AMS will support the State in
maintaining good working relationships with the Federal and State representatives.

Lack of funding for maintenance and operation – The State will identify needs and
project resources necessary to maintain and operate the SACWIS system after the
implementation of Phase II. As part of Phase I, AMS will provide estimates of the
resources required to continue support for the application components that will be
necessary beyond implementation.

Confidence of the stakeholders in the projects ability to meet all requirements
(cost, schedule, functionality) – Weekly project status meetings and monthly Steering
Committee meetings are the vehicle to keep stakeholders informed on the progress of this
project, and provide confirmation that the Louisiana SACWIS project is on-time and on-
budget. The design review sessions, updated copies of the workplan, and the review
before the acceptance of project deliverables, will provide the State with opportunities to
verify that Louisiana SACWIS meets requirements.

Problems with interfacing systems may impact ability of system to meet
requirements – AMS will pursue early contact with the managers and team members who
“own” the legacy systems for the required interfaces to Louisiana SACWIS. It is critical to
meet SACWIS project timeframes to establish credibility with the interfacing system
teams. The team must foster and maintain working relationships with the staff who support
and oversee the external systems. While interface development is not part of Phase I
activity, early involvement of the State's SACWIS project staff to discuss the intent and
context of data sharing with staff of other state systems is beneficial. This can ensure that
political and administrative issues can be identified, explored, and properly addressed,
and proactive executive-level involvement can be secured when necessary.

Ability of system to adapt to changes in federal and state regulations
(requirements) – This is a joint responsibility of the AMS and Louisiana SACWIS project
staff to create and approve functionally cohesive yet flexible system designs to allow
adaptation to requirement changes. Actual changes to requirements or the possibility of
requirements or legislation changes need to be communicated to the SACWIS project
team as early as possible.

Lack of end-user buy-in – This risk will be addressed by the Change Readiness team
but can be further avoided by continuous communications including regional demos of the
American Management Systems                                                    Page 23 of 36
Louisiana SACWIS                                                                        11/17/00
Risk Management Plan
initial screen designs, if applicable. AMS has found that user participation increases the
credibility of the campaign and provides agency staff with ownership of the results of
change readiness activities.

Lack of support for web-enabled operations – In order to avoid this risk, the Change
Readiness team will need to communicate that the web is a tool to support the State’s
automation direction. The State technical team will need training and exposure to ensure
adequate support for the equipment and software needed to implement web-based
technology.

Staff may object to job changes – To address or avoid this risk, a solid change
readiness approach must be in place. The SACWIS project staff should begin to set
expectations with their peers and to normalize the automation of human service delivery.
Post-Implementation support, after Phase II, will facilitate the transition to conducting OCS
business with a statewide automation focus.

Large list of stakeholders – Louisiana SACWIS is a project with many stakeholders. As
milestones are reached their success should be communicated by various means.
Weekly project status meetings and monthly Steering Committee meetings are the vehicle
to keep stakeholders informed on the progress of this project, and provide confirmation
that the Louisiana SACWIS project is on-time and on-budget.




American Management Systems                                                    Page 24 of 36
Louisiana SACWIS                                                                        11/17/00
Risk Management Plan
Risk Impact Classification: Medium

Stakeholder requirements may not be compatible; Stakeholder requirements may
not be clear; Misinterpretation of requirements among stakeholders – Conducting
requirement definition sessions with attendees representing different stakeholder groups
will help clarify requirements. The Steering Committee is tasked with communication to the
broad group of stakeholders. Publishing meeting notes after the requirements definition
sessions will give the session attendees an opportunity to validate that the requirements
were recorded properly.

Ability for contractor to remain focused on State & Local Government solutions –
AMS has a growing business unit that specifically deals with State and Local government,
with a focus area in human service delivery automation. The Human Services unit within
AMS has grown consistently since 1995.

Inability of state to hire, train and retain qualified staff may cause project impact –
Should this risk become a threat to the success of the SACWIS project, AMS will support
the State through management discussions and sharing of information on recruiting
strategies or retention of current employees. The SACWIS project is using newer
technology which could be attractive to current staff and may attract new recruits.

Bad press and/or bad public relations – This risk can be managed through a proactive
approach. Through “good press” in the project information updates, the project can
attempt to create a “baseline” of good public relations. If an external or internal event
occurs that creates bad press, it must be approached in regards to the specific
circumstance. AMS will offer support through participation in the mitigation plan.




American Management Systems                                                  Page 25 of 36
Louisiana SACWIS                                                                      11/17/00
Risk Management Plan
Risk Impact Classification: Low

We do not have the ability to meet the schedule with all the requirements – This risk
will be addressed on a daily basis through all project members working to the schedule. If
a requirement or set of requirements begin to impact the schedule, they will be identified
as issues and specific risks. At that time, a specific risk mitigation plan with action steps
will be executed to minimize or eliminate the schedule impact.

New contractor does not know existing system – Through working closely with the
State staff and analysis of the legacy system(s) AMS will obtain the knowledge required to
minimize this risk. Design sessions, meetings and review of system documentation will
help AMS build the necessary knowledge base.

Inability of contractor to maintain qualified staff on the project may cause project
impact – This risk is addressed specifically in the Staff Retention Plan.

Existing requirements may no longer be applicable – Should this risk arise, the project
staff will document each specific requirement that is obsolete, with verification. Any new or
modified requirements would go through analysis to determine impact on schedule or
design.

Privatization could cause a change in requirements – This risk would be addressed
through means similar to changes in requirements. Any new or modified requirements
would go through analysis to determine impact on schedule or design.

Changing priorities may take project resources – The project plan includes interim
milestones as well as major deliverables. Internal priorities will be managed through
weekly status meetings, and monthly Steering Committee meetings. If there are external
priorities that impact project resources, the project management must provide a mitigation
strategy. If risks are identified that could impact the schedule, a risk mitigation plan with
specific action steps will be applied.

Availability of staff and users throughout the life cycle – This risk will be mitigated by
early communication of project schedules to both State and AMS staff. With advance
notice of meetings, reviews and working sessions, staff would be requested to plan
accordingly. In addressing parties external to the project, it is critical that the project meets
the published schedules. If there is a change, for any reason, this must be communicated
to all parties immediately.




American Management Systems                                                       Page 26 of 36
Louisiana SACWIS                                                                           11/17/00
Risk Management Plan
                                  APPENDIX B

                              Current Critical Risks




American Management Systems                            Page 27 of 36
Louisiana SACWIS                                                11/17/00
Risk Management Plan
                  Issue Number:                                                                     Initial Date: 11/15/00
  Current
                  Impacted Functional Area: Organizational
                  Risk Description: Impact of previous funding problems on future funding- AMS will support mitigation
                  of this risk by providing the State officials and stakeholders continual information on the following: progress of
                  the Louisiana SACWIS project, confirmation that the project is on-time and on-budget, statistics from the
                  parishes and state OCS office that demonstrate the need for SACWIS automation for the State. Additionally,
                  AMS will support the State in maintaining good working relationships with the Federal and State
                  representatives.



     RED          Impact:                                                                           Impacted Dependencies:

  Previous        Planned Mitigation Steps                                   Responsibility                        Status
    N/A

                  1.
                  2.
                  3.




American Management Systems                                                                                             Page 28 of 36
Louisiana SACWIS                                                                                                                 11/17/00
Risk Management Plan
                  Issue Number:                                                                 Initial Date: 11/15/00
  Current
                  Impacted Functional Area: Organizational
                  Risk Description:
                  Lack of funding for maintenance and operation- The State will identify needs, and project resources
                  necessary to maintain and operate the SACWIS system after implementation of Phase II. As part of Phase I,
                  AMS will provide estimates of the resources required to continue support for the application components that
                  will be necessary beyond implementation.




     RED          Impact:                                                                       Impacted Dependencies:

  Previous        Planned Mitigation Steps                                Responsibility                      Status
    N/A

                  1.
                  2.
                  3.




American Management Systems                                                                                       Page 29 of 36
Louisiana SACWIS                                                                                                           11/17/00
Risk Management Plan
                  Issue Number:                                                                     Initial Date: 11/15/00
  Current
                  Impacted Functional Area:
                  Risk Description:
                  Confidence of the stakeholders in the projects ability to meet all requirements (cost, schedule,
                  functionality)- Weekly project status meetings and monthly Steering Committee meetings are the vehicle to
                  keep stakeholders informed on the progress of this project, and provide confirmation that the Louisiana
                  SACWIS project is on-time and on-budget. The design review sessions, updated copies of the workplan, and
                  the review before the acceptance of project deliverables, will provide the State with opportunities to verify that
                  Louisiana SACWIS meets requirements.


     RED          Impact:                                                                           Impacted Dependencies:

  Previous        Planned Mitigation Steps                                   Responsibility                        Status
    N/A

                  1.
                  2.
                  3.




American Management Systems                                                                                             Page 30 of 36
Louisiana SACWIS                                                                                                                 11/17/00
Risk Management Plan
                  Issue Number:                                                                   Initial Date: 11/15/00
  Current
                  Impacted Functional Area:
                  Risk Description:
                  Problems with interfacing systems may impact ability of system to meet requirements – AMS will
                  pursue early contact with the managers and team members who “own” the legacy systems for the required
                  interfaces to Louisiana SACWIS. It is critical to meet SACWIS project timeframes to establish credibility with
                  the interfacing system teams. The team must foster and maintain working relationships with the staff who
                  support and oversee the external systems. While interface development is not part of Phase 1 activity, early
                  involvement of the State's SACWIS project staff to discuss the intent and context of data sharing with staff of
                  other state systems is beneficial. This can ensure that political and administrative issues can be identified,
                  explored, and properly addressed, and pro-active executive-level involvement can be secured when
                  necessary.
     RED          Impact:                                                                         Impacted Dependencies:

  Previous        Planned Mitigation Steps                                  Responsibility                      Status
    N/A

                  1.
                  2.
                  3.




American Management Systems                                                                                          Page 31 of 36
Louisiana SACWIS                                                                                                              11/17/00
Risk Management Plan
                  Issue Number:                                                                Initial Date: 11/15/00
  Current
                  Impacted Functional Area:
                  Risk Description:
                  Ability of system to adapt to changes in federal and state regulations (requirements) – This is a joint
                  responsibility of the AMS and Louisiana SACWIS project staff to create and approve functionally cohesive yet
                  flexible system designs to allow adaptation to requirement changes. Actual changes to requirements or the
                  possibility of requirements or legislation changes need to be communicated to the SACWIS project team as
                  early as possible.



     RED          Impact:                                                                      Impacted Dependencies:

  Previous        Planned Mitigation Steps                                Responsibility                      Status
    N/A

                  1.
                  2.
                  3.




American Management Systems                                                                                       Page 32 of 36
Louisiana SACWIS                                                                                                           11/17/00
Risk Management Plan
                  Issue Number:                                                                 Initial Date: 11/15/00
  Current
                  Impacted Functional Area:
                  Risk Description:
                  Lack of end-user buy-in – This risk will be addressed by the Change Readiness team but can be further
                  avoided by continuous communications including regional demos of the initial screen designs, if applicable,
                  can be given. AMS has found that user participation increases the credibility of the campaign and provides
                  agency staff with ownership of the results of change readiness activities.




     RED          Impact:                                                                       Impacted Dependencies:

  Previous        Planned Mitigation Steps                                Responsibility                      Status
    N/A

                  1.
                  2.
                  3.




American Management Systems                                                                                        Page 33 of 36
Louisiana SACWIS                                                                                                            11/17/00
Risk Management Plan
                  Issue Number:                                                                 Initial Date: 11/15/00
  Current
                  Impacted Functional Area:
                  Risk Description:
                  Lack of support for web-enabled operations- In order to avoid this risk, the Change Readiness team will
                  need to communicate that the web is a tool to support the State’s automation direction. The State technical
                  team will need training and exposure to ensure adequate support for the equipment and software needed to
                  implement web-based technology.




     RED          Impact:                                                                       Impacted Dependencies:

  Previous        Planned Mitigation Steps                                Responsibility                       Status
    N/A

                  1.
                  2.
                  3.




American Management Systems                                                                                        Page 34 of 36
Louisiana SACWIS                                                                                                            11/17/00
Risk Management Plan
                  Issue Number:                                                                     Initial Date: 11/15/00
  Current
                  Impacted Functional Area:
                  Risk Description:
                  Staff may object to job changes – To address or avoid this risk, a solid change readiness approach must
                  be in place. The SACWIS project staff should begin to set expectations with their peers and to normalize the
                  automation of human service delivery. Post-Implementation support, after Phase II, will facilitate transition of
                  OCS to deliver services with a statewide automation focus.




     RED          Impact:                                                                           Impacted Dependencies:

  Previous        Planned Mitigation Steps                                   Responsibility                        Status
    N/A

                  1.
                  2.
                  3.




American Management Systems                                                                                            Page 35 of 36
Louisiana SACWIS                                                                                                                11/17/00
Risk Management Plan
                  Issue Number:                                                               Initial Date: 11/15/00
  Current
                  Impacted Functional Area:
                  Risk Description:
                  Large list of stakeholders- Louisiana SACWIS is a project with many stakeholders. As milestones are
                  reached, their success should be communicated by various means. Weekly project status meetings and
                  monthly Steering Committee meetings are the vehicle to keep stakeholders informed on the progress of this
                  project, and provide confirmation that the Louisiana SACWIS project is on-time and on-budget




     RED          Impact:                                                                     Impacted Dependencies:

  Previous        Planned Mitigation Steps                               Responsibility                     Status
    N/A

                  1.
                  2.
                  3.




American Management Systems                                                                                      Page 36 of 36
Louisiana SACWIS                                                                                                          11/17/00
Risk Management Plan

				
DOCUMENT INFO
Description: Risk Management Plan for the System document sample