Upload
ngomien
View
215
Download
0
Embed Size (px)
Citation preview
© 2002 The MITRE Corporation. All Rights Reserved.1
ESCRisk Management Process
Facilitator TrainingVersion 1.0
Joe Duquette
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
2
ESC RMP Facilitator Training Agenda
Morning Session• Session 1 - Implementing Risk Management • Session 2 - RAM (Risk Assessment Meeting) Step 1 Preparation • Session 3 - RAM Step 2, 3, & 4 Identifying/Group/Write Risk
Afternoon Session• Session 4 - RAM Step 5&6 Analysis & Prioritize• Session 5 - RAM Step 7 Developing Handling Plans• Session 6 - Conduct Risk Review Meeting (RRM)
Each Session is 45 - 60 minutes, between sessions we will have a 15 minute break
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
3
Session 1 ESC RMP Facilitator Training
Implementing Risk ManagementImplementing Risk Management
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
4
ESC RMP Facilitator Training Agenda
Morning Session• Session 1 - Implementing Risk Management • Session 2 - RAM (Risk Assessment Meeting) Step 1 Preparation • Session 3 - RAM Step 2, 3, & 4 Identifying/Group/Write Risk
• Afternoon Session• Session 4 - RAM Step 5&6 Analysis & Prioritize• Session 5 - RAM Step 7 Developing Handling Plans• Session 6 - Conduct Risk Review Meeting (RRM)
Each Session is 45 - 60 minutes, between sessions we will have a 15 minute break
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
5
Session 1 ESC RMP Facilitator Training
Implementation ExampleImplementation Example
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
6
RMP ImplementationProblem Space and Interfaces
LeverageYour
Culture
RMPRMPUnknownProcess
Area
LifeCycle
ProductivityImpact
BusinessPlanning
BusinessPartners
OrganizationalStructureChange
Cost$$$$$$$$$
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
7
Problem Space Questions
• What is the ultimate goal of RMP Implementation? • How will we get to that goal?• What do we need to consider in planning for RMP?• What is the Enterprise role?• What is our Business?• How do we do business now?• How will we do RMP Implementation?• Who needs to be considered?• How do we want our implementation to execute?
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
8
What is Strategy
A Careful Plan or Method: a clever stratagem
The art of devising or employing plans or stratagems toward a goal
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
9
Understanding the Enterprise The Top of the Pyramid
Nothing great was ever achieved without enthusiasm. -- Ralph Waldo Emerson
• What do we want to be when we grow up?– Need to define the enterprise goals in terms of the desired end-
state of the enterprise.– Need to establish the roles of enterprise leaders in the process
improvement.– Need to identify and make available the appropriate resources to
implement the strategy.
• Rational people make rational decisions!– Need to establish the rationale for the adoption of the RMP.– Need to insure that the attributes of the enterprise are accounted
for in the RMP implementation.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
10
Your BusinessWhere Do We Live
• Clearly identify what your business is and how it relates to the rest of the world.
• What you are has a strong influence on what you will be or want to be.– Identify the unique character of you business– Denial is an enemy..be yourself– Knowing this will allow for understanding of what path to follow
to obtain the desired end-state
• How does your business operate.– What does the business cycle look like– What is the business tempo
Your goals, minus your doubts, equal your reality. -- Ralph Marston
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
11
Process Legacy Point of Departure
• What is your current approach to Risk Management?– Nothing– Contractor– System Engineering– ISO– Homemade
• Map current process approach to the ESC Standard. – Determine what is working– Phase out what isn’t working– Identify the gaps that need to be filled
• Identify and develop plans to manage the business impacts.Change is not merely necessary to life, it is life.
-- Alvin Toffler
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
12
Problems cannot be solved at the same level of awareness that created them-- Albert Einstein
Process Strategy Where the Rubber Hits the Road
• Need to decide on what your implementation approach will be. The process legacy gap analysis will point the way.
• Identify how you will do RMP Implementation.– Organize!– Plan?
• “Where you Live” will point the way as well, the business construct identified there needs to be mapped to the RMP.
• Establish the resource requirement and how it will be managed.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
13
External StakeholdersRMP Is Done By People
• The RMP will have an impact on the stakeholders.– Identify the impacts and needs – Determine if the RMP will be shared– Are there processes used by external stakeholders that could be
adapted by the enterprise
• Establish the methods of collaboration and the type of working relationships– Who are the players?– What is their authority?– Where will the engagements take place?– How often will the engagements occur?
Coming together is a beginning, staying together is progress, and working together is success.-- Henry Ford
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
14
Methods & Technique Tools Bring Process Alive
• What tools (methods, techniques, procedures) are currently being used?– Why are they being used?– What are they being used for?
• Do these tools fit into the process strategy defined?– Are they consistent with the RMP?
• Are they compatible with the the planned stakeholder collaboration?
• What tools are really needed? • How will you acquire, manage, and use the tools in your
toolbox? Men have become the tools of their tools.
-- Henry David Thoreau
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
15
Fitting It Altogether
Acqu
isitio
nOrg
aniza
tion
Cont
racto
r
Logis
tics
Opera
tions
Other
Custo
mer or
Spon
sor
Certi
ficati
onan
d Tes
t
Proje
ctM
anag
emen
t
Supp
ort
Custo
m
Other
Proc
ess
Man
agem
ent
Engin
eerin
gNo
thin
g
CMM
-SW
Sys.
Eng.
ISO
(Oth
er)
Hom
e Mad
e
Gove
rnm
ent
DoD
Indu
stry
Join
t
Com
mer
cial
ENTERPRISE
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
16
ExampleESC/MC RMP Implementation
Plan to Establish A Standard Risk Management Process In ESC/MC
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
17
BackgroundThree Phase Implementation
Implement Risk Management in the Following Phases
• Phase 1 - ESC/MC Set of Terminals- Program Director Defines Set of Terminals- Establish and Demo for ESC/MC Terminal Programs
• Phase 2 - MSSO Set of Terminals and Controls- Lead Engineer Provides Guidance - Establish and Demo Synchronized Component Program
• Phase 3 - Apply to Segments- Present Phase 1 & 2 Results to SE Council- Approval to Proceed with Phase 3- Propose Integration Strategies with Segments- Establish and Demo for MILSATCOM
Full Life Cycle
SoS
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
18
BackgroundPhase 1 - ESC/MC Implementation
Purpose: • Establish a Risk Management Process for a Selected set of MILSATCOM Terminal Programs
Objectives:• Rollout ESC/EN CMMI Based Risk Management Process• Integrate Process Over the Selected Set of MILSATCOM
Terminal Programs• Use Rollout Experience to Improve Upon the Risk Management Process and Methods for Rollout at Other ESC SPOs
Establish a Consistent, Enduring, and Integrated Risk Management Activity
To Answer the Question “What are the Risks.”
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
19
Assumptions
• Currently NO Integrated Risk Management Program(RMP) in ESC/MC- Isolated Ad Hoc Processes - CMMI Risk Management Concept to be Implemented
At Project and SPO Level Current Ad Hoc Project Processes Compatible
- Training Required at All Levels
• Risk Nav® will form Basis for the Definition of ESC/MC Risk Management Tools/Templates/Checklist/Metrics/Formats (Met all MC Tool Requirements)
Implement ESC/EN CMMI Based RiskManagement Process & Appropriate Tools
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
20
SPD* RMLT Lead
PM* RMLT
PM* RMLT
PM* RMLT
PM* RMLT
PM* RMLT
* Or Designated Representative
LE RMIPT
LE RMIPT
LE RMIPT
LE RMIPT
LE RMIPT
CE RMIPT Lead
• Identify Terminal Programs for Rollout of the ESC/MC RMP• Establish ESC/MC Risk Management Infrastructure
- Appoint Risk Management IPT (RMIPT)- Appoint Risk Management Leadership Team (RMLT)- Establish Risk Management Advisory Group
ESC Gov’t RepMSSO Rep.
AEROSPACEMITREMJPOJTEO
Core Group (As Required)
Terminal E
ESC/MC CE
Terminal A Terminal B Terminal C Terminal D
ESC/MC SPD
Terminal Programs for Rollout of the ESC/MC RMPPhase 1A:
• FABT• GMT• AITG
Phase 1B:• GBS• DSCS• SMARTT
• MBMMR• SPITFIRE
ESC/MC RMP Rollout Preparation
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
21
Risk Management Process (RMP) Teams
RMAG
RMLT
RMIPT
Core Group
• Risk Management Leadership Team (RMLT)
• Risk Management IPT (RMIPT)
• Risk Management Implementation Core Group
• RMP Advisory Group (RMAG)
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
22
• Conduct Familiarization Briefings (RMLT, RMIPT, Others)- Overview of ESC/MC Risk Management Rollout- Introduction to Risk Management Process
• RMIPT- Conduct Risk Management Self Assessment- Prepare Program Background Questionnaire
• RMLT- Become Advocate for Risk Management
with Program Team- Provide Resources to RMIPT Members
•RMAG- Ensure RMP addresses top-level synchronization- Break down barriers to ensure integration across segments
$
ESC/MC RMP Rollout Preparation (Continued)
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
23
ESC/MC RMP RolloutTailor
• Adapt CMMI Based Risk Management Process for ESC/MC Implementation- Use ESC/MC Program Baseline Information - Conduct Gap Analysis
Consistent with Existing Reporting Requirements Incorporate Existing Best PracticeIdentify Areas of Tailoring
- Revise CMMI Based Risk Management Process
• Define ESC/MC Risk Management Tools/Templates/Checklist/Metrics/Formats- Meet Requirements for Multiple Geographically Separated Programs - Adapt to ESC/MC Integrated Digital Environment
• ESC/MC Risk Management Process Review and Approval- RMLT Reviews and Approves ESC/MC Risk Management Process- Review and Recommendation from RMAG
No (Continue Monitoring)
Isthe Risk Plan
Working?Yes
(Continue Monitoring) Key
MilestoneApproaching
?
“n” MoSince Last Assessment
?
Revise Risk Plan
Step 7Monitor
Handling Plans
Step 5Establish Handling
Plans
Step 6Implement RiskHandling Plans
Step 1Prepare
Step 2Identify
Risks & Hazards
Step 4Decide on Control
Options
Step 3Assess & Prioritize
Risks
New Phase or KeyStakeholder
?
Yes
No
No (Continue
Monitoring)
Yes
Yes
(Continue Monitoring) No
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
24
ESC/MC RMP RolloutImplementation
• Finalize ESC/MC Risk Management Policy- Appropriate Policy on ESC/MC Risk Management Process - Operating Instructions on ESC/MC Risk Management Process
• Finalize Risk Management Infrastructure- Tools/Templates/Checklist/Metrics/Formats Tailored to
ESC/MC Risk Management Process- Install Tools/Templates/Checklist/Metrics/Formats on ESC/MC IDE
• Conduct Implementation Training- Tailor CMMI Based Risk Management Training- Provide Training for RMIPT, ESC/MC Trainers, Managers, and Others
• Initiate ESC/MC Risk Management Process- Execute ESC/MC Risk Management Process with Brainstorming Sessions with Each Program to be Included
- Use RMIPT to Monitor Progress
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
25
ESC/MC RMP Policy Letter
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
26
ESC/MC RMP OI
Contents• Background• Policy Implementation
• MC Standard RMP• MC Standard RMP Tool• RMP Training• Use of the MC Standard RMP
• Objectives• Roles and Responsibilities• References
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
27
ESC/MC Standard RMP Guides
Training
Tool
Process
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
28
ESC/MC Standard RMP Training
• Orientation Training• Train the Trainer• ESC/MC Standard RMP Training• ESC/MC Standard RMP Tool Training• Manager Training• Familiarization Training
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
29
ESC/MC Standard RMP Tools
AIR FORCE MILSATCOM
TERMINAL PROGRAMS
ESC/MC
RiskNav®
ESC/MC Risk Process Toolbox
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
30
ESC/MC Implementation Summary
• Implementation fell Behind Schedule due to Server Availability
• RiskNav® Install for all programs
• All RMP Assets ready
• RMP Toolkit Installed
• RMP Training Completed
• Initial Risk Assessment Conducted
• Implemented on more Programs than Planned
Coming together is a beginning, staying together isprogress, and working together is success.
-- Henry Ford
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
31
ESC/MC RMP ImplementationLessons Learned
Senior Manager "Buy-In" Essential for Successful Process Implementation. Thesuccess of the implementation will be because the senior leadership of theOrganization/SPO embraced risk management as an essential element of good programmanagement. The Organization Manager or SPO Director should launch the effort byannouncing his/her intention to establish an Organization/SPO-wide Risk ManagementProcess. This announcement should be immediately followed up with a series ofOrientation Briefings open to all Organization/SPO personnel. The OrganizationManager/SPO Director should introduce these sessions and emphasized the importance ofthe need for good risk management. These aren't just words. The OrganizationManager/SPO Director then directs the establishment of the organization/programRMIPTs and assigned a member of the Senior Leadership Team (i.e. Deputy) to chair theOrganization/SPO RMIPT. Other senior leaders in the Organization /SPO (e.g. DeputyDirector, Chief Engineer, MITRE Project Managers, and Technical Support ContractManagers) also need to demonstrate the same enthusiasm for the implementation. Thecontinuing emphasis and support by the Organization/SPO management team will createan excellent environment for the Organization/SPO Team to get about the business ofimplementing a Risk Management Process.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
32
ESC/MC RMP ImplementationLessons Learned(Continued)
Establish a Risk Management Culture. The risk management implementation is morethan a top down push. With the establishment of the RMIPTs at the Organization/SPOand IPT/Program level a culture of risk management will begin to form. The RMIPTs area natural mechanism for the development of understanding of the process, its supporttools, and how the process will be implemented. In the conduct of the program self-assessments, the IPT/Program RMIPTs will create a forum not only for the establishmentof Risk Management in the IPT/Program, but begin the integration of Risk Managementinto the daily management of the Organization/SPO. With this the Risk ManagementCore Team will be enabled and the communications across RMIPTs and across theOrganization/SPO will enable the team to work out problems and difficulties with theculture change that the Organization/SPO is undergoing.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
33
ESC/MC RMP ImplementationLessons Learned(Continued)
Fit the Process and Tools to the Organizational Business Model. A one size fits allattitude is not an appropriate paradigm for the implementation in the Organization/SPO.Even though the objective of the implementation is to establish a standard process acrossthe Organization/SPO, it will become clear very early in the implementation that theremay be a variety of needs. If this is not recognized early in the implementation (hopefullydiscovered in the preparation step) then potentially a large segment of theOrganization/SPO may end up implementing the process inappropriately. Further, thiswill cause frustration and may create "push back" that can have serious slow downs theimplementation. Therefore, the way the process is implemented must be adjusted to meetthe needs of the individual IPTs/Programs while maintaining the integrity of the standardapproach.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
34
ESC/MC RMP ImplementationLessons Learned(Continued)
Train the Process and how the Tools Enable the Process. In general the focus at thebeginning of the implementation activity will be the RiskNav® Tool with only someattention given to the process. In order to shift this emphasis, the training must focus onhow the tool will fit into the process. The training must make clear that the peopleexercising the process have the answers and the tool provides a place to house and use theinformation that the program teams possessed. This will offer a big payoff during theinitial program risk assessments. The IPTs or program teams need to understood whenand how the tool fits into the process and be able to practice good process discipline. Inaddition, the IPTs/Program Teams should use the tool as an enabler. It is likely that theinitial assessment meeting will end up with not using the tool at all. As the IPTs/ProgramTeams form their risk statements then the tool will be brought on line to perform theanalysis and prioritization that is needed to proceed with the development of themitigation strategies and actions.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
35
ESC/MC RMP ImplementationLessons Learned(Concluded)
Integrate into Everyday Program Management. If Risk Management is perceived as an"additional duty" or just another "bolt on" process than it is likely to be just a squarefiller. From the beginning of the implementation effort emphasis must be placed on theidea that Risk Management is congruent with Program Management and that the RiskManagement activities conducted by the IPTs/Program Teams should be integrated intotheir everyday program management activities. Further, the Organization/SPO Directorshould make it clear that the process and tool will be used regularly for internalOrganization/SPO management (e.g. program reviews). The idea is not to create work,but merely use the work that is accomplished in the normal course of managing theprogram. In addition, risk assessment/review meetings will become larger than the act ofidentifying and analyzing risks. These meetings will become a forum for theOrganization/SPO teams to synchronize the efforts of the entire team in executing theprogram by establishing a common view and understanding of the program-planninghorizon.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
36
Session 1 ESC RMP Facilitator Training
Instructing TechniquesInstructing Techniques
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
37
ESC RMP Facilitator Training Training Techniques
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
38
ESC RMP Facilitator Training Training Techniques
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
39
ESC RMP Facilitator Training Training Techniques
CONTINUOUSADULTLEARNINGCYCLE
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
40
ESC RMP Facilitator Training Training Techniques
FOUR STAGESOF
LEARNING ACTIVITIES
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
41
ESC RMP Facilitator Training Training Techniques
CHECKLIST1. Assess the Class2. Prepare for the Class3. Encourage Involvement4. Encourage Discussion5. Change Pace Often6. Explain WIIFM7. Build on Their Knowledge8. Comfortable Learning9. How It Fits Into the Job
10. Ownership
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
42
ESC RMP Facilitator Training Training Techniques
TEN PRESENTING “SINS”
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
43
ESC RMP Facilitator Training Training Techniques
Techniques That Work: Guidelines For Internal Presenters
ByPatricia A. HurtonMITRE Institute1 October 1998
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
44
Session 1 ESC RMP Facilitator Training
Facilitating RMP ImplementationFacilitating RMP Implementation
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
45
Awakening to the Need
The dawning realization of the need for change can take many forms:
• signs of a decline, which everyone has a reason for, but whichno one really understands
• high turn-over of talented staff• the existence of new and exciting opportunities that seem justout of grasp — unless some new ways of thinking and doingbusiness are implemented
• a pattern of projects that exceed cost, schedule or both• the unwillingness of certain customers to work with us unless wecan demonstrate mature product development processes
• the competition is eating our lunch• our most important customer just terminated their relationship
with us
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
46
Key Success Factors for Effective Launchof RMP
Before Risk Management can even be contemplated, topmanagement must recognize the need and be sold on the idea.
The Must Haves:
1 A compelling reason for RMP2 Leadership of the RMP implementation by the top executive in
the organization — responsibility cannot be delegated3 Informed commitment of the top management team4 Designation of a primary facilitator and an adequate
mandate for change5 Sound performance measures that drive change
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
47
1 Compelling Reason for RMP
For risk management implementation to take place, there must be a compelling reason for risk management. To be effective, the case for change must be
• Clear• Well articulated and meaningful• Logical and reasonable• Tied to the organization’s business goals• Qualitative and quantitative• Well-documented in an implementation plan• Persuasive enough to drive people to action
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
48
2 Leadership by Top Executive
For major change to take place, there must be a leader for the RMP implementation — someone who has the power to legitimize it.
This individual must be the top executive in the organization.
• the change is no longer a wish; it becomes policy and resourcesare assigned to make it happen
• the leader works in concert with the top management teamto elicit their support and sponsorship
• with the top executive and direct reports acting in concert,sponsorship is cascaded down through the organization andeach departmental manager and supervisor becomes persuadedof the need to act as a sponsor of change in their own area
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
49
3 Informed Commitmentof Top Management Team
The full support and commitment of the top management team arecritically necessary for the effort to succeed. Top management mustunderstand that
• their sustained support will be required, not just a decisionto move ahead; therefore, they need to understand what theyare getting into
• there is a need to translate their intellectual commitmentinto personal and emotional involvement
• there will be a need for new performance measuresand incentives
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
50
4 Designation of a Facilitatorwith an Adequate Mandate
Experience indicates that the skill and dedication of thefacilitator (change agent) is a key success factor.
• What is a Facilitator?
• What is the role of the Facilitator?
• What is an Adequate Mandate for the Facilitator?
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
51
What is a Facilitator?
The facilitator is the individual whose role is to support the leader and the management team in bringing about the desired transformation of the organization.
In CMM-based process improvement, we call this individual the Process Group (PG) leader.
This person needs to thoroughly understand quality management methods—or be willing and able to learn very quickly.
This person must be able to work with senior management effectively. He or she must be effective in a senior management role (i.e., more strategic than operational), and be familiar with how senior management thinks and works.
This person must be competent in management skills, such as communication and interpersonal skills, negotiation, working with groups, etc.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
52
Role of the Facilitator
The facilitator supports and advises the leader and other executive colleagues as a peer, as a subject matter expert, and as a helper. For example, the facilitator
• plays an active part in discussions and decision-making regardingimplementation issues that affect the organization (as a peer at topmanagement meetings)
• provides guidance to the management team on technical issueshaving to do with implementing the RMP
- selecting appropriate strategies and methods forimplementing the RMP- choosing the individuals that will participate on implementationteams
• challenges top management team when evidence suggests thatthe implementation or the team’s commitment is faltering
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
53
Possible Roles of the Facilitator
• Visionary• Advocate• Navigator• Confidant, supporter• Coach• Subject-matter expert• Role model
InappropriateAppropriate
• Gopher• Commander Quality• Spy• Progress chaser• Self-promoter or credit-taker
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
54
What is an Adequate Mandate for theFacilitator?
For effective implementation to occur, the organization’s leaders must provide the facilitator with the following:
• a formal definition of the role, including an understanding that theperformance measures for this individual are not short-term andbottom-line
• adequate time to devote to the job, that is, a full-time assignment• membership on the management team• a time horizon sufficient to implement the RMP (6-12 months)and functioning
• an expectation on the part of the top executive that the Facilitator will become a close and trusted colleague
• an adequate budget allocation
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
55
5 Performance Measuresthat Drive Implementation
Measures are integral to effective implementation. A goal-focusedmeasurement system is the best vehicle for galvanizing managementaction and institutionalizing the RMP.
If you deploy a poor set of measures (or none at all), any positiveaccomplishment will be undermined by inefficiencies as managerschase an inconsistent and/or conflicting set of targets.
Performance measures must be:
• Relevant. Does the measure have a significant, demonstrablerelation to strategy and business goals?
• Reliable. Will the measure identify strengths or weaknessesof one or more business processes?
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
56
Performance Measures: Reestablishing Your Business Goals
Performance measures must be tied to and reflect the new vision thatis driving the implementation. And the right measures must be forged onbusiness goals that are both real and inspirational.
For most organizations, development of performance measures mustbe preceded by reestablishing or refreshing the organization’s values,vision, mission and goals.
When these are undefined, are not communicated, or are not inspiringto people, it can undermine any effort to improve.
If the values, vision, mission and goals are poorly defined, then workwill be needed before performance measures can be considered—orbefore other positive changes can be achieved.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
57
You Must Have the “Must-Haves”
1 A compelling reason for change2 Leadership of the change effort by the top executive in
the organization — responsibility cannot be delegated3 Informed commitment of the top management team4 Designation of a primary change agent (the SEPG
Leader) and an adequate mandate for change5 Sound performance measures that drive change
Without these, there’s a significant riskthat you will experience a “false start” ofyour Risk Management Implementation.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
58
ESC RMP Facilitator Training Facilitating RMP Implementation
Adapted from Material Prepared by:
Mike Bloom and
Extracted from SEI’sMastering Process Improvement
Course
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
59
ESC RMP Facilitator Training Break
15 Minute Break
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
60
Session 2 ESC RMP Facilitator Training
Conduct Risk Assessment Meeting (RAM) RAM Step 1 Preparation
Conduct Risk Assessment Meeting (RAM) RAM Step 1 Preparation
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
61
ESC RMP Facilitator Training Agenda
Morning Session• Session 1 - Implementing Risk Management• Session 2 - RAM (Risk Assessment Meeting) Step 1 Preparation • Session 3 - RAM Step 2, 3, & 4 Identifying/Group/Write Risk
• Afternoon Session• Session 4 - RAM Step 5&6 Analysis & Prioritize• Session 5 - RAM Step 7 Developing Handling Plans• Session 6 - Conduct Risk Review Meeting (RRM)
Each Session is 45 - 60 minutes, between sessions we will have a 15 minute break
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
62
ESC RMP Facilitator Training How to Conduct a RAM
Objective - Program Stakeholders Identify, Analyze, Prioritize,and Develop Handling Plans
Setting - Group “face-to-face” Meeting• Bringing Stakeholders Together Provides Opportunity to Develop a Common Program Identity• Provides Focus and Insures that the Risk Management Team Develops a Common
Understanding of Mission, Program and Risk Management Philosophy• Punctuates the Need for Commitment to the Task and Commitment of Resource• Provides Opportunity for Training if Needed• Opens the Channels of Communication
Tools Used• ESC Risk Toolbox• Brainstorming• Affinity Grouping• RiskNav®
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
63
ESC RMP Facilitator Training RAM Steps
Step 1 - Define the Key Program Objectives or RequirementsStep 2 - Use Structured Brainstorming to Identify RisksStep 3 - Use Affinity Diagram to Group, Classify and Identify
Dependent or Related RisksStep 4 - Write Clear and Quantifiable Risk StatementsStep 5 - Review Risks and Identify Relevant Time Frame,
Probability, and Impact for Each Risk IdentifiedStep 6 - Prioritize RiskStep 7 - Brainstorm Actions (Mitigation Strategies)
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
64
ESC RMP Facilitator Training RAM Checklist
• Seven Pages• One Page for Each RAM Step• Each Step has Introduction• Each Step Identifies Specific Actions
• Notes Space
We will use this checklist as aGuide through the RAM
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
65
ESC RMP RAM Step 1 - Prepare
Risk Management Becomes a Management PriorityRisk Management Becomes a Management Priority•• Manager Becomes Advocate of Risk ManagementManager Becomes Advocate of Risk Management•• Manager Commits Energy and Resource to EffortManager Commits Energy and Resource to Effort
Risk Management Becomes a Program PriorityRisk Management Becomes a Program Priority•• Stakeholders Become CoStakeholders Become Co--Sponsors Sponsors •• Stakeholders Commit to Sufficient ResourceStakeholders Commit to Sufficient Resource
Risk Management Becomes a Mission PriorityRisk Management Becomes a Mission Priority•• Process is Focused on Successful MissionProcess is Focused on Successful Mission•• Stakeholders Become Familiar with Program and MissionStakeholders Become Familiar with Program and Mission
Stakeholders Identify Mission UncertaintiesStakeholders Identify Mission Uncertainties•• Various Risk Data and Information Available to All StakeholdersVarious Risk Data and Information Available to All Stakeholders•• Each Stakeholder Formulates Individual Concerns/UncertaintiesEach Stakeholder Formulates Individual Concerns/Uncertainties
Action 1:Obtain Commitment andResources from Program Manager on Risk Mgmt.
Action 3:Identify and Distribute to
Stakeholders the Key ProgramMission Objectives & Requirements
Action 2:Identify Key Program/
Mission Stakeholders andRequest Their Participation
Action 4:Identify, Review, and Distribute
Applicable Risk /Hazard Taxonomies to Stakeholders
Form the TeamForm the Team Know the MissionKnow the Mission Think RisksThink Risks
PM B
uyPM
Buy
--InIn
Stakeholder Buy
Stakeholder Buy--ININ
Mission Priority
Mission Priority
ID RisksID Risks
CommitCommit
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
66
ESC RMP RAM Checklist Step 1 - Prepare
Instructions: Prior to the Risk Assessment Meeting meet with the program manager andestablish the meeting objectives and agenda. Provide all participants in the meeting with accessto program documentation and the Risk Management Toolbox. Instruct the participants to reviewthe program documentation for understanding and the Risk Management Toolbox for anunderstanding of the Risk Management Process to be used. In addition, appropriate risktaxonomies and lessons learned should found in the toolbox should be reviewed.
Step 1 Define the Key Program Objectives or Requirements: The purpose of thisactivity is to ensure that there is consensus and clear understanding of the program objectives orrequirements (operational, key technical performance parameters, cost, and schedule). Programrequirements can be found in a number of places: capstone requirements document, operationalrequirements document (ORD), acquisition program baseline (APB), program managementdirective, policy directives.
Action Description Complete1 Is a white board, flip chart, or electronic means available for use in
recording the program Objectives or Requirements?2 Have the key program requirements been reviewed and captured?3 Has the list been reviewed and does everyone agree with the list? Has
anything been forgotten?4 Do all participants understand and agree with the program objectives and
requirements defined?
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
67
ESC RMP Training ExercisePreparing the Team for the RAM
Exercise 1
Preparing for the Risk Assessment Meeting
(Pages 3-7 of ESC RMP Facilitator Training Exercise Booklet)
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
68
ESC RMP Facilitator Training Break
15 Minute Break
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
69
Session 3 ESC RMP Facilitator Training
RAM Step 2, 3, & 4 Identifying/Group/Write RiskRAM Step 2, 3, & 4 Identifying/Group/Write Risk
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
70
ESC RMP Facilitator Training Agenda
Morning Session• Session 1 - Implementing Risk Management • Session 2 - RAM (Risk Assessment Meeting) Step 1 Preparation • Session 3 - RAM Step 2, 3, & 4 Identifying/Group/Write Risk
• Afternoon Session• Session 4 - RAM Step 5&6 Analysis & Prioritize• Session 5 - RAM Step 7 Developing Handling Plans• Session 6 - Conduct Risk Review Meeting (RRM)
Each Session is 45 - 60 minutes, between sessions we will have a 15 minute break
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
71
ESC RMPRAM Step 2 -4 Identify/Group/Write
Conduct Risk Management Meetings Conduct Risk Management Meetings •• Initial Meeting Sets Tone and Opens Channels of CommunicationInitial Meeting Sets Tone and Opens Channels of Communication•• Subsequent Meetings Need to be Held as Program ProgressesSubsequent Meetings Need to be Held as Program Progresses
Understand Mission, How Risk Will be Managed, and Tools AvailablUnderstand Mission, How Risk Will be Managed, and Tools Availablee•• Compare Current Mission with Past Missions (Taxonomies)Compare Current Mission with Past Missions (Taxonomies)•• Make Sure Everyone Understands How Risk Management Will be DonMake Sure Everyone Understands How Risk Management Will be Donee
Identify Program RisksIdentify Program Risks•• The Inability to Achieve Program ObjectivesThe Inability to Achieve Program Objectives•• When will it HappenWhen will it Happen
Classify the RisksClassify the Risks•• Can Use a Predefined Structure (Taxonomy, WBS, CPT etc.)Can Use a Predefined Structure (Taxonomy, WBS, CPT etc.)•• Can Use a SelfCan Use a Self--Organized StructureOrganized Structure
Consolidate Like Risk and Write Risk StatementsConsolidate Like Risk and Write Risk Statements•• Capture Concise Description to be Acted UponCapture Concise Description to be Acted Upon•• Risk Statement = Condition + ConsequenceRisk Statement = Condition + Consequence
Establish TeamEstablish Team Develop UnderstandingDevelop Understanding IdentifyIdentify WriteWrite
Action 1:Assemble
Stakeholders for Risk Assessment
Action 2:Review Program/Mission
Objectives, Taxonomies andRisk Assessment Process
Action 3:Conduct Risk
Identification Through Stakeholder Discussion
Action 4:Group
Related Risks
Action 5:Consolidate RelatedRisks & Write “If -
Then” Risk Statements
ClassifyClassify
No (Continue Monitoring)
Isthe Risk Plan
Working?Yes
(Continue Monitoring) Key
MilestoneApproaching
?
“n” MoSince Last Assessment
?
Revise Risk Plan
Step 7Monitor
Handling Plans
Step 5Establish Handling
Plans
Step 6Implement RiskHandling Plans
Step 1Prepare
Step 2Identify
Risks & Hazards
Step 4Decide on Control
Options
Step 3Assess & Prioritize
Risks
New Phase or KeyStakeholder
?
Yes
No
No (Continue
Monitoring)
Yes
Yes
(Continue Monitoring) No
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
72
ESC RMP RAM Checklist Step 2 - Identify Risk
Step 2 Use Structured Brainstorming to Identify Risks: In identifying the risks,consider the following things: when is the risk likely to impact the program (timeframe), how badlywill it affect our ability to achieve program objectives, and how likely is it to occur? Considerationshould be given to the time frame of concern (e.g. now to next milestone, development,production, etc.)
Risk identification is accomplished through structured brainstorming techniques to generateideas. Each person writes his or her ideas on sticky notes. One idea per person is read aloud, ora participant can pass until the next round. Questions may be asked to clarify understanding, butparticipants should withhold judgement or criticism at this time. Each risk is posted on a board orwall. This process ensures that all the participants have an equal opportunity to express theirconcerns or risk areas. A complete round of “passes” ends the session and the participants areready for the next step.
Action Description Complete1 What is the timeframe of concern for the risk assessment meeting?2 Have materials required for brainstorming available (sticky notes,
pencils)?3 Has it been made clear that the goal is to generate ideas, therefore it is
important to postpone judgement?4 Have each participant write each of their risk/concern in silence on sticky
notes. (repetitive action)5 Have each participant present one idea per person in sequence, or “pass”
(repetitive action)6 Each participant reads his or her idea aloud. (repetitive action)7 Are questions being asked to clarify understanding not for analysis?8 A complete round of “passes” ends the session.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
73
ESC RMP RAM Checklist Step 2 - Identify Risk
How to do structured brainstorming• The goal is to generate ideas, therefore it is important to postpone judgement• Write each idea in silence on sticky notes• One idea per person in sequence, or “pass”
− The idea is read aloud− Questions may be asked to clarify understanding not for analysis
• A complete round of “passes” ends the session
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
74
ESC RMP RAM Checklist Step 3 - Group Risk
Step 3: Use Affinity Diagram to Group, Classify and Identify Dependent orRelated Risks: This step in the process uses classic affinity diagramming techniques to grouprelated and dependent risk and determine risk categories. This approach works well because itlets the team determine the appropriate categories rather than having to force fit the risks intostandard categories (cost, schedule, political, technical) that might not cover all the uniqueaspects of a program. The team silently organizes the sticky notes from the brainstorming activityinto related groups. The intent is to group similar risks under a single category and identify relatedrisks. Identification of dependent risks will aid in constructing action plans that address not onlythe risks but also other risks that might be affected by the proposed mitigation strategies. Thisactivity helps the team achieve consensus on the grouping and helps eliminate or consolidateduplicate risks that might have been generated during the brainstorming phase.
Action Description Complete1 As a team, silently organize risks captured on the yellow stickies into
related groups or subgroups.2 Identify “Which risks are similar?”3 Answer the following question for each risk identified, "Is this risk
connected to any other risk?"4 For each proposed risk determine if there is a logical connection with
other risks or ideas that the participants may have. Note: It is OK forsome notes to stand alone
5 Have duplicates been identified and combined?6 Create summary or header cards -- short word or statement describing
each of the groups established.7 Achieve consensus on the description of each group before moving on.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
75
ESC RMP Affinity Grouping
MaintenanceMaintenance Training/Training/QualsQuals Preflight/PlanningPreflight/Planning
Flight ProceduresFlight Procedures Tactical ApplicationsTactical Applications Personnel PerformancePersonnel Performance
PartsSE/Test EquipmentMaintenance ManualsInterface w/ other equipQA
AircrewSimulatorsMaintenanceQARs
Info for programmingTime for programmingWarm-up/test procedures
Emergency proceduresNavigationFormationNATOPS Manual
VertrepFastropeTroop Insertion/Extraction
ScanCockpit responsibilitiesHabit patterns
How to create the Affinity Diagram• As a team, silently organize risks captured on the yellow“post-it”notes into related groups or subgroups
−“Which risks are similar?”−“Is this risk connected to any other risk?”
• As an Idea is moved back and forth try to see the logical connection the other person is making. It is OK for some notes to stand alone.
• Use the process to identify and combine duplicates• For each grouping
−Create summary or header cards -- short word or statement describing the group−Achieve consensus on the description before moving on
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
76
ESC RMP RAM Checklist Step 4 - Write
Step 4 Write Clear And Quantifiable Risk Statements (“if condition, thenConsequences”): This step is important because it facilitates communication among theteam members about the meaning of the risks and makes it easier to generate action plans andmitigation strategies. Going through each risk statement, the team transforms each into an “if”condition, then “consequences” statement and make sure everyone agrees with the words used.At this point, the recorder enters each risk statement into the RiskNav®.
Action Description Complete1 Does each risk statement provides the clarity and descriptive information
required for a reasoned and defensible assessment of the risk’soccurrence probability and impact?
2 Does each risk statement contain two components: 1. A statement of theCondition Present (i.e. the "if condition" and the Associated Risk Event(or events) (i.e. "then consequences")?
3 For each of the risk statements add a new risk in the RiskNav® databaseand enter the data on the screen.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
77
ESC RMP Write Risk Statements
• For example:− Requirement reads: “Use Common Operational Picture (COP)
in DII COE Release 1.5”− Identified risk: availability of DII COE version 1.5 when
needed− Risk statement:
IF DII COE version 1.5 is more than 1 month late, THEN Program xyz release 1 will experience a day for
day schedule slip
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
78
ESC RMP Training ExerciseRisk Identification & Recording
Exercise 2
Identifying and Recording Risk Using RiskNav®
(Pages 8-12 of ESC RMP Facilitator Training Exercise Booklet)
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
79
ESC RMP Facilitator Training Lunch
Lunch Break
STOP
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
80
Session 4 ESC RMP Facilitator Training
RAM Step 5&6 Analysis & PrioritizeRAM Step 5&6 Analysis & Prioritize
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
81
ESC RMP Facilitator Training Agenda
Morning Session• Session 1 - Implementing Risk Management• Session 2 - RAM (Risk Assessment Meeting) Step 1 Preparation • Session 3 - RAM Step 2, 3, & 4 Identifying/Group/Write Risk
Afternoon Session• Session 4 - RAM Step 5&6 Analysis & Prioritize• Session 5 - RAM Step 7 Developing Handling Plans• Session 6 - Conduct Risk Review Meeting (RRM)
Each Session is 45 - 60 minutes, between sessions we will have a 15 minute break
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
82
ESC RMPRAM Step 5 & 6 - Analyze & Prioritize
AIdentify Consequences or Level of Impact to the Program If the Identify Consequences or Level of Impact to the Program If the Risk OccursRisk Occurs• Establish or use Predetermined Impact Categories Establish or use Predetermined Impact Categories (e.g. Critical, Serious, Moderate, Minor, Negligible)(e.g. Critical, Serious, Moderate, Minor, Negligible)
Determine the Probability of OccurrenceDetermine the Probability of Occurrence•• Establish or Use Predetermined Probability Bands Establish or Use Predetermined Probability Bands ( e.g. Very Unlikely, Unlikely, Probably, Likely, Very Likely)( e.g. Very Unlikely, Unlikely, Probably, Likely, Very Likely)
For Each Risk Identify the Time Period When the Risk Is Likely For Each Risk Identify the Time Period When the Risk Is Likely to Occurto Occur•• Establish or Use Predetermined Time Periods ( e.g. Near, MidterEstablish or Use Predetermined Time Periods ( e.g. Near, Midterm, Far)m, Far)
Incorporate Existing Identified Risks With Newly Identified RisIncorporate Existing Identified Risks With Newly Identified Risksks•• Reassess Existing Risks Following Actions 1,2, and 3.Reassess Existing Risks Following Actions 1,2, and 3.•• Fold Existing Risks and Newly Identified Risk TogetherFold Existing Risks and Newly Identified Risk Together
Prioritize RisksPrioritize Risks•• Involves Grouping Risks Using Impact, Probability and TimingInvolves Grouping Risks Using Impact, Probability and Timing•• Objective Is to Identify Most Serious Program RisksObjective Is to Identify Most Serious Program Risks
Identify Risk Handling BandsIdentify Risk Handling Bands•• Place Risks in to Appropriate Handling BandPlace Risks in to Appropriate Handling Band•• Objective Is to Establish Preliminary Resource ConstraintsObjective Is to Establish Preliminary Resource Constraints
Impact ?Impact ? Probability ?Probability ? Old Risks ?Old Risks ? Coarse SortCoarse Sort
Action 1:Identify & Reach
Consensus on Impact / Severity for Each Risk
Action 2:Identify & Reach Consensus
on Probability ofOccurrence for Each Risk
Action 3:Identify Time Window when
Risk Could Occur
Action 5:Prioritize Risks
by Impact,Probability & Time
Action 6:Identify Handling
Bands
Action 4:Reassess AnyExisting Risks
in Database
When ?When ? PrioritizePrioritize
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
83
ESC RMP RAM Checklist Step 5 - Analyze
Step 5 Review Risks and Identify Relevant Time Frame, Probability, andImpact for Each Risk Identified: Using the RiskNav risk list developed in the previousstep, open each added risk. As a group, discuss each risk and agrees upon the appropriateimpact date, probability and impacts (cost, schedule, technical, and oversight & compliance).
Action Description Complete1 For each risk added to the RiskNav® database the group identifies the
time period (actual date) when the risk is likely to occur and enter thisdate and justification using the edit analysis function in RiskNav®.
2 For each risk added to the RiskNav® database the group identifies theprobability of the risk occurring and enters the probability and justificationusing the edit analysis function in RiskNav®.
3 For each risk added to the RiskNav® database the group identifies thecost impact and enters the cost impact and justification using the editanalysis function in RiskNav®.
4 For each risk added to the RiskNav® database the group identifies theschedule impact and enters the schedule impact and justification usingthe edit analysis function in RiskNav®.
5 For each risk added to the RiskNav® database the group identifies thetechnical impact and enters the technical impact and justification usingthe edit analysis function in RiskNav®.
6 For each risk added to the RiskNav® database the group identifies theC&O impact and enters the C&O impact and justification using the editanalysis function in RiskNav®.
7 For each risk, upon completion of the entries in Actions 1-6 above,compute the risk scores by depressing the Recompute button on theRiskNav® edit analysis screen.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
84
ESC RMP RAM Checklist Step 6 - Prioritize
Step 6 Risk Priority: With the completed risk analysis, the RiskNav® tool will compute therisk priority. This involves the grouping of risks using impact, probability and timing. The objectiveof the prioritization is to identify the most serious program risks. See the ESC/MC RMP toolGuide for an example of the result of RiskNav® prioritization of risks.
Action Description Complete1 Use the calculated Risk Priority of the RiskNav® tool to identify highest to
lowest risk within the risk list2 Using the RiskNav® tool Plots identify high priority risks to manage3 Establish agreement about the results between PM and team
(consensus) as to risk to proceed to develop handling plans for.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
85
ESC RMP Training ExerciseAnalyzing and Prioritizing Risk
Exercise 3
Using RiskNav® to Assess and Prioritize Risk
(Pages 13-16 of ESC RMP Facilitator Training Exercise Booklet)
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
86
ESC RMP Facilitator Training Break
15 Minute Break
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
87
Session 5ESC RMP Facilitator Training
RAM Step 7 Developing Handling PlansRAM Step 7 Developing Handling Plans
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
88
ESC RMP Facilitator Training Agenda
Morning Session• Session 1 - Implementing Risk Management• Session 2 - RAM (Risk Assessment Meeting) Step 1 Preparation • Session 3 - RAM Step 2, 3, & 4 Identifying/Group/Write Risk
• Afternoon Session• Session 4 - RAM Step 5&6 Analysis & Prioritize• Session 5 - RAM Step 7 Developing Handling Plans• Session 6 - Conduct Risk Review Meeting (RRM)
Each Session is 45 - 60 minutes, between sessions we will have a 15 minute break
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
89
ESC RMPRAM Step 7 - Handling Plans
a
Choose Risk Handling Options Choose Risk Handling Options
Decide Which Risk Will:Decide Which Risk Will:•• Be AssumedBe Assumed•• Be Watched (set Be Watched (set ““TriggersTriggers”” or or ““CuesCues””))•• AvoidedAvoided•• TransferredTransferred•• MitigatedMitigated
Assign Responsibility for Risk PlanningAssign Responsibility for Risk Planning•• Avoid Risk Avoid Risk -- Research, Design, Fund etc.Research, Design, Fund etc.•• Transfer Risk Transfer Risk -- To Whom, AcceptanceTo Whom, Acceptance•• Mitigate Risk Mitigate Risk -- Strategy, Resources etc.Strategy, Resources etc.
Establish and Update a Risk DatabaseEstablish and Update a Risk Database
OptionsOptions Easy RisksEasy Risks ResponsibilityResponsibility CaptureCapture
Action 1:Identify Handling Options
Within Each Risk Band
Action 2:Identify Which
Risks will be Assumed
Action 3:Identify Which
Risks will be Avoided,Transferred or Mitigated
Action 4:Assign Plan OPRs
for Avoided, Transferred,or Mitigated Risks
Action 5:Establish orUpdate Risk
Database
High Medium Low
Ranked Risks
AssumeAvoid
TransferMitigateMonitor
AvoidTransferMitigateMonitor
“Cues”ActionPlans
“Triggers”ContPlans
Hard RisksHard Risks
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
90
ESC RMP RAM Checklist Step 7 - Handling Plans
Step 7 Brainstorm Actions (Mitigation Strategies), Select Strategy andBegin Developing Action Plans for Risks that Have Been Selected toManage: This activity focuses on the risks identified in the previous step. This step can beaccomplished using a freeform (or unstructured) brainstorming method to identify potentialmitigation strategies. For each risk, participants contribute ideas as they come to mind. Theseideas are captured on a white board or flip charts. A summary statement for the mitigationapproach is captured. Responsible individuals are assigned to implement the action plans. Thesehandling plans are documented in the mitigation section of the RiskNav® tool.
Action Description Complete1 Focus is on the risks identified in the previous step2 Use freeform (or unstructured) brainstorming to develop potential
strategies (participants contribute ideas as they come to mind).3 From the RiskNav® risk list, open each risk mitigation, on the mitigation
page open Create Mitigation Plan.4 For each risk assign the appropriate POC responsible for the risk, either
by the pull-down menu or adding a new POC.5 For each risk enter the mitigation strategy and impact description.6 If actions are to be added, open the risk mitigation plan and add action
steps using the RiskNav Define New Action Step screen. Repeat until allactions have been entered.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
91
ESC RMP Establishing Handling Plans
ADraft the Handling PlansDraft the Handling Plans
•• Avoided, Transferred and Mitigated RisksAvoided, Transferred and Mitigated Risks•• Contingency and Risk Status Change PlansContingency and Risk Status Change Plans•• 11--3 Pages, Standard Format, Matches Database3 Pages, Standard Format, Matches Database
Program Manager Review and ApprovalProgram Manager Review and Approval•• Program Manager BuyProgram Manager Buy--in of the Handling Planin of the Handling Plan•• Formal Process to Insure That Resources Required Are AllocatedFormal Process to Insure That Resources Required Are Allocated•• Opportunity to Improve the Handling Plan and Provide Team PerspOpportunity to Improve the Handling Plan and Provide Team Perspectiveective•• Process Is Iterative and May Require a Number of Changes to ProProcess Is Iterative and May Require a Number of Changes to Proposed Plansposed Plans•• Can Provide an Opportunity to Expose and Adjudicate Different PCan Provide an Opportunity to Expose and Adjudicate Different Points of Viewoints of View
Funded, Directed and Integrated with Program ManagementFunded, Directed and Integrated with Program Management•• Usually Requires Expenditure of Resources (E.G. Cost Estimates Usually Requires Expenditure of Resources (E.G. Cost Estimates And/or Budget Actions)And/or Budget Actions)•• For a Handling Plan to Have Impact It Must Be EnforceableFor a Handling Plan to Have Impact It Must Be Enforceable•• Appropriate Changes to Program Directives and Execution DocumenAppropriate Changes to Program Directives and Execution Documents and Monitoredts and Monitored
Develop Plans & EstimatesDevelop Plans & Estimates Review and ApproveReview and Approve Fund, Direct, IntegrateFund, Direct, Integrate
Action 1:Develop Draft Handling
Plans and AssociatedResource Requirements
Action 2:Obtain Program Manager Review
and Approval of HandlingPlans and Exit Criteria
Action 3:Handling Plan are Funded,Directed, and Integrated
with Program Management
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
92
ESC RMP Training ExerciseDeveloping Handling Plans
Exercise 4
Developing Handling Plans and Using RiskNav®
(Pages 17-19 of ESC RMP Facilitator Training Exercise Booklet)
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
93
ESC RMP Facilitator Training Break
15 Minute Break
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
94
Session 6 ESC RMP Facilitator Training
Conduct Risk Review Meeting (RRM)Conduct Risk Review Meeting (RRM)
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
95
ESC RMP Facilitator Training Agenda
Morning Session• Session 1 - Implementing Risk Management• Session 2 - RAM (Risk Assessment Meeting) Step 1 Preparation • Session 3 - RAM Step 2, 3, & 4 Identifying/Group/Write Risk
Afternoon Session• Session 4 - RAM Step 5&6 Analysis & Prioritize• Session 5 - RAM Step 7 Developing Handling Plans• Session 6 - Conduct Risk Review Meeting (RRM)
Each Session is 45 - 60 minutes, between sessions we will have a 15 minute break
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
96
ESC RMP Facilitator Training How to Conduct a RRM
Objective - Program Stakeholders Review, Update, and Identify New Risk
Setting - Group “face-to-face” Meeting (Alternative VTC/Telecon)• Bringing Stakeholders Together for Collective Review of Current Risks• Provides Focus and Insures that the Risk Management is Executing the Risk Management
Process (i.e. Executing Handling Plans, Adjusting Risk, Identifying New Risk)• Punctuates the Need for Commitment to the RMP and Commitment of Resource• Provides Opportunity for Training if Needed• Opens the Channels of Communication
Tools Used• ESC Risk Toolbox• Brainstorming• Affinity Grouping• RiskNav®
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
97
ESC RMP Facilitator Training RRM Steps
Step 1 - Meeting PreparationStep 2 - Review Current RisksStep 3 - Review Proposed RisksStep 4 - Identify New Risk and Write Clear and Quantifiable
Risk StatementsStep 5 - Review New Risks and Identify Relevant Time Frame,
Probability, and Impact for Each Risk IdentifiedStep 6 - Brainstorm Actions (Mitigation Strategies)Step 7 - Review of Complete Risk List
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
98
ESC RMP Facilitator Training RRM Checklist
• Seven Pages• One Page for Each RRM Step• Each Step has Introduction• Each Step Identifies Specific Actions
• Notes Space
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
99
ESC RMP Facilitator Training RRM Checklist - Step 1 Meeting Preparation
Instructions: Prior to the Risk Review Meeting meet with the program manager and establishthe meeting objectives and agenda. Encourage all participants in the meeting to review thecurrent program risk list in RiskNav® prior to the review meeting.
Step 1 Meeting Preparation: Insure that all POCs responsible for risk mitigation ormitigation actions have updated the RiskNav database prior to the meeting.
Action Description Complete1 Notify all POCs and other attendees of the meeting date, location, and
agenda.2 Prior to the Risk Review Meeting review the risk list for completeness.3 Prepare necessary and appropriate RiskNav® reports4 Arrange for meeting room with access to RiskNav®.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
100
ESC RMP Facilitator Training RRM Checklist - Step 2 Review Current Risk
Step 2 Review Current Risks: The objective of this step is to review the currently activerisk using the RiskNav® tool.
Action Description Complete1 Using the RiskNav® tool open the project's risk list and filter using the risk
state filter to show only "active" risk.2 Open plots mode and filter to upper right quadrant3 Review the status of each risk in this quadrant4 Identify actions that need to be taken as a result of the review5 Update individual risk using the edit functions in RiskNav®
6 For risks that are to be "closed" use the "change risk state" functions onthe risk description page in RiskNav® and complete the screen entries.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
101
ESC RMP Facilitator Training RRM Checklist - Step 3 Review Proposed Risk
Step 3 Review Proposed Risks: The objective of this step is to review the risks that havebeen proposed in RiskNav and are not yet active.
Action Description Complete1 Using the RiskNav® tool open the project risk list2 Filter RiskNav® list for "Proposed" risks (if there are no proposed risk GO
TO STEP 4)3 Review each proposed risk description and edit accordingly4 Review each proposed risk analysis and edit accordingly5 Review each proposed risk mitigation plan and edit accordingly6 When all edits are complete go to the "change risk state" function on the
risk description page and change the state to "open" and complete thescreen entries if the risk are approved, otherwise leave as proposed ordelete from the RiskNav® data base.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
102
ESC RMP Facilitator Training RRM Checklist - Step 4 Write New Risk
Step 4 Identify New Risk and Write Clear And Quantifiable Risk Statements(“if condition, then consequences”): Poll each of the meeting participants for new riskinputs. If all new risks have been proposed in RiskNav® GO TO STEP 7 otherwise continue withthis step. This step is important because it facilitates communication among the team membersabout the meaning of the risks and makes it easier to generate action plans and mitigationstrategies. Going through each new risk statement, the team transforms each new risk into an “if”condition, then “consequences” statement and make sure everyone agrees with the words used.At this point, the recorder enters each risk statement into the RiskNav®.
Action Description Complete1 Does each risk statement provides the clarity and descriptive information
required for a reasoned and defensible assessment of the risk’soccurrence probability and impact?
2 Does each risk statement contain two components: a statement of theCondition Present (i.e. the "if condition") and the Associated Risk Event(or events) (i.e. "then consequences")?
3 For each of the new risk statements add a new risk in the RiskNav®
database and enter the data on the screen.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
103
ESC RMP Facilitator Training RRM Checklist - Step 5 Analyze New Risk
Step 5 Review New Risks and Identify Relevant Time Frame, Probability,and Impact for Each Risk Identified: Using the RiskNav® risk list developed in theprevious step, open each added risk. As a group, discuss each risk and agrees upon theappropriate impact date, probability and impacts (cost, schedule, technical, and oversight &compliance).
Action Description Complete1 For each new risk added to the RiskNav® database the group identifies
the time period (actual date) when the risk is likely to occur and enter thisdate and justification using the edit analysis function in RiskNav®.
2 For each new risk added to the RiskNav® database the group identifiesthe probability of the risk occurring and enters the probability andjustification using the edit analysis function in RiskNav®.
3 For each new risk added to the RiskNav® database the group identifiesthe cost impact and enters the cost impact and justification using the editanalysis function in RiskNav®.
4 For each new risk added to the RiskNav® database the group identifiesthe schedule impact and enters the schedule impact and justificationusing the edit analysis function in RiskNav®.
5 For each new risk added to the RiskNav® database the group identifiesthe technical impact and enters the technical impact and justificationusing the edit analysis function in RiskNav®.
6 For each new risk added to the RiskNav® database the group identifiesthe C&O impact and enters the C&O impact and justification using theedit analysis function in RiskNav®.
7 For each new risk, upon completion of the entries in Actions 1-6 above,compute the risk scores by depressing the Recompute button on theRiskNav® edit analysis screen.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
104
ESC RMP Facilitator Training RRM Checklist - Step 6 New Risk Handling
Step 6 Brainstorm Actions (Mitigation Strategies), Select Strategy andBegin Developing Action Plans for the New Risks that Have BeenAccepted: This activity focuses on the risks identified in the previous step. This step can beaccomplished using a freeform (or unstructured) brainstorming method to identify potentialmitigation strategies. For each risk, participants contribute ideas as they come to mind. Theseideas are captured on a white board or flip charts. A summary statement for the mitigationapproach is captured. Responsible individuals are assigned to implement the action plans. Thesehandling plans are documented in the mitigation section of the RiskNav® tool.
Action Description Complete1 Focus is on the risks identified in the previous step2 Use freeform (or unstructured) brainstorming to develop potential
strategies (participants contribute ideas as they come to mind).3 From the RiskNav® risk list, open each risk mitigation, on the mitigation
page open Create Mitigation Plan.4 For each risk assign the appropriate POC responsible for the risk, either
by the pull-down menu or adding a new POC.5 For each risk enter the mitigation strategy and impact description.6 If actions are to be added, open the risk mitigation plan and add action
steps using the RiskNav Define New Action Step screen. Repeat until allactions have been entered.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
105
ESC RMP Facilitator Training RRM Checklist - Step 7 Review Complete List
Step 7 Review of Complete Risk List: With the completed risk analysis, the RiskNav®
tool will compute the risk priority. This involves the grouping of risks using impact, probability andtiming. The objective of the prioritization is to identify the most serious program risks. See theESC/MC RMP tool Guide for an example of the result of RiskNav® prioritization of risks.
Action Description Complete1 Use the calculated Risk Priority of the RiskNav® tool to identify highest to
lowest risk within the risk list2 Using the RiskNav® tool Plots identify high priority risks to manage. Open
plots mode and filter to upper right quadrant.3 Review the status of each risk in this quadrant4 Identify actions that need to be taken as a result of the review5 Update individual risk using the edit functions in RiskNav®
6 Establish agreement about the results between PM and team(consensus) as to risk to proceed to develop handling plans for.
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
106
ESC RMP Training ExerciseConducting a Risk Review Meeting
Exercise 5
Using RiskNav® to Conduct a Risk Review Meeting
(Pages 20-25 of ESC RMP Facilitator Training Exercise Booklet)
© 2001 The MITRE Corporation. All Rights Reserved.© 2002 The MITRE Corporation. All Rights Reserved.V1.0
107
ESC RMP Facilitator Training Agenda
Morning Session• Session 1 - Implementing Risk Management • Session 2 - RAM (Risk Assessment Meeting) Step 1 Preparation • Session 3 - RAM Step 2, 3, & 4 Identifying/Group/Write Risk
• Afternoon Session• Session 4 - RAM Step 5&6 Analysis & Prioritize• Session 5 - RAM Step 7 Developing Handling Plans• Session 6 - Conduct Risk Review Meeting (RRM)
[email protected] 781-271-6373