Risk Mitigation Plans (Topic Commenter)

TransitionRiskTIMTuesday15July20080800-1230CentralJohnsonSpaceCenterBuilding1/Room945DRAFTProceedingsAgenda0800-0810IntroductionJohnOlson/JoelKearns0810-1000RiskReviewbyProgramProgramRMOs(SSP,ISSP,CxP,C3PO)1000-1045RiskMitigationPlansWhatarethestrengths?Whataretheweaknesses?Isintegrationacrossprogramsrequiredforsomeoftheserisks?1045-1130AssociatedCostThreatsHaveweadequatelyidentifiedallcostthreats?Whatismissingfromourcurrentlist?1130-1200RiskTransferstoCxP/InstitutionsHaveweidentifiedriskswhichwillnotbeclosedattheendoftheShuttleProgramwhichneedtobetransferredtoCLVorCxP?Ifnot,whatdoweneedtoadd?Ifnot,howshouldweplantodothis?1200-1230RMProcessesDowehaveadequatechannelstocommunicateourrisksacrossprograms/projects?Whatisworkingwell?Whatdoweneedtofix?•Whatareournextsteps?OCE/ChiefEngineershouldperformandindependentreviewofthetechnicalrisktransferprocess/plans.Fromaninformationstandpoint,howdowesharethisinformationacrossprograms/projects/institutions?Doweneedtobeefupthetransitionportal?Standupawiki?WillanySSPrisksbetransferredtoISS?ShouldtheyhavethatdiscussionwithSSP?WeshouldaddressSTSandISSlessonslearnedcapture/transfer(mgmt,technical,cost,schedule,etc)toensurekeyknowledgenotlostforfuture.WilltheSSPriskdatabasebearchivedandmadeavailableasaresource?Risktolosingandfailingtoattractyoungtalentduringperiodthatwearenotflying.Needtouseworkinglevelandmanagementlevelforum(s)tomaintainmomentumonrisktransfers/handoffsWeshouldplantodiscusstheseattheCxPTRRandtrackprogressthatway.Howarestrategichumancapital(HO)riskshandled?IsHQinvolved?Dothey"own"anyHCrisks?WeshouldstartscopinghowmanySSPriskswillbetransferred.NeedtolookintoAgencyBPRprocessasameansofcommunicatingtransitionrisks.Itisprematuretostarttalkingaboutindependentreviews.Needtoaddressrisksassociatedwith"walkingawayfrom'*propertyandrecordsattheendoftheShuttleProgram.JeffHanley-JohnShannonshouldholdatransitiondiscussionthisfall.CurrentlyworkingwithSSPPRACA-whattoretain.ShouldProgramManagersshowtransitionriskstoAssociateAdministrators?Weneedariskforrisktransition2.HaveweidentifiedriskswhichwillnotbeclosedattheendoftheShuttleProgramwhichneedtobetransferredtoCLVorCxP?Ifnot,whatdoweneedtoadd?Yes,suchasinfrastructuresrisks,budgetrisks,etc.Wearecurrentlyintheprocessofidentifyingseveralriskareasthatwillcarryovertoafutureentity(CxP,ESMD,CenterInstitutional),butcloseoutissueswithcontracts,facilities,property,records,etc.willdeterminethetimelineformanagingtheassociatedrisksineachoftheseareas.Inaddition,criticalskillsretentionandknowledgeretentionareoverarchingAgencyriskareasoffocustomanage.Eachoftheseareasneedtoaddedasriskareas.NeedtoaddSEA,WSTF,andSLF.SSPFmaybeoneoftheserisks.ItisaKSCinstitutionalriskalso.KSCneedstodocumentitsriskmitigationplan.Other"non-technical"riskareasresultingfromT&Rsuchassocio-economicimpacts,NASA'slegislative/politicalcapital,andoverallworkforcemoraleneedtobecapturedandtrackedaswellwithinanintegratedTransitionriskpictureSupplychainrisks,criticalsingle-sourcesuppliers,workforceskillsmixneeds/shortfallsforCxP,threatsagainstCxPreserves(Agency-wide)RMProcessesWhatisworkingwell?WehavematureRMprocessesattheprogramlevelandtheexistingRiskManagementProcessworkswelltoelevateriskstoProgramManager.JSCtransitionintegrationeffortsareworkingwell.TheuseofTCBandJICBforumsto"manage"cross-directoraterisksshouldbeexercised.Someofourtransitionrisksshouldbe"owned"bytheadministrator'soffice-thereisnoprocessinplacetoescalatetothislevelLowlevelriskcommunicationatJSC(sincesameorganizations/peopleworkmultipleprograms).Riskmanagementcommunityiswell-coordinatedintermsofprocesses,commonlanguage,etc.Thenew,increasedemphasisbySSPmanagertohelpCxPsucceedisveryimportanttotheAgencybeingsuccessfulinhumanspaceflighttransition.GoodcommunicationmechanismswithinSSP,ISSandJSC.Examples-Rendezvous,Odyssey,JSCTransitionNewsletter.CxP'sbudget,techneedsdetermination,etc.arecloselylinkedtorisksinCxIRMA.Allprojectsarefullyawareofthis.Wehavegoodcollaborationamongprogramsandinstitutions.Upperlevelmanagementissupportive-weneedtogetlowerlevelmanagersandworkforcesoldonriskmanagement.Whatdoweneedtofix?Morefrequentandperhapsformalizedcross-talk:RMOstalkingtoeachother,ProgramManagerssettingpolicy&expectations,MissionDirectorateAA'sholdingallaccountableFormalizeCenterRiskManagementforTransitionatJSC,KSC,MSFCandSSC;startaregularlyscheduledcross-Programcross-CenterTransitionRisktagup.Crossprogramcouldbeanadd-ontoexistingTri-ProgramJPRCB.NeedtointegrateriskidentificationatCenters,acrossCentersandInstitution,withprogram,inacoherentfashion.GaininsightintotheCenters(Institution)RiskManagementProcessforKSC,MSFC,andSSC.AgencyshouldmanagetransitionrisksatanAgency-level,withallthatentails.Scoleseshouldengage.Cleaner,moreintuitivewaytoroll-upalloftheprograms*risks:CxP,SSP,ISSP,C3P,HRP,ETDP,Institutional,l&A,HumanCapitalNeedtoengagetheCenters/InstitutionwiththePrograms.Doesn'tappeartheyarewelllinkedatallCentersStrengthencommunicationwithregardstoRMandtheallocationofresources(i.e.noriskidentified=noadditionalresourcestodothejobathand).Defineexpectationforriskroll-upattheagencylevel.InstitutionalRMneedstobeimplemented-thisdirectionneedstocomedownfromtheCodeAlevel-it'snotworkingverywellrightnowEachCenterDirectorshouldengageintheriskmanagementprocess,andholdamonthlyreviewmeetingwhichintegratesprogramandprojectriskswithinstitutionalrisksandCenterrisks.Mayneedtoimplementdecisiontoolstoprioritizethetoptransitionrisks(MALIT,AHP,etc.)Formallypropose/defineany"cross-Agency"or"cross-Program"transitionrisksthatarenotsimplythesumoftwo(ormore)programorinstitutionrisks.Withthemyriadportals,wikis,etc.forcommunicatingandcollaborating,weshouldhavealistofthesesitesmadeavailableCodeAshouldengageindevelopinganAgency-levelriskmanagementroll-up,riskidentificationandmanagementprocess.Otherwise,itwon*thappen.Strengthencommunicationofrisksandmitigationprogress(notjustplans)withexternalstakeholders,relatedgovernmentorganizationsandimpactedemployees/mgmt(contractorandcivilservants)ThereneedstobeanintegratedLevelIITechnicalRiskReviewfunction(originallyitwouldhavebeentheJPRCBorTRIPRCB),buttheresidentHSFcentersshouldbepartofthereviewboardaswell.Thisshouldhappenatleastquarterly.MayneedsomeriskeducationorguidelinestogetusallonthesamepageasitrelatestoRMandRiskcommunications.WedonotneedOCE/OCIOtoflowdownunfundedrequirementsforknowledgecapture-weshouldbedoingthiswithinthecontextofourRMsystems/processesIdentifyrisksby$whichhaverealizationcostsspreadacrossdifferentorganizations-programs,centers,etc.-toseeifthecostrealizationoftheriskisbeingidentifieddifferently(e.g.,byQRA,butworstonworst,etc.)Needacross-cuttingcostthreatanalysis(QRA)oftransitionrisks.Developanintegrated"TopTransitionRisks"list.InstitutionalRMneedstobecrisplydefined-overlapwithprogramsmaynotbeagoodthingIntegratedrisktrackingmetricsforthetransferredormulti-ownershipTransitionrisks.SCaNRMprocessisstillimmature一weeventuallyneedtoincludetheminthisprocess.NeedaTransitionRiskWorkingGrouptointegrate,prioritizeand"package"transitionrisksforJoel/John.ESMDandSOMDshouldhavedirectoratelevelrisksassociatedwithtransition(e.g.forassuringcompletionandcurrencyoftransitionplansifnothingelse,forriskhandoffprocessassurance,etc)Weshouldhavevisibilityintohowmanysystems/tools/processesouttheretomanagetransitionactivities.Agencywebsite(s)fortransitionshouldincludecopiesofallcenter/programtransitionplanswhichcanbeseenbyinternal(atminimum)andexternalstakeholdersforreadinessreassuranceTCBandJICBagendas,presentationsandresultsshouldbebettermaintained/currentandaccessibleonHQwebsites(forsharingwithHQandcenterpersonnel)EncouragecompletionandawarenessoftheupdatetoNPR8000.4(riskmgmtpolicy)whichexpandsriskmgmttoagencyinstitutions(previouslyjustappliedtoprograms/projects)AlotofKSCfacilitiesriskswerediscussedtoday—weshouldhaveaKSCrepatnextmeeting(assumingweholdone)3.Whatareournextsteps?Processes:NeedtocontinuetodefinetransferprocessesbetweenprogramsandinterfaceswithinstitutionalGrouptheinputsfromtoday-lookingforcommonthemes.Askaninter-programgroupofRiskManagerstoassess,addto,andprioritizetheinputs.Developactionsplansandimplement.(Soundseasy...right?)Establishanaming/numberingconventionanddisciplinethathelpsassociaterisksacrossprograms,organizations,CentersandAgency.RackupallthecommentsandhaveSOMD/ESMD"disposition"themtoprovidecontextforanyfollow-onintegrationworkonTransitionRiskForallwhoareinvolvedintransitionriskmgmt,provideeachwithaccesstoallappropriateriskdatabases(STS,ISS,Cx,center,directorate,etc)toaidinsightandintegration.Cleanupthecurrentlistofrisks,addnewonesthataremissing(resultsfromthisexercise),coordinate,review,andrepeatprocesstoinfinityAdditionalTransitionRiskTIMS:HoldaSSP/CxPRiskTIMattheworkingleveltodeterminewhichriskswilltransfertoCxP.HoldmoreriskTIMstoaddressprogram-institution-andagencylevelrisks.Continuesometypeofregularcommunication,rollup,meetings.TIMSatalllevels(3andbelowtocapturetheelementdetails,Level2forprogrammaticrollupandreview,Level1Directoratereview,visibility,andapportionment,andLevel0Agencyownershipandagreement).Thisinitialforumisahealthystarttointegratetheexistingriskmitigationeffortsandensureproperhandoffs(andshouldbecontinued).EnaaaeSeniorManaqement:InvolveProgramManagement/Institutionalmanagementinthesediscussion(needexplicit,nottacitbuyin)EngageCodeAandScolese.StandupanAgency-levelprocess.Decideiftherisksshowntodayarethe"TransitionRiskList"thatwillbeshowntoGerstenmaier/RickandJICBinSeptember9.NeedtotalkatESMD/SOMDlevel-whatdidwelearn?NeedstobediscussedwithGerstenmaierandGilbrechtAfuturestepmightbetoholdajointreviewofthetoptransitionriskissueswithtopmanagementfromSSP,ISS,CxP,SOMD,ESMD,l&Aandthecenters.InformtheAPMC/BPRofthekeytransitionrisksandthefindings/forwardplansfromthisTIMConductsomeformofongoingfollow-uptotoday'sforum(beyondTCB/JICBatworkinglevelandathighermgmtlevellikeAPMC)DevelopanMOUbetweentheLevelIIProgramLeadership(CxP,ISSP,SSP,C3PO)tospellouttheRiskTransferandcollaborationprocessesandagreementsinsharinginformationetc.MakesuretohaveasimilaragreementwithLevelIIHSFCenterLeadershipandtheProgramstospelloutRisktransfersandcollaborationsConsiderhavingaperiodic(quarterly,semi-annual)topleveltransitionriskreviewattheTCB/JICB.Establishamulti-program/institutionalriskmanagementpaneltoallowtransferorsharingofrisksamongprograms.AccumulateallHRrelated,Facilityrelated,andenvironmentalrelated,etcrisksforbettercommunication.SubmittedfortheRecordDateDavidM.LengyelExplorationSystemsMissionDirectorateRisk&KnowledgeManagementOfficerAttendees:ESMD/JohnOlsonESMD/DavidLengyelSOMD/JoelKearnsOSMA/RichardFullertonSSP/MikeCangaSSP/GloriaAraiza-YoungSSP/CharlesSalkowskiSSP/AliciaGutierrezISS/MikeLutomskiISS/SteveElsnerISS/RyanRushingJSC/SueLeibertJSC/LarryShawJSC/LovelyKrishenJSC/NC/MadelineClarkCxP/ScottFieldCxP/LindaHamCxP/PatBrownCxP/RosemaryIdelerCxP/KevinWatsonMOD/MartyDemaretMOD/KathyBoleMSFC/JimEllisMSFC/BillPowellMSFC/JimMooreMSFC/MikeAllenMSFC/JohnMcColloughMSFC/KenWhitelyMSFC/AnneMeinholdAres/JeffHawleyAres/EdMiddenAerospace/SergioGuarroAerospace/TomJasinAerospace/ArtJoslinAerospace/DaveAdlisl&A/DianaHoytRiskMitigationPlansWhatarethestrengths?HighlevelmitigationplansappearadequateforSSPandISSP,particularlyforactivitiespriortoFY11.Thecross-programandinstitutionaldialoguenecessarytoaddressmitigationplansisgoodandshouldcontinuetoevolve.ProgrammaticimpactsareadequatelycapturedfromCxP,ISSandSSP.Mostoftheplansappeartobethoughtfulanddetailed.Atthehighlevelwehaveseentoday,isnotclearthatthemitigationplansarecommensurable-i.e.formulatedatthesamelevels.Themitigationplansappeartoaddresscost,schedule,technical,andsafetyriskmitigationfromaQRA/PRAsupportedstance.ThefactthatSSPT&RrisksarebriefedtoJSCJTIPisgood.IssomethingsimilarbeingdoneatMSFC&KSC&SSC?Theyprovideastarttowarddocumentingstepstomitigate.Somearebetterthanothers,buttheycanevolve.Needtoclearlyidentifywhoisresponsibleforwhichmitigationstepandwherethereissharedresponsibility.TheISSProgramreviewsitsrisksevery6-8weeksandmostrecentlyonJune18,2008.Mitigationplansarereviewedforalltopprogramrisks.TheISSProgrammanagerplaceshighemphasisonthoroughplanswithdetailedmitigationtasks.So,IbelievethattheISSrisksoverallhaveverygoodplans.Yes,MitigationPlansareadequatelyaddressedattheSSPProgrammaticLevel.TheCxPrisksappeartoaddressthe"obvious"risks-facilitiesreadiness,conflictsonVABuse,STS-125impactstoAresl-X.Itseemsthatthemitigationplansarematuring,andthisisresultinginmorediscussionacrossprogramsandprojects.Withintheprograms,riskmitigationplansareunderconstantreviewresultinginfrequentupdatingofthemitigationplans.Overall,mitigationplansseemtobeadequate,butshouldbemonitoredandupdatedoften.Somemitigationplanssuggestthatmoreorgsshouldbeinvolvedinidentifyingtransitionriskissues.Mitigationsarebeingaddressedseparatelybyallprogramsandrevealtheuniqueness.Whataretheweaknesses?InstitutionalRiskManagement:CentersneedtodevelopformalriskmanagementstrategiesthatintegratebothprogramandinstitutionalriskattheCENTERDIRECTORLEVEL.Theserisksshouldthenbeelevated,asappropriate,toHQs.NothavinganAgency-levelinsightintoAgency-levelrisksisacriticalweaknessfortheAgencyandposesathreattoTransition.WewouldliketoseetheInstitutionmitigationplanswhentheyareavailable.Institutionneedstoengageinmitigationplansforpost2010transitionrisks.WelackintegrationofriskmanagementacrossPrograms.TheplansneedtobealittlemorespecificaboutimpacttotheInstitutionorCenterandwhatisexpectedorsuggested.ThelackofinstitutionalRMsystemsatMSFCandKSCwillhurtthiseffortCross-Proaram/InstitutionIntearation:Cross-programintegrationisrequiredforseveraloftheserisksandfornewlyidentifiedtransitionrisks.ItisnotclearifProgramsidentifyineachriskallotherprograms/institutionswhichcouldbeaffected.Thelevelofrecurringcross-programcoordinationandintegrationcouldbeimproved.Yes,cross-programintegrationisrequiredformanyoftherisks.Whilethisisgoingon,reviewslikethiswillillustratetheneedtodomoreofit.NeedtoincluderisksfromCenters-JSC,KSC,MSFC,SSCtostart.MaybeDFRClater.Crossorganization,crossCenter,crossAgencymitigationisnotalwaysindicated.Assumetheintegrationforcross-ProgramriskshappensattheProjectlevel—.g.ShuttleTanktoConstellationTank.Isthere"oversight"ofthatprocess?Isitneeded?ThisreviewhelpedusunderstandthatISSshouldcoordinatemorecloselywithS&LSonARM1772.Processes:Impactcategoriesmaybelackingduetoinstitutionalflavorofconsequences(facilities,storage,personnel,andotherinfrastructureissues)Lackofclearlydefinedownershipofmitigationtasksandissues-maybecollaborativeinnaturebetweenprogramsandinstitutional“tigerteams,'tocompletecertainmitigations.Notenoughdetailwithschedules,burndown,tracking,ormetricsforSSPtransitionrisks(lowerlevelTORs).Howdowemeasureprogressofthemacrotransitioneffortbylookingatriskmitigationplans?byaggregateschedule/byaggregatecostthreats?Needconfidencelevelswhenquantitativeinformationisused/neededManyT&RrisksnotbeingtrackedbytheRMprocesses--1thinkweneedaconscienceefforttoIDtheseacrossprogramsExposinghowweareperformingonpersonnelretentionissuesinriskstatuseswouldbeuseful.Manyofthemitigationplansareweakand/ornonexistent.Weneedtodoabetterjobofdevelopingcoherentplansandmeaningfulmitigationsteps.Weshoulddoabetterjobofparent-childaswellas"associations"ofriskrecordsacrossprograms-needaconsistentprocessdefined.Needanongoingworkinglevelintegrationeffort(beyondTCB/JICB).Considerusingexistingforumsforperiodicreviews.Risksarenotreviewed/revisedintimelymanner.Theredoesnotseemtobeaholisticapproachtotheintegrationoftheserisks-eitheracrossprograms,orbetweenandacrossprograms,Centers,andtheInstitutionalbase.Thereshouldbesomeoversightmechanismatthetoplevelsothatriskswhichareactuallyproducedbyrisksofoneprogramimpactinganotherprogramtoproduceathirdriskarecaptured,trackedandaddressed.Thisisacriticalweaknessofthissystem.Mitigationplanswithintheriskdatabasesaresimply"memoryjoggers"actualworkoccursatprogramlevel.Weneedtoassuretrackingsystemsarealwaysinsyncwithreality.CxPneedsaspecificriskonimpactsofprovidingbudgettoSSPandInstitutionstoprovidecostofSSPT&R(Phase-out),basedonPPBE2010Phase-Outcostestimate(FY11-FY15).WithinSSPmanymitigationplansareeitherstatusingorresearchoftherisks,theycouldbemorefocusedonaccomplishingriskreduction.CxPusesaone-pagerformatfortopprogramrisks-shouldweadoptthisaspartofthetransitioneffort?PerhapsbriefingthisattheJICB?Needtopullintherelevantriskeffortsbeyondthemainprograms.Insubsequentforum(s),addresstherisksofcenter,institutional,directorate,HQfunctionaloffices,etc.ItisnotclearthatNASAactuallymanagesitsprogramstotheserisks.Dowereallymakerisk-informeddecisions?Someriskshaveinadequatefidelityintheriskmitigationplans-theyneedtobemoredetailed,havegreatergranularity,andbemoredirectlyfocusedonresourceallocationandmitigation.Theconsequenceforeachriskneedstobeclearlyidentified.Sometimeslowerlevelrisksarenotassociatedwithhigherlevelrisksmakingitdifficulttodetermineifall"pieces"areconsideredindevelopinganoverallmitigationplan.Thefacility-relatedriskmitigationplansneedmorework-perhapstheyneedtobebetterintegrated(checkpointsdevelopedthrutheERICprocess?)Needtoshowahierarchyofparent-childand/orassociatedrisksineachprogram.Tocomplementinternal/bottoms-upperspectives,oughttoreviewandaddress(asappropriate)therisksthathavebeenandcontinuetobeidentifiedbyexternaladvisoryorgs(NRC,NAC,ASAP,SRBs,GAO,IG,etc)Didnotseeanyenergycostriskmitigationassociatedwithfacilitiesrisks-notanissue?Itdoesn'tseemliketopissuesfromtheTCB,JICB,SMC,PRCB,JPRCB,NAC,ASAPandothersareallcapturedinourRiskroll-up...iftheyaren'there,welikelyaren'ttrulymanagingthesecriticalissueswiththeriskmanagementsystem.Saidanotherway,weneedtohaveahighfidelity,responsiveriskroll-upthathasallofthebigissues-it'snotthereyet.Amitigationplanisproposedbytheoneorganizationwhichoriginatestherisk.Whenthereareseveralsimilarrisksonsametopicbydifferentorganizations,themitigationplansmaynotbecoordinatedoratodds.Aretheyidentifyingrisks-orcommenting/assessingusonoursystem/processes?Mitigationplansneedtoidentifyinter-relationshipsthatcouldthenbeaddressedinworkinggroupsstaffedbymembersfromalltheimpactedorganizations.Weneedtoconsideranaming/numberingconventionthatreadilyassociatesrisksandmitigationplans.SuggestaworkshopwithRMOstoreallydiscussweaknessesofourmitigationplans.KSCneedstodevelop/documentamitigationplanforIRMA5824.Itisnotacceptabletoassumethereisnooption,butfortheISSprogramtofundthefacilitycostshortfall.Seemstobeheavilyfocusedonneartermandfacilities.BeyondShuttle,notenoughcoverageofworkforce/criticalskillsbeyond2010,STS/ISSlessonslearnedcapture,supplychain,etcSuggestawayofdisplayingparentandchildrisksinawaywhichisreadilyapparent.Perhapsasimpleindentationwhenthey'reputuponthescreen.Escalationdisciplineisdiscussedandcommunicated.WhatisaCenterTransitionManger'stoprisk?TOR?TopCenterRisk?Weshouldreallytakeahard,independentlookatthesafetyimpactsfromthetransitionrisksNeedtobounceagencytransitionplan(anditscommitmentstoexternalstakeholders)againstthevariousriskeffortstoensureadequateattentiontoconcernsandpromisesRiskroll-upandmanagementisacriticalweakness.Whiletherearemanyforums,theyarenotcross-walkedorlinked-PMC,SMC,OMC.TCB,JICB,ITCB,IJICB,etc.EachCentershouldhaveONEtransitionriskmanagerresponsibleforintegrationacrossprogramsandtheinstitution.MoreemphasisneedtobeplacedonmeetingtheECDdateshighlightedforeachmitigationstep.Weneedtoview,discussandcommunicateTransitionrisksinaholisticwaysowecanunderstandthebigpictureriskexposure/mitigation.With1.2millionequipment./personalpropertylineitemstodisposeof,andwiththecosttodisposeofthepropertyalargepercentageoftheSSPT&Routyearestimate,nothavingthesplitbetweentransfer/disposeagreedwithCxPisacostriskonSSPT&R(ifalargerpercentageneedstobedisposed,andlesstransferred.thanestimatedbySSPinPPBE2010).CxPwill"pay"eitherway,butthecostwillbedrivenbyhowmanylineitemsaretransferredvs.disposedof.ThecosttoCxPtoeithertakethepropertyandeitheruseitordisposeofit,orpositivelystateitisnotneededsoitwillbedisposedofinFY11+,maydriveCxP'sdesireofhowmanyitemsshouldbetransferredorimmediatelydisposedof.Someofthekeydatafieldsintheindividualrisksseemoutdatedorincompleterelativetoactualongoingactivities(e.g.closurecriteria,mitigati