United States Department of Agriculture (USDA) eGovernment Program

#########  {#section .unnumbered}

#########  {#section-1 .unnumbered}

######### Risk Profile -- Risk Management Plan {#risk-profile-risk-management-plan .unnumbered}

######### eLearning Business Case {#elearning-business-case .unnumbered}

######### Draft {#draft .unnumbered}

February 2003

![](media/image1.jpeg){width="1.75in" height="1.2666666666666666in"}

#########  {#section-2 .unnumbered}

Table of Contents

[Revision History ii](#revision-history)

[Previous Change History ii](#previous-change-history)

[Document Sign-off ii](#document-sign-off)

[1 Introduction 1](#introduction)

[2 Identify Risks 2](#identify-risks)

[2.1 Financial Risks 2](#financial-risks)

[2.2 Technical Risks 2](#technical-risks)

[2.3 Operational or Business Risks 3](#operational-or-business-risks)

[2.4 Schedule or Project Resources Risks
3](#schedule-or-project-resources-risks)

[2.5 Legal and Contractual or Strategic Risks
3](#legal-and-contractual-or-strategic-risks)

[2.6 Organizational and Change Management Risks
3](#organizational-and-change-management-risks)

[2.7 Data/Information Risks 4](#datainformation-risks)

[2.8 Security Risks 4](#security-risks)

[2.9 Privacy Risks 4](#privacy-risks)

[2.10 Risks Associated with Contracting to an Application Service
Provider
4](#risks-associated-with-contracting-to-an-application-service-provider)

[3 Analyze Risks 5](#analyze-risks)

[3.1 Risk Probability 5](#risk-probability)

[3.2 Percent Occurring 6](#percent-occurring)

[3.3 Risk Priority 7](#risk-priority)

[3.4 Cost of Risk 8](#cost-of-risk)

[3.5 Risk Adjusted Cost 9](#risk-adjusted-cost)

[3.6 Risk Score 9](#risk-score)

[4 Mitigate Risks 10](#mitigate-risks)

[4.1 Strategy and Methodology 10](#strategy-and-methodology)

[5 Track Risks 13](#track-risks)

[6 Appendix A 14](#appendix-a)

[6.1 Risk Management Table 14](#risk-management-table)

# Revision History {#revision-history .unnumbered}

## Previous Change History {#previous-change-history .unnumbered}

Table a -- Previous Change History

  --------------------------- ------------------------ -------------------------- ---------------------------
  **[Version]{.smallcaps}**   **[Date]{.smallcaps}**   **[Author]{.smallcaps}**   **[Comment]{.smallcaps}**

  1.0                         10/24/2002               Amanda R. Plummer          Initial Draft

  2.0                         11/04/2002               Elaine K. Turville         Updated with comments

  2.1                         11/06/2002               Elaine K. Turville         Updated with comments

  2.2                         11/11/2002               Elaine K. Turville         Updated with comments

  2.3                         11/12/2002               Elaine K. Turville         Updated bullet lists

  2.4                         11/20/2002               Amanda R. Plummer          Updated with Risks
                                                                                  Associated with Contracting
                                                                                  to an Application Service
                                                                                  Provider, Risk Costs

  2.5                         11/20/2002               Elaine K. Turville         Updated with team comments

  2.6                         11/21/2002               Elaine K. Turville         Updated with risk score

  2.7                         12/03/2002               Sara Q. Tyndall            Updated formatting

  2.8                         12/09/2002               Elaine K. Turville         Updated Naming

  2.9                         01/17/2003               Elaine K. Turville         Updated with team comments

  3.0                         01/22/2003               Elaine K. Turville         Updated with team comments

  3.1                         02/03/2003               Liesl M. Awalt             Updated with team comments

  3.2                         02/25/2003               Liesl M. Awalt             Updated with CyberSecurity
                                                                                  comments
  --------------------------- ------------------------ -------------------------- ---------------------------

## Document Sign-off {#document-sign-off .unnumbered}

Table b -- Document Sign-off

  ------------------------ ------------------------ -----------------------------------
  **[Date]{.smallcaps}**   **[Name]{.smallcaps}**   **[Title]{.smallcaps}**

                                                    
  ------------------------ ------------------------ -----------------------------------

# Introduction

Risk is the possibility that an uncertain circumstance or event that
could stand in the way of achieving the objectives of an investment.
Risks are distinct from issues in that they reflect things that might
happen in the future. Issues on the other hand are things that are
current occurring. Issues can be thought of as the outcomes of risks.
This document primarily focuses on addressing and preparing for
eLearning risks before they become issues.

Risk is inevitable and all investments incur a certain amount of risk.
Risk is to be expected in any situation and therefore must be considered
when approaching new investments. The downfall of risks is not that they
exist or even occur, but that many times they are not recognized. Most
project problems arise when there is no plan in place for dealing with
risks when they become issues.

Risk Management has been identified as the systematic approach for
identifying, analyzing, and mitigating risks that could be encountered
by an initiative. Risk Management is not about being \'risk averse\';
rather, it is based on informed decisions and analyses of potential
outcomes.

Since it is possible that some risks identified for the eLearning
initiative will eventually become realities, it is important to begin
identifying and planning for these risks in the early stages of the
project. This document addresses and discusses risks associated with the
recommended eLearning approach. Reviewing and outlining risks during
this phase will help to better prepare the project team to manage risks
in a timely and effective manner.

To ensure added effectiveness, this plan is designed such that
identified risks and controls can be continuously updated over the
entire project lifecycle. Through continuous evaluation of the potential
risks and the creation of plans to manage them, adjustments can be made
to prevent or reduce many of the damages that result when risks occur.

The following sections of this document discuss the steps that will be
followed to manage relevant eLearning risks. These include:

-   Identify Risks;

-   Analyze Risks;

-   Mitigate Risks; and

-   Track Risks.

# Identify Risks

Risk identification involves determining and documenting risks that
could potentially impact the eLearning initiative. These have been
identified in the following areas:

-   Financial Risks;

-   Technical Risks;

-   Operational or Business Risks;

-   Schedule or Project Resources Risks;

-   Legal and Contractual or Strategic Risks;

-   Organizational and Change Management Risks;

-   Data/Information Risks;

-   Security Risks;

-   Privacy Risks; and

-   Risks Associated with Contracting to an Application Service
    Provider.

> Each of these risk areas relevant to the eLearning initiative are
> discussed in the following subsections and are further detailed in
> Table 6.1a in Appendix A.

## Financial Risks

Financial risks have a purely financial outcome. The financial risks
identified for the eLearning initiative include threats such as:

-   Proper funding not being acquired to continue moving forward;

-   System procurement costs exceeding the estimated amount;

-   Technical support costs exceeding the estimated amount; and

-   Deployment/Operational costs could exceed estimated amount.

## Technical Risks

The technical risks center around the selection, implementation and
deployment of a technology solution. The relevant technical risks
identified for the eLearning initiative include:

-   Project team lacks technical expertise required for successful
    implementation;

-   Solutions are out of date when delivered due to advances in
    technology or delay in funding;

-   The solution doe not deliver usable and useful services;

-   Underestimating the complexity of interfaces with other systems; and

-   Complexity of interfaces with other systems in underestimated.

## Operational or Business Risks

Operational or business risks are the most common risks. These occur
during the life of the project and include risks like:

-   Users are not able to use the system proficiently; and

-   Inadequate estimation of maintenance and/or enhancement resources
    required to operate the solution.

## Schedule or Project Resources Risks

Schedule or project resource risks involve the degree to which the
expected completion dates for all major investment activities meet
organizational deadlines and constraints for affecting change. The
eLearning risks related to the project schedule or project resources
include:

-   Time required for business process re-engineering could exceed
    estimates;

-   Time required to rollout the solution could exceed estimates;

-   Generic processes common to all agencies and unique agency processes
    not; and clearly identified and compared to delivered vendor
    product.

## Legal and Contractual or Strategic Risks

Legal and contractual risks relate to events to which USDA could be held
liable. The eLearning legal and contractual risks include:

-   Improper information may be published to the public; and

-   Discussions with the Unions may lead to delays in the process or
    necessary changes.

## Organizational and Change Management Risks

Large projects impact many people and processes. The relevant eLearning
organizational and change management risks involve:

-   Redistribution of power occurring within the Department; and

-   Agencies or individual employees are resistant to adopt proposed
    solutions.

## Data/Information Risks

Data and information risks relate to the loss of data or information.
The eLearning data and information risks include:

-   Loss of content due to an accident, fire, or other disaster; and

-   Erroneous deletion or destruction of content.

## Security Risks

Security is paramount for any system to prevent unauthorized access. The
eLearning security risks include:

-   Roles and responsibilities related to solution are improperly
    administered; and

-   Unauthorized users gain access to data or content stored in the
    solution.

## Privacy Risks

In accordance with the Privacy Act of 1974 and related legislation,
privacy of data and information must be maintained. The eLearning risks
related to privacy include:

-   Unauthorized users access, use, or disclose private information that
    is stored in the system.

## Risks Associated with Contracting to an Application Service Provider

If the choice is made to contract the eLearning solution to an
application service provider, some additional risks will be incurred:

-   Inability to transfer assets, such as equipment, facilities, and
    licenses, from USDA to the application service provider;

-   Inability to acquire the skills or resources necessary to manage the
    provisions of the service contract;

-   Lack of control over skills and resources as well as quality and
    performance of the application service provider; and

-   Issue identification and resolution are not achieved in a timely
    manner due to unresponsiveness of the application service provider.

# Analyze Risks

Identified risks are analyzed based on an assessment of their likelihood
of occurrence and the impact that could result if they occur. During the
risk analysis process, numerous activities are conducted to aid in the
development of the risk management and control strategies. The
activities for examining the potential eLearning risks include:

-   Determining Risk Probability:

-   Calculating Percent Occurrence;

-   Assigned Risk Priority;

-   Calculating the Cost of Risk;

-   Determining the Risk Adjusted Cost; and

-   Assigning the Risk Score.

## Risk Probability

Probability of occurrence is the likelihood that a particular risk will
occur. Risk probabilities have been assigned to each of the potential
eLearning risks by estimating the likelihood that the risk would
actually be recognized based on the scale identified in Table 3.1a.
Risks that will exist for the duration of the project have been assigned
a higher probability of occurrence than risks that do not span the whole
lifecycle. Probabilities are also higher for common risks that occur
frequently within USDA.

Table 3.1 -- Probability of Occurrence Scale

+------------------+-------------------------+-------------------------+
| **[Assessment    | **[Clarifying           | **[Figure for           |
| o                | Remarks]{.smallcaps}**  | Cal                     |
| f]{.smallcaps}** |                         | culation]{.smallcaps}** |
|                  |                         |                         |
| **[Risk          |                         |                         |
| Probabilit       |                         |                         |
| y]{.smallcaps}** |                         |                         |
+------------------+-------------------------+-------------------------+
| Highly Likely    | Likelihood of           | 88%                     |
|                  | occurrence \> 75%       |                         |
+------------------+-------------------------+-------------------------+
| Somewhat Likely  | Likelihood of           | 63%                     |
|                  | occurrence between 50%  |                         |
|                  | and 75%                 |                         |
+------------------+-------------------------+-------------------------+
| 50/50 Chance     | Likelihood of           | 50%                     |
|                  | occurrence 50%          |                         |
+------------------+-------------------------+-------------------------+
| Somewhat         | Likelihood of           | 38%                     |
| Unlikely         | occurrence between 25%  |                         |
|                  | and 50%                 |                         |
+------------------+-------------------------+-------------------------+
| Highly Unlikely  | Likelihood of           | 13%                     |
|                  | occurrence \< 25%       |                         |
+------------------+-------------------------+-------------------------+

Risk probability is recorded in Tables 6.1a in Appendix A for each of
the risks identified for the eLearning initiative. The risks with the
highest probability of occurrence include:

-   Underestimating the complexity of interfaces with other systems;

-   Inability to migrate existing Agency content and documents into the
    solution; and

-   Inability to acquire the skills or resources necessary to manage the
    provisions of the service contract.

## Percent Occurring

The percent occurring refers to the impact or estimated percent of
Agencies, users, systems and/or processes that could be affected by each
risk. The impact each risk could have on the eLearning initiative or the
entire Department has been determined based on the scale identified in
Table 3.2a.

Table 3.2 -- Percent Occurring Scale

+-----------------------------+-----------------------------------------+
| **[Assessment               | **[Clarifying Remarks]{.smallcaps}**    |
| of]{.smallcaps}**           |                                         |
|                             |                                         |
| **[Percent                  |                                         |
| Occurring]{.smallcaps}**    |                                         |
+-----------------------------+-----------------------------------------+
| Critical Impact             | 66% to 100% Impact                      |
+-----------------------------+-----------------------------------------+
| Moderate Impact             | 33% to 66% Impact                       |
+-----------------------------+-----------------------------------------+
| Low Impact                  | Less than 33% Impact                    |
+-----------------------------+-----------------------------------------+

The percent occurring for each of the potential eLearning risks are
estimated in Appendix A. The following risks have been identified to
have critical risk:

-   Proper funding may not be secured to continue moving forward with
    the initiative;

-   Complexity of interfaces with other systems is underestimated;

-   Users are not able to use the system proficiently;

-   Improper information may be published to the public;

-   Discussions with the Unions may lead to delays in the process or
    necessary changes;

-   Agencies or individual employees are resistant to adopt proposed
    solutions;

-   Unauthorized users gain access to data or content stored in the
    solution;

-   Unauthorized users gain access to sensitive content because they are
    not properly identified in the system;

-   Inability to transfer assets, such as equipment, facilities, and
    licenses, from USDA to the application service provider; and

-   Inability to acquire the skills or resources necessary to manage the
    provisions of the service contract.

## Risk Priority

After the list of risks is qualified according to the risk probability
and percent of occurrence, the risks are prioritized. This process helps
to determine which risks are most critical and should be addressed
first, as well as the least significant risks that may not be as
critical to the project's success. Risks have been prioritized into
three main groups based on combinations of likelihood and impact as
identified in Table 3.3a, below.

Table 3.3 -- Risk Priority Rating Scale

  ---------------------------- ---------------------------- --------------------------
  **[Priority]{.smallcaps}**   **[Risk                      **[Percent
                               Probability]{.smallcaps}**   Occurring]{.smallcaps}**

  1                            Highly Likely                Critical

                               Highly Likely                Moderate

                               Somewhat Likely              Critical

                               Somewhat Likely              Moderate

                               50/50 Chance                 Critical

  2                            Highly Likely                Low

                               Somewhat Likely              Low

                               50/50 Chance                 Critical

                               50/50 Chance                 Moderate

                               Somewhat Unlikely            Critical

  3                            50/50 Chance                 Low

                               Somewhat Unlikely            Moderate

                               Somewhat Unlikely            Low

                               Highly Unlikely              Moderate

                               Highly Unlikely              Low
  ---------------------------- ---------------------------- --------------------------

As evident from the table above, priority 1 risks are most crucial and
priority 3 risks are least crucial. Risk priorities have been identified
for the eLearning risks and are also included in the risk management
table in the appendix. Some of the more crucial risks include:

-   Proper funding may not be secured to continue moving forward with
    the initiative;

-   Complexity of interfaces with other systems is underestimated;

-   Users are not able to use the system proficiently;

-   Agencies or individual employees are resistant to adopt proposed
    solutions;

-   Inability to transfer assets, such as equipment, facilities, and
    licenses, from USDA to the application service provider; and

-   Inability to acquire the skills or resources necessary to manage the
    provisions of the service contract.

## Cost of Risk

Most risks, financial or other, have a cost associated to them. The cost
of risk relates to the financial setbacks that would be encountered as a
result of the risk. Estimated costs for the identified eLearning risks
are detailed in Table 6.1a in Appendix A. The more costly risks include:

-   System procurement costs (software & related hardware) could exceed
    estimated amount;

-   Proper funding may not be secured to continue moving forward with
    the initiative;

-   Deployment and/or Operations costs could exceed the estimated
    amount;

-   Technical support costs could exceed the estimated amount;

-   Solutions are out of date when delivered due to advances in
    technology or delay in funding;

-   The solution does not deliver usable and useful services;

-   Complexity of interfaces with other systems is underestimated;

-   Time required to rollout the solution could exceed estimates;

-   Discussions with the Unions may lead to delays in the process or
    necessary changes;

-   Agencies or individual employees are resistant to adopt proposed
    solutions;

-   Loss of content due to an accident, fire, or other disaster;

-   Roles and responsibilities related to the solution are improperly
    administered;

-   Unauthorized users gain access to data or content stored in the
    solution;

-   Unauthorized users gain access to sensitive content because they are
    not properly identified in the system; and

-   Inability to transfer assets, such as equipment, facilities, and
    licenses, from USDA to the application service provider.

Costs for risk could be incurred due to legal penalties for failure to
properly identify and protect official records or legal penalties for
destruction of official record material without proper disposition
authority. Another cost of risk could include legal penalties for
destruction of evidence based upon inconsistent handling of official
record material.

Table 3.4 -- Estimated Risk Cost Ranges

  ---------------------------- -------------------------- ----------------------------
  **[Category]{.smallcaps}**   **[Range]{.smallcaps}**    **[Figure for
                                                          Calculation]{.smallcaps}**

  A                            Less than \$5,000          \$2500

  B                            \$5,000 to \<\$25,000      \$15,000

  C                            \$25,000 to \<\$100,000    \$62,500

  D                            \$100,000 to \<\$2.5       \$1.3 million
                               million                    

  E                            \$2.5 to \<\$5 million     \$3.75 million
  ---------------------------- -------------------------- ----------------------------

## Risk Adjusted Cost

Risk adjusted cost is measured by multiplying the risk cost (in dollars)
by the percentage risk probability. Risk adjusted costs have been
calculated for each potential eLearning risks and are also included in
the risk management table in the appendix.

The investment's overall risk adjusted cost or risk exposure has been
determined to be \$8,149,900 by taking a sum of each of the eLearning
risk factors.

## Risk Score

Finally, a risk score is assigned to the initiative to provide a more
accurate picture of the overall investment risk. Risk score is measured
by dividing the investment's overall risk factor by the total number of
identified risks. Since 28 eLearning risks have been identified and the
investment's risk score is \$8,149,900, the eLearning risk score
calculates to \$313,458. The *eLearning -- Financial Profile - Cost
Benefit Analysis* accounts for the risk cost in the lifecycle costs for
each of the alternatives by assuming that approximately 10% of this cost
will occur each year

# Mitigate Risks

## Strategy and Methodology

Risk mitigation includes the strategy and methodology for controlling
risks when they become issues. The main objective of risk mitigation is
to define the approach for dealing with risks to ensure that the
eLearning initiative is completed on time and on budget. This section of
the document addresses this strategy and methodology for mitigating
risks.

The method begins by determining the techniques or risk strategies,
through identifying and utilizing the level of control for each risk.
Table 4.1a defines the risk strategies that have been identified for
controlling eLearning risks.

Table 4.1a -- eLearning Risk Mitigation Strategies

  ---------------------------- --------------------------------------------------------
  **[Strategy]{.smallcaps}**   **[Definition]{.smallcaps}**

  Avoidance                    Avoidance is any action that completely eliminates the
                               risk.

  Transfer                     Transfer moves the responsibility for the risk to the
                               party best placed to respond to it.

  Control                      Control identifies an action or product that becomes
                               part of the work plan. It is monitored and reported as
                               part of the regular performance analysis and progress
                               reporting. Control will reduce the likelihood of a risk
                               materializing, or if it does materialized it will reduce
                               the potential impact.

  Acceptance                   Acceptance is taking on the risk without putting into
                               place a risk mitigation pan. This occurs when
                               implementing a risk mitigation plan is impossible or not
                               cost effective.

  Investigation                Investigation is recommended when no clear solution can
                               be identified. Investigation involves undertaking
                               further research to more accurately define the level of
                               risk and developing a contingency plan until a
                               mitigation plan can be developed.
  ---------------------------- --------------------------------------------------------

To assist in selecting an appropriate mitigation strategy for risks, the
level of control is determined for each risk. Level of control can be
external, internal, or both. External control levels utilize the
avoidance, transfer, acceptance, or investigation mitigation strategies.
Internal control levels utilize the control, acceptance, or
investigation mitigation strategies. If the level of control is both
external and internal, avoidance, transfer, control, acceptance, or
investigation mitigation strategies are applied. This methodology is
further depicted in Table 4.1b, below.

Table 4.1b -- Levels of Control

+-----------+-----------+---------------------------------------------+
| **[Level  | **[M      | **[Explanation]{.smallcaps}**               |
| of        | itigation |                                             |
| Cont      | Strat     |                                             |
| rol]{.sma | egy]{.sma |                                             |
| llcaps}** | llcaps}** |                                             |
+-----------+-----------+---------------------------------------------+
| **E       | A         | -   **Transfer** or **avoid** these risks.  |
| xternal** | voidance, |                                             |
|           |           | -   If the risk can neither be transferred  |
|           | Transfer, |     nor avoided, consider **accepting** it. |
|           | Ac        |     By their nature, these risks are not    |
|           | ceptance, |     within our control. Accepting these     |
|           | Inve      |     risks could result in exposure to       |
|           | stigation |     potentially costly liabilities.         |
|           |           |     Whenever risk is accepted, a            |
|           |           |     contingency plan should be developed to |
|           |           |     respond if/when the risk becomes a      |
|           |           |     reality.                                |
|           |           |                                             |
|           |           | -   If more information is needed to select |
|           |           |     a technique, **investigate.**           |
+-----------+-----------+---------------------------------------------+
| Internal  | Control,  | -   Develop risk mitigation responses to    |
|           | Ac        |     **control** these risks.                |
|           | ceptance, |                                             |
|           | Inve      | -   If risk mitigation techniques are       |
|           | stigation |     unavailable or cost prohibitive, or if  |
|           |           |     the risk priority is low (priority 3),  |
|           |           |     consider **accepting** the risk.        |
|           |           |     Whenever risk is accepted, a            |
|           |           |     contingency plan should be developed to |
|           |           |     respond if/when the risk becomes a      |
|           |           |     reality.                                |
|           |           |                                             |
|           |           | -   If more information is needed to select |
|           |           |     a technique, **investigate.**           |
+-----------+-----------+---------------------------------------------+
| **Both**  | A         | -   **Transfer** or **avoid** these risks   |
|           | voidance, |     if possible, especially where control   |
|           |           |     is indirect or minimal.                 |
|           | Transfer, |                                             |
|           | Control,  | -   If the risks can neither be transferred |
|           | Ac        |     nor avoided, develop risk mitigation    |
|           | ceptance, |     responses to **control** them.          |
|           | Inve      |                                             |
|           | stigation | -   If risk mitigation techniques are       |
|           |           |     unavailable or cost prohibitive, or the |
|           |           |     risk priority is low (priority 3),      |
|           |           |     consider **accepting** it. Whenever     |
|           |           |     accepting a risk, a contingency plan    |
|           |           |     should be developed to respond if/when  |
|           |           |     the risk becomes a reality.             |
|           |           |                                             |
|           |           | -   If more information is needed to select |
|           |           |     a technique, **investigate.**           |
+-----------+-----------+---------------------------------------------+

Risk mitigation strategies have been assigned to the identified
eLearning risks. These are displayed in the Mitigation Strategy column
of Table 6.1a in Appendix A.

Following the identification of the control level and risk mitigation
strategy, detailed descriptions of the risk mitigation techniques are
developed. Since the initial response may prove to be unsuccessful in
this Risk Management Plan, multiple risk mitigation techniques are
detailed for each area of risk. The inclusion of multiple techniques
allows the project team to implement the most appropriate risk
mitigation techniques. It also supports back-up plans.

As previously mentioned, the Risk Management Plan should be continually
updated throughout the life of the project. The tool should house any
identified risks and mitigation strategies. If or when risks become
issues, the risk management plan should be referenced as a resource for
potential solutions. Since mitigation could also impact schedules and
resources, it is important to note that the responses assigned to these
risks may require modifications to the project plan. The tracking of
risks is further mentioned in the Track Risks section of the document.

A future step in the risk mitigation methodology is the assignment of
responsibility. Individuals, not groups, should be assigned to risks
during the phase the risk could occur. Responsibility should be
allocated across the project team to ensure that risks will be managed
and monitored more closely.

The project manager should be responsible for overseeing the risk
management process and periodically reconvening the project team to
determine if new risks have surfaced. The project team should continue
to revisit the plan, and use the process described throughout this
document to add new risks and update the team's progress on existing
risk mitigation responses.

# Track Risks

As issues begin to arise and the identified responses are put into
action, an important component of any risk mitigation plan is ongoing
monitoring and communication of risk.

A Risk Management table has been identified as the appropriate tool for
tracking and updating the eLearning risks. This table, included in
Appendix A, details the following:

-   Date Identified;

-   Area of Risk;

-   Description;

-   Risk Priority;

-   Risk Probability;

-   Occurrence;

-   Cost of Risk;

-   Level of Control;

-   Mitigation Strategy; and

-   Current Status.

As previously mentioned, risk management is an iterative and continuous
process. Therefore, this table will serve the purpose of tracking the
eLearning risks as they evolve and as additional risks are identified.

During the design, build, and implementation phases, the Risk Management
Plan will be reviewed, updated, and republished to ensure that all risks
are documented and tracked.

# Appendix A

## Risk Management Table

Table 6.1 -- Risk Management

<table>
<colgroup>
<col style="width: 7%" />
<col style="width: 10%" />
<col style="width: 11%" />
<col style="width: 6%" />
<col style="width: 9%" />
<col style="width: 9%" />
<col style="width: 7%" />
<col style="width: 7%" />
<col style="width: 6%" />
<col style="width: 15%" />
<col style="width: 7%" />
</colgroup>
<thead>
<tr class="header">
<th><strong><span class="smallcaps">Date Identified</span></strong></th>
<th><p><strong><span class="smallcaps">Area of</span></strong></p>
<p><strong><span class="smallcaps">Risk</span></strong></p></th>
<th><strong><span class="smallcaps">Description</span></strong></th>
<th><p><strong><span class="smallcaps">Risk</span></strong></p>
<p><strong><span class="smallcaps">Priority</span></strong></p></th>
<th><p><strong><span class="smallcaps">Risk</span></strong></p>
<p><strong><span class="smallcaps">Probability</span></strong></p></th>
<th><strong><span class="smallcaps">Occurrence</span></strong></th>
<th><strong><span class="smallcaps">Cost of Risk</span></strong></th>
<th><p><strong><span class="smallcaps">Risk</span></strong></p>
<p><strong><span class="smallcaps">Adjusted
Cost</span></strong></p></th>
<th><p><strong><span class="smallcaps">Level</span></strong></p>
<p><strong><span class="smallcaps">of Control</span></strong></p></th>
<th><p><strong><span class="smallcaps">Mitigation</span></strong></p>
<p><strong><span class="smallcaps">Strategy &amp; Detailed
Description</span></strong></p></th>
<th><p><strong><span class="smallcaps">Current</span></strong></p>
<p><strong><span class="smallcaps">Status</span></strong></p></th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Financial</p>
</blockquote></td>
<td>System procurement costs (software &amp; related hardware) could
exceed estimated amount</td>
<td><blockquote>
<p>2</p>
</blockquote></td>
<td>50/50 Chance</td>
<td><blockquote>
<p>Moderate</p>
</blockquote></td>
<td><blockquote>
<p>D</p>
</blockquote></td>
<td>$650,000</td>
<td>Internal and External</td>
<td><blockquote>
<p><u>Avoidance</u></p>
</blockquote>
<ul>
<li><p>Select software &amp; hardware to be within budget amounts
through thorough planning &amp; contingency funding</p></li>
</ul>
<blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Conduct market research on costs and incorporate into the funding
request</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="even">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Financial</p>
</blockquote></td>
<td>Proper funding may not be secured to continue moving forward with
the initiative</td>
<td><blockquote>
<p>1</p>
</blockquote></td>
<td>50/50 Chance</td>
<td><blockquote>
<p>Critical</p>
</blockquote></td>
<td><blockquote>
<p>D</p>
</blockquote></td>
<td>$650,000</td>
<td>Internal and External</td>
<td><blockquote>
<p><u>Avoidance</u></p>
</blockquote>
<ul>
<li><p>Present OMB with a concise and thorough business case that fully
supports the vision</p></li>
</ul>
<blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Implement in phases</p></li>
<li><p>Assess and reassess the cost of implementation</p></li>
<li><p>Create a contingency plan for going forward</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="odd">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Financial</p>
</blockquote></td>
<td>Deployment and/or Operations costs could exceed the estimated
amount</td>
<td><blockquote>
<p>2</p>
</blockquote></td>
<td>50/50 Chance</td>
<td><blockquote>
<p>Moderate</p>
</blockquote></td>
<td><blockquote>
<p>D</p>
</blockquote></td>
<td>$650,000</td>
<td>Internal and External</td>
<td><blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Conduct periodic and timely project monitoring according to
milestones</p></li>
<li><p>Tracking time and expenses</p></li>
<li><p>Perform thorough planning</p></li>
<li><p>Implement iterative development processes</p></li>
<li><p>Schedule independent quality control audits</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="even">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Financial</p>
</blockquote></td>
<td>Technical support costs could exceed estimated amount</td>
<td><blockquote>
<p>2</p>
</blockquote></td>
<td>50/50 Chance</td>
<td><blockquote>
<p>Moderate</p>
</blockquote></td>
<td><blockquote>
<p>D</p>
</blockquote></td>
<td>$650,000</td>
<td>Internal and External</td>
<td><blockquote>
<p><u>Avoidance</u></p>
</blockquote>
<ul>
<li><p>Select and task resources to be within budget amounts</p></li>
</ul>
<blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Utilize a project manager to ensure that timeframes and timelines
are met</p></li>
<li><p>Adopt a cohesive, agreed-upon technical support strategy</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="odd">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Technical</p>
</blockquote></td>
<td>Project team lacks technical expertise required for successful
implementation</td>
<td><blockquote>
<p>3</p>
</blockquote></td>
<td>Somewhat Unlikely</td>
<td><blockquote>
<p>Moderate</p>
</blockquote></td>
<td><blockquote>
<p>C</p>
</blockquote></td>
<td>$23,750</td>
<td>Internal and External</td>
<td><blockquote>
<p><u>Avoidance</u></p>
</blockquote>
<ul>
<li><p>Define technical expertise in advance of determining
team</p></li>
<li><p>Screen and select deployment staff with expertise in all
functional areas</p></li>
<li><p>Provide training</p></li>
<li><p>Select staff with prior experience in similar project</p></li>
<li><p>Use resources with overlapping expertise</p></li>
<li><p>Select vendor with good technical support</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="even">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Technical</p>
</blockquote></td>
<td>Solutions are out of date when delivered due to advances in
technology or delay in funding</td>
<td><blockquote>
<p>3</p>
</blockquote></td>
<td>Highly Unlikely</td>
<td><blockquote>
<p>Moderate</p>
</blockquote></td>
<td><blockquote>
<p>D</p>
</blockquote></td>
<td>$169,000</td>
<td>External</td>
<td><blockquote>
<p><u>Acceptance</u></p>
</blockquote>
<ul>
<li><p>Incorporate technology upgrades/“just-in-time technology” as
available and keep close watch on standards and other changes in
industry</p></li>
</ul>
<blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Conduct impact analysis of technologies</p></li>
<li><p>Select a solution that incorporates industry open
standards</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="odd">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Technical</p>
</blockquote></td>
<td>The solution does not deliver usable and useful services</td>
<td><blockquote>
<p>3</p>
</blockquote></td>
<td>Highly Unlikely</td>
<td><blockquote>
<p>Moderate</p>
</blockquote></td>
<td><blockquote>
<p>D</p>
</blockquote></td>
<td>$169,000</td>
<td>Internal and External</td>
<td><blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Document lessons learned from early adopters</p></li>
<li><p>Conduct iterative user acceptance and usability testing</p></li>
<li><p>Ensure solid and concise business requirements</p></li>
<li><p>Provide a system to collect and track concerns and ensure that
these are addressed</p></li>
<li><p>Conduct a prototype implementation</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="even">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Technical</p>
</blockquote></td>
<td>Complexity of interfaces with other systems is underestimated</td>
<td><blockquote>
<p>1</p>
</blockquote></td>
<td>Somewhat Likely</td>
<td><blockquote>
<p>Critical</p>
</blockquote></td>
<td><blockquote>
<p>D</p>
</blockquote></td>
<td>$819,000</td>
<td>Internal and External</td>
<td><blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Predefine interface protocols that work between disparate
systems</p></li>
<li><p>Leverage early adopters of systems we select</p></li>
<li><p>Define standards using industry protocols</p></li>
<li><p>Define integration requirements</p></li>
<li><p>Ongoing assessment and evaluation based on early
adopters</p></li>
<li><p>Prove solution would integrate through ‘Proof of
Concept’</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="odd">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Operational</p>
</blockquote></td>
<td><blockquote>
<p>Agencies are unable to migrate existing content (within scope of the
project) into the solution.</p>
</blockquote></td>
<td><blockquote>
<p>1</p>
</blockquote></td>
<td>Somewhat Likely</td>
<td><blockquote>
<p>Moderate</p>
</blockquote></td>
<td><blockquote>
<p>C</p>
</blockquote></td>
<td>$39,375</td>
<td>Internal and External</td>
<td><blockquote>
<p><u>Investigate</u></p>
</blockquote>
<ul>
<li><p>Investigate conversion tools</p></li>
</ul>
<blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Ensure the solution supports native and open standards</p></li>
<li><p>Ensure Agencies prioritize content for inclusion into the
solution</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="even">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Operational</p>
</blockquote></td>
<td>Users are not able to use the system proficiently</td>
<td><blockquote>
<p>1</p>
</blockquote></td>
<td>50/50 Chance</td>
<td><blockquote>
<p>Critical</p>
</blockquote></td>
<td><blockquote>
<p>C</p>
</blockquote></td>
<td>$31,250</td>
<td>Internal and External</td>
<td><blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Ensure system is flexible and customizable</p></li>
<li><p>Ensure the system is integrated with existing suite of tools to
decrease user learning curve</p></li>
<li><p>Conduct usability and user acceptance testing as products are
developed</p></li>
<li><p>Provide timely and modularized training and extensive education
(both online and in person)</p></li>
<li><p>Conduct marketing effort to educate both internal and external
users</p></li>
<li><p>Choose a solution that provides FAQ, help centers, and online
real-time customer support</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="odd">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Operational</p>
</blockquote></td>
<td>Inadequate estimation of maintenance and/or enhancement resources
required to operate the solution</td>
<td><blockquote>
<p>2</p>
</blockquote></td>
<td>50/50 Chance</td>
<td><blockquote>
<p>Moderate</p>
</blockquote></td>
<td><blockquote>
<p>C</p>
</blockquote></td>
<td>$31,250</td>
<td>Internal and External</td>
<td><blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Use early adopters to predict required maintenance and/or
enhancements</p></li>
<li><p>Account for extra maintenance time in the schedule</p></li>
<li><p>Utilize other agency experience</p></li>
</ul>
<blockquote>
<p><u>Avoidance</u></p>
</blockquote>
<ul>
<li><p>Utilize fixed cost contracts with selected vendors</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="even">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Schedule</p>
</blockquote></td>
<td>Time required for business process re-engineering could exceed
estimates</td>
<td><blockquote>
<p>2</p>
</blockquote></td>
<td>50/50 Chance</td>
<td><blockquote>
<p>Moderate</p>
</blockquote></td>
<td><blockquote>
<p>C</p>
</blockquote></td>
<td>$31,250</td>
<td>Internal and External</td>
<td><blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Incorporate business process changes early in the project
plan</p></li>
<li><p>Conduct project monitoring and identification of potential
schedule impacts so that corrective measures can be taken</p></li>
<li><p>Prioritize the processes that will be implemented in order of
importance</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="odd">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Schedule</p>
</blockquote></td>
<td>Time required to rollout the solution could exceed estimates</td>
<td><blockquote>
<p>2</p>
</blockquote></td>
<td>50/50 Chance</td>
<td><blockquote>
<p>Moderate</p>
</blockquote></td>
<td><blockquote>
<p>D</p>
</blockquote></td>
<td>$650,000</td>
<td>Internal and External</td>
<td><blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Set realistic expectations and manage those expectations</p></li>
<li><p>Conduct periodic review and reevaluation of the project
plan</p></li>
<li><p>Offer incentives (and penalties) to ensure timely
completion</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="even">
<td><blockquote>
<p>11/04/02</p>
</blockquote></td>
<td><blockquote>
<p>Schedule</p>
</blockquote></td>
<td>Generic processes common to all agencies and unique agency processes
not clearly identified and compared to delivered vendor product</td>
<td><blockquote>
<p>2</p>
</blockquote></td>
<td>50/50 Chance</td>
<td><blockquote>
<p>Moderate</p>
</blockquote></td>
<td><blockquote>
<p>C</p>
</blockquote></td>
<td>$31,250</td>
<td>Internal and External</td>
<td><blockquote>
<p><u>Control</u></p>
<p>Careful analysis of:</p>
</blockquote>
<ul>
<li><p>Training administration processes of all Agencies</p></li>
<li><p>Identification of common process and unique Agency
processes</p></li>
<li><p>Careful analysis of vendor delivered processes</p></li>
<li><p>Identification of processes where custom solutions are
required.</p></li>
<li><p>Define common workflow and training process.</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="odd">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Legal</p>
</blockquote></td>
<td>Improper information may be published to the public</td>
<td><blockquote>
<p>2</p>
</blockquote></td>
<td>Somewhat Unlikely</td>
<td><blockquote>
<p>Critical</p>
</blockquote></td>
<td><blockquote>
<p>B</p>
</blockquote></td>
<td>$5,700</td>
<td>Internal</td>
<td><blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Use staging servers to keep information separate</p></li>
<li><p>Follow Quality of Information Guidelines</p></li>
<li><p>Utilize established agency processes for the quality assurance of
information</p></li>
<li><p>Instill accountability to Project Managers for the content that
is provided to the public</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="even">
<td><blockquote>
<p>11/6/2002</p>
</blockquote></td>
<td><blockquote>
<p>Legal</p>
</blockquote></td>
<td>Discussions with the Unions may lead to delays in the process or
necessary changes.</td>
<td><blockquote>
<p>2</p>
</blockquote></td>
<td>Somewhat Unlikely</td>
<td><blockquote>
<p>Critical</p>
</blockquote></td>
<td><blockquote>
<p>D</p>
</blockquote></td>
<td>$494,000</td>
<td>Internal</td>
<td><blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Begin the Union discussions early n the process in order to allow
for needed changes.</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="odd">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Organizational</p>
</blockquote></td>
<td>Redistribution of power within the Department</td>
<td><blockquote>
<p>2</p>
</blockquote></td>
<td>50/50 Chance</td>
<td><blockquote>
<p>Moderate</p>
</blockquote></td>
<td><blockquote>
<p>A</p>
</blockquote></td>
<td>$2,250</td>
<td>External</td>
<td><blockquote>
<p><u>Acceptance</u></p>
</blockquote>
<ul>
<li><p>Accept this risk</p></li>
</ul>
<blockquote>
<p><u>Avoidance</u></p>
</blockquote>
<ul>
<li><p>Ensure that a change management component is included in the
implementation and rollout</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="even">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Organizational</p>
</blockquote></td>
<td>Agencies or individual employees are resistant to adopt proposed
solutions</td>
<td><blockquote>
<p>1</p>
</blockquote></td>
<td>50/50 Chance</td>
<td><blockquote>
<p>Critical</p>
</blockquote></td>
<td><blockquote>
<p>D</p>
</blockquote></td>
<td>$650,000</td>
<td>External</td>
<td><blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Create and implement a change management plan</p></li>
<li><p>Ensure compliance with established communication plan to promote
and market the benefits of the solution to agencies and
employees</p></li>
<li><p>Include as a part of the Performance Elements</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="odd">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Data</p>
</blockquote></td>
<td>Loss of content due to an accident, fire, or other disaster</td>
<td><blockquote>
<p>3</p>
</blockquote></td>
<td>Highly Unlikely</td>
<td><blockquote>
<p>Moderate</p>
</blockquote></td>
<td><blockquote>
<p>D</p>
</blockquote></td>
<td>$169,000</td>
<td>Internal</td>
<td><p><u>Avoidance</u></p>
<ul>
<li><p>Create backups for content and documents</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="even">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Data</p>
</blockquote></td>
<td>Erroneous deletion or destruction of content</td>
<td><blockquote>
<p>3</p>
</blockquote></td>
<td>Somewhat Unlikely</td>
<td><blockquote>
<p>Moderate</p>
</blockquote></td>
<td><blockquote>
<p>A</p>
</blockquote></td>
<td><blockquote>
<p>$950</p>
</blockquote></td>
<td>Internal</td>
<td><p><u>Control</u></p>
<ul>
<li><p>Select solution with valid workflow processes and standards for
deletion or destruction of content or documents</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="odd">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Security</p>
</blockquote></td>
<td>Roles and responsibilities related to the solution are improperly
administered</td>
<td><blockquote>
<p>3</p>
</blockquote></td>
<td>Somewhat Unlikely</td>
<td><blockquote>
<p>Moderate</p>
</blockquote></td>
<td><blockquote>
<p>D</p>
</blockquote></td>
<td>$494,000</td>
<td>Internal</td>
<td><p><u>Control</u></p>
<ul>
<li><p>Involve USDA Cyber Security Office and agency level security
office in design and review of solutions</p></li>
<li><p>Continuously review and update the Security plan</p></li>
<li><p>Instill accountability to Program Managers</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="even">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Security</p>
</blockquote></td>
<td>Unauthorized users gain access to data or content stored in the
solution</td>
<td><blockquote>
<p>2</p>
</blockquote></td>
<td>Somewhat Unlikely</td>
<td><blockquote>
<p>Critical</p>
</blockquote></td>
<td><blockquote>
<p>D</p>
</blockquote></td>
<td>$494,000</td>
<td>Internal and External</td>
<td><p><u>Control</u></p>
<ul>
<li><p>Involve USDA Cyber Security Office and agency level security
office in design and review of solutions</p></li>
<li><p>Continuously review and update the Security plan</p></li>
<li><p>Instill accountability to Program Managers</p></li>
<li><p>Implement sound security plan that includes appropriate
firewalls</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="odd">
<td><blockquote>
<p>10/28/02</p>
</blockquote></td>
<td><blockquote>
<p>Privacy</p>
</blockquote></td>
<td>Unauthorized users access, use, or disclose private information that
is stored in the system.</td>
<td><blockquote>
<p>2</p>
</blockquote></td>
<td>Somewhat Unlikely</td>
<td><blockquote>
<p>Critical</p>
</blockquote></td>
<td><blockquote>
<p>D</p>
</blockquote></td>
<td>$494,000</td>
<td>Internal and External</td>
<td><blockquote>
<p><u>Avoidance</u></p>
</blockquote>
<ul>
<li><p>Ensure that the proper policies and practices concerning the
protection of privacy information have been implemented through
Certification and Accreditation</p></li>
<li><p>Conduct a Privacy Impact Assessment</p></li>
<li><p>Identify and register a system of records</p></li>
</ul>
<blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Perform extensive review of content and documents to identify
time-sensitive and market-sensitive materials</p></li>
<li><p>Instill accountability for Program Managers to assign
metadata</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="even">
<td><blockquote>
<p>11/15/02</p>
</blockquote></td>
<td><blockquote>
<p>Risks Associated with Contracting to an Application Service
Provider</p>
</blockquote></td>
<td>Inability to transfer assets, such as equipment, facilities, and
licenses, from USDA to the application service provider</td>
<td><blockquote>
<p>1</p>
</blockquote></td>
<td>50/50 Chance</td>
<td><blockquote>
<p>Critical</p>
</blockquote></td>
<td><blockquote>
<p>D</p>
</blockquote></td>
<td>$650,000</td>
<td>Internal and External</td>
<td><blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Jointly define a migration plan to estimate the time and costs
associated with preparing the environment</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="odd">
<td><blockquote>
<p>11/15/02</p>
</blockquote></td>
<td><blockquote>
<p>Risks Associated with Contracting to an Application Service
Provider</p>
</blockquote></td>
<td>Inability to acquire the skills or resources necessary to manage the
provisions of the service contract</td>
<td><blockquote>
<p>1</p>
</blockquote></td>
<td>Somewhat Likely</td>
<td><blockquote>
<p>Critical</p>
</blockquote></td>
<td><blockquote>
<p>C</p>
</blockquote></td>
<td>$39,375</td>
<td>Internal</td>
<td><blockquote>
<p><u>Control</u></p>
</blockquote>
<ul>
<li><p>Develop and implement a Service Level Agreement (SLA) with the
application service provider to ensure expectations are met. Include
penalties to the provider for non-compliance.</p></li>
<li><p>Create a group specifically responsible for vendor management
activities.</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="even">
<td><blockquote>
<p>11/15/02</p>
</blockquote></td>
<td><blockquote>
<p>Risks Associated with Contracting to an Application Service
Provider</p>
</blockquote></td>
<td>Lack of control over skills and resources as well as quality and
performance of the application service provider</td>
<td><blockquote>
<p>2</p>
</blockquote></td>
<td>50/50 Chance</td>
<td><blockquote>
<p>Moderate</p>
</blockquote></td>
<td><blockquote>
<p>C</p>
</blockquote></td>
<td>$31,250</td>
<td>External</td>
<td><blockquote>
<p><u>Avoid</u></p>
</blockquote>
<ul>
<li><p>Develop and implement a Service Level Agreement (SLA) with the
application service provider to ensure quality expectations are met. The
SLA should explicitly state the number of resources required to support
operations.</p></li>
</ul></td>
<td>Identified</td>
</tr>
<tr class="odd">
<td><blockquote>
<p>11/15/02</p>
</blockquote></td>
<td><blockquote>
<p>Risks Associated with Contracting to an Application Service
Provider</p>
</blockquote></td>
<td>Issue identification and resolution are not achieved in a timely
manner due to unresponsiveness of the application service provider</td>
<td><blockquote>
<p>2</p>
</blockquote></td>
<td>50/50 Chance</td>
<td><blockquote>
<p>Moderate</p>
</blockquote></td>
<td><blockquote>
<p>C</p>
</blockquote></td>
<td>$31,250</td>
<td>External</td>
<td><blockquote>
<p><u>Avoid</u></p>
</blockquote>
<ul>
<li><p>Develop and implement a Service Level Agreement (SLA) with the
application service provider that includes issue management policies and
procedures as well as provider penalties for non-compliance.</p></li>
</ul></td>
<td>Identified</td>
</tr>
</tbody>
</table>