The Agency Head must be included since risk mitigation is a business function, not just an IS function. Users provide insight into how their systems are used. Legal and procurement staff provide contract guidance with suppliers and vendors. Finally, MIS staff, the Y2K Project Manager and key personnel must be part of the team. The first step for the risk management team is to develop and document a risk list.
Spreadsheets are useful tools for capturing the risk information.
A sample Risk List is provided in Attachment A. A good place to start in compiling a risk list is the Y2K Project Manager's top five concerns. Risks identified during Y2K team meetings and during project reviews with executive management should be added to the list as they are identified. As the project team becomes more comfortable with risk management, risks should be identified during formal risk management meetings. The risk management team should meet regularly. For each meeting, the team should pick a group of risks that need to be specified or reassessed.