2.109.2 Risk, Issue, and Action Item Management Process
- 2.109.2.1 Program Scope and Objectives
  - 2.109.2.1.1 Background
    - 2.109.2.1.1.1 Process Description
    - 2.109.2.1.1.2 Goal
    - 2.109.2.1.1.3 Objectives
  - 2.109.2.1.2 Authority
  - 2.109.2.1.3 Roles and Responsibilities
  - 2.109.2.1.4 Program Management and Review
  - 2.109.2.1.5 Program Control
    - 2.109.2.1.5.1 Controls
    - 2.109.2.1.5.2 Metrics
    - 2.109.2.1.5.3 Tailoring Guidelines
  - 2.109.2.1.6 Terms/Definitions/Acronyms
    - 2.109.2.1.6.1 Terms and Definitions
    - 2.109.2.1.6.2 Acronyms
  - 2.109.2.1.7 Related Resources
  - 2.109.2.1.8 Training
- 2.109.2.2 Process Workflow
  - 2.109.2.2.1 Main Process Diagram
  - 2.109.2.2.2 Inputs
  - 2.109.2.2.3 Outputs
  - 2.109.2.2.4 Activities
  - 2.109.2.2.5 Procedure
    - 2.109.2.2.5.1 1.0: Risk Management Process
      - 2.109.2.2.5.1.1 Cross-Functional Flow Diagram
    - 2.109.2.2.5.2 2.0: Issue Management Process
      - 2.109.2.2.5.2.1 Cross-Functional Flow Diagram
    - 2.109.2.2.5.3 3.0: Action Management Process
      - 2.109.2.2.5.3.1 Cross-Functional Flow Diagram
    - 2.109.2.2.5.4 4.0: Risk and Issue Meeting and Reporting Process
      - 2.109.2.2.5.4.1 Cross-Functional Flow Diagram

Part 2. Information Technology

Chapter 109. Risk, Issue, and Action Item Management Policy

Section 2. Risk, Issue, and Action Item Management Process

2.109.2 Risk, Issue, and Action Item Management Process

Manual Transmittal

April 22, 2020

Purpose

(1) This transmits new Internal Revenue Manual (IRM) 2.109.2, Risk, Issue, and Action Item Management Practices, Risk, Issue, and Action Item Management Process.

Material Changes

(1) This is a new manual and thus without material changes.

Effect on Other Documents

Risk, Issue, and Action Item Management Process Description Version 3.1.3 dated October 09, 2014 is superseded.
Risk Identification Procedure Version 1.0.3 dated October 20, 2014 is superseded.
Risk Analysis and Validation Procedure Version 1.0.3 dated October 20, 2014 is superseded.
Risk Mitigation Planning and Execution Procedure Version 1.0.3 dated October 20, 2014 is superseded
Issue Management Procedure Version 1.0.3 dated October 20, 2014 is superseded.
Action Item Management Procedure Version 1.0.3 dated October 20, 2014 is superseded.
Risk/Issue Meeting and Reporting Procedure Version 1.0.2 dated October 20, 2014 is superseded

Audience

The audience for this manual is the Information Technology (IT) Organization, contracted personnel, and other stakeholders responsible for following Enterprise Life Cycle (ELC) guidance.

Effective Date

(04-22-2020)

Nancy Sieger
Acting Chief Information Officer

2.109.2.1 (04-22-2020)

Program Scope and Objectives

Overview - This document describes the formal process for implementing the requirements of the Risk, Issue, and Action Item Management process which includes risk identification, analysis, validation, mitigation planning and execution, reporting as well as issue management and action item management. It provides an operational definition of the major components of the process and how to perform each step in the process. This document also describes the logical arrangements of steps that are essential to successfully completing the process and achieving its desirable outcome.
Purpose - The purpose of this policy is to establish a common management process for risks, issues, and action items management plans across Internal Revenue Service (IRS) IT Organization.
Audience - The audience for this IRM is the IT Organization, contracted personnel, and other stakeholders responsible for following the Enterprise Life Cycle (ELC) guidance.
Policy Owner - Strategy and Planning, Business Planning and Risk Management, Enterprise Life Cycle Office.
Program Owner - Strategy and Planning, Business Planning and Risk Management, Enterprise Life Cycle Office is responsible for the development, implementation, and maintenance, of this process. Approval of this process, including updates, rests with the Director, Business Planning and Risk Management. All proposed changes to this policy must be submitted to Business Planning and Risk Management, Enterprise Life Cycle Office.
Primary Stakeholders - This process applies to all IT projects and programs.
Program Goals - The goal is to establish an authoritative repository for all IT programs and projects to maintain risk and issues, and action items management.

2.109.2.1.1 (02-28-2020)

Background

A process is defined as “A set of related activities that accomplish a common goal”. The process definition laid out in this document further breaks down these Activities into Tasks, each of which have a complete set of attributes defined such as data and tool specifications and the role(s) responsible for executing the tasks. The document also includes process goal and objectives, metrics, role definitions, policies and other process related attributes.

2.109.2.1.1.1 (02-28-2020)

Process Description

This Risk, Issue, and Action Item Management process describes what happens within the Risk, Issue, and Action Item Management process and provides an operational definition of the major components of the process. This process specifies, in a complete, precise, and verifiable manner, the requirements, design, and behavior characteristics of the Risk, Issue, and Action Item Management process.

2.109.2.1.1.2 (02-28-2020)

Goal

The process goal describes a specific purpose or achievement toward which the efforts of the process are directed. Each process has a specific focus and when combined with the other processes, forms a comprehensive framework for delivering and managing services.

The goal of this process is to establish a common management process for risk, issue, and action item management across the IT organization.
- To support risk management requirements for all IT program and projects.
- To provide a set of interrelated activities that all program and projects should follow regarding the Risk, Issue, and Action Item Management process.

2.109.2.1.1.3 (02-28-2020)

Objectives

The objective is to have everyone using the same tools and techniques and follow the same repeatable steps so that the organization can quantify how well the Risk, Issue, and Action Item Management process is working and train future staff members who may not currently know the routine. Ensuring consistency is a critical component for ensuring optimum efficiency.

The following is a list of objectives for this process:
- To assist a program or project with the identification, analysis, validation and mitigation of risks.
- To assist a program or project with the management of issues.
- To assist a program or project with the management of action items.
- To assist a program or project with the reporting and tracking of risks, issues and action items.

2.109.2.1.2 (02-28-2020)

Authority

All proposed changes to this document must be submitted in writing, with supporting rationale, to the Strategy and Planning, Business Planning and Risk Management, Enterprise Life Cycle Office.

2.109.2.1.3 (02-28-2020)

Roles and Responsibilities

Each process defines at least one role. Each role is assigned to perform specific tasks within the process. The responsibilities of a role are confined to the specific process. They do not imply any functional standing within the hierarchy of an organization. For example, the process manager role does not imply the role is associated with or fulfilled by someone with functional management responsibilities within the organization. Within a specific process, there can be more than one individual associated with a specific role. Additionally, a single individual can assume more than one role within the process although typically not at the same time.

Below are the roles and provide a brief description for this process.

Name	Description
Responsible Manager	The Responsible Manager is ultimately responsible for the management of all risks and issues in accordance with the mission and goals of the IT organization to ensure the program and/or project goals are achieved. Also the Responsible Manager: ensures that risks and issues are identified and managed on a continual basis throughout the life of the program or project, normally leads item identification activities during initial planning and re-planning for a program or project, assigns an Item Owner, approves the mitigation or management plan for resolving the risk or issue, provides the necessary resources required to successfully execute the plan; ensuring that the mitigation or management plan does not inadvertently change technical or contract requirements or negatively impact organization schedules. assesses the success/results of the activity and reviews progress of the risk or issue to resolution of the activity associated with a risk, issue, or action item, approves final disposition of a risk, issue and action item and decides when the item may be closed. conducts the review meetings, and escalates the risk or issue to the appropriate reporting Governance Board
Item Identifier	Any program, project or team member or stakeholder may identify a candidate risk, issue or action item. The Item Identifier: provides clear and concise information that defines a candidate risk, issue or action item and its context (such as title, statement, date identified, source, scope, responsible manager/organization, probable impact date, due date, closure criteria, etc.), provide completed information in an acceptable format, using one of the templates based on if the item identified is a risk, issue or action item, shall forward the required information to the Item Coordinator for entry into the Item Tracking Reporting and Control (ITRAC) Repository, and may be asked to participate in the analysis of the risk or issue to determine its impact and the activities required for resolution.
Item Owner (Risk, Issue or Acton Item)	The Item Owner Item is responsible for developing the mitigation or management plan to resolve a risk or an issue. The Item Owner obtains necessary resources from the Responsible Manager and manages the execution of the mitigation or management plan as well as: modifies the mitigation or management plan, when necessary, to achieve the required results, determines the appropriate mitigation or management approach. Re-plans the mitigation or management strategy when changes in item parameters warrant a different approach, provides status on the resolution activities throughout the execution of the mitigation or management plan to the Responsible Manager, provides information to the Item Coordinator for entry in the ITRAC repository, determines the results needed to resolve the action item, involve the stakeholders or SME to assist with developing the information about the risk or issue to a sufficient level of detail for the Responsible Manager to make a decision, advises the Responsible Manager regarding escalation of the item, directs the Activity Owners to start activities for each step of the mitigation plan or management plan., ensures Activity Owners have required information and resources, Monitors activity to completion, and converts risk to an issue if risk happens and recommends closure of an item.
Activity Owner	The Activity Owner executes the assigned activity. During the performance of assigned activities the Activity Owner: may be involved in the development of the management plan and dates for assigned activities. provides timely status information to the Item Owner, and provides status information to the Item Coordinator to update ITRAC.
Item Coordinator (Risk, Issue, or Action Item)	The Item Coordinator for a program, project or organization records the risk, issue or action item in the ITRAC repository. The Item Coordinator is also responsible for: collecting and entering status information, and producing reports for the Responsible Manager when notified update and close a risk, issue or action item as well as that all decisions are recorded in ITRAC, ensures that the Item Owner provides timely status to the risk or issue information, generates the reports as necessary to support management needs, and assist with the coordination of the risk/issue meetings.

2.109.2.1.4 (02-28-2020)

Program Management and Review

Policies outline a set of plans or courses of action that are intended to influence and determine decisions or actions of a process. Policies provide an element of governance over the process that provides alignment to business vision, mission and goals.

Process Management
Statement:	The Risk, Issue, and Action Item Management process will have a single Process Owner and a separate Process Manager responsible for implementation and ensuring adherence to the process. The process will be reviewed regularly to ensure that it continues to support the business requirements of the enterprise. The process will be designed and developed based on ROI to the business. Process metric will be focused on providing relevant information as opposed to merely presenting raw data.
People:
Statement:	Roles and responsibilities for the process must be clearly defined and appropriately staffed with people having the required skills and training. The mission, goals, scope and importance of the process must be clearly and regularly communicated by upper management to the staff and business customers of IT. All IT staff (direct and indirect users of the process) shall be trained at the appropriate level to enable them to support the process.
Rationale:	It is imperative that people working in, supporting or interacting with the process in any manner understand what they are supposed to do. Without that understanding Risk, Issue, and Action Item Management process will not be successful.
Process:
Statement:	Modifications to the Risk, Issue, and Action Item Management process must be approved by the Process Owner. The design of the process must include appropriate interfaces with other processes to facilitate data sharing, escalation and workflow. The process must be capable of providing data to support real-time requirements as well as historical/trending data for overall process improvement initiatives. The process must be fully documented, published and accessible to the various stakeholders of the process. The process will be reviewed on a periodic basis in order to ensure it continues to support organizational goals and objectives (continuous improvement). The process must include Inputs, Outputs, Controls, Metrics, Activities, Tasks, Roles and Responsibilities, Tool and Data requirements along with documented process flows. The process will be kept straight forward, rational, and easy to understand.
Rationale:	The process must meet operational and business requirements.
Technology and Tools:
Statement:	All tools selected must conform to the enterprise architectural standards and direction. Existing in-house tools and technology will be used wherever possible, new tools will only be entertained if they satisfy a business need that cannot be met by current in-house tools. The selection of supporting tools must be process driven and based on the requirements of the business. Selected tools must provide ease of deployment, customization and use. Automated workflow, notification and escalation will be deployed wherever possible to minimize delays, ensure consistency, reduce manual intervention and ensure appropriate parties are made aware of issues requiring their attention. The tools used by this process are the following: ITRAC EXCEL MS Word MS Power Point
Rationale:	Technology and tools should be used to augment the process capabilities, not become an end themselves.

2.109.2.1.5 (02-28-2020)

Program Control

Activities involved in ensuring a process is predictable, stable, and consistently operating at the target level of performance.

2.109.2.1.5.1 (02-28-2020)

Controls

Process controls represent the policies and guiding principles on how the process will operate. Controls provide direction over the operation of processes and define constraints or boundaries within which the process must operate.

Name	Description
Audits	ITRAC undergoes a Privacy & Civil Liberties Impact Assessment (PCLIA) every three years. Procedure and policies are reviewed every two years
Policies	Policies for the Risk, Issue, and Action Item Management process are established in the Risk, Issue, and Action Item Management Policy IRM 2.109.1.
Security Policies	Security policies governing access to ITRAC has specified levels of access and the database is protected by user-set passwords. All Users must have a valid IRS Network Login Standard Employee Identifier (SEID).
Scope	The scope of the Risk, Issue, and Action Item Management process is to provide a centralized set of standard procedures.
Change Management Policies	Requests for changes to this process should be directed to the process owner.
Management Reports	Metric and statistics reports concerning ITRAC risks, issues, and action items manager are produced on a monthly basis.

2.109.2.1.5.2 (02-28-2020)

Metrics

Metrics are used for the quantitative and periodic assessment of a process. They should be associated with targets that are set based on specific business objectives. Metrics provide information related to the goals and objectives of a process and are used to take corrective action when desired results are not being achieved and can be used to drive continual improvement of process effectiveness and efficiency.
Management will regularly set targets for process performance, gather quantifiable data related to different functions of the Risk, Issue, and Action Item process, and review that data in order to make informed decisions and take appropriate corrective action.

2.109.2.1.5.3 (02-28-2020)

Tailoring Guidelines

The tailoring guidelines identify the allowable variations of the IT organization’s standard process as needed for adjustments (adding, deleting, modifying) relative to specific operational or functional needs of another organization. Process tailoring is about roles and procedures, not the standard process or major activities defined in this process. All tailoring request, with supporting rationale, must be submitted in writing to and approved by the Strategy and Planning, Business Planning and Risk Management, Enterprise Life Cycle Office owner.

2.109.2.1.6 (02-28-2020)

Terms/Definitions/Acronyms

Terms/Definitions/Acronyms

2.109.2.1.6.1 (02-28-2020)

Terms and Definitions

Term	Definition
Action Item	A short-duration, minimal resources activity assigned to a member or stakeholder in the program/project or organization within IT. An action item must be within the scope of the duties currently assigned to that person.
Action Plan	Description of the activities planned to resolve the action item and updates giving status of the activities.
Activity Update	Detailed status of the activity - Typically, a running chronology is provided in descending date order. Example: 10/22/2020 – Action plan approved by mgr. 09/20/2020 – Kickoff meeting held.
Actual Date Closed	Date management approved closure.
Actual Start Date	Date activity was started.
Actual Completion Date	Date activity was completed.
Assigned Organization Code	Acronym of the organization to whom the item identifier recommends the responsibility for the risk, issue or action item be assigned. This is a recommendation by the responsible manager or item identifier.
Attachments	Other files providing further information or documentation may be attached to the risk, issue or action item. Example: Work plans, decision papers, information to support closure criteria or Power Point presentations.
Closed Date	Date an issue or action item is actually closed.
Closure Criteria	Description of the requirement that must be met to close the ITRAC record. The closure criteria should be specific and measurable and should state how the item can be closed or eliminated.
Closure Rationale	Reason for closing the item along with the name of approving manager. The item is no longer valid, the event has occurred, or the item is no longer considered a risk. Example: Mitigation plan has successfully completed and has reduced the probability of this risk occurring to less than 10%. Per approval of the project manager, Jane Doe, this risk can be closed. Note: Closure rationale should address the closure criteria or explain why the item can be closed without criteria being met.
Contractor Coordinator	The name of the IRS contractor employee assigned to edit, input, and/or update the ITRAC record.
Date Identified	Date the risk was identified.
Decisions	The Item Owner’s assessment of any key decisions that would impact successful closure of this item.
Description	Narrative of the issue and its impact on the organization. Example: Lack of compatibility of tools in environment is causing a 50% increase in workload for 10 people.
Due Date	Date resolution is needed by the program or a project(s) to resolve the issue or action item.
Impact	This is a required database field in the ITRAC system. Rating is the cumulative effect of a risk on the cost, schedule, technical performance, and effect on other Teams/Projects. A numerical rating for each of these 4 areas is selected by the user. The overall impact rating for the Risk is generate by ITRAC and reflects the worst potential in each of the four areas: 1 and 2 = Low, 3 = Medium, 4 = High, 5 = Severe Cost Ratings: 1. Minimal or no impact 2. Additional resources required; able to meet need date 3. Minor slip in key milestones; not able to meet need date 4. Major slip in key milestones or critical path impacted 5. Cannot achieve key team or major program milestone Schedule Ratings: 1. None or Minimal Impact (ex: < $10,000) 2. Low (ex: $10,000 - $100,000) 3. Moderate (ex: $100,000 - $ 1,000,000) 4. High (ex: $1,000,000 - $10,000,000) 5. Severe (ex: > $10,000,000) Technical Performance Ratings: 1. Minimal or no impact 2. Minor technical shortfall but no impact to requirements 3. Moderate technical shortfall but workaround available which will eliminate impact to requirements 4. Major technical shortfall but work around available which will eliminate impact to requirements 5. Solution not meeting minimum technical requirements Impact on other Team Ratings: 1. None 2. Some Impact 3. Moderate Impact 4. Major Impact Unacceptable impact, may affect a release window
Include on Chief Information Officer (CIO) Risk Report	A check box in the ITRAC system used by the User to identify project risks to be included on the CIO Risk Report. If checked, then this risk will be listed in the project’s CIO Risk Report.
Include on Risk Categories Risk Report	A check box used by the User to identify project risks to be included on the Risk Categories on the report. If checked, then this risk will be listed in the project’s Risk Categories Risk Report. The Risk Categories support the OMB E300 Risks.
Interfaces	Owner’s assessment of any interface actions that would impact successful closure of this item.
IRS Coordinator	The name of the IRS federal employee assigned to edit, input, and/or update the ITRAC record.
Issue	A situation or condition that (1) currently has a negative consequence for the investment, program, project, or organization or (2) has 100% probability of having negative consequences for the investment, program, project, or organization within 30 calendar days.
Item	An item is a risk or issue as defined. Item can also be interchanged for an Action Item, Risk or Issue Coordinator, Identifier or Owner as defined.
ITRAC ID	Unique number for a risk, issue or action item. The number is automatically generated by the database and assigned to the item when it is entered the repository.
Mitigation/Management Activity	Multiple entries containing the date of the entry and status of the mitigation activity. Status is listed in most recent date order. Example: 7/21/2022 - Approved proposal template. 7/15/2022 - Proposal template completed by working group. 6/15/2022 - Working group formed to revise proposal template.
Probable Impact Date	Most likely date that the program or a project(s) will be impacted by the risk.
Probability of Risk Occurring	This is a required database field in the ITRAC system. A user supplied estimate that the risk will occur, and it provides thresholds for evaluating probability. 1. Probability of occurrence is less than 25% and greater than 0% 2. Probability of the occurrence is less than 75% and greater than or equal to 25% 3. Probability of occurrence is less than 100% and greater than or equal to 75%
Priority	Indicator of the urgency of an item for the program or project: High: Item has a significant impact (such as a solution not meeting minimal technical requirements; or cost or schedule being affected). Moderate: Item has a moderate impact (such as a technical shortfall but work-around available which will eliminate impact to requirements; and no impact on cost and schedule). Low: Item has a low impact (such as a minor technical shortfall but no impact to requirements; and no impact to cost or schedule).
Projected Completion Date	Date projected for a risk, issue or action item closure.
RACI	The RACI model is based on the principle that people act in one of four ways when executing a task. It accounts for the fact that more than one role may be active in performing a specific task while clearly defining specific responsibilities for that role. While many roles may be involved in a task only one is Accountable for the results. The actions are: R Responsible for the action (may do the task) A Accountable for the action (including approval) C Required to be Consulted on the action I Required to be Informed of the action. If a task does not have an Accountable role indicated then the Responsible role is assumed to be accountable for the task.
Responsible Manager	The name of the IRS manager assigned to mange the ITRAC record.
Resources	Owner’s assessment of any resources that would impact successful closure of this item.
Risk	A potential event or condition that could have an impact or opportunity on the cost, schedule, business, or technical performance of an Information Technology investment, program, project, or organization.
Risk Categories	Office of Management and Budget (OMB) - A11 Risk Categories. An E 300 database field has been added to ITRAC to support (OMB-A11). The user assessment of what category type; you can populate this data field by selecting one of the values that appear in a drop-down pick list. Additional information can be found on the Risk Management Share Point site.
Risk, Issue, and Action Item Management	Risk, Issue, and Action Item Management is a set of well-defined program management processes and procedures designed to identify, analyze, report, and manage IT program or project risks, issues, and action items.
Scheduled Completion Date	Date activity is scheduled to be complete.
Scheduled Start Date	Date activity is scheduled to start.
Scope	Selected from a pick list by the user to identify the scope of this item. Indication of whether the item is at the program level organization(s) or project(s) or multiple organizations are affected by the following item. This is a required database field for all ITRAC Items: Project: It is a fixed-duration endeavor undertaken with defined start and stop dates to deliver a unique product, service or result. It represents solutions to a specific business issue. Example: Customer Account Data Engine 2 (CADE 2) Transition State 2. Program: is to be selected if the item impacts a group of related project releases managed in a coordinated way which usually includes an element of ongoing work. It may impact projects that are concurrently executed with or without overlapping dates and can have more than one domain involved. Example: Foreign Account Tax Compliance Act (FATCA) (includes all project releases). Domain is to be selected if the item impacts an area that contains similar project activities directed toward achieving a set of defined functions in support of the agency’s mission and vision strategy Example: Submission Processing. Enterprise Release: is to be selected if the item impacts a set of configuration items including application software, hardware, systems software, telecommunications and procedures grouped together to be delivered to the Production environment at a certain point in time. A release will generally include components from across architecture, projects, programs, and domains. Example: Enterprise Architecture. Portfolio: It is a custom view of a set of IT investments that is user definable. IT Portfolio Summary includes all IT resources for the IT Investments from all funding sources.
Source	Name of organization/person or event that identified the risk, issue; or action item. Example: Risk Review Board Meeting - Tom Jones
State	Active Mitigation - a mitigation plan is currently being executed for the risk. Candidate - Default when the risk is first is entered into the repository. Closed - the item is no longer opened, and all closure criteria have been met or it is no longer a risk, an issue or action item. Escalated - the risk or issue has been escalated to a higher management level. Monitored - the risk is being watched, but no mitigation plan is currently active. Open – the issue or action item is currently active and has not yet been resolved. Withdrawn - the candidate risk has not been accepted for monitoring and potential mitigation. Note: Current life cycle state for a Risk is “Candidate, for an Issue or Action Item: “Open” (default state is set when an item is first entered into the ITRAC database).
Statement	A clear, concise statement of the condition followed by a clear, concise statement of the consequence. The condition is a single phrase that briefly describes the key circumstances, situations, etc. causing the concern; The consequence is a single phrase that describes the potential event that will have a negative impact on the program/project. Example: If a new methodology is imposed on the project, then additional training costs will be incurred.
Status	Summary status of item
Status of Mitigation/Management Plan	Indicator of the overall status of the mitigation plan is calculated by ITRAC. Green: all open activities have started as scheduled. Yellow: one or more activities have not started as scheduled. Red: one or more activities have not completed as scheduled or the probable impact date or due date has passed. N/A: Risk is not in the Active Mitigation State, and probable impact date has not passed
Title	Title containing keywords that briefly identify the Condition and Consequence of the risk (max 120 characters). This title is used in summary level reports to identify the risk. Example: A new methodology is imposed on the project which would incur additional training costs. This description is used in summary level reports to identify the issue or action item. Example: Lack of tools compatibility in the development environment.

2.109.2.1.6.2 (02-28-2020)

Acronyms

Acronyms	Description
ACIO	Associate Chief Information Officer
CADE2	Customer Account Data Engine 2
CIO	Chief Information Officer
ELC	Enterprise Life Cycle
FATCA	Foreign Account Tax Compliance
IPM	Integrated Process Management
IRM	Internal Revenue Manual
IRS	Internal Revenue Service
IT	Information Technology
ITRAC	Item Tracking Reporting and Control
OMB	Office of Management and Budget
PCLIA	Privacy & Civil Liberties Impact Assessment
RACI	Responsible, Accountable, Consulted and Informed
ROI	Return-on-Investment
SEID	Standard Employee Identifier
SME	Stakeholder and Subject Matter Expert
TIGTA	Treasury Inspector General for Tax Administration

2.109.2.1.7 (02-28-2020)

Related Resources

The following sources were used to develop and/or support this process.
- Risk, Issue, and Action Item Management Policy IRM 2.109.1

2.109.2.1.8 (02-28-2020)

Training

Process training involves training all stakeholders about key processes that are crucial for an organization to deliver business objectives. Training provides clarity to employees on a set of procedures that needs to be carried out as part of the process and the best possible way to do them. List below the training resources available for this process:
- PM IT Risk Management (Formerly Software Risk Management) – Course 13868
- SKSBS Identifying Risks in Your Organization – Course 66312
- SKSBS Risk Management: Identifying Risk – Course 47947
- SKSBS IT Project Management Essentials: Managing Risks in an IT Project – Course 36546
- SKSBS IT Project Management Essentials: Monitoring and Controlling IT Projects – Course 36545

2.109.2.2 (02-28-2020)

Process Workflow

A process workflow consists of Activities and Tasks, Inputs and Outputs, Roles, and Flow Diagrams. It describes the tasks, procedural steps, organizations or people involved, required input and output information, and tools needed for each step of the process.

2.109.2.2.1 (02-28-2020)

Main Process Diagram

The following figure graphically depicts the roles, activities, and steps for each activity within the Risk, Issue, and Action Item Management process.

Figure 2.109.2-1

Risk, Issue, and Action Item Management ProcessThis figure is a graphic substitute for the text.

Please click here for the text description of the image.

2.109.2.2.2 (02-28-2020)

Inputs

Process inputs are used as triggers to initiate the process and to produce the desired outputs. Users, stakeholders or other processes provide inputs. The following is a list of inputs for this process:

Name	Description	Supplier
A risk event	A potential risk to the cost, schedule or performance of an IT program or project is identified	Program Manager or Project Manager or Responsible Manager or Team Member or SME or Stakeholders
Materialized risk event	A previously identified risk is realized.	Program Manager or Project Manager or Responsible Manager or Team Member or SME or Stakeholders
Reports	Generate the item reports as necessary to support management needs.	Program Manager or Project Manager or Responsible Manager or Team Member or SME or Stakeholders
Issue	An event that has impact on the program or project ability to achieve its goal.	Program Manager or Project Manager or Responsible Manager or Team Member or SME or Stakeholders
Problems or issues discussed at Executive meetings	The issues at hand that have been discussed at Executive level meetings and require immediate attention.	Senior Executive
Action Item	A short-duration, minimal resources activity assigned to a member or stakeholder in the program/project or organization. An action item must be within the scope of the duties currently assigned to the member or stakeholder in the program/project or organization.	Senior Executive, Program Manager or Project Manager or Responsible Manager

2.109.2.2.3 (02-28-2020)

Outputs

Each process produces tangible outputs. These outputs can take the form of products or data and can be delivered to a user or stakeholder or they can be used as inputs to other processes. Outputs are measurable in terms of quantity and quality.

Below is the process output table.

Name	Description	Recipient
Candidate risk	A candidate risk that has been accurately recorded in the risk repository.	Program Manager or Project Manager or Responsible Manager or Team Member or SME or Item Owner or Item Coordinator
A risk in monitoring state	A risk is observed, and the progress is checked over a period and keeps under systematic review.	Program Manager or Project Manager or Responsible Manager or Team Member or Item Owner or Activity Owner or Item Coordinator
A risk that is withdrawn	A risk is withdrawn when it is determined that it is not a valid risk.	Program Manager or Project Manager or Responsible Manager or Team Member or Item Owner or Activity Owner or Item Coordinator
A risk that is transferred to another organization	When a risk is determined to be the responsibility of another organization. The risk is transferred to another organization and is accepted by all parties involved.	Program Manager or Project Manager or Responsible Manager or Item Owner or Stakeholder or Item Coordinator
A closed risk	A risk that did not occur or was mitigated.	Program Manager or Project Manager or Responsible Manager or, Team Member or Item Owner or Activity Owner or Item Coordinator
A materialized risk	A previously identified risk is realized	Program Manager or Project Manager or Responsible Manager or, Team Member or Item Owner or Activity Owner or Stakeholder or Item Coordinator
An generated item report and conducting meetings	A detail item report or index summary report produced to support management decisions during a meeting	Program Manager or Project Manager or Responsible Manager or, Team Member or Item Owner or Activity Owner or Stakeholder or Item Coordinator
An closed Issue	An issue is managed or closed, no longer valid, no longer considered an issue, or escalated.	Item Coordinator
An closed Action Item	An action item that is executed, no longer valid no longer considered an action item, escalated or closed.	Item Coordinator

2.109.2.2.4 (02-28-2020)

Activities

An activity is a major unit of work to be completed in achieving the objectives of the process. A process consists of a sequence of related activities that transforms inputs into outputs and performed by the roles defined in the process. Activities are measurable in terms of efficiency and effectiveness. Identify the activities in the process and provide a brief description. The activities must correspond with the high-level process flow diagram above.

ID	Name	Description
1.0	Risk Management Process	This activity includes identifying a potential risk that could potentially prevent the program, or project from achieving its objectives. Assessment of the risk to determine whether the potential event is of significance to the organization. Determination of the mitigation strategies that will be performed to minimize or avoid the risk.
2.0	Issue Management Process	Determination of the management strategies that will be performed to minimize the issue.
3.0	Action Item Management Process	The management of action items resulting from significant program or project level meetings..
4.0	Risk and Issue Meeting and Reporting Process	This process is an iterative allows the program and/or project team to identify, categorize, prioritize, and mitigate or avoid issues, uses progress status reports and deliverable status to monitor and control risks and issues.

2.109.2.2.5 (02-28-2020)

Procedure

Procedure

2.109.2.2.5.1 (02-28-2020)

1.0: Risk Management Process

Risk Management is the identification, assessment, and prioritization of risks followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities.
- Risk identification allows individuals to identify risks so that the project team becomes aware of potential problems. Not only should risk identification be undertaken as early as possible, but it also should be repeated frequently.
- Risk analysis transforms the estimates or data about specific risks that developed during risk identification into a consistent form that can be used to make decisions around prioritization. Risk analysis enables stakeholders to commit resources to manage the most important risks.
- Risk validation takes the information obtained from risk analysis and uses it to formulate strategies, plans, change requests, and actions. Risk validation ensures that these plans are approved and then incorporated into the standard day-to-day processes and infrastructure.
- Risk control and mitigation is the process of executing risk action plans and their associated status reporting; the development of mitigation plans designed to manage, eliminate, or reduce risk to an acceptable level. Risk control and mitigation also includes monitoring risks, identifying new risks, prioritizing mitigation alternatives, and evaluating risk process effectiveness throughout the project. This requires that detailed descriptions of the risk mitigation plans, mitigation activities, and closure rationale are captured, and closure documentation is entered into the ITRAC for all IT organization program and projects risks, as applicable.
- Risk tracking monitors the status of specific risks and the progress in their respective action plans. Risk tracking also includes monitoring the probability, impact, exposure, and other measures of risk for changes that could alter priority or risk plans and ultimately the availability of the service. Risk reporting ensures that the operations staff, service manager, and other stakeholders are aware of the status of top risks and the plans to manage them. Each program or project is required to conduct periodic reviews of the risk descriptions and documentation entered into the ITRAC to ensure that the information is appropriate, current, complete, and accurate.
During the risk management process, develop appropriate action plans to reduce the risks from impacting to program or project goals and objectives. Conduct periodic reviews of the risks to ensure that all mitigation activities are being implemented, monitoring previously identified risks, and reevaluating existing risks to verify the planned risks response strategies for their effectiveness. Validate risk mitigation strategies and alternatives. Reassess the risk as necessary, monitoring any triggers associated with the risk.

Capture any new identified actions to be taken and track risk response. Prioritize risks for subsequent ongoing management based on their likelihood of occurrence and potential impact. Set realistic due dates and then work to meet the dates.

Update ITRAC with detailed analysis and assessment of the risk and with specific mitigation plan activities for the risk. Take corrective action when actual events occur. Identify new risks resulting from risk mitigation actions. Attached any documents as necessary that capture the results of mitigation actions. Communicate status and risk response follow-through as appropriate.

The following table depicts the tasks and roles for each activity in the Risk Management process.

ID	Task Name and Description	Role	RACI	Duties
Risk Identification 1.1	Identify a candidate risk This activity includes identifying a potential risk and providing clear and concise information about the risk and its context.	Item Identifier	R	As appropriate, involve people who understand the program, project, domain and environment in working session to draw on available team and stakeholder experience. Use the techniques such as brainstorming or a checklist during the meeting to aid in identifying candidate risks. Examine and evaluate the program or project environment and available documentation; work that has been done previously to determine its adequacy for the program or project, in general or at a particular phase of the program or project. Pay close attention to missing information that must be obtained from sources outside the program or project. Evaluate the business and technical performance requirements that the project must achieve. Determine the operational (functional and environmental) conditions under which the key performance areas or key performance parameters are measured. Pay close attention to requirements that are not clearly stated or stable. Identify the engineering processes being applied. Evaluate the reasonableness of the schedule estimate and whether the schedule is sufficient for the work required to be performed. Evaluate the reasonableness of the cost estimate and determine whether the planned (or budgeted) cost is feasible for the work required to be performed. Insufficient resources (personnel, funds, schedule, and tools necessary for successful development and deployment of the project) are a common and serious risk. Examine dependencies upon other organizations. Cross-project dependencies and dependencies on other program level organizations are a normal part of managing a large program. Only include a dependency as a risk when there is some external event that may cause a condition where the other organization cannot meet a commitment on your critical path. The existence of a dependency does not automatically constitute a risk. Examine underlying assumptions that define the success, direction, or existence of the organization such as executive management sponsorship and funding. Document all candidate risks identified during the review and analysis phase and maintain all available documentation. For each identified candidate risk: Note the *date* that the candidate risk was identified Note the *source* or event where the candidate risk was identified Create a *title* for the risk that captures identifying keywords Develop a *risk statement* that clearly communicates the risk to management, at all levels, and is sufficiently descriptive and specific to allow review by the responsible manager to assess its validity as a risk. A risk statement contains two parts: Cause - a clear, concise statement of the condition. This is a single phrase that briefly describes the key circumstances, situations, etc. causing the concern. Impact - a clear, concise statement of the consequence. This is a single phrase that describes the potential event that will have a negative impact on the program/project.
Risk Identification 1.2	Determine the scope of the risk This activity includes using all available information to determine the scope of the risk.	Item Identifier Responsible Manager	R C	Using available information, assess the scope of the risk. As necessary, engage the Responsible Manager, other stakeholders and SMEs in determining the scope of the risk. Assess cross project and other external dependencies that may identify other program/projects or organizations impacted by the risk. Determine if the risk is limited to a specific project, program or domain, or enterprise wide. Document all areas impacted by the risk.
Risk Identification 1.3	Estimate the probable date of impact. The purpose of this activity is to review related program/project schedules and related information for impacted areas.	Item Identifier Responsible Manager	R A	Review related program/project schedules and related information for impacted areas. As necessary, engage the Responsible Manager, other stakeholders and SMEs in determining the scope of the risk. Assess impact date of cross project or external dependencies which may contribute to impact of the risk. Estimate and document a probable date when the candidate risk event could begin to negatively impact the program/project or organization entities.
Risk Identification 1.4	Develop closure criteria This activity involves using available information, research possible criteria that would clearly indicate when a risk should be closed	Item Identifier Responsible Manager	R A	Using available information, research possible criteria that would clearly indicate when a risk should be closed. As necessary, engage the Responsible Manager, Item Coordinator and other stakeholders and SMEs in determining the closure criteria. Develop and document objective closure criteria that will be recommended for determining the closure of a specific risk.
Risk Identification 1.5	Submit the candidate risk This activity involves submitting for review.	Item Identifier	R	Assemble risk related information determined in activities A1 – A4: Risk Title Risk Statement Date Identified Risk Identifier Risk Source Risk Scope Responsible Manager and Organization Probable Impact Date Closure Criteria Record information in an acceptable format, such as the Risk Template available on the Risk Management website at https://portal.ds.irsnet.gov/sites/ITSPRiskManagement. Forward required candidate risk information to the Responsible Manager for review. As requested, support the Item Coordinator by providing additional information or clarification.
Risk Identification 1.6	Identify the responsible manager and organization Based impacted program or project determine responsibility of the risk.	Responsible Manager	R	Review and validate correctness, completeness, and understandability of all recorded risk information, and determine level of analysis required. Based on program/project and organizational areas that have been identified as impacted areas, identify the responsible manager and organization for each impacted area. As necessary, engage stakeholders and SMEs in determining the responsible managers/organizations. Determine and note the Responsible Manager/Organization with the greatest potential impact. If a Responsible Manager cannot be identified, at a minimum determine the Responsible Organization. Forward required candidate risk information to the Item Coordinator for entry into the ITRAC Repository.
Risk Identification 1.7	Enter the candidate risk in repository Create a new Risk item in ITRAC and enter candidate risk information in the system. As necessary engage the Responsible Manager and/or other stakeholders in validating or correcting submitted information.	Item Coordinator Responsible Manager	R A	Review candidate risk information for completeness and accuracy. As required request additional information or clarification from the Item Identifier. As needed, engage the Responsible Manager to validate or correct submitted information. If there are any changes to the submitted candidate risk information, these changes should be coordinated with the Item Identifier. Create a new Risk item in ITRAC. Projects may use the Risk Template as a guide of required information necessary for input into ITRAC. NOTE: All IT projects shall record and maintain risks and issues, in the Item Tracking Reporting and Control (ITRAC) repository with the exception of Cybersecurity, which shall record and maintain all IT risks and issues in Archer. ITRAC serves as the authoritative source of IT projects’ Risk information at Internal Revenue Service. Notify the Responsible Manager and Item Identifier that a new risk item has been created and provide the unique Risk ID assigned by ITRAC.
Risk Analysis and Validation 1.1	Perform an analysis of the candidate risk This activity includes performing a preliminary assessment of the risk.	Responsible Manager	R	Review the risk attributes to determine whether the information (such as the risk statement, probable impact date, and close criteria) is specific, complete, accurate, and understandable. Work with the Item Identifier and SME to obtain clarification where necessary. Perform a preliminary assessment of the risk to determine whether the potential event is of such significance to the organization that additional resources are warranted to perform further analyses and possible mitigation planning.
Risk Analysis and Validation 1.2	Determine disposition The purpose of this activity is for the Responsible Manager to determine the disposition of the risk.	Responsible Manager Item Identifier	R C	If the Responsible Manager decides the candidate risk is not a valid risk, the risk is withdrawn. If the Item Identifier disagrees with the Responsible Manager that a candidate risk is not a valid risk, the Item Identifier can escalate the risk to the next level of management for resolution. If the Responsible Manager decides the candidate risk belong another to the organization, the risk is transferred to that organization. The risk remains in the “Candidate” state, if transferred, until the receiving organization validates the risk. After the risk is validated (accepted), the risk state is set to “Monitored” or “Active Mitigation” in the risk repository. Inform the Item Coordinator and identify an Item Owner. Assign a Item Owner to evaluate the risk parameters. The Item Owner is typically an organization member with expertise in the subject of the risk and experienced in evaluating risk parameters
Risk Analysis and Validation 1.3	Analyze the risk If the risk is validated (accepted), a risk owner is assigned to analyze the risk.	Item Owner	R	The Item Owner will analyze the risk to develop a mitigation plan for the risk. The Item Owner will review related program/project schedules and related information for impacted areas such as: Detailed Impact Description: Create a detailed description of the anticipated impact of the risk on the organization. Assumptions may be made to develop a reasonable impact cost. This could include potential loss of skilled resources, additional resource costs to retain staff or contractors for extended time periods, impacts to other organizations or projects, schedule slips, and any other consequences attributable to the occurrence of the risk. Ensure that detailed descriptions of the risk mitigation plans, mitigation activities, and closure rationale are captured, and entered into the ITRAC for all IT organization program or projects risks. Probability: Assign probability to risk.
Risk Analysis and Validation 1.4	Update the risk in the repository Record any changes to risk attributes resulting from refinements made during review and validation of the candidate risk in the risk repository.	Item Coordinator Item Owner	R I	Record any changes to risk attributes resulting from refinements made during analysis and validation of the candidate risk in ITRAC. The following additional information is required for a validated risk: Detailed Impact Description Names of Responsible Manager and Item Owner Probability and impact
Risk Mitigation Planning and Execution 1.1	Determine the mitigation approach The purpose of this activity is determined which strategy is the most effective basis for a mitigation approach.	Item Owner Responsible Manager	R A	Determine which strategy is the most effective basis for a mitigation approach. For example, the Item Owner may select an approach that guarantees maintenance of the organization schedule but has a high cost. Or, the Item Owner may select an approach that stays within cost boundaries but extends schedule. There are four common strategies for managing risks: Risk Control seeks to contain the effects of a risk (but not to eliminate the source of the risk) through direct management activities that reduce the risk’s likelihood of occurrence and/or its impact to the organization. Risk Acceptance acknowledges the existence of a particular risk and makes a deliberate decision to accept the risk without engaging in special efforts to control the risk. This is most effective during the planning phase of a project or other significant effort. Risk Avoidance seeks to eliminate the sources of a risk and replace them with a lower risk solution. This is most effective during the planning phase of a project or other significant effort and caution should be given when considering this strategy. Risk Transfer reallocates the risk from one organization to another. This process can involve the reallocation of risks within Contractors’ organizations, to IRS organizations, or to IRS organizations not directly involved in the project/program/organization Summarize the mitigation approach in a three or four sentence paragraph that specifies the strategy selected and the goal of the mitigation approach in ITRAC.
Risk Mitigation Planning and Execution 1.2	Develop the mitigation plan The purpose of this activity is to develop actions to be taken to mitigate risks.	Item Owner Responsible Manager	R A	Develop actions to be taken to mitigate risks. Define each mitigation activity as a bounded activity with a measurable result. Ensure that completing all the mitigation activities results in satisfying the overall risk close criteria. Mitigation plans do not replace current task plans; they drive necessary work into the normal program/project management processes where they can be scheduled and staffed. Identify an owner for each activity in the mitigation plan. The Activity Owner must have the expertise and the authority to implement the specific activity. If the Activity Owner does not belong to the Item Owner organization, then the Item Owner has to have acceptance of the activity from the Activity Owner. Verify that the probable impact date of the risk is still valid. Review task schedules, cross-project dependencies, and program level organization dependencies to verify the probable impact date. Schedule a start and complete date for each activity. Allow for recovery time within the plan if activities slip. Ensure that all the mitigation activities are scheduled for completion before the probable impact date of the risk. Estimate the cost of each mitigation approach, including labor and materials. The cost can be a gross estimate; however, it must be sufficient to enable the Responsible Manager to make trade-offs when recommending where scarce organization resources should be spent to mitigate risks. Identify any costs estimated in the current task plan that will not be incurred if the mitigation plan is executed. Estimate the cost of several different mitigation strategies, if appropriate, to select the most cost-effective approach compared to the impact cost of the risk.
Risk Mitigation Planning and Execution 1.3	Execute the mitigation plan The Item Owner initiate mitigation activities.	Item Owner Responsible Manager	R A	Accept the mitigation plan. Activities includes to estimate the cost of each mitigation approach, including labor and materials as well as resources. The cost of the mitigation plan should be relative to the criticality and impact cost of the risk. The cost of the mitigation plan relative to the criticality and impact cost of the risk are factors considered by the Responsible Manager in accepting the mitigation plan for implementation. A high-level assessment of three key areas (resources, key decisions and interfaces) should be considered by the Responsible Manager in mitigation planning as well. Set the risk state to Active Mitigation in ITRAC and direct the Activity Owners to begin mitigation activities. Assess completion status of each activity and the effectiveness of the expected results. Adjust plan as necessary to achieve results as directed by the Responsible Manager. Re-plan the mitigation plan if the goal or mitigation strategy must be changed to achieve success or there is significant impact to the project (e.g. in case the original mitigation plan fails to solve the problem). Record the current status of mitigation activities in the mitigation plan. Review and update the status of mitigation activities in ITRAC.
Risk Mitigation Planning and Execution 1.4	Recommend the risk disposition This activity involves recommendation for closure of the risk.	Item Owner Responsible Manager	R A	The Item Owner recommends to the Responsible Manager closure of the risk when all mitigation activities have been completed, the closure criteria have been met, and the goal of the mitigation strategy has been achieved; or, when the time-frame has passed, and the risk has not occurred. If the risk has already materialized, it should be converted to an issue or if the probability of a risk occurring rises to 100%.
Risk Mitigation Planning and Execution 1.5	Update the risk repository The purpose of this activity is to update the status of mitigation activities in ITRAC.	Item Coordinator Responsible Manager Item Owner	R A I	Update risk parameters in the risk repository. Update the status of mitigation activities in ITRAC. Ensure the accuracy of the parameters and mitigation status which must support the decisions the Responsible Manager has to make to effectively manage the risk. Confirm the closure criteria have been met. Record the risk state as Closed, record the rationale for closure, and record the date the closed disposition was approved.. Ensure that all activities have been completed and closed prior to closing out the risk. Attached any necessary documents associated with the closing of this risk, as applicable. The additional information required for a tracked or controlled risk is as follows: Actual start date of each mitigation activity Actual completion date of each mitigation activity Results/status updates of each mitigation activity Status of overall mitigation plan Rationale for closure Date of closure

2.109.2.2.5.1.1 (02-28-2020)