DOE G 413.3-7A Chg2 (LtdChg), Risk Management Guide - Change Chart

U.S. Department of Energy LIMITED CHANGE Washington, DC Chg 2 (LtdChg): 11-22-2021 SUBJECT: LIMITED CHANGE TO DOE G 413.3-7A, RISK MANAGEMENT GUIDE 1. EXPLANATION OF CHANGES. To add content related to joint cost and schedule confidence level (JCL), also known as integrated schedule and cost risk analysis. To add content related to parametric estimation of contingency. To update references to superseded DOE directives and standards and external best practices. 2. LOCATIONS OF CHANGES: See chart below. Page Section Changed To Throughout Minor formatting updates. Throughout Minor grammatical edits. Throughout DOE-STD-1189-2008 DOE-STD-1189-2016 Throughout ANSI/EIA-748B EIA-748D i Forward “Guides are not requirement documents and should not be construed as requirements. DOE Guides are part of the DOE Directives Program and provide suggested ways of implementing Orders, Manuals, and other regulatory documents.” “This Guide does not impose, but may cite, requirements. Guides neither substitute for requirements nor replace technical standards that implement requirements. Program-specific guidance takes precedence over this guide. Send citations of errors, omissions, ambiguities, and contradictions found in this guide to PMpolicy@hq.doe.gov.” 10 2.0 “This guide should not be intended to replace assessment processes developed for nuclear safety and environmental, safety, health, and quality (ESH&Q). It should also not be intended to replace assessment processes developed for safeguards and security. This guidance also recognizes the benefit and necessity of early consideration and integration of safety related project risk into the project risk management process.” “This guide should not be intended to replace assessment processes developed for nuclear safety, climate change, and environmental, safety, health, and quality (ESH&Q). It should also not be intended to replace assessment processes developed for safeguards and security. This guidance also recognizes the benefit and necessity of early consideration and integration of climate change, safety, and security related DOE G 413.3-7A Page Section Changed To project risk into the project risk management process.” 11 3.2 “In order to implement the risk management principles and processes successfully, an organizational process perspective should be considered within which the risk management.” “In order to implement the risk management principles and processes successfully, an organizational process perspective should be considered within which the risk management processes could operate. The processes and procedures, along with applicable tools to be used for performing risk management functions should be carefully considered, established, and well defined when implemented. The risk management processes described later in this guide should be carefully tailored to involve and meet the needs of the organization’s internal planning, assessment, project controls, risk monitoring, reporting, and decision-making processes at the different levels of risk management.” 12 3.2 “Increase the interaction and communication between upper management and functional contributors, and to better understand all types of project risks, such as: political, economic, social, and technological, policy, program, project, financial, resource-based, health and safety, safeguards and security, and operational. Without this interaction, identification of risks and the communication and handling of risks cannot be adequately accomplished, or be well understood.”

“Increase the interaction and communication between upper management and functional contributors, and to better understand all types of project risks, such as: political, economic, social, and technological, policy, program, project, financial, resource- based, climate change and extreme weather, health and safety, safeguards and security, and operational. Without this interaction, identification of risks and the communication and handling of risks cannot be adequately accomplished, or be well understood.” 12 3.3 “A complete responsibility assignment matrix for risk “The key roles, roles which have a significant impact upon Page Section Changed To management roles and responsibilities should be included in the risk management plan.” the risk management of the project, and responsibilities are the highest level of project risk authority and responsibility. A complete responsibility assignment matrix for risk management roles and responsibilities should be included in the risk management plan.” 13 3.3.3 “For non-M&O contracts, the CPM manages risks under the Contract Budget Base…” “The CPM manages risks under the Contract Budget Base…” 15 4.1 “Instead it is meant to demonstrate when one should initiate for the first time certain process steps.” “Instead, it is meant to demonstrate when one should initiate certain process steps for the first time.” 19 4.3.1 Added to list. “EM Project Critical Decision Assessment Tool (CDAT) analyses.” 19 4.3.1 “Environmental considerations such as seismic, wind and flooding” “Environmental considerations such as seismic, climate change and extreme weather (e.g., wind and flooding).” 25 Figure 3 Updated the chart format. 26 4.3.6.1.1 “However, there may be little or no correlation between a risk’s determinative impact and the qualitative risk rating, so caution with the lowest rated risks in the qualitative analysis.” “However, a risk’s qualitative risk rating, does not necessarily correlate with its determinative impact. Therefore, one should exercise caution with the lowest rated risks in the qualitative analysis.” 36 4.3.6.2.2 Added section and footnote. Integrating schedule and cost risk, also known as joint cost and schedule confidence level (JCL) analysis, generates a representation of the likelihood a project will complete its scope and achieve its key performance parameters on time and within budget. Conduct this analysis with risks, prioritized by likelihood of realization and Page Section Changed To impact, appearing in the risk management plan and a fully burdened resource-loaded integrated master schedule with uncertainties associated with activities. The process uses software tools that examine the schedule and cost implications of the hypothetical realization of risks or manifestations of uncertainty to generate an integrated probability distribution. The Association for the Advancement of Cost Engineering International (AACE International)[1] Recommended Practice (RP) 57R-09, Integrated Cost and Schedule Risk Analysis Using Risk Drivers and Monte Carlo Simulation of a CPM Model, provides a method for simultaneously considering schedule and cost risks. The AACE RP 113R-20, Integrated Cost and Schedule Risk Analysis and Contingency Determination Using Combined Parametric and Expected Value provides techniques to deal with baselines using combined methods of cost estimating. Implement JCL on major systems projects in preparation for CD-2 and thereafter.

[1] Reference https://web.aacei.org/resources/publica tions/recommended-practices to see recommended practices (Cost for these documents should be factored into other direct costs). 38 4.3.6.4 Risk attitude, the position that can be stated or unstated that the organization holds towards risk, is one factor that can influence how risk is handled and how Risk attitude, the explicitly stated or unstated position that the organization holds towards risk, is one factor that can influence how risk is handled and how https://login-rsa.vdi.doe.gov/Citrix/StoreWeb/clients/HTML5Client/src/SessionWindow.html?launchid=1640873711174#_ftn1 https://login-rsa.vdi.doe.gov/Citrix/StoreWeb/clients/HTML5Client/src/SessionWindow.html?launchid=1640873711174#_ftnref1 https://web.aacei.org/resources/publications/recommended-practices https://web.aacei.org/resources/publications/recommended-practices Page Section Changed To values are assigned, and should be included in the analysis. values are assigned and should be included in the analysis. 39 4.3.6.5 Added. A parametric estimating model, through mathematical cost relationships, logically and predictably correlates the physical or functional characteristics of a project with its cost. When used in risk analyses, some parametric models relate cost growth to risk drivers such as the level of project scope development and the technology readiness level. AACE RP 42R-08 , Risk Analysis and Contingency Determination Using Parametric Estimating, offers an approach to estimating contingency, but not MR, based on cost data from similar completed projects. Another AACE RP, 44R-08, Risk Analysis and Contingency Determination Using Expected Value, provides a basis for generating inputs to the methodology appearing in AACE RP 42R-08. Use the spreadsheet calculator included in AACE RP 43R-08, Risk Analysis and Contingency Determination Using Parametric Estimating – Example Models as Applied for the Process Industries, to make calculations more efficient and transparent. The calculator collects cost and project definition level information. The contingency estimates produced following this methodology best support cost estimate ranges generated prior to CD-0 and CD-1. 57 7.3 In establishing the PB when contracts are in-place, the PB will comprise the contractor’s price. In establishing the PB when contracts are in-place, the PB will comprise the contractor’s price (PMB plus MR plus fee) plus contingency and any Page Section Changed To Government other direct costs (see Figures 4 and 5 above). 7 Attachment 11 Added. An advantage of an integrated cost and schedule risk model is the ability to capture schedule related costs impacts, such as level-of-effort (LOE) support activities that increase project costs as schedule related risk impacts delay or extend work efforts. Integrated risk models increase the flexibility of the risk analysis and reduce the amount of manual coordination needed to model cost and schedule risk impacts. Project risks and the associated cost and schedule impacts are the primary inputs to the risk model and are maintained within the project’s risk register. Figure A-4 depicts a conceptual risk model showing typical inputs and outputs. 8 Attachment 11 Added. When developing risk models, care should be exercised to assure the risk models are developed using appropriate performance baseline information and project risk assumptions.

10 Attachment 11 Added. Integrated Schedule and Cost Risk Integrated schedule and cost risk, also known as JCL analysis, generates a representation of the likelihood a project will complete its scope and achieve its key performance parameters on time and within budget. Conduct this analysis with a prioritized risk management plan and a fully burdened resource-loaded integrated master schedule with uncertainties associated with activities. The process uses Page Section Changed To software tools that examine the schedule and cost implications of the hypothetical realization of risks or manifestations of uncertainty to generate an integrated probability distribution. AACE RP 57R-09, Integrated Cost and Schedule Risk Analysis Using Risk Drivers and Monte Carlo Simulation of a CPM Model, provides a method for simultaneously considering schedule and cost risks. Implement JCL in preparation for CD-2 and thereafter on major systems projects. 11 Attachment 11 Added. Parametric Estimating of Contingency AACE RP 42R-08, Risk Analysis and Contingency Determination Using Parametric Estimating, offers an approach to estimating contingency, but not MR, based on cost data from similar completed projects. Another AACE RP, 44R-08, Risk Analysis and Contingency Determination Using Expected Value, provides a basis for generating inputs to the methodology appearing in AACE RP 42R-08. Use the spreadsheet calculator included in AACE RP 43R-08, Risk Analysis and Contingency Determination Using Parametric Estimating – Example Models as Applied for the Process Industries, to make calculations more efficient and transparent. The calculator collects cost and project definition level information. The contingency estimates produced following this methodology best support Page Section Changed To cost estimate ranges generated prior to CD-0 and CD-1. 2 Attachment 12 project risks be realized that delay the anticipated project completion. Note that this differs from contractor schedule reserve, which cannot add time or schedule duration to the contracted end date. The FPD may alternately choose to apply the DOE schedule contingency to the end of milestones and/or the project completion date to determine the expected completion date should project risks be realized that delay the anticipated project completion. Note that this differs from contractor schedule reserve, which cannot add time or schedule duration to the contracted end date. 4 - 12 Attachment 12 Added a new section to the document. The new section includes the following headers: - Quantitative Contingency Analyses - Cost and Schedule Risk Models - Cost Risk Model - DOE Schedule Risk Model - Integrated Schedule and Cost Risk - Parametric Estimating of Contingency - Risk Model Outputs - Updating Contingency Analyses 1 Attachment 13 Added. Beyond the inputs proposed in the Risk Management Guide, the project schedules should integrate the contractor and DOE schedules to allow the use of Monte Carlo simulation software. 3 Attachment 15 Added. Joint Cost and Schedule Confidence Level (JCL): “A process that combines a project's cost, schedule, and risk into a complete picture. JCL is not necessarily a specific methodology . . . or a product from a specific tool. The JCL calculation includes Page Section Changed To consideration of the risk associated with all elements, regardless of whether or not they are funded from . . . appropriations or managed outside of the project. A JCL identifies the probability that a given project or program cost will be equal to or less than the targeted cost AND that the schedule will be equal to or less than the targeted schedule date.”

Appendix A Updated references to most recent versions and updated URLs. Appendix A Added. AACE RP 42R-08, Risk Analysis and Contingency Determination Using Parametric Estimating. AACE RP 43R-08, Risk Analysis and Contingency Determination Using Parametric Estimating – Example Models as Applied for the Process Industries. AACE RP, 44R-08, Risk Analysis and Contingency Determination Using Expected Value. AACE RP 57R-09, Integrated Cost and Schedule Risk Analysis Using Risk Drivers and Monte Carlo Simulation of a CPM Model. DOE, Office of Management, Sustainability Performance Division, Vulnerability Assessment and Resilience Planning Guidance, September 2021 DOE, 2021 Climate Adaptation and Resilience Plan, August 25, 2021 Page Section Changed To EIA-748D, Earned Value Management Systems, January 2019. Appendix A Added to the “Checklist References” list. http://www.risk-management- basics.com/risk-management- checklists.shtml, Risk Management Basics, March 2006. http://www.wiredforgrowth.co m/risk-tools/risk- checklists/?cprofile=N, Wired for Growth, 2008. http://it.toolbox.com/blogs/enter prise-solutions/risk- management-checklist-22039,