Introduction:

This Interim User Guide is a quick reference document for elementary risk management practices. It represents a basic approach to risk management practices as the Federal Highway Administration (FHWA) embarks on the first stage of a two-stage risk management initiative. The second stage will begin with release of the companion Risk Management Framework, a textbook reference for advance risk management practices.

As the FHWA becomes more familiar and comfortable with pure risk management practices, we expect to revise this guide several times based on your experience with applying it to improve FHWA's identification of risk practices and support the Risk Management Framework.

1. Information Gathering

   The Interim User Guide is a communication tool that uses prescribed Core Elements (CE) as a starting point for discussion. Division offices must first refer to the prescribed CEs required by FHWA leadership and then determine what additional elements should be included in the division office assessment. The goal is to show where division offices are prioritizing their prescribed CEs in comparison to other non-prescribed Program Elements.

   Washington Headquarters (HQ) offices will not use prescribed CEs but will develop categories internally based on their responsibilities and division office risk assessments. The FHWA will update the CE list based on what can be applied to the development of strategic and operational level work plans and common additional elements being used by division offices. Additionally, each HQ office should look at the current health assessment provided by the Program Delivery Assessment Tool (PDAT). Other sources for information are process reviews from previous years, specific audit reports, or past risk assessments.

   Prescribed Core Elements: PDAT Core Elements (see Appendix A)

2. Risk Identification

   Risk identification recognizes future events that provide a threat or opportunity within a CE. A risk is a future phenomenon that may occur with a direct impact to the project or program to the project or program's benefit or detriment. Headquarters offices naturally perceive their functional Program Areas with more detail than division offices. HQ and division offices do not perceive risks similarly because the offices' Program Areas or responsibilities differ in depth and breadth. For example, HQ offices perceive Program Areas from an in-depth national perspective. On the other hand, division offices must assess across the agency and include all HQ office functions within their assessments. Different areas of responsibility and perceptions of risk should continue and be communicated to create a learning environment for agency needs and risks. Using an assessment form (See Appendix B) can facilitate the user to "back into" identification of risks. Additionally, the Program Delivery Assessment Tool (PDAT) may also help identify Program Health and Risk Areas. The Risk Management Framework will have specific methods described to facilitate the identification of risks.

   A tool to help organize identified risks is a Risk Register. Create a Risk Register table that lists all risks identified within each CE. Because risk events can have multiple impacts, document risks in the risk register sorting by cause and effect, those elements, which would have a negative or positive impact on the program.

   Example of Risk Register for Finance (FIRE) CE:

   Risk	Cause	Effect	Opportunity/Threat
   FIRE1	The Federal Aid number is not a part of all State computer systems	The numbering systems in use may be confusing and interrupt future audit trails for tracking.	Threat
   FIRE2	Adopt a standardized numbering system	May enhance data management systems and documentation used to record and maintain Federal Project Data.	Opportunity
   FIRE3	Federal Share programmed into State Accounting System may be incorrect on projects	May cause occurrences of over- billing in the Federal Aid Projects.	Threat
   FIRE4	No Source documentation for project authorization available	Not sufficient information available for future Federal reimbursement	Threat
   FIRE5	Payroll transactions contain occurrences of errors	Time and equipment used on Federal Aid Projects could be incorrectly accounted for.	Threat
   FIRE6	Payroll transactions contain occurrences of errors	Documentation provided is difficult to follow.	Threat
   FIRE7	Financial Team skill-Sets and willingness is low	Reliance heavily on consultants for Financial Planning	Threat
   FIRE8	State Financial Team skill-Sets and willingness is low	Willingness to complete future documentation associated with procedures and financial accounting processes ranges from some to none	Threat
   FIRE9	State Financial Team skill-Sets and willingness is low	Financial data processing will experience multiple problems, in part due to a lack of State accounting experience by division office financial manager	Threat
   FIRE10	Training on Federal Accounting Procedures and Generally Accepted Accounting Procedure for Financial Management Staff	Enhance State management/fiscal responsibility skills within the program.	Opportunity
   FIRE11	GAO is scheduled to Visit the division office to audit Financial Procedures	Challenge staff to improvements, report may be used as a tool to motivate State partners	Opportunity
   FIRE12	GAO is scheduled to visit the division office to audit Financial Procedures	May garner unwanted public exposure/attention, political involvement, controversy, and Lawsuits.	Threat

   
   

    

3. CE and Risk Event Analysis (Deliverable)

   For CE analysis:
   A standard tool for CE is prescribed for the assessment of the likelihood and impact of the prescribed and non-prescribed CEs. The prescribed tool can be found in Appendix B of this Interim User Guide.

   Statement of Risks
   Eventually, the gathered information should be circulated to critical stakeholders, including the program management team (division administrators and assistant division administrators), the senior executive team within the Administration, as well as any lead participants with influence within the State or local jurisdictions and other jurisdictional authorities. A CE Statement of Risks should identify the highest-prioritized risk events. Note that at the division office level, all Statement of Risks should be stated in terms of their relationships to CEs, as these have been determined to be the areas of greatest overall concern to FHWA as a whole. The Statement of Risks should be a discussion that includes at least 4-5 of the highest risks within each CE.

   Statement of Risks Example for Finance (FIRE):

   After prioritizing individual risks within the CE of Finance, there were many risks identified that exceeds division office Management Risk Thresholds.  The division office's highest risk is the potential for limited source documentation at the State Transportation Agency (STA) that supports project authorization.  If no sufficient information is available for future audits or documentation inquiries, division office management has judged that Federal reimbursement for projects cannot be legitimized without source documentation (FIRE4).

   The division office's second largest Risk Event in the Finance CE is that the Government Accountability Office (GAO) has inquired and may schedule a visit to the division office to audit financial-tracing/tracking processes.  Division office management views the visit as an opportunity to challenge division office and State staff for improvements and needed changes.  The resulting GAO report may be used as a tool to motivate State partners and promote change that will have a large impact on the ability to trace Federal-aid projects and financial performance (FIRE11).

   The division office's third highest risk surrounds some erratic current issues with programming Federal Share into STA Accounting System.  Although some Federal Share accounting reviews in the past have proven a solid process, there is a high likelihood that the Federal share is accounted for incorrectly.  The impact is fairly large and may cause occurrences of over-billing in the Federal Aid projects and a lack of Federal share financial performance.  Additionally, Financial performance is on the President's Management Agenda, which is considered an indicated risk and enhance the impact rating of the Risk Event (FIRE3).

   The division office's fourth highest risk is the opportunity to adopt a standardized numbering system.  A standardized numbering system may enhance the financial data management system and documentation drastically.  The current system is used to record and maintain Federal Project Data and previous process reviews have noted current issues in tracking basic project information (FIRE2).

   The division office's fifth highest Risk is the threat that STA's Financial Team skill-Sets and illingness to learn is inadequate.  The STA willingness and ability to complete required future documentation associated with an upcoming Major Project's financial plan and changed financial accounting processes is somewhat unlikely.  The impact of STA's lack of appropriate staff could be significantly high and effect cross-functional financial performance, Major Project Schedules and Cost Accounting, and Project Reimbursement (FIRE8).

   It is expected that a tool will be completed for each of the prescribed and non-prescribed CEs with its associated Statement of Risk and submitted to The Office of Infrastructure, Office of Program Administration.

   CE Analysis Example for Finance CE (FIRE):

   See next page.

   Likelihood Criteria	Likelihood Indicators	Scoring	Impact Criteria	Impact Levels	Scoring
   Staffing (Levels & Experience)	Severely understaffed or no experience (5)	1	Federal Interest?	High (5)	5
   	Understaffed or some experience (2)			Moderate (2)
   	Adequately staffed or competent (0)			Low (0)
   Operational Procedures	None (5)	2	Stakeholder Interest	High (5)	5
   	Some (2)			Moderate (2)
   	Good and up-to-date (0)			Low (0)
   Guidance	None (5)	2	Exposure (Public, Media or Political)	High (5)	2
   	Some (2)			Moderate (2)
   	Good and up-to-date (0)			Low (0)
   Problem History	A lot of (5)	5	Funding Level	High (5)	5
   	Some (2)			Moderate (2)
   	None (0)			Low (0)
   New Program, Phase or Component	Cutting Edge (5)	1	Goals	High (5)	2
   	Some experience (2)			Moderate (2)
   	Old news (0)			Low (0)
   Complexity	High (5)	3	Controversy or Lawsuits	High (5)	4
   	Moderate (2)			Moderate (2)
   	Low (0)			Low (0)
   Outside Control	High (5)	4	Effect on Safety	High (5)	0
   	Moderate (2)			Moderate (2)
   	Low (0)			Low (0)
   Potential for Waste, Fraud and Abuse	A lot of (5)	5	Effect on Congestion	High (5)	0
   	Some (2)			Moderate (2)
   	None (0)			Low (0)
   Work Force Development and Training	None (5)	2	Effect on the Environment, or quality	High (5)	0
   	Some (2)			Moderate (2)
   	A lot of (0)			Low (0)
   FHWA Involvement	None (5)	2	Potential to Effect Public Trust and Confidence	High (5)	5
   	Some (2)			Moderate (2)
   	A lot of (0)			Low (0)
   Consultant Use	A lot of (5)	0	Emerging Initiatives	High (5)	5
   	Some (2)			Moderate (2)
   	None (0)			Low (0)
   Other	High (5)		Other	High (5)
   	Moderate (2)			Moderate (2)
   	Low (0)			Low (0)

   
   

    

4. Prioritize CEs: (Deliverable)

   Using the results of Step 3, the CEs should be listed in priority order. Risk Mapping is an approach that can be useful for visually depicting risk priority. Risk Mapping uses an XY Scatter Chart with the axes being likelihood and impact. An example Risk Map in the Phase I report and will be in the Risk Management Framework.

   For qualified values, like the results from Step 3, the impact and likelihood values could be multiplied, deriving an Expected Value (EV) that would be compared with other EVs to prioritize risk events.

   Prioritization Example:

   CE	Likelihood (0-60)	Impact (0-60)	EV (0-3600)
   1	10	11	110
   2	50	42	2100
   3	60	30	1800

   Therefore, CEs in priority order would be:

   1. CE 2
   2. CE 3
   3. CE 1

   Each office is expected to use a method consistently to arrive at its CE Prioritization.

5. Prioritize Top 20 Risks for Corporate Evaluation: (Deliverable)

   Creating a list of Top 20 risks within each office may or may not include risks within each CE. The Top 20 should be the highest 20 risks pulled from all of the identified Risks Statements. The concept is meant to breakaway from office "stovepipes" and communicates the top risks throughout the office as a whole. Office resource decisions may hinge on a single high risk CE. Additionally, Top Risks documentation can provide insights into the needs of an office and resource shortcomings of existing staff in reducing high-risk events. Work plan documentation, and how work plans link to risks, is extremely useful in evaluating resource consumptions and outputs. In a well designed, performance based risk management system; work plan outputs should relate directly to high-level risk events.

   Risk Statement Example Top 20 Risks:

   1.	The accumulation of contract scope changes resulting in increases in individual project cost and unanticipated delays in individual project schedules would have a negative impact on the program through an increased strain on the Construction Programs apparent effectiveness (CONST1).
   2.	The State has multiple major projects with complex designs that could cause issues with the contractor capacity to complete construction (CONST2).
   3.	Construction of planned Major Projects in geotechnical volatile areas that could disrupt planned schedule, cost, and scope, which effects publics trust in project management (CONST15).
   4.	Limited source documentation at the STA that supports project authorization (FIRE4).
   5.	The risk of untimely and/or inaccurate data resulting in faulty estimates of system condition, performance, usage, and the inequitable distribution of funds, which would have a negative impact on the transportation system planning activities and the programs financial performance (PLAN5).
   6.	Government Accountability Office (GAO) has inquired and may schedule a visit to the division office to audit Financial-tracing/tracking processes (FIRE11).
   ETC . . .

   
   

    

6. Identify Risk Response Strategies

   Risk Response Strategies (RRS) are commonly divided into four types: Avoidance, transference, acceptance, and mitigation. The number of risks that FHWA is able to implement responses to can be guided by the amount of resources offices have available to devote to a risk. Generally, the more multidisciplinary resources available as a resource, the more flexibility managers have in dedicating staff to High Risks. It is expected that the acceptance RRS will be applied in a large percentage of cases. Concerns extracted from the Framework Pilot often surrounded how the acceptance RRS supports better management decisions. If a high-risk exists nationwide or in a specific State, and resources are not available to administer an effective RRS, the acceptance RRS and documentation should support management decisions to not add resources to high-risks, or CEs. Like identification of risks, an RRS register or list may be helpful in identifying reasonable responses. Additionally, the PDAT should be helpful in setting program health goals for CEs if applicable. Because managers will need to use the acceptance RRS, even though a more active RRSs may be developed, managers may find it useful to record non-acceptance RRS for contingency planning purposes.

   Example RRS registry list for the Finance CE:

   CE	RRS	Work Plan	Work Code
   FIRE4	Mitigation	Implement Monthly reviews of Source Documentation for Federal-Aid Project Authorizations.  Develop or Search for Best Practices and set goals for implementation.  Hold reimbursements do not have required source documentation available.	FiWork1
   FIRE11	Enhance	Invite GAO staff to collaborative review of financial procedures.  Ask GAO for guidance based on previous experiences with other agencies.	FiWork2
   FIRE3	Transference	FHWA division offices will now data entry Federal Share financial data into FMIS.	FiWork3
   FIRE2	Transference	Transfer Impacts of Risks to HQ offices.  Request needed enhancements for multiple Demo Ids/Earmarks for one Project ID, Tracking all categories of the Project Continuum, and regulation that defines the term Project and its accounting applications.	FiWork4
   FIRE8	Mitigation	Conduct Conflict Resolution Workshops.  Conduct Marketing Study to determine State Education needs.	FiWork5
   FIRE12	Acceptance/Contingency	Request Leadership Conducts Meetings with GAO investigators on the importance of communication with the Public and potential for High Risk Events caused by GAO actions	FiWork6
   FIRE7	Acceptance	TBD	N/A
   FIRE10	Acceptance	TBD	N/A
   FIRE1	Acceptance/ Contingency	As Occurrences Occur, Financial Staff may need to complete a process review to find troubles that cause inaccuracies in current process.	FiWork7
   FIRE5	Acceptance	TBD	N/A
   FIRE6	Acceptance/ Contingency	As Occurrences Occur, Financial Staff may need to complete a process review to find troubles that cause inaccuracies in current process.	FiWork7
   FIRE9	Acceptance/ Contingency	Conduct Conflict Resolution Workshops.  Conduct Marketing Study to determine State Education needs.	FiWork5

   
   

    

7. Incorporate RRSs into Office Work plan

   Work planning decisions may hinge on a single CE or a high-risk event. Work Plan documentation can afford insights into the needs of an office and the shortcomings of existing responsibilities in reducing high-risk measurements. Work plan documentation, and how work plans link to risks, is extremely useful in evaluating resource consumptions and outputs. In a well-designed system, work plan outputs should crosswalk directly to outcomes (performance measures) or risk level measurements.

   Example of Finance CE work plan:

   CE	RRS	FY2007 FIRE Work Plan	Work Code	Resources
   FIRE4	Mitigation	Implement Monthly reviews of Source Documentation for Federal-Aid Project Authorizations.  Develop or Search for Best Practices and set goals for implementation.  Hold reimbursements do not have required source documentation available.	FiWork1	Jill, Bob
   FIRE11	Enhance	Invite GAO staff to collaborative review of financial procedures.  Ask GAO for guidance based on previous experiences with other agencies.	FiWork2	Dave
   FIRE3	Transference	FHWA division offices will now data entry Federal Share financial data into FMIS.	FiWork3	Jill, Bob
   FIRE2	Transference	Transfer Impacts of Risks to HQ offices.  Request needed enhancements for multiple Demo Ids/Earmarks for one Project ID, Tracking all categories of the Project Continuum, and regulation that defines the term Project and its accounting applications.	FiWork4	HQ FMIS, HQ Policy, AREA DFS
   FIRE8	Mitigation	Conduct Conflict Resolution Workshops.  Conduct Marketing Study to determine State Education needs.	FiWork5	Mary, Jill, Tyler
   FIRE12	Acceptance/Contingency	Request Leadership Conducts Meetings with GAO investigators on the importance of communication with the Public and potential for High Risk Events caused by GAO actions	FiWork6	Dave
   FIRE1	Acceptance/Contingency	As Occurrences Develop, Financial Staff may need to complete a process review to find troubles that cause inaccuracies in current process.	FiWork7	Jill as needed.
   FIRE6	Acceptance/Contingency	As Occurrences Develop, Financial Staff may need to complete a process review to find troubles that cause inaccuracies in current process.	FiWork7	Jill as needed.
   FIRE9	Acceptance/Contingency	Conduct Conflict Resolution Workshops.  Conduct Marketing Study to determine State Education needs.	FiWork5	Bob as needed.

   
   

    

8. Monitor, Evaluate and adjust strategies based on Stewardship Performance

   Control is one of the most critical components in risk management, and performance tracking is one of the most effective control techniques. If CEs are selected, a quantified measure for each CE or outcome goal can be presented (e.g., 1-10). Performance measurement information is extremely useful for management at the strategic and operational level as well as for risk facilitating agency-wide communication. Performance measurement has both indirect and direct impacts on risk levels of CEs. Performance measurement provides feedback, which can trigger problem solving and organizational learning. Additionally, performance measurement can trigger awareness of performance gaps. Therefore, management must first recognize acceptable risk thresholds and then understand both how a CE risk level will increase over time without attention and how quickly an RRS activity will recover the CE. Looking at the chart below, management must determine the most efficient application of resources and RRSs' to keep risk levels at an acceptable level. There will always be a #1 CE. That said, CEs might alternate ratings, if RRSs are effective. Note that the higher the application of attention and resources will allow a longer period between the RRS cycles. Since each CE will have its own unique degradation and recovery characteristics, the inspection and attention requirements for each CE will also vary.

Appendix A: Program Delivery Assessment Tool (PDAT) Core Elements (01/13/06)

Finance

1. Funds Management
2. Federal-aid Billing
3. Project Authorization, Modification & Voucher
4. Major Projects
5. Locally Administered Projects

Planning

1. STIP/TIP Development
2. Air Quality Transportation Conformity
3. Congestion Management Process
4. Fiscal Constraint
5. Planning/NEPA Linkage
6. Public Involvement & State DOT Consultation/Coordination with MPO & Locals
7. Travel Demand Modeling

Right of Way

1. Acquisition and Appraisal
2. Relocation Assistance
3. Program Management
4. Highway Beautification Implementation

Environment

1. Environmental Processes
2. Planning/NEPA Linkage
3. Environmental Stewardship
4. Interagency Coordination

Design

1. Road Design
2. Bridge & Structure Design
3. PS&E
4. Consultant Selection and Administration
5. Context Sensitive Solutions

Construction

1. Contract Administration
2. Material Quality Assurance
3. Locally Administered Projects

Operations

1. Foundation for Operations
2. Managing Traffic Under Normal Condition
3. Managing Traffic Under Unusual Conditions
4. Transportation Demand Management/Pricing
5. Traveler Information

Transportation System Preservation

1. Programming and Financing
2. Strategic Planning/Performance Measures
3. Data Collection/Inventories and Utilization
4. Management Systems/Systematic Process

Safety

1. Highway Safety Improvement Program
2. Strategic Highway Safety Plan
3. Crash Data Collection and Analysis
4. Required Safety Programs
5. Focused Safety Programs

Civil Rights

1. EEO Contract Compliance
2. State Internal EEO
3. DBE Program
4. Title VI Program
5. ADA
6. Tribal Employment Rights & Relations
7. Special Outreach Initiatives

Appendix B

Criteria Scoring Tool

Criteria Scoring Tool - With Context

Fire Tool Kit Table of Contents | Order 45601a.htm