Dod Rio

DoD Risk, Issue, and Opportunity (RIO) Management Guide

Source: OUSD R&E (US Government work, public domain; Distribution A) | Chapters: 8

When to use

Use this skill to run program risk, issue, and opportunity management on a U.S. defense acquisition program: defining and scoring risks, choosing and burning down mitigations, managing realized issues, hunting opportunities toward should-cost, containing cross-program interface risk, tailoring the whole effort to the chosen Adaptive Acquisition Framework (AAF) pathway, layering in specialized risk methods, and institutionalizing it all through the program's plan, boards, tools, roles, and cost/schedule/technical artifacts. This is the DoD-acquisition rendering of risk management — the program-office mechanics that sit on top of the general continuous-risk-management theory in nasa-risk and inside the SE process frame in dau-se-guidebook.

Prerequisites: none — plain Markdown; no MCP server, API key, or licence tier needed at runtime.

How to Use This Skill

• Without arguments — load the core frameworks below: the three RIO objects, the five-step process, likelihood/consequence scoring and the matrix, the four mitigation options, and the institutional machinery.
• With a topic — ask about a scoring rule (consequence = max-of-three, unmitigated), a mitigation option (accept/avoid/transfer/control), a burn-down plan, issue or opportunity management, cross-program tripwires, an AAF pathway (UCA/MTA/MCA/Software/DBS/Services), or a specialized method (RMF, Cyber Table Top, ITRA/DTRAM, FMECA).
• With a chapter — ch02 (identify + analyze + scoring), ch03 (mitigate/monitor/issues), ch04 (opportunity + cross-program), ch05/ch06 (RIO by AAF pathway), ch08 (PRMP/boards/roles/tool integration).

Supporting files: glossary.md, patterns.md, cheatsheet.md.

One discipline, three faces, two complements. Risk, issue, and opportunity are managed as one family with a shared register and shared boards. The guide is guidance, not mandate — recommended practice for AAF programs, used with DoDI 5000.02, not a mandatory checklist. Read it with nasa-risk (the general method) and dau-se-guidebook (the SE process), which it specializes rather than replaces.

Core Frameworks & Mental Models

The three RIO objects (the diagnostic lens)

The guide reduces the whole domain to three diagnostic questions, each a distinct managed object tied to the cost / schedule / performance baseline:

• Risk — what can go wrong? A possible future event/condition that could harm objectives; characterized by likelihood AND consequence.
• Issue — what has gone, or will certainly go, wrong? A realized or near-certain negative event (likelihood = 5 / probability = 1); characterized by consequence only.
• Opportunity — what can be improved? A potential future benefit; the upside mirror of risk, the engine for reaching should-cost (vs. merely staying inside will-cost).

The central stance: the worth of risk management comes from a PM who thinks critically and grows a risk-aware culture, not from satisfying policy. Plans over process — the individual mitigation plans (the output) matter more than the machinery; drop any step that doesn't add value, and never "shoot the messenger."

The five-step risk process

Copy code
Plan → Identify → Analyze → Mitigate → Monitor
       └────────── continuous Communication & Feedback ──────────┘

The same steps apply across every life-cycle phase and every AAF pathway; only the detail of each action changes. The PM owns it (jointly led with the LSE); it is multidisciplinary (SE, T&E, EVM, production, QA, logistics) and runs top-down and bottom-up at once.

Scoring: 1–5 ordinal, max-of-three, unmitigated

• Likelihood 1–5 against probability bands (Table 2-2); consequence 1–5 against tailored criteria (Table 2-1, anchored to the MCA pathway).
• Consequence = the maximum of cost/schedule/performance impact — never an average — assessed as if fully realized with no further mitigation, using fully burdened costs. A KPP/APB threshold breach forces Level 5.
• No fractional scores (2.4 is invalid). Government and contractor use a common framework so disagreements are visible and comparable, not forced into consensus.
• The 5×5 risk matrix maps likelihood × max-consequence to Low (green)/Moderate (yellow)/High (red). Risk level ≠ priority — also weigh cost-effectiveness, time frame, inter-risk relationships, and EMV/ROI, but always rank KPP-threatening risks high. Model aggregate exposure with Monte Carlo SRA/CRA.
• The risk register (built early) is the single source of truth; risk/issue/opportunity registers may be combined.

The four mitigation options

Every controlled risk gets Accept · Avoid · Transfer · Control (or a hybrid):

A burn-down plan (six steps) makes a Control plan trackable: sequence → make objective/measurable → assign planned L/C → date → load into IMS → chart level vs. time. Required for all high/moderate and selected low risks. Meetings don't burn down risk — results do. Front-load high-consequence risks.

Issues and opportunities (the mirrors)

• Issue management mirrors the risk loop but drops the likelihood axis (probability = 1): score consequence, assign an RMB owner, plan a corrective action / POA&M with an EAC in the IMS, re-assess for spawned risks. Options are mainly Ignore (after a business case) or Control.
• Opportunity management is the proactive twin: a six-activity loop (plan → identify → analyze [business case] → decide → monitor → feedback), with options Pursue / Defer / Reevaluate / Reject. Spending effort raises the likelihood of a good event (the inverted lever). Aggregate small wins; reject short-term-gain/long-term-loss candidates.

Cross-program / interface risk

When a system depends on hardware/software/schedules owned by other programs, the interfaces are a primary risk source owned by no one. Contain with a designated technical authority, MOAs carrying cost/schedule/performance tripwires, an ICWG, ICDs/IRSs, synchronized schedules, an integration plan, and giver–receiver deliverables tracked in the IMS. Escalate early up PM → PEO → SAE → DAE; refer requirements disputes to the CSB. Reconcile SWAP-C across the seam.

RIO is tailored to the AAF pathway

There is no single DoD risk process — the pathway pre-sets the risk posture, and tailoring is fine adjustment:

• UCA (<2 yr, DoDI 5000.81) — accepts deficiencies for speed; ends in a disposition analysis.
• MTA (2–5 yr, DoDI 5000.80) — fails early and descopes; op demo ≥1 yr before completion.
• MCA (milestone-driven, DoDI 5000.85) — front-loads hard decisions, picks the entry milestone by where risk lives, burns down Technology/Engineering/Integration risk in TMRR while money is cheap, and gates with SETRs (ASR/SRR/SFR/PDR → CDR/TRR/SVR/FCA/PRR → OTRR/IOT&E/PCA) plus TRA/MRA/SRA.
• Software (DoDI 5000.87) — automation/continuous-test/cyber up front; MVP→MVCR; User Agreement; technical-debt tracking.
• DBS (DoDI 5000.75) — fit a commercial product to re-engineered processes via fit-gap; ATP gates.
• Services (DoDI 5000.74) — the requirement is the risk; seven steps, ARRT→PWS/QASP, CPARS.

Contract type follows the risk profile — risk is never fully transferred to industry (the Government still needs the product).

Specialized methods feed the enterprise register

Each is a sensor for a risk class the general process won't surface; funnel each back into one register with a common consequence language (roll micro-risks up, decompose macro-risks down): RMF (DoDI 8510.01; 7 steps; tiered per NIST SP 800-39), MBCRA / Cyber Table Top (DoDI 5000.89; mission-framed cyber), Agile metrics (Size/Time/Effort/Defects), FMECA on the digital model (DoDI 5000.88), ITRA/DTRAM (8 risk areas × 7 factors), and S&T/program protection (DoDI 5000.83).

Institutionalization

RIO becomes durable machinery: the PRMP (written at formulation, refreshed at life-cycle events); boards — PM-chaired RMB, JRMB for mutual Government–contractor risk, ROMB when it also handles opportunities, chartered RWGs; an early, SEP-documented tool (Project Recon / Active Risk Manager / Risk Exchange); tiered roles with the non-negotiable rule that every risk has an owner; and traceability into WBS (MIL-STD-881F), IMP/IMS, EVM (EIA-748), and TPMs (DoDI 5000.02, kept SMART). A mitigation not tied to a funded work package and a schedule activity is aspiration, not management.

Chapter Index

Topic Index

• AAF pathways (selecting/tailoring) → ch05, ch06, cheatsheet
• Aggregate / compounding risk (Monte Carlo) → ch02, ch08
• Burn-down plan / chart → ch03, ch08, cheatsheet
• Business / External risk → ch02
• Consequence (max-of-three, unmitigated, fully burdened) → ch02, cheatsheet
• Contract type as a risk instrument → ch05, ch08
• Cross-program / interface risk; MOAs; tripwires; ICWG; SWAP-C → ch04
• Cyber Table Top (CTT) / MBCRA → ch07, ch06
• DCMA 14-point schedule metrics / schedule health → ch08
• Digital Engineering / FMECA → ch07
• DTRAM (8 areas × 7 factors) / ITRA → ch07
• EMV / ROI prioritization → ch02
• Escalation chain (PM→PEO→SAE→DAE) / CSB → ch04
• Framing assumptions → ch05
• Issue management (probability = 1; Ignore/Control; POA&M/EAC) → ch03
• Likelihood (1–5 bands) → ch02
• Mitigation options (accept/avoid/transfer/control) → ch03, cheatsheet
• Monitoring (EVM/IMS/TPM, trend matrix) → ch03, ch08
• Opportunity management / should-cost vs. will-cost → ch04, cheatsheet
• PRMP (plan, outline, refresh triggers) → ch01, ch02, ch08
• Risk vs. issue vs. opportunity (definitions) → ch01, cheatsheet
• Risk categories (Technical/Programmatic/Business) → ch02
• Risk matrix (5×5) → Low/Moderate/High → ch02, cheatsheet
• Risk register (single source of truth, combined) → ch02, ch08
• Risk statement (event+consequence+cause; if–then) → ch02
• RMB / JRMB / ROMB / RWG (boards & working groups) → ch02, ch03, ch08
• RMF (7 steps; Assess Only; NIST SP 800-39 tiers) → ch07
• Roles (Executive/Management/Working; every risk has an owner) → ch08
• SETRs (ASR/SRR/SFR/PDR/CDR/TRR/SVR/FCA/PRR/OTRR/PCA) → ch05
• Software pathway (MVP→MVCR, User Agreement, technical debt) → ch06
• SRA / CRA / PRA (indicators, not verdicts) → ch08, ch02
• Tailoring (drop steps that don't add value) → ch01, ch05
• Tools (Project Recon / Active Risk Manager / Risk Exchange) → ch08
• TRA / MRA (readiness assessments) → ch05
• WBS / IMP / IMS / EVM / TPM integration → ch08

Supporting Files

• glossary.md — RIO terms (boards, scores, pathways, tools, methods), alphabetical, with chapter references
• patterns.md — 11 reusable techniques (write a risk statement, score, classify, pick a mitigation, build a burn-down, manage issues/opportunities, contain cross-program risk, tailor to pathway, funnel specialized methods, institutionalize) with When/How/Trade-offs
• cheatsheet.md — the three RIO objects, scoring rules, mitigation/issue/opportunity options, AAF pathway → posture table, specialized-methods table, institutionalization, and tells & smells

Scope & Limits

Covers: program risk, issue, and opportunity management for U.S. defense acquisition programs per the DoD RIO Management Guide (Sep 2023, incl. Change 2.2) — the RIO definitions; the tailorable five-step risk process; 1–5 likelihood/consequence scoring, the 5×5 matrix, EMV/ROI, and aggregate Monte Carlo analysis; the four mitigation options and the six-step burn-down; issue management (probability = 1); opportunity management toward should-cost; cross-program/interface risk; RIO tailoring across all six AAF pathways; the specialized methods (RMF, MBCRA/CTT, Agile metrics, DE/FMECA, ITRA/DTRAM, S&T protection) as risk sensors; and institutionalization via the PRMP, boards, tools, tiered roles, and WBS/IMP/IMS/EVM/TPM integration.

Does not cover in depth (deferred by the source to its own authorities): general risk theory and continuous-risk-management method built from scratch (use nasa-risk); the broader SE process model RIO sits inside (use dau-se-guidebook); system safety / ESOH and hazard analysis (DoDI 5000.88, MIL-STD-882 — see mil-std-882 / system-safety packs); Human Systems Integration (DoDI 5000.95 — see nasa-hsi); the full cybersecurity RMF control workflow and SP 800-53 catalog (DoDI 8510.01 / NIST — see nist-800-37, nist-sse); electromagnetic spectrum/E3 (DoDI 4650.01 / 3222.03); Technology Readiness Assessment depth (see gao-tra); and modular-open-systems detail (see dod-mosa). It is guidance, not mandatory policy, and is thin on worked numeric examples beyond the single Appendix-D UAV-jammer walkthrough.

Jurisdiction: U.S. DoD work, public domain (Distribution A — approved for public release, distribution unlimited). Recommended guidance for AAF acquisition programs; used alongside DoDI 5000.02 and Military Department direction.

Source version: DoD Risk, Issue, and Opportunity Management Guide for Defense Acquisition Programs, OUSD R&E, September 2023, Incorporating Change 2.2 (December 2023).