PROCUREMENT RISK
MANAGEMENT PLAN
Project Name/Description
Reference Number
Department/Agency
Prepared by
Date
(For procurements that are high in complexity
and/or value)
Table of Contents
1.
PURPOSE OF DOCUMENT ............................................................................. 2
2.
PROCUREMENT CONTEXT ............................................................................ 2
3.
IDENTIFY, ANALYSE, EVALUATE AND TREAT RISKS ................................ 3
4.
RISK REGISTER .............................................................................................. 5
State Procurement Board Procurement Risk Management Plan
Page 1 of 5
Version 1.0
Issue Date: April 2013
Review Date: April 2015
1. PURPOSE OF DOCUMENT
Risk management in procurement is about identifying, assessing and managing the risks
associated with the purchase of goods or services to ensure unexpected or undesirable
outcomes are minimised whilst achieving the objectives of the procurement.
Risk management is an essential part of good procurement. Practitioners who manage
procurement risk well are more likely to achieve the project outcomes and objectives.
In accordance with the State Procurement Board’s Acquisition Planning Guideline, and Risk
Management Guideline, a procurement risk management plan must be developed for all
procurements that are considered high in complexity and/or value (quadrant 2, 3 or 4
procurements). The level of detail to be recorded will be commensurate with the value and
complexity of the procurement.
The recommended risk management approach is based on the Australian Standards on Risk
Management AS/NZS 31000 and the State Procurement Board’s Risk Management
Guideline.
There are six steps in the procurement risk management process:
 establish the context;
 identify the risks;
 analyse the risks;
 evaluate risks;
 treat risks; and
 monitor and report the risks.
This document is to be read in conjunction with the following documents:
Insert document names and file reference. For example, acquisition plan, evaluation plan
and tender documents.
2. PROCUREMENT CONTEXT
Objectives of Procurement
Insert details on:
 Objectives of the procurement (what is the procurement hoping to achieve)
Scope of Procurement
Insert details on:
 Scope of the procurement
Key Stakeholders
Insert details on:
 Key stakeholders – both internal and external
State Procurement Board Procurement Risk Management Plan
Page 2 of 5
Version 1.0
Issue Date: April 2013
Review Date: April 2015
Procurement Strategy
Insert details on:
 procurement strategy
Procurement Context
Insert details on:
 Other issues within the procurement context (refer to SPB Risk Management
Guideline):
o Legislation, standards, policy relevant to the procurement objectives;
o External elements including the economic and competitive environment
o Cross-agency, lead agency or individual agency responsibilities;
o Timeframes to undertake the procurement activity
o Specialist knowledge or other knowledge required; and
o Lessons learnt from previous similar procurements.
Risk Management Responsibilities
Insert details on:
 Governance committee / project team (key staff members who will manage the
procurement risks)
3. IDENTIFY, ANALYSE, EVALUATE and TREAT RISKS
Identify Risks
Identify the risks for this procurement and document (refer risk register). This will include
risks that are common to the procurement process, and risks that are specific to this
particular procurement.
Risks have been identified through the following methods:
 List the methods used to identify the risks including the involvement of appropriate
discipline or risk experts
Risks have been identified through the following methods:
 List the methods used to identify the risks including the involvement of appropriate
discipline or risk experts
Analyse Risks
When analysing risks, account for the effect of controls built into existing procedures (refer to
the risk register to document current controls). The residual risk is the risk remaining after
considering the current controls in place.
Analyse the risk using the key criteria of:
 Likelihood – how likely is it that the risk may arise?
 Impact / consequence – what will be the impact if the potential risk eventuates?
Refer to your organisation’s ratings for the measures of likelihood and consequence.
Determine the level of risk or risk rating based on the measures of likelihood and
consequence – again refer to your organisation’s risk rating levels.
State Procurement Board Procurement Risk Management Plan
Page 3 of 5
Version 1.0
Issue Date: April 2013
Review Date: April 2015
Evaluate Risks
Evaluate each risk identified and:
 For each risk rated as low, they may be accepted with no or minimal treatment
 For each risk rated as moderate or high, ensure a treatment is assigned in
accordance with your organisation’s risk tolerance.
 For each risk rated as moderate or high, identify who is responsible for managing
that risk and the timeframe.
Treat Risks
Identify treatments for risk:
 For each risk rated as low, they may be accepted with no or minimal treatment
 For each risk rated as moderate or high, ensure a treatment is assigned in
Monitor Risks
Risks must be monitored and if appropriate, revised throughout the procurement process.
Risks will be monitored by the following methods:
List the methods used to monitor the risks
Risk Register
For each risk identified, record the likelihood, consequence, associated risk rating and
treatment in the attached table (refer section 4).
State Procurement Board Procurement Risk Management Plan
Page 4 of 5
Version 1.0
Issue Date: April 2013
Review Date: April 2015
4. RISK REGISTER
Risk Name &
Description
What could happen and
why?
Risk Assessment
Current Controls
Impacts
Are there current
controls for the risk
Impact if the risk
eventuates
none
Delays to purchasing
Likelihood
Consequence
Risk Treatment
Risk
Rating
Refer to your organisation’s ratings for measures
Example:
Insufficient funding
State Procurement Board Procurement Risk Management Plan
Page 5 of 5
C Possible
4 Major
Version 1.0
Issue Date: April 2013
Review Date: April 2015
High
Depending on risk rating additional controls /
mitigation strategy to be
implemented (to reduce risk
rating)
Ensure funding approvals
obtained at start of project
Responsibility
/ Due Date