60GG-1.002. Risk and Complexity Assessment

(1) The Agency will perform Risk & Complexity Assessments (R&C Assessments) for information technology (IT) projects to evaluate the risk and complexity factors for each IT project https://www.flrules.org/Gateway/reference.asp?No=Ref-05569. The purpose of the assessments is to determine the minimum level of project management control necessary to manage a given project in order to reduce risk and increase the probability of success.

(2) These assessments align projects by risk and complexity levels into one (1) of four (4) Risk and Complexity (R&C) Categories, which determine the amount of project management control required. The following diagram indicates the distribution of risk and complexity levels into the R&C Category:

		Complexity
		Low	Medium	High
Risk	Low	1	1	2
	Medium	2	2	3
	High	3	3	4

(a) Category 4 represents High Risk and High Complexity projects.

(b) Category 3 represents High Risk and Medium Complexity projects, High Risk and Low Complexity projects, or Medium Risk and High Complexity projects.

(c) Category 2 represents Medium Risk and Medium Complexity projects, Medium Risk and Low Complexity projects, or Low Risk and High Complexity projects.

(d) Category 1 represents Low Risk and Medium Complexity projects or Low Risk and Low Complexity projects.

(e) Specific lifecycle phase requirements for each category are identified in rule 60GG-1.003, F.A.C. ‒ Initiation; rule 60GG-1.004, F.A.C. ‒ Planning; rule 60GG-1.005, F.A.C. ‒ Execution; rule 60GG-1.006, F.A.C. ‒ Monitoring and Controlling; and rule 60GG-1.007, F.A.C. ‒ Closure.

(3) The R&C Assessments are conducted using Form DMS-F-0505A, DMS Risk & Complexity Assessment Workbook (07/15). This workbook is used by Agencies to determine the cumulative R&C Category designation. The R&C Assessment Workbook is divided into seven (7) separate assessment worksheets which are conducted at four (4) key points in the project management life cycle. Form DMS-F-0505A, DMS Risk & Complexity Assessment Workbook, is hereby incorporated by reference in this rule.

(a) The Agency must complete a Pre-Charter R&C Assessment (consisting of a Risk worksheet and a Complexity worksheet) at the start of the Initiation phase of the project. During this assessment, the Agency will review priorities and business need, assess the project, and analyze factors that might impact project success. The resulting R&C Category establishes the project management control requirements to be applied during the project Initiation phase. (See rule 60GG-1.003, F.A.C. ‒ Initiation)

(b) The Agency must complete an Initiation Gate R&C Assessment at the end of the Initiation phase following completion of project Initation documentation. During this assessment, the Agency will review Initiation documents, validate or amend the previous R&C assessment findings, and complete the Initiation Gate R&C Assessment (consisting of a Risk worksheet and a Complexity worksheet). This assessment will confirm or adjust the project’s cumulative risk & complexity level and resulting R&C Category, examine the effectiveness of Initiation phase activities, and set requirements for the project Planning phase. (See rule 60GG-1.004, F.A.C. ‒ Planning)

(c) The Agency must complete a Planning Gate R&C Assessment at the end of the Planning phase, following completion of project planning documentation. During this assessment, the Agency will review project documents, validate or amend the previous R&C assessment findings, and complete the Planning Gate R&C Assessment (consisting of a Risk worksheet and a Complexity worksheet). This assessment will confirm or adjust the project’s cumulative risk and complexity level and resulting R&C Category, examine the effectiveness of Planning phase activities, and set requirements for the project Execution and Monitoring and Controlling phases. (See rule 60GG-1.005, F.A.C. ‒ Execution, and rule 60GG-1.006, F.A.C. ‒Monitoring and Controlling)

(d) The Agency must complete an Event-Driven R&C Assessment if the project experiences a significant change, or cumulative changes (in cost, schedule, or scope) from the project baseline. During this assessment, the Agency will review the change control request(s) and project documentation. The Agency will also review, validate or amend the previous R&C assessment findings, and complete the Event-Driven R&C Assessment (consisting of a Risk worksheet). This assessment will confirm or adjust the project’s cumulative risk & complexity level and resulting R&C Category and determine if review and amendment to project management baselines are needed.

Rulemaking Authority 282.0051(18) FS. Law Implemented 282.0041, 282.0051 FS. History‒New 7-16-15, Formerly 74-1.002.