Risk management and assessment of sub-contractors and suppliers must start early in the life of a bid. As soon as the need for bought in items is identified and a list of potential sub-contractors created, the risk management process kicks in.

Risk assessment of sub-contractors becomes more essential, the more complex the item of supply and the fewer suppliers there are to choose from.

The amount and importance of risk management goes in this order, starting with the most difficult:

If the system requires a complicated piece of modified software based on an existing proprietary software, then due to copyright issues, only the original owner of the code can be approached to change it as required. This is a sole source supply involving software development, which is notoriously difficult, and needs to be micro-managed in order to succeed.

Equally, if a complicated bespoke software is needed, even given that there are a number of sub-contractors capable of doing the work, it is a very risky business and needs careful management.

Items of hardware which will be designed and manufactured specifically for this project or which require special manufacturing processes need a high degree of careful risk management.

Next down the chain in terms of risk are specialist items of proprietary hardware. Again, this is likely to be a sole-source item, which in itself carries risk.

Alternatively, the risk involved in buying standard commercial-off-the-shelf (COTS) items of either hardware or software where there are various similar products to choose from, is fairly low, but still exists and management will be required.

In a nutshell, the order of risk, starting with the highest is:

Sole source software development
Multiple source software development
Sole source complex COTS software requiring system integration
Sole source hardware development and manufacture
Multiple source hardware development and manufacture
COTS Software supply
COTS Hardware supply

Each of these scenarios carry different types and quantities of risks, making individual plans for their management absolutely essential.

In our next article we'll look and the management of risk associated with selecting potential sub-contractors.

-------------------------------------------------------
Michael Russell
Your Independent guide to Risk Management
-------------------------------------------------------