Contract Risk Assessment, Mitigation Strategies and
Monitoring Checklist
INSTRUCTIONS
This document is sample only. Some information in the document may or may not be applicable or relevant to your contract.
Agencies are advised to modify as appropriate to meet their individual risk assessment needs, and/or reflect specific
program or contract requirements.
Contractor Name: Contract #
Start/End Date: Contracted Service(s) Provided:
Risk Assessment Type: Initial Revised
Service Risk Value Response Strategies
Risk Factors & Assigned Risk Values Pts. (Suggested Action Steps for contract and on-site review)
1 This is a new contract, or a significant change to an New contract may require early monitoring to ensure any
(3)
existing contract (within the past year). technical assistance issues are addressed adequately.
2 Contract contains more than one service/SOW, or Complex programs or services may require early monitoring to
SOW contains multiple complex requirements that ensure any technical assistance issues are addressed
require technical assistance from program staff to (2) adequately.
understand and complete.
4 Funding source requires special reporting from the Funding requirements must be evaluated to ensure all required
Contractor. (3) reporting and controls are included in contracts and monitoring
tool.
5 Payment method to be used: • Perf. Based - Contract must include adequate reporting,
• Performance Based (PB), or payment tied (0)
or requires documented delivery of work (deliverables) to
to deliverable, per requirements ensure required performance is achieved.
• Fee for Service (FFS) – PB requirement • FFS – Reporting must include adequate tracking of
waived (1) services performed.
• Cost Reimbursement – PB requirement • Cost Reimb. – Contract must include language to track
waived progress toward achievement of contract to ensure
(3)
budget isn’t overspent in early stages.
6 Contractors for the contract must maintain Contract must address the requirement, and consequences if
accreditation or certification requirements the accreditation or licensure is not maintained for the life of
(1)
the contract. Must be checked during monitoring to ensure
these are still in effect.
7 Contractors will have access to agency data (5) Data Security Requirements Exhibit must be included in each
contract and Contract must be monitored to ensure security of
data.
8 If IT related, Contractor is creating a custom IT Consider hiring or engaging additional technical resources that
solution/system or making substantial may support the contract to ensure successful implementation
customizations to a Commercial-Off-The Shelf of the system (for example, Business Analyst, Quality Assurance
(3)
system for the agency. Specialist). Project Manager should conduct on-going
performance review and assessment during the life of the
contract.
9 Other Risk Factors (explain & assign value):
Service Risk Score Total
Adapted from DSHS HQ Contract Risk Assessment Template and DES Contract Management Manual Page 1 of 7
Contract Risk Assessment, Mitigation Strategies and Monitoring Checklist
Contract Risk Value Response Strategies
Risk Factors & Assigned Values Pts. (Suggested Action Steps for contract and on-site review)
10 This contract will represent a significant portion of Determine the potential impact on the program if a contractor
the total program funding for this service. (3) does not meet its obligation, and determine what progress
should be checked during monitoring.
11 Contract Maximum Consideration $100,000 or over. Determine the potential impact on the program if a contractor
(1)
does not meet their obligation, and determine what progress
should be checked during monitoring.
12 Contractor will be allowed to subcontract key If subcontractors are allowed, identify in the contract the
activities of this service. (1) monitoring that the contractor must complete to ensure
subcontractors are compliant with all requirements.
13 Contractor requires the agency to enter into Vendor Consider additional areas of risk depending on what is
(2) contained in the vendor created terms and conditions.
created terms and conditions.
Contract Risk Score Total
Contractor Risk Value Response Strategies
Risk Factors & Assigned Values Pts. (Suggested Action Steps for contract and on-site review)
14 Contractor is providing these goods or services for If new, determine whether contractor staff have sufficient
the first time. (3) understanding of the service requirements. May need to
expand planned technical assistance.
15 Contractor has defaulted on contract(s) within the Identify the reason for the default(s) and assess whether similar
last five years. (5) situations would endanger the success of this contract. Identify
any additional monitoring requirements needed to address this.
16 Contractor has received audit findings (within the Review audit findings to determine whether the weaknesses
past two years) indicating weaknesses in internal (5) have been corrected, or whether additional requirements need
control over federal or state programs. to be addressed in the contract.
17 Contractor has received contract monitoring Review monitoring findings to determine whether the
findings that required a written corrective action (4) weaknesses have been corrected, or whether additional
plan (within the past two years) for state contracts. requirements need to be addressed in the contract.
18 Past performance problems – most recent 2 years. If performance history is poor, determine whether an
(2) alternative contractor would be appropriate. If not, plan on
additional technical assistance to contractor and more frequent
on-site monitoring.
19 Licensing or Accreditation Organization has Check with licensing or accrediting organization to determine
documentation of actions against the Contractor in whether there have been complaints filed. If complaints have
the past 2 years. been filed but the agency will continue the contract with the
(2)
Contractor, plan on having additional technical assistance, or
more stringent monitoring activities such as more frequent on-
site monitoring.
20 Contractor has had lawsuits filed or pending against Assess whether issues addressed in lawsuits would impact the
them in the past 12 months. (2) decision to utilize the services of the Contractor for this service,
or would place the Contractor in financial difficulties.
21 Significant staff turnover (>25%) in the past year. Has there been frequent/high turnover of contractor
management, or key personnel? Has contractor changed major
(1)
subcontractors recently? Assess what impact these changes
may have on the contract.
22 Other Risk Factors (explain & assign value):
Contractor Risk Score Total
RISK LEVEL: LOW (0-12) MEDIUM (13-23)
Risk Score – Grand Total
HIGH (24 or >)
Form Completed By: Date: Program:
Adapted from DSHS HQ Contract Risk Assessment Template and DES Contract Management Manual Page 2 of 7
Contract Risk Assessment, Mitigation Strategies and Monitoring Checklist
Risk Monitoring Checklist
Requirements Checklist
❑ Are there agency policy, regulatory and/or statutory requirements impacting risk?
❑ Any required qualifications of the contractor and/or their staff?
❑ Timeline for delivery create risk?
❑ Inspections or testing to accept the goods require?
❑ Are quality assurance audits needed?
❑ Is the contractor providing a service that could injure people or property (for example, welding)?
Agency-Contractor Interdependency
Map out the dependencies
❑ What is the contractor depending on to do its work?
❑ Who is the contractor going to depend on to receive information, data, approvals, etc.?
❑ What is the Agency depending on? (Data, reports, samples, draft versions, etc.)
❑ Who is the Agency going to depend on? (from this contractor or another contractor)
❑ Who will test, inspect or accept work? (In other words, does someone need to travel to the location
for the Agency to test a system?)
❑ Who within the Agency will approve work and is that the same person who will formally accept the
work according to the performance criteria?
❑ What are the time frames associated with these dependencies?
❑ What are the potential barriers to receiving adequate information, data or approvals associated
with the dependency?
Statement of Work
❑ Transition Planning Schedule.
o This is a schedule to transition work from one party to another. It is not the same as contractor
milestone dates, which is contractor specific. This schedule will include anticipated dates the
Agency or possibly another contractor will transition its work to the contractor.
Adapted from DSHS HQ Contract Risk Assessment Template and DES Contract Management Manual Page 3 of 7
Contract Risk Assessment, Mitigation Strategies and Monitoring Checklist
o This language would outline the Agency criteria for approving of the transition of work from
the contractor to the State or from one contractor to another contractor.
❑ Milestone Dates. There are different categories for
o Contractor delivery,
o Agency approval/acceptance,
o Invoice submittals and payments.
❑ Contractor Representative Named as Project Manager. Some contractors prefer a title to a named
individual.
❑ Acceptance Criteria.
o Note the circular nature of template contracts. Templates will refer back to the scope of work,
technical specifications, contractor’s response, or applicable standards.
o Be sure that formal acceptance or applicable industry standards are included in the scope of
work or technical specifications. These mechanisms act as a control.
❑ Reports and Reporting Timeline. The contractor will need to demonstrate its compliance with
transitions in the form of a report of some kind. And, how often does the Agency wish to receive
these reports. Consider tying them to the acceptance criteria.
❑ Performance criteria.
o Is the transition happening all at once or over a period of time? If over a period of time,
consider a metric (90% complete by a date) or a Service Level Agreement (90% on-time
delivery by a date).
Financial Risks
❑ Compliance
o Ensure the contractor complies with laws and regulations regarding federal funding (or other
sources of funding)
o Ensure the contractor is appropriately insured and complies with insurance reporting
requirements
o Ensure that sub-contractors working for the contractor comply with laws, regulations and
policies
Adapted from DSHS HQ Contract Risk Assessment Template and DES Contract Management Manual Page 4 of 7
Contract Risk Assessment, Mitigation Strategies and Monitoring Checklist
❑ Small businesses
o Insufficient cash flow to complete services or deliver goods
o Insufficient cash flow to pay sub-contractors or employees
o Insufficient (or lapsed) insurance coverage
❑ Insufficient insurance for:
o Goods or services provided to the community on behalf of the Agency
o Complex services that pose a potential risk to the Agency (such as complex Information
Technology work)
o Contractor employees who work on-site at the Agency
❑ Wrong type of insurance for the list noted above
❑ Does the Agency require proof of insurance for the duration of the contract term?
❑ Bankruptcy, Insolvency, Receivership
❑ Contractor mergers/acquisitions with other businesses
❑ Insufficient auditing of invoices against contract payment terms
❑ Lack of auditing the contractor’s records when an issue arises
❑ Insufficient or non-existent recording keeping for an audit process
Hybrid Contract Risks
❑ Is the contractor providing goods/services directly to the agency or providing goods/services to the
community on behalf of the agency?
❑ Is the contractor buying goods for the Agency from another contractor (original equipment
manufacturer)? If yes,
o Is the contractor passing through warranties from the manufacturer?
o Is the contractor purchasing from a distributor?
o Or, is the contractor using their own warranty provision to warrant the materials?
❑ What are the Agency’s obligations to the contractor (technical drawings, approvals, etc.). List those
agency’s requirements.
❑ Should your Agency’s policy, regulatory and statutory requirements be documented here in the
functional requirements? In other words, does the good need to meet a regulatory or policy
Adapted from DSHS HQ Contract Risk Assessment Template and DES Contract Management Manual Page 5 of 7
Contract Risk Assessment, Mitigation Strategies and Monitoring Checklist
obligation? List them.
❑ If the Agency is providing any goods/equipment for this Statement of Work, how does the Agency
stay within the provisions of the original equipment manufacturer warranty for those
goods/equipment as the contractor accesses the items with the good/service the contractor
provides?
❑ List any required qualifications for the good, such as meeting OCIO standards?
❑ Does the good have its own software of any kind at all? If so, how does this software code impact
any existing software code the Agency is using?
❑ List any required qualifications required of the contractor and/or their staff to perform the services?
❑ Which one is dependent on the other? Does the good arrive first or does the service start first?
❑ Is the timeline for performance/delivery etc. clearly outlined?
o Are there gaps in the delivery dates or “TBD’s”?
o Who, when and how will the “TBD’s” be determined?
Intellectual Property Risks
❑ How robust is your Agency’s oversight of contractor’s who have access to
o Sensitive Agency data,
❑ Community or citizen’s data, or
o Access to agency networks?
o How will you personally monitor data breaches, security breaches etc.? If it is not your duty,
then whose duty is it?
❑ How recently have your Agency’s cyber-security policies been updated? Are those updates in the
current contract template that will be attached to the solicitation?
❑ Does this project require background checks on the contractor’s employees?
❑ Check your work: How will these risks be incorporated into the Statement of Work and contract
terms?
Software Need Checklist
❑ What exactly—in lay person’s terms—does the agency need from the contractor? Don’t worry
about talking in legal terms for now, just make sure you list things like:
o Does the agency need to make adjustments to the code over time?
Adapted from DSHS HQ Contract Risk Assessment Template and DES Contract Management Manual Page 6 of 7
Contract Risk Assessment, Mitigation Strategies and Monitoring Checklist
o Does the agency need to get the code to work with new items that agency might purchase,
such as new elements in a security system in the near future?
o Does the agency need to include the custom software into an existing network?
o Does the agency need the ability for other contractor s to access this custom code over time?
o In terms of use of or ownership of the code, the Contract Professional and legal staff will align
the template terms with what the business needs.
❑ How long does the contractor intend to service the software (i.e. upgrades)?
❑ How long does the Agency project using the software and updates? (months, years, decades).
Therefore, when accessing, modifying or creating drivers for older software consider the following:
❑ Will the contractor need access to another contractor’s software at the Agency for their work?
❑ Does the Agency have that right to access the software?
❑ Can this contractor legally help the Agency get that access?
❑ What is the solution if the Agency does not have the right to access the software? (Note, older
contracts were not well written to anticipate the issues
Adapted from DSHS HQ Contract Risk Assessment Template and DES Contract Management Manual Page 7 of 7