I work for a large defense contractor and we are currently in a proposal phase for a 5 year IDIQ contract.  We have a high win probability with this one and it's a deliverable that will consist of a few high risk suppliers.  
One deliverable of this proposal is a thorough risk managing plan. This plan consists of standard risk assessments (0-10) that provides a risk score for each supplier and will also utilize a couple of platforms, most notably Connex and Exiger.   
I am struggling on determining a program budget allocated to supply chain's risk management execution and monitoring.   I know the license, fees, and maintenance costs, but does anyone have any methodology on capturing RM costs?   Possibly % of overall program budget?  % of supplier spend?  % per each supplier? 
Obviously this will be a conservative  estimate but I'd like to have some sort of justification.  In the past, we just threw a 10% adder for all suppliers listed as "high risk", but we never was able to really answer why we had a 10% rule of thumb.  
Thanks in advance!   

Disclaimer: I’m certainly not an expert in risk management and RM estimating, if that is what you are asking about. 

We don’t know what type of contract or delivery order pricing is involved, e.g., cost reimbursement, FFP, etc.

However, your flat rate 10% add on for “high risk” suppliers appears to be a simple contingency.

I was on the government side of the early phases of a highly technical cost reimbursement systems IDIQ contract with separate phases for design, construction, process systemization, pilot operations, full scale operations, closure, dismantling…  It was a Chemical Weapons Demilitarization plant for assembled chemical weapons as well as various bulk chemical agents using a process that had only been bench tested.

 The lead firm of the joint venture Prime was one of the two largest US engineering and construction contractors. During the negotiations for design-construct phases, the JV and us identified numerous, various cost and schedule risks, then the SC used a Monte Carlo risk analysis to determine and estimate risk to the schedule and cost.

I left the project for other duties before seeing the results, though. DoD purposely slowed down the last two plants in the Chemical Weapons Demilitarization Program by at least 15 years! 

 

 

 

When I was doing consulting work, the Project Management Institute was an excellent source for this type information.  If someone in your company belongs, ask them for help.  If not organization has lots of free information that might be of assistance.

PMI

 

For your information, I am providing the following:

1. 31.205-7 Contingencies.

(a) "Contingency," as used in this subpart, means a possible future event or condition arising from presently known or unknown causes, the outcome of which is indeterminable at the present time.

(b) Costs for contingencies are generally unallowable for historical costing purposes because such costing deals with costs incurred and recorded on the contractor’s books. However, in some cases, as for example, terminations, a contingency factor may be recognized when it is applicable to a past period to give recognition to minor unsettled factors in the interest of expediting settlement.

(c) In connection with estimates of future costs, contingencies fall into two categories:

(1) Those that may arise from presently known and existing conditions, the effects of which are foreseeable within reasonable limits of accuracy; e.g., anticipated costs of rejects and defective work. Contingencies of this category are to be included in the estimates of future costs so as to provide the best estimate of performance cost.

(2) Those that may arise from presently known or unknown conditions, the effect of which cannot be measured so precisely as to provide equitable results to the contractor and to the Government; e.g., results of pending litigation. Contingencies of this category are to be excluded from cost estimates under the several items of cost, but should be disclosed separately (including the basis upon which the contingency is computed) to facilitate the negotiation of appropriate contractual coverage. (See, for example, 31.205-6(g) and 31.205-19.)

2. If your focus is (c)(1), you should be able to articulate in detail in relation to each high risk supplier, in writing, the critical threat and vulnerability and how it is to be limited by what expenditure and $ amount for what. After all, you are required have a thorough risk management plan.  

3. I am surprised that it looks to me like your company put an additional arbitrary dollar amount into its prior proposals, and on the negotiation table, and the government just bought into it without any comment or question or rationale from the contractor??

4. I don't think there is a magic "number" that anyone has that you could or should just borrow outright for your company and its statement of work requirements.

5. It was not clear to me whether the 10% was an internal management challenge that comes out of the amount negotiated with the customer or whether the customer pays for it. If your large company has been successful in the past with whatever it has done, maybe there is no reason to change.

 

 

In simple terms, adding a 10% contingency to each high risk is saying that there is a 100% probability that every risk will occur.

With risk management and using a Monte Carlo analysis, the analysis can be used to predict probabilities of delays and costs due to one or multiple risks. It’s not a linear cumulative value. 

Since my experience was almost 20 years ago, I don’t remember all the details but one can look it up and there are knowledgeable practitioners to help you.

Here is some sample info on it.

https://www.proprofsproject.com/blog/monte-carlo-analysis-in-project-management/#:~:text=The Monte Carlo Analysis is,project cost and project timeline.