Gateway Risk Profile Assessment (RPA) / Agency Engagement Responsibilities

Agency Responsibilities

Agencies must complete an initial RPA (Risk Profile Assessment, attached above)  for any project or programme that would expose the government to significant fiscal or ownership risk if it were not delivered within the projected functionality, cost, and timelines (Cabinet Office Circular CO (10) 2).

The RPA comprises 26 multiple-choice questions.  These identify, at a high level, the presence of risk indicators for a project; the RPA is an agency’s initial self-assessment of a project's inherent risk.

The RPA is not an exhaustive risk analysis model; it does not replace the need for agencies to perform their own detailed risk analysis and management throughout a project's lifecycle.

The RPA produces an indicative risk rating.

For any programme or project where the RPA risk rating is Medium or High, the agency must send the completed RPA to the SSC Gateway Unit (gatewayunit@ssc.govt.nz).  The Gateway Unit, in consultation with other central agencies, and after discussions with the submitting agency if necessary, makes the final decision on whether the project is High Risk and hence requires Gateway review.

The RPA must be submitted at least ten weeks before any review is likely to be required, after consideration of the timing requirements for Gateway reviews.

Timely disclosure

Gateway reviews are required prior to the key investment decision points, as described in the Gateway methodology.

When the Gateway Unit assesses a project/programme as High Risk, the Gateway Unit will conduct an Assessment Meeting with the Senior Responsible Owner (SRO).  This meeting confirms the risk rating, determines the dates for and requirements of the review, and explains the requirements for agency and SRO participation in the review.

The Gateway Unit requires eight weeks between agency commitment to a Review (signed acceptance of the fee) and the commencement of a review, to undertake the necessary planning and review team engagement.

To ensure sufficient time for this to occur, the agency must:

• Ensure, where applicable, that an RPA is submitted at least ten weeks before a review could be required.

• Ensure an Assessment Meeting is arranged for a date at least nine weeks before the review.

To support this, agencies are expected to:

1 Establish processes to ensure early and on-going engagement between major capital programmes/projects and the Gateway Unit.

2 Ensure that Senior Responsible Owners (sponsors) of new programmes and projects understand the requirements of Gateway.

3 Ensure that Gateway reviews begin early in the lifecycle of a project or programme.  Early reviews provide the greatest benefit by helping to ensure that:

• the foundations for success are in place

• the purpose of the project or programme is clearly understood

• there is a realistic view about the costs and benefits of the project or programme.

4 Ensure that the State Services Commission is given sufficient notice of upcoming decision points.  

• Cabinet has agreed that failure to properly perform and disclose the results of an initial RPA, or to submit timely requests for applicable Gateway reviews, is a serious matter and will be viewed negatively.

Ongoing Assessment and Disclosure Requirements

If there is a significant change to a project or programme previously assessed as not high risk, that could affect the rating, agencies must re-assess the project by updating the RPA.

For programmes or projects that have previously been reviewed, agencies must submit a timely request to the Gateway Unit for the next review to be arranged. If in any doubt, contact the Gateway unit as early as possible (gatewayunit@ssc.govt.nz).

To see all information published about the Gateway process, go to the Gateway homepage.