Description

A focused course, tailored for you

Risk-Gated QA for Government IT Delivery

Build the integrated risk and quality framework that keeps federal programs on schedule, on spec, and audit-ready.

Your risk log and QA register are two separate documents. A defect can pass QA and still trigger a schedule risk nobody caught. The integration layer between them is the artefact most government IT program offices never formally build.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

On federal IT programs, Project Managers, Risk Managers, and QA leads often operate from separate tools and separate cadences. The risk register is updated monthly; the QA checklist runs per sprint or per milestone. When a quality finding surfaces, it gets resolved against the acceptance criteria, not re-scored against the risk register. The result: a deliverable that passes QA, ships on the contract line item, and silently contributes to schedule slippage or cost variance that only surfaces at the program review. The integration artefact that connects these two disciplines is the risk-gated QA framework. It is the document your DCAA auditor, your DCMA quality assurance representative, and your contracting officer all want to see, and it is the artefact most program offices build reactively rather than by design.

What you walk away with

Design a risk-gated QA framework that connects your QA findings directly to your risk register entries.
Build the audit trail structure that satisfies DCAA and DCMA documentation requirements without duplicating effort.
Write QA gate criteria that function as both delivery checkpoints and risk mitigation records.
Produce the integrated risk-quality artefact your contracting officer and program review board will recognise.
Establish a cadence that keeps risk and quality data in sync across sprint, milestone, and quarterly review cycles.
Identify the three integration failure modes that most commonly surface at program audits and build guards against them.

The 12 modules

Module 1. Why Risk and QA Diverge on Federal Programs

This module maps the structural reasons risk management and quality assurance operate as separate disciplines on most government IT programs. It traces how FAR and DFARS clause requirements create parallel documentation obligations that rarely cross-reference each other, and identifies the three decision points where the divergence causes the most downstream damage: the CDR, the IOC milestone, and the program management review.

Module 2. Anatomy of a Risk-Gated QA Framework

This module describes the four components of an integrated risk-quality artefact: the risk-scored acceptance criteria matrix, the defect-to-risk escalation trigger table, the gate decision record, and the audit trail log. Each component is defined by what it contains, who owns it, when it is updated, and what it produces for the contracting officer or DCMA quality assurance representative at program review.

Module 3. Writing Risk-Scored Acceptance Criteria

Standard QA acceptance criteria answer the question: does this deliverable meet spec? Risk-scored acceptance criteria add a second question: does this deliverable meet spec at the risk threshold the program can absorb? This module walks through the scoring method, the threshold table calibrated to program risk category (low, moderate, high, critical), and the language that makes the criteria legible to both a QA reviewer and a DCAA auditor.

Module 4. Building the Defect-to-Risk Escalation Trigger

Not every QA defect needs to reach the risk register, and not every risk register entry maps to a QA finding. This module defines the escalation trigger table: the set of defect types, severity levels, and contract line item associations that automatically promote a quality finding to a risk event requiring re-scoring. The module includes the decision logic, the ownership assignment, and the documentation trail the trigger must produce.

Module 5. Gate Decision Records That Survive an Audit

A gate decision record is the formal artefact documenting that a program milestone or deliverable was evaluated against both quality criteria and risk thresholds, and that a named decision-maker authorised the outcome. This module covers the required fields under DCMA MO guidance, the signature and approval chain for programs under DoD 5000.02, and the version control and storage requirements that keep the record retrievable at audit.

Module 6. Aligning QA Cadence to Risk Register Update Cycles

QA often runs per sprint or per CDR while risk registers update monthly or quarterly. When the cycles are out of phase, quality findings aged out of the current sprint never enter the risk register before the next program review. This module designs the synchronisation cadence: the meeting structure, the hand-off protocol between QA lead and risk manager, and the standing agenda item that keeps both artefacts current at every reporting boundary.

Module 7. DCAA and DCMA Documentation Requirements

DCAA auditors focus on cost and labour documentation; DCMA quality assurance representatives focus on technical and schedule compliance. Both want to see that risk and quality data are integrated, traceable, and tied to contract deliverables. This module maps the specific documentation requests both agencies generate on IT programs, identifies where an integrated risk-quality artefact satisfies both, and flags the gaps most programs leave open.

Module 8. Writing the Integrated Risk-Quality Section of the Program Management Plan

The Program Management Plan is the primary contractual document describing how quality and risk will be managed. Most PMPs describe them in separate sections that do not cross-reference. This module rewrites the integration section: the language that explains the risk-gated QA framework to the contracting officer, the metrics that will be reported, and the escalation path that connects a QA finding to a contract-level risk event.

Module 9. Handling Quality Findings That Exceed Risk Thresholds

When a QA finding is escalated and re-scored against the risk register, the program may discover it is operating above its approved risk threshold. This module covers the decision tree: what triggers a formal risk response plan, how to present the finding to the program review board, what the contracting officer expects in the notification, and how to document the resolution in a way that closes the audit trail.

Module 10. Metrics and Reporting for Risk-Quality Integration

An integrated risk-quality framework produces data that neither a standalone QA report nor a standalone risk register can generate alone: defect-to-risk escalation rate, gate pass rate by risk category, time between QA finding and risk register update, and resolution rate before the next program milestone. This module defines the six metrics most useful for program review briefings, the data sources, the reporting frequency, and the format that reads clearly to a non-technical program executive.

Module 11. Standing Up the Framework on an In-Flight Program

Most practitioners encounter this problem mid-program, not at contract award. This module covers the retrofit path: how to back-populate the defect-to-risk trigger table from the existing risk register, how to resurface historical QA findings that should have been escalated, how to negotiate the framework adoption with a contracting officer who did not see it in the original PMP, and how to establish the new cadence without disrupting the current sprint or milestone schedule.

Module 12. The Audit-Ready Package: What to Have Ready Before the Walk

When DCMA schedules a surveillance visit or DCAA requests a documentation package, the integrated risk-quality framework should produce a single retrievable artefact set: the risk-scored acceptance criteria, the gate decision records, the defect-to-risk escalation log, and the PMP integration section. This module defines the package structure, the index format auditors prefer, the version control naming convention, and the three questions the audit lead will ask that most program offices are not prepared to answer.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

You own the risk register but the QA team is on a separate reporting line. Modules 1, 3, and 6 give you the integration artefact and the cadence to bridge that gap without a reorganisation.

Your DCMA QAR is asking for evidence of quality-risk linkage that you do not currently have documented. Modules 5, 7, and 8 produce the specific artefacts and PMP language that answer that request.

A defect just surfaced at the CDR that should have been in the risk register three sprints ago. Modules 4, 9, and 11 walk through the escalation handling and the retrofit path on an in-flight program.

You are preparing for a program review where the executive sponsor will ask why a deliverable that passed QA is still showing schedule risk. Module 10 gives you the metrics and the reporting format to answer that question before it is asked.

What you get with this course

Twelve written modules covering risk-quality integration from framework design through audit-ready documentation.
Downloadable templates: risk-scored acceptance criteria matrix, defect-to-risk escalation trigger table, gate decision record, integrated PMP section language, and audit package index.
Worked examples drawn from CDR, IOC, and program review scenarios on federal IT programs.
The hand-built implementation playbook: a step-by-step guide to standing up the risk-gated QA framework on your specific program, including the retrofit path for in-flight programs.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.

Before and after

Before

Risk register and QA checklist are separate documents on separate update cycles. A deliverable can pass QA and still carry unscored risk into the program review. The DCMA QAR asks for quality-risk linkage you cannot produce on short notice.

After

A designed integration artefact connects every QA gate to the risk register. Escalation triggers are documented and owned. Gate decision records survive an audit. The program review briefing includes metrics that show the two disciplines working as one.

What happens if you do not address this

Without a formal integration artefact, every program review carries the risk of a DCMA finding or a DCAA documentation gap. Quality findings that are not re-scored as risks accumulate silently until they surface as cost or schedule variance at a milestone the program cannot absorb. The artefact is not optional on mature federal IT programs; it is the difference between a surveillance visit that closes in a day and one that opens a corrective action request.

Who it is for

Project, risk, and quality assurance professionals on government IT programs at defense and federal civilian agencies. Typically mid-to-senior practitioners who own one or two of these disciplines and need to align with the others on a shared artefact that satisfies both delivery and audit requirements.

Who this is NOT for. Commercial IT project managers without federal contracting exposure. QA engineers in pure software development roles with no program-level risk accountability. Entry-level practitioners not yet responsible for audit-facing documentation.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Twelve modules at roughly 30-45 minutes each. Most practitioners complete the core integration artefact build across two working sessions.

Why $199 is the right number

PMBOK and CMMI provide frameworks but not the federal-specific integration artefact. DAU courses cover individual disciplines (risk or quality) but not the integration layer. Internal mentors typically have program-specific patterns that do not transfer. This course builds the artefact you take into the next program review.

FAQ

Does this apply to CPFF, FPIF, and FFP contract types?

Yes. The risk-gated QA framework is contract-type agnostic; it adapts to the risk allocation and documentation requirements of each contract vehicle. Modules 3 and 5 note where the threshold calibration and audit trail requirements differ by contract type.

Is this compatible with Agile delivery on federal programs?

Yes. Module 6 specifically addresses the cadence alignment problem on Agile programs where sprint-level QA cycles are out of phase with monthly risk register updates. The framework works within SAFe, DAD, and standalone Scrum adapted for federal use.

Can I use the templates in a program that already has an approved PMP?

Yes. Module 11 covers the retrofit path: how to introduce the integration artefact into an in-flight program without triggering a PMP rebaseline, and how to negotiate the addition with a contracting officer who did not see it at contract award.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.