Guidelines For Risk Management - NASA

3.26Risk MitigationRisk mitigation is action taken to reduce the severity of a risk by reducingthe likelihood of its occurrence, and/or minimizing the consequences ofoccurrence.3.27Risk Mitigation PlanA Risk Mitigation Plan is a document that captures the actions to be takento reduce the likelihood of risk occurrence. This document is the output ofrisk mitigation planning.3.28Risk Mitigation PlanningRisk Mitigation Planning is the process of analyzing a risk to determineactions that may be taken to reduce the likelihood of risk occurrence.3.29Risk OwnerThe “risk owner” is the entity, usually a named individual, designated asthe lead for overseeing the implementation of the agreed disposition ofthat risk.3.30Risk ResearchRisk research is the investigation of an identified risk. Risk researchcontinues until there is enough information to determine if risk ownershipis still properly assigned, and to determine the risk mitigation strategy (i.e.,accept, watch, or mitigate the risk).3.31Risk Review Board (RRB)Risk Review Boards (RRB) are formally established groups of peopleassigned specifically to review risk information. Their output is twofold: 1)to improve the management of risk in the area being reviews and (2) toserve as an input to decision-making bodies in need of risk information.This generally takes the form of understanding and approving candidaterisks as well as evaluating proposed mitigation plans and approving them.The RRBs are held primarily at the functional organization level (Officelevel) and at the Office of the Director Level (Program Level providinginformation to the functional organization leader and ProgramManagement.Guidelines for Risk Management, S3001, Version FEffective Date: 12/17/20148 of 40

3.32Risk StakeholderA risk stakeholder is a person, group, or organization that is affected by arisk or a risk mitigation strategy.3.33Risk StatementA risk statement is a single descriptive statement that defines the risk’scurrent or possible condition and undesired consequence. The riskstatement is generally written in a format of “Given that [CONDITION],there is a possibility of [DEPARTURE] adversely impacting [ASSET],thereby leading to [CONSEQUENCE].”A CONDITION is a single phrase that describes the current key fact-basedsituation or environment that is causing concern, doubt, anxiety oruneasiness.A DEPARTURE describes a possible change from the (program, project,or activity) baseline project plan. It is an undesired event that is madecredible or more likely as a result of the condition.The ASSET is an element of the functional organization portfolio(analogous to a WBS). It represents the primary resource that is affectedby the individual risk.The CONSEQUENCE is a single phrase that describes the foreseeable,credible negative impact(s) on the organizational unit’s ability to meet itsperformance requirements.The Risk Statement is not equivalent to the solution. The Risk Statementis written in matter-of-fact, straightforward language, avoiding theexcessive use of technical terms or jargon.3.34Risk TrackingRisk tracking is the capturing, compiling, and reporting of risk attributesand metrics that determine whether or not risks are being mitigatedeffectively, and whether Risk Mitigation Plans are implemented correctly.3.35Sensitive RisksSensitive risks are risks that contain information requiring restricted orlimited access, such as SBU, supervisory, legislative, or procurementsensitive information.Guidelines for Risk Management, S3001, Version FEffective Date: 12/17/20149 of 40

MRMSRMTRRBSPSRRSSOWBSEstimated Completion DateEnterprise Content ManagementFiscal YearNASA IV&V Management SystemIV&V OfficeNASA Online Directives Information SystemNASA Procedural RequirementsOccupational Safety and Health AdministrationPreliminary Design ReviewProgram Financial ManagementProject LeadProject ManagerQuality ManualRisk Management SystemRiskManager ToolRisk Review BoardSpecial PublicationSystem Requirements ReviewSMA Support OfficeWork Breakdown ScheduleGuidelines for Risk Management, S3001, Version FEffective Date: 12/17/201410 of 40

4.0ProcedureThis section provides additional guidance on how to create and process IV&VProgram risks from developing a strategy to documenting and communicatingthose risks.All risks and associated information resulting from the execution of this riskprocess shall be captured in the RMT and/or Enterprise Content Management(ECM) System. In this document, references made to a “risk database” indicatethese repositories.4.1Develop StrategyThe first step in any risk management effort is to define the approach forrisk management. The designated program/project/activity manager/lead(hereafter referred to as the PM) for any effort shall determine theapproach needed to manage risk on projects assigned to them.The approaches may vary depending upon the size of the project. Largecomplex projects may need a documented plan detailing the approach toperforming risk management as well as defined interactions with theproject’s governing Risk Review Board. Smaller projects may only need asimple process by which they identify any risks, document them, and takethem before the governing Risk Review Board.For IV&V projects, there is also a need to define a strategy for dealing withexternal risks discovered through the course of performing IV&V analysis.So, all IV&V projects may have both an internal and external risk strategydefined.The basic risk management strategy is intended to identify both technicaland non-technical critical areas and risk events, and take necessaryactions to handle them before they can become problems and causeserious safety, cost, schedule, or performance consequences. PMs canextensively use typical risk sources/risk drivers to handle new riskspopulated throughout the project’s lifecycle.The PM needs to ensure that they have defined performance goals ormeasures for their project in order to adequately plan their risk strategy.The performance measure should be created with input from thefunctional organization under which the project falls.The basic strategy that is developed should include the identification,analysis, planning, tracking and control of risk associated with that project.Guidelines for Risk Management, S3001, Version FEffective Date: 12/17/201411 of 40

Risk information will be a part of all program/project/activity reviews. ThePM will conduct additional reviews periodically to update current riskstatus and to ascertain if new risks exist. The goal is to continuously lookfor future risks in areas that may impact individual project/activities as wellas the NASA IV&V Program.Everyone has some responsibility for risk management. However, there isan overall structure to the responsibility that starts with the IV&V ProgramDirector and flows down to the functional organizations and the projects.4.2Identify RisksThe first step in the risk management process is the identification of risks.Risks can be identified using a number of processes. This document doesnot define how any specific risk identification process is to be performed,as different types of projects may require different approaches; however,some of the more common approaches are listed in the following table:FormalInformalSystem safety assessments – fault Brainstormingtree analysis, hazard analysis,failure modes and effects analysisQuantitative risk assessmentsTest and verificationSystem and software engineeringPause and learn sessionsProgram planning and control –Experience – previous analysis,cost and schedule risk analysislessons learned, historical dataModels and simulationsTable 4-1 - Risk Identification MethodsRisk identification depends heavily on both open communication and aforward-looking perspective.This encourages all personnel tocommunicate new risks and to plan beyond their immediate problems.Although individual contributions play a role in risk management,teamwork improves the chances of identifying new risks by allowing allpersonnel to combine their knowledge and understanding of the project.Risk identification shall begin as early as possible and continue throughoutthe project lifecycle, including ad hoc risk identification, as well asidentification approaches captured in the Project’s risk managementstrategy (see Section 4.1, Develop Strategy).Guidelines for Risk Management, S3001, Version FEffective Date: 12/17/201412 of 40

4.2.1 Risk DocumentationThe PM (or designee) shall document each risk identified to includea title, risk statement, context statement (descriptive narrativewhich captures the context of the risk by describing thecircumstances, contributing factors, uncertainty, range of possibleconsequences and related issues), and closure criteria. This isperformed for both internal and external risks1.The RiskManager Tool (RMT) is a web based automated tool tofacilitate documenting risk status of IV&V Program. The RMT is acontrolling function of the risk management process to document,communicate, track, and manage risks that can be accessed by theIV&V Program Portal (http://portal.ivv.nasa.gov/).4.2.1.1TitleThe title should be written to gain attention and focuson the appropriate audience. It should answer thequestion “So what?”4.2.1.2Risk StatementThe risk statement should be written in acondition/consequence format. The following is theexpected format for a risk statement:“Given that [CONDITION], there is a possibility of[DEPARTURE] adversely impacting [ASSET], therebyleading to [CONSEQUENCE].”2It is the job of the risk identifier, working as neededwith risk management personnel, to develop theverbiage for the CONDITION, DEPARTURE, ASSET,1External risks are risks generated as a result of IV&V analysis performed on development projects. They are risksthat affect the developer of the project and not risks that affect the ability of the IV&V project to meet itsperformance requirements.2The format provided here is specified in the NASA Risk Management Handbook, NASA/SP-2011-3422,Version 1.0 (Nov 2011) and is intended to provide consistency in the risks statements; clarify whichfunctional organization is responsible for the risk; as well as, provide a better understanding of the eventthat must occur for the CONSEQUENCE to result. The CONSEQUENCE is the inability to meet aperformance requirement. Other formats for risk statements may be accepted, but they need to clearlyestablish the functional organization responsible for the risks as well as the event that will cause theCONSEQUENCE.Guidelines for Risk Management, S3001, Version FEffective Date: 12/17/201413 of 40

and CONSEQUENCEstatement.componentsoftherisk CONDITION – The CONDITION is a singlephrase that describes the current key factbased situation or environment that is causingconcern, doubt, anxiety, or uneasiness. Thefact-based aspect of the CONDITION helps toground the individual risk in reality, in order toprevent the risk database from becoming arepository for purely speculative concerns. TheCONDITION represents evidence in support ofthe concern that can be independentlyevaluated by risk management personnel andwhich may be of value in determining anappropriate risk management response duringthe Plan step. DEPARTURE – The DEPARTURE describes apossible change from the baseline project plan.It is an undesired event that is made credibleor more likely as a result of the CONDITION.Unlike the CONDITION, the DEPARTURE is astatement about what might occur at a futuretime. It is the uncertainty in the occurrence ornon-occurrence of the DEPARTURE that is theinitially identified source of risk. ASSET – The ASSET is an element of theorganizational office (this is usually a specificproject or a specific portion of a project andmay be seen as similar to a portion of a WBS).It represents the primary resource that isaffected by the individual risk. CONSEQUENCE – The CONSEQUENCE is asingle phrase that describes the foreseeable,credible negative impact(s) on the functionalorganization’s ability to meet its performancerequirements. It should describe the impact(s)in terms of failure to meet requirements thatcanbemeasured,described,andcharacterized.It is important to keep in mind that risk statementsneed to be crafted without regard to potentialGuidelines for Risk Management, S3001, Version FEffective Date: 12/17/201414 of 40

mitigations or other risk responses that may suggestthemselves to the risk identifier. The risk statementshould not be equivalent to the solution and shouldnot be written to provide a solution.The riskstatement should not presume anything that is not inthe current baseline project plan other than theCONDITION, which has its basis in fact.An example of an incorrect risk statement is, “If we donot get more funding, then the project will not be ableto complete the analysis.”This risk statementincorrectly implies that the only possible resolution isextra funding. The risk statement should be written inmatter-of-fact, straightforward language. Excessiveuse of technical terms or jargon should be avoided.4.2.1.3Context StatementThe risk statement provides a concise description ofthe risk, however, this is usually not sufficient tocapture all the information that the risk identifier hasto convey nor carry enough information for others tounderstand and respond to the risk effectively. Thecontextstatement providesthebackgroundinformation so that the risk can stand on its own andbe understood by someone not otherwise familiar withthe risk. The context statement is format free and caninclude: Key circumstances surrounding the risk Contributing factors Uncertainties The range of possible consequences Related information such as what, where,when, how and whyThe context statement should include only facts, notassumptions.Ensure that no new risks areintroduced here. The author should cite relatedrequirements and objectives that may be affected ifthe risk is realized. A well-written context statementserves as the starting point for the development of aRisk Mitigation Plan. In fact, the risk identifier cansuggest or recommend potential mitigations or otherrisk responses that she/he feels is most appropriate.Guidelines for Risk Management, S3001, Version FEffective Date: 12/17/201415 of 40

The risk identifier is usually someone with significantsubject matter expertise in the affected asset and it isimportant to capture that expertise not onlyconcerning the nature of the possible consequencebut also its remedy. When a risk response isrecommended, the risk identifier should also recordthe rationale for the recommendation, preferablyincluding an assessment of the expected risk shifting(for example from a safety risk to a cost risk) thatwould result.There may be times when a development project riskgenerates an IV&V Project risk. In these instances, itis beneficial to note the development project’s risk inthe context statement.4.2.1.4Closure CriteriaThe closure criteria should document how the risk canbe eliminated, or how the likelihood of the risk can bereduced to an acceptable level. The closure criteriashould be specific and measurable, and should statehow the risk can be closed or eliminated. Riskclosure is the goal of risk mitigation, and is the laststep in the Risk Mitigation Plan.4.3Analyze RiskIt is important to the success of the risk management program that everyindividual risk receives the appropriate level of analysis needed toincorporate it into the overall risk perspective for the program, project oractivity.The PM and/or risk owner shall analyze and prioritize identified risks. Thisis accomplished by comparing the likelihood of occurrence, consequence,impact time frame (sunrise and sunset dates), and impact horizon (impacttime frame in relation to the current date (Near, Mid, and Long term)).The likelihood can be determined in a quantitative or qualitative manner.In either case, the results of the analysis are used in conjunction withTable 4-2 Risk Likelihood Criteria, to assign a likelihood score from 1 to 5.Guidelines for Risk Management, S3001, Version FEffective Date: 12/17/201416 of 40

LikelihoodScoreLikelihood of Occurrence (p)5Near certaintyp 80%4Highly Likely60% p 80%3Likely40% p 60%2Low likelihood20% p 40%1Not likelyp 20%Table 4-2 - Risk Likelihood CriteriaThe consequence score is determined by assessing the consequence ofthe risk and assigning a consequence score from 1 to 5 based on thecriteria in Table 4-3, Risk Consequence Criteria. Risks must be analyzedand scored on each separate consequence heduleCost2345Minimalconsequence toobjectives/goalsMinorconsequence toobjectives/goalsUnable to achieve aparticular objective/goal, but remainingobjective goalsrepresent betterthan minimumsuccess or outcomeUnable to achievemultiple objectives/goals but minimumsuccess can still beachieved or claimedUnable to achieveobjectives/goalssuch that minimumsuccess cannot beachieved or claimedDiscomfort ornuisanceFirst aid event perOSHA criteriaMinorconsequence:asset hascosmetic damageand is repairableCritical path is notslipped; totalslack of slippedtasks will notimpact criticalpath in less than10 daysMinor costconsequence.Cost variance 5% of totalapproved FYbaselineLost time injury orillness per OSHAcriteriaMajor consequenceasset issubstantiallydamaged butrepairableCritical path slipsLoss of lifeMinimalconsequence:asset has nosign of physicaldamageMinimalconsequenceNo lost time injuryor illness per OSHAcriteriaMinorconsequence: assetis damaged butrepairableCost consequence.Cost variance 10%but 15% of totalapproved FYbaselineMajor costconsequence.Cost variance 15%of total approved FYbaselineMinimalconsequenceCritical path is notslipped; total slackof slipped tasks iswithin 10 days ofimpacting thecritical pathCost consequence.Cost variance 5%but 10% of totalapproved FYbaselineDestroyed: asset iscompromised, andun-repairable: atotal lossCritical path slipsand one or morecritical milestonesor events cannot bemetTable 4-3 - Risk Consequence CriteriaThe highest score from these four consequence categories is then usedas the final consequence score. For instance, a risk with a likelihoodscore of 3 that has safety consequence score of 2, a performanceconsequence score of 3, a schedule consequence score of 4, and a costGuidelines for Risk Management, S3001, Version FEffective Date: 12/17/201417 of 40

consequence score of 3 would be considered a “3x4” risk (the likelihoodscore is 3, and the schedule consequence score is 4, which is the highestconsequence score). If one of the consequence categories is notapplicable, that consequence score is 0 (i.e., if a risk has no consequencefor safety, the safety consequence score should be 0).In addition to likelihood and consequence scores, the impact time frameand impact horizon are determined. The impact time frame con

Guidelines for Risk Management, S3001, Version F Effective Date: 12/17/2014 6 of 40 3.15 Risk Assessment Risk assessment is the qualitative and/or quantitative evaluation of the likelihood and consequence of a risk occurring. 3.16 Risk Attribute Risk attribut