Risk Assessment & Risk Management at GSFC Ted Hammer NASA GSFC (301) 286-7123 thammer@pop300.gsfc.nasa.gov and Michael Bay MAP System Engineer (301) 286-9759 mbay@pop700.gsfc.nasa.gov Identify Analyze Plan Track Control Communicate & Document 1

Agenda Objective Genesis of Requirements Risk Management Questions on the Table Objective Genesis of Requirements Risk Management Risk Assessment Framework Aids to Application Conclusion

Questions on the Table What is the purpose of Risk Management and Risk Assessment? Drivers - where did the requirements for Risk Management and Risk Assessment come from? What does Risk Management and Risk Assessment mean to projects underway and to projects just starting out? Are Risk Management and Risk Assessment conducted in-house or contracted out?

Objective The overall objective of Risk Management and Risk Assessment is to apply some formality to performing risk assessment, understanding the risks, and managing the risks by making appropriate decisions based on the information available. NASA HQ has emphasized use of FMEA, FTA & PRA to use in support of the formalized process.

Genesis of Requirements Risk Management - NPG 7120.5A, NASA Program and Project Management Processes and Requirements (Section 4.2) - Risk Management Plan; NPG 7120.5A (Section 4.2.1 and 4.2.2) - A system for documenting and tracking of risk decisions (Section 4.2.2.c(6)) Risk Management Guidelines - NPG 8705.x Risk Management Procedures and Guidelines (in review) Risk Assessment (RA) - use of formal risk assessment tools/techniques addressed in Administrators message of 6/00; Red Team review criteria addresses the use of formal risk assessment; use of formal RA tools/techniques addressed in NASA Systems Engineering Handbook, SP-6105, June 1995. Risk management appears in all of these current and future standards and policy. The common message across them is that projects should perform risk management, but these standards and policies do not prescribe how to do risk management. While this course is based on the Continuous Risk Management Guidebook, the material in this course satisfies NASA Procedures and Guidelines (NPG) 7120. In the Appendix is a translation guide that serves as a cross-reference between the Guidebook terminology and the terminology proposed in NPG 7120. PM’s often don’t have the resources needed during a project. Risk Management is one way to save money in the long run.

Risk Management Continuous Risk Management (CRM) is a structured management practice with processes, methods, and tools for managing risks in support of project’s or program’s goals. CRM provides a disciplined environment for proactive decision making to: assess continually what could go wrong (risks) determine which risks are most important to deal with implement strategies to deal with those risks measure and assure effectiveness of the implemented strategies

Risk Assessment Supports the overall Continuous Risk Management process by providing information (qualitative, quantitative, or a combination) to decision makers. This function can be performed in-house or contracted outside of the project. If it is contracted out, the project still needs to have enough expertise to fully understand the in put and output of the risk assessments in order to make well-informed decisions. Risk Assessment methods and tools blend into the CRM process in the activities of Identification and Analysis and can be either qualitative or quantitative. RA Information RA Information

Framework Formulation - Develop Risk Management Plan - Perform risk assessment during systems analysis subprocess - Establish an initial set of risks (simplest technique is brainstorming) - RM plan and risk profile evaluated and baselined in evaluation subprocess Implementation - Implement risk management process defined in the plan - Implement risk tracking system - Use risk management continuously to control and mitigate risks - Use risk assessment to identify and analyze risks

Aids to Application Support provided by Code 302: Continuous Risk Management (CRM): - Training: 2 day, and focused training 1 day and 1/2 day - Consultation on Risk Management database tools - Risk Management Plan samples and templates - Review of program/project RM Plans Risk Assessment Methods and Tools; can perform analysis or review output from analysis; or consultation on: - FMEA, Fault Tree Analysis, Probabilistic Risk Assessment - Tools: SHAPHIRE and RELEX (Receive/coordinate training) CRM web site: http://satc.gsfc.nasa.gov/crm/

Conclusion Risk management and use of formal risk assessment techniques is now a required part of all Goddard projects. Risk management requires proactive forecasting of uncertainties vice reactive management of problems. RISK Early identification and analysis of potential problems, through the use of disciplined techniques and tools, allows for well-informed project decision making the best use of limited project resources to achieve the highest probability of mission success.