Risk Assessment & Risk Management at GSFC

1. Control Identify Communicate & Document Track Analyze Plan Risk Assessment & Risk Management at GSFC Ted Hammer NASA GSFC (301) 286-7123 thammer@pop300.gsfc.nasa.gov and Michael Bay MAP System Engineer (301) 286-9759 mbay@pop700.gsfc.nasa.gov

2. Agenda • Questions on the Table • Objective • Genesis of Requirements • Risk Management • Risk Assessment • Framework • Aids to Application • Conclusion

3. Questions on the Table • What is the purpose of Risk Management and Risk Assessment? • Drivers - where did the requirements for Risk Management and Risk Assessment come from? • What does Risk Management and Risk Assessment mean to projects underway and to projects just starting out? • Are Risk Management and Risk Assessment conducted in-house or contracted out?

4. Objective The overall objective of Risk Management and Risk Assessment is to apply some formality to performing risk assessment, understanding the risks, and managing the risks by making appropriate decisions based on the information available.NASA HQ has emphasized use of FMEA, FTA & PRA to use in support of the formalized process.

5. Genesis of Requirements • Risk Management - NPG 7120.5A, NASA Program and Project Management Processes and Requirements (Section 4.2) • - Risk Management Plan; NPG 7120.5A (Section 4.2.1 and 4.2.2) • - A system for documenting and tracking of risk decisions (Section 4.2.2.c(6)) • Risk Management Guidelines - NPG 8705.x Risk Management Procedures and Guidelines (in review) • Risk Assessment (RA) - use of formal risk assessment tools/techniques addressed in Administrators message of 6/00; Red Team review criteria addresses the use of formal risk assessment; use of formal RA tools/techniques addressed in NASA Systems Engineering Handbook, SP-6105, June 1995.

6. Risk Management • Continuous Risk Management (CRM) is a structured management • practice with processes, methods, and tools for managing risks in support of project’s or program’s goals. • CRM provides a disciplined environment for proactive decision • making to: • assess continually what could go wrong (risks) • determine which risks are most important to deal with • implement strategies to deal with those risks • measure and assure effectiveness of the implemented strategies

7. Risk Assessment Supports the overall Continuous Risk Management process by providing information (qualitative, quantitative, or a combination) to decision makers. This function can be performed in-house or contracted outside of the project. If it is contracted out, the project still needs to have enough expertise to fully understand the in put and output of the risk assessments in order to make well-informed decisions. Risk Assessment methods and tools blend into the CRM process in the activities of Identification and Analysisand can be either qualitative or quantitative. RA Information RA Information

8. Framework • Formulation - Develop Risk Management Plan - Perform risk assessment during systems analysis subprocess - Establish an initial set of risks (simplest technique is brainstorming) - RM plan and risk profile evaluated and baselined in evaluation subprocess • Implementation - Implement risk management process defined in the plan - Implement risk tracking system - Use risk management continuously to control and mitigate risks - Use risk assessment to identify and analyze risks

9. Aids to Application • Support provided by Code 302: • Continuous Risk Management (CRM): • - Training: 2 day, and focused training 1 day and 1/2 day • - Consultation on Risk Management database tools • - Risk Management Plan samples and templates • - Review of program/project RM Plans • Risk Assessment Methods and Tools; can perform analysis or review output from analysis; or consultation on: • - FMEA, Fault Tree Analysis, Probabilistic Risk Assessment • - Tools: SHAPHIRE and RELEX (Receive/coordinate training) • CRM web site: http://satc.gsfc.nasa.gov/crm/

10. Conclusion • Risk management and use of formal risk assessment techniques is now a required part of all Goddard projects. • Risk management requires proactive forecasting of uncertainties vice reactive management of problems. RISK • Early identification and analysis of potential problems, through the • use of disciplined techniques and tools, allows for well-informed project decision making the best use of limited project resources to achieve the highest probability of mission success.