# Presentation: 702121

## Risk Assessment & Risk Management at GSFC

- Ted Hammer
- NASA GSFC
- (301) 286-7123
- thammer@pop300.gsfc.nasa.gov
- and
- Michael Bay
- MAP System Engineer
- (301) 286-9759
- mbay@pop700.gsfc.nasa.gov

## Agenda

**   ****Questions on the Table**
**  ****Objective**
**  ****Genesis of Requirements**
**  ****Risk Management**
**  ****Risk Assessment**
**  ****Framework**
**  ****Aids to Application  **
**  ****Conclusion**

## Questions on the Table

-  What is the purpose of Risk Management and Risk Assessment?
-  Drivers - where did the requirements for Risk Management and Risk Assessment come from?
-  What does Risk Management and Risk Assessment mean to projects underway and to projects just starting out?
-  Are Risk Management and Risk Assessment conducted in-house or contracted out?

## Objective

- The overall objective of Risk Management and Risk Assessment is to apply some formality to performing risk assessment, understanding the risks, and managing the risks by making appropriate decisions based on the information available.  NASA HQ has emphasized use of FMEA, FTA & PRA to use in support of the formalized process.

## Genesis of Requirements

-   Risk Management - NPG 7120.5A, NASA Program and Project Management Processes and Requirements (Section 4.2)
- -  Risk Management Plan; NPG 7120.5A (Section 4.2.1 and 4.2.2)
- -  A system for documenting and tracking of risk decisions (Section 4.2.2.c(6))
-   Risk Management Guidelines - NPG 8705.x Risk Management Procedures and Guidelines (in review)
-  Risk Assessment (RA) - use of formal risk assessment tools/techniques addressed in Administrators message of 6/00; Red Team review criteria addresses the use of formal risk assessment; use of formal RA tools/techniques addressed in NASA Systems Engineering Handbook, SP-6105, June 1995.

**Notes:**
Risk management appears in all of these current and future standards and policy.  The common message across them is that projects should perform risk management, but these standards and policies do not prescribe how to do risk management.

While this course is based on the Continuous Risk Management Guidebook, the material in this course satisfies NASA Procedures and Guidelines (NPG) 7120.

In the Appendix is a translation guide that serves as a cross-reference between the Guidebook  terminology and the terminology proposed in NPG 7120.

PM’s often don’t have the resources needed during a project.  Risk Management is one way to save money in the long run.

## Risk Management

- Continuous Risk Management (CRM) is a ***structured*** management
- practice with processes, methods, and tools for managing risks in support of  project’s or program’s goals.
- CRM provides a disciplined environment for proactive decision
- making to:
-  assess *continually* what could go wrong (risks)
-  determine which risks are most important to deal with
-  implement strategies to deal with those risks
-  measure and assure effectiveness of the implemented strategies

## Risk Assessment

- Supports the overall Continuous Risk Management process by
- providing information (qualitative, quantitative, or a combination)
- to decision makers.  This function can be performed in-house or
- contracted outside of the project. If it is contracted out, the project
- still needs to have enough expertise to fully understand the in put and output of the risk assessments in order to make well-informed decisions. Risk Assessment methods and tools blend into the CRM process in the activities of _*Identification*_ and _*Analysis*_ and can be either qualitative or quantitative.

- RA Information

- RA Information

## Framework

**Formulation**
- -  Develop Risk Management Plan
- -  Perform risk assessment during systems analysis subprocess
- -  Establish an initial set of risks (simplest technique is brainstorming)
- -  RM plan and risk profile evaluated and baselined in evaluation subprocess
**Implementation**
- -  Implement risk management process defined in the plan
- -  Implement risk tracking system
- -  Use risk management continuously to control and mitigate risks
- -  Use risk assessment to identify and analyze risks

## Aids to Application

- Support provided by Code 302:
-   Continuous Risk Management (CRM):
- -  Training: 2 day, and focused training 1 day and 1/2 day
- -  Consultation on Risk Management database tools
- -  Risk Management Plan samples and templates
- -  Review of program/project RM Plans
-   Risk Assessment Methods and Tools; can perform analysis or    review output from analysis; or consultation on:
- -  FMEA, Fault Tree Analysis, Probabilistic Risk Assessment
- -  Tools: SHAPHIRE and RELEX (Receive/coordinate training)
-   CRM web site: http://satc.gsfc.nasa.gov/crm/

## Conclusion

**Conclusion**

-   Risk management and use of formal risk assessment techniques is now a *required* part of all Goddard projects.
-   Risk management requires proactive forecasting of uncertainties vice reactive management of problems.

-   Early identification and analysis of potential problems, through the
- use of disciplined techniques and tools, allows for well-informed project decision making the best use of limited project resources to achieve the highest  probability of mission success.

**RISK**