NASA Systems Engineering Handbook

6.4 Technical Risk Management
Te Technical Risk Management Process is one of the
crosscutting technical management processes. Risk is defned
as the combination of (1) the probability that a program
or project will experience an undesired event and
(2) the consequences, impact, or severity of the undesired
event, were it to occur. Te undesired event might
come from technical or programmatic sources (e.g., a
cost overrun, schedule slippage, safety mishap, health
problem, malicious activities, environmental impact,
Key Concepts in Technical Risk Management
or failure to achieve a needed scientifc or technological
objective or success criterion). Both the probability
and consequences may have associated uncertainties.
Technical risk management is an organized, systematic
risk-informed decisionmaking discipline that proactively
identifes, analyzes, plans, tracks, controls, communicates,
documents, and manages risk to increase
the likelihood of achieving project goals. Te Technical
Risk Management Process focuses on project objectives,
Risk: Risk is a measure of the inability to achieve overall program objectives within defned cost, schedule, and technical
constraints and has two components: (1) the probability of failing to achieve a particular outcome and (2) the
consequences/impacts of failing to achieve that outcome.
Cost Risk: This is the risk associated with the ability of the program/project to achieve its life-cycle cost objectives and
secure appropriate funding. Two risk areas bearing on cost are (1) the risk that the cost estimates and objectives are
not accurate and reasonable and (2) the risk that program execution will not meet the cost objectives as a result of a
failure to handle cost, schedule, and performance risks.
Schedule Risk: Schedule risks are those associated with the adequacy of the time estimated and allocated for the development,
production, implementation, and operation of the system. Two risk areas bearing on schedule risk are (1)
the risk that the schedule estimates and objectives are not realistic and reasonable and (2) the risk that program execution
will fall short of the schedule objectives as a result of failure to handle cost, schedule, or performance risks.
Technical Risk: This is the risk associated with the evolution of the design and the production of the system of interest
afecting the level of performance necessary to meet the stakeholder expectations and technical requirements.
The design, test, and production processes (process risk) infuence the technical risk and the nature of the product as
depicted in the various levels of the PBS (product risk).
Programmatic Risk: This is the risk associated with action or inaction from outside the project, over which the project
manager has no control, but which may have signifcant impact on the project. These impacts may manifest
themselves in terms of technical, cost, and/or schedule. This includes such activities as: International Trafc in Arms
Requirements (ITAR), import/export control, partner agreements with other domestic or foreign organizations, congressional
direction or earmarks, Ofce of Management and Budget direction, industrial contractor restructuring, external
organizational changes, etc.
Hazard Versus Risk: Hazard is distinguished from risk. A hazard represents a potential for harm, while risk includes consideration
of not only the potential for harm, but also the scenarios leading to adverse outcomes and the likelihood of
these outcomes. In the context of safety, “risk” considers the likelihood of undesired consequences occurring.
Probabilistic Risk Assessment (PRA): PRA is a scenario-based risk assessment technique that quantifes the likelihoods
of various possible undesired scenarios and their consequences, as well as the uncertainties in the likelihoods
and consequences. Traditionally, design organizations have relied on surrogate criteria such as system redundancy
or system-level reliability measures, partly because the difculties of directly quantifying actual safety impacts, as opposed
to simpler surrogates, seemed insurmountable. Depending on the detailed formulation of the objectives hierarchy,
PRA can be applied to quantify Technical Performance Measures (TPMs) that are very closely related to fundamental
objectives (e.g., Probability of Loss of Crew (P(LOC))). PRA focuses on the development of a comprehensive
scenario set, which has immediate application to identify key and candidate contributors to risk. In all but the simplest
systems, this requires the use of models to capture the important scenarios, to assess consequences, and to systematically
quantify scenario likelihoods. These models include reliability models, system safety models, simulation models,
performance models, and logic models.
NASA Systems Engineering Handbook 139