NASA Procedures and Guidelines
This Document is Obsolete and Is No Longer Used. Check the NODIS Library to access the current version: http://nodis3.gsfc.nasa.gov
NPR 8000.4A Eff. Date: December 16, 2008 Cancellation Date:	Agency Risk Management Procedural Requirements (Revalidated 1/29/14)
| TOC | ChangHistory | Preface | Chapter1 | Chapter2 | Chapter3 | AppendixA | AppendixB | AppendixC | AppendixD | ALL |

Appendix A. Definitions

Aggregate Risk. The cumulative risk associated with a given performance measure, accounting for all significant risk contributors. For example, the total probability of loss of mission is an aggregate risk quantified as the probability of the union of all scenarios leading to loss of mission.

CRM. As discussed in paragraph 1.2.3, a systematic and iterative process that efficiently identifies, analyzes, plans, tracks, controls, and communicates and documents risks associated with implementation of designs, plans, and processes.

Cross-cutting Risk. A risk that is generally applicable to multiple mission execution efforts, with attributes and impacts found in multiple levels of the organization or in multiple organizations within the same level.

Deliberation. In the context of this NPR, the formal or informal process for communication and collective consideration, by stakeholders designated in the Risk Management Plan, of all pertinent information, especially risk information, in order to support the decision maker.

Dispositions (Risk)

a. Accept. The formal process of justifying and documenting a decision not to mitigate a given risk associated with achieving given objectives or given performance requirements. (See also Risk Acceptability Criterion).

b. Close. The determination that a risk is no longer cost-effective to track, because (for example) the associated scenario likelihoods are low (e.g., the underlying condition no longer exists), or the associated consequences are low.

c. Elevate. The process of transferring the decision for the management of an identified source of risk to the risk management structure at a higher organizational level.

Note: Some organizational units within NASA use the term "escalate" to mean "elevate."

d. Mitigate. The modification of a process, system, or activity in order to reduce a risk by reducing its probability, consequence severity, or uncertainty, or by shifting its timeframe.

e. Research. The investigation of a risk in order to acquire sufficient information to support another disposition; i.e., close, watch, mitigate, accept, or elevate.

f. Watch. The monitoring of a risk for early warning of a significant change in its probability, consequences, uncertainty, or timeframe.

Institutional Risks. Risks to infrastructure, information technology, resources, personnel, assets, processes, occupational safety, environmental management, or security that affect capabilities and resources necessary for mission success, including institutional flexibility to respond to changing mission needs and compliance with external requirements (e.g., Environmental Protection Agency or Occupational Safety and Health Administration regulations).

Knowledge Management. Knowledge management is getting the right information to the right people at the right time and helping people create knowledge and share and act upon information in ways that will measurably improve the performance of NASA and its partners.

Likelihood. A measure of the possibility that a scenario will occur that also accounts for the timeframe in which the events represented in the scenario can occur.

Organizational Unit. An organization, such as a program, project, Center, Mission Directorate, or Mission Support Office that is responsible for carrying out a particular activity.

Performance Measure. A metric used to measure the extent to which a system, process, or activity fulfills its intended objectives.

Note: Performance measures should in general relate to observable quantities. For example, engine performance parameters, cost metrics, and schedule are observable quantities. Although safety performance measures can be observed in principle, many of them have to be modeled. Partly because of this, in ranking decision alternatives, one may use a risk metric (e.g., probability of loss of crew) as a surrogate for a performance measure.

Performance Requirement. The value of a performance measure to be achieved by an organizational unit's work that has been agreed-upon to satisfy the needs of the next higher organizational level.

Risk. In the context of mission execution, risk is operationally defined as a set of triplets:

The scenario(s) leading to degraded performance with respect to one or more performance measures (e.g., scenarios leading to injury, fatality, destruction of key assets; scenarios leading to exceedance of mass limits; scenarios leading to cost overruns; scenarios leading to schedule slippage).

The likelihood(s) (qualitative or quantitative) of those scenarios.

The consequence(s) (qualitative or quantitative severity of the performance degradation) that would result if those scenarios were to occur.

Uncertainties are included in the evaluation of likelihoods and consequences.

Risk Acceptability Criterion. A rule for determining whether a given organizational unit has the authority to decide to accept a risk.

Note: This does not mean that all risks satisfying the criterion are accepted, or that a combination of such individual risks is automatically acceptable in the aggregate, but rather that, subject to aggregate risk considerations, the given unit has the authority to decide to accept individual risks satisfying the criterion.

Risk-Informed Decision Making (RIDM). A risk-informed decision-making process uses a diverse set of performance measures (some of which are model-based risk metrics) along with other considerations within a deliberative process to inform decision making.

Note: A decision-making process relying primarily on a narrow set of model-based risk metrics would be considered "risk-based."

Risk Management. Risk management includes RIDM and CRM in an integrated framework. This is done in order to foster proactive risk management, to better inform decision making through better use of risk information, and then to more effectively manage implementation risks by focusing the CRM process on the baseline performance requirements emerging from the RIDM process.

Risk Owner. The "risk owner" is the entity, usually a named individual, designated as the lead for overseeing the implementation of the agreed disposition of that risk.

Risk Review Boards. Formally established groups of people assigned specifically to review risk information. Their output is twofold: (1) to improve the management of risk in the area being reviewed and (2) to serve as an input to decision-making bodies in need of risk information.

Safety. In a risk-informed context, safety is an overall condition that provides sufficient assurance that mishaps will not result from the mission execution or program implementation, or, if they occur, their consequences will be mitigated. This assurance is established by means of the satisfaction of a combination of deterministic criteria and risk-informed criteria.

Note: This NPR uses the term "safety" broadly to include human safety (public and workforce), environmental safety, and asset safety.

Scenario. A sequence of events, such as an account or synopsis of a projected course of action or events.

Threshold. A level for a performance measure or a risk metric whose exceedance "triggers" management processes to rectify performance shortfalls.

Uncertainty. An imperfect state of knowledge or a variability resulting from a variety of factors including, but not limited to, lack of knowledge, applicability of information, physical variation, randomness or stochastic behavior, indeterminacy, judgment, and approximation.

DISTRIBUTION:
NODIS