Valuing Rigor in the Risk Management Process

NASA, as an organization, takes risk management (RM) seriously, and for most projects, the risk management process is exemplar. There can be challenges, though, with defining RM processes. For example, many different risk analysis methodologies are available, they can be applied with varying degrees of rigor, and they can have different value depending on how projects use them. In particular, risk analysis methodologies vary considerably in the level of quantitative detail, with more probabilistic techniques encouraged in some situations. We discussed these processes and methodologies with ten project managers (PM) at the NASA Goddard Space Flight Center (GSFC). Our intent was not to prove with some level of statistical significance that some are more helpful than others, but rather to obtain a general understanding of how projects are identifying, and thinking, about risks. This paper describes some of the available risk processes and methodologies, and provides some insights about the benefits that can gained from their use. We provide an in-depth discussion of one quantitative methodology, Probabilistic Risk Assessments (PRAs), and conclude with a few insights from observed best practices.