ECSS-M-ST-80C 31 July 2008 Space project management Risk management ECSS Secretariat ESA-ESTEC Requirements & Standards Division Noordwijk, The Netherlands ECSS‐M‐ST‐80C 31July2008 Foreword This Standard is one of the series of ECSS Standards intended to be applied together for the management, engineering and product assurance in space projects and applications. ECSS is a cooperative effort of the European Space Agency, national space agencies and European industry associationsforthepurposeofdevelopingandmaintainingcommonstandards.Requirementsinthis Standardaredefinedintermsofwhatshallbeaccomplished,ratherthanintermsofhowtoorganize and perform the necessary work. This allows existing organizational structures and methods to be appliedwhere they are effective, andforthe structures and methodsto evolve asnecessarywithout rewritingthestandards. This Standard has been prepared by the ECSS‐M‐ST‐80 Working Group, reviewed by the ECSS ExecutiveSecretariatandapprovedbytheECSSTechnicalAuthority. Disclaimer ECSSdoesnotprovideanywarrantywhatsoever,whetherexpressed,implied,orstatutory,including, butnotlimitedto,anywarrantyofmerchantabilityorfitnessforaparticularpurposeoranywarranty that the contents of the item are error‐free. In no respect shall ECSS incur any liability for any damages,including,butnotlimitedto, direct,indirect,special,orconsequentialdamagesarisingout of, resulting from, or in anyway connected to the use of this Standard, whether or not based upon warranty,business agreement, tort,orotherwise; whetheror not injurywassustained by personsor propertyorotherwise;andwhetherornotlosswassustainedfrom,oraroseoutof,theresultsof,the item,oranyservicesthatmaybeprovidedbyECSS. Publishedby: ESARequirementsandStandardsDivision ESTEC, P.O. Box 299, 2200 AG Noordwijk The Netherlands Copyright: 2008 © by the European Space Agency for the members of ECSS 2 ECSS‐M‐ST‐80C 31July2008 Change log ECSS‐M‐00‐03A 25April2000 Firstissue ECSS‐M‐00‐03B 16August2004 Secondissue ECSS‐M‐ST‐80C Thirdissue 31July2008 MaindifferencesbetweenECSS‐M‐00‐03B(16August2004)andthis versionare: • RenumberingfromECSS‐M‐00‐03toECSS‐M‐ST‐80. • Deletionofthedefinitionsfor:.risk,residualrisk,riskmanagement,risk managementpolicybecauseidenticallydefinedinECSS‐S‐ST‐00‐01 • Update of descriptive text in clause 4.4, 5.1, 5.2.1.2f, 5.2.1.2h, 5.2.2.1, 6.5c, • In clause 7, former text contained in “AIM” converted into notes and former text from “EXPECTED OUTPUT” deleted or converted into requirementswhennormative. 3 ECSS‐M‐ST‐80C 31July2008 Table of contents Change log 3 Introduction 6 1 Scope 7 2 Normative references 8 3 Terms, definitions and abbreviated terms 9 3.1 Terms from other standards 9 3.2 Terms specific to the present standard 9 3.3 Abbreviated terms 10 4 Principles of risk management 11 4.1 Risk management concept 11 4.2 Risk management process 11 4.3 Risk management implementation in a project 11 4.4 Risk management documentation 12 5 The risk management process 13 5.1 Overview of the risk management process 13 5.2 Risk management steps and tasks 15 5.2.1 Step 1: Define risk management implementation requirements 15 5.2.2 Step 2: Identify and assess the risks 18 5.2.3 Step 3: Decide and act 19 5.2.4 Step 4: Monitor, communicate, and accept risks 20 6 Risk management implementation 22 6.1 General considerations 22 6.2 Responsibilities 22 6.3 Project life cycle considerations 23 6.4 Risk visibility and decision making 23 6.5 Documentation of risk management 23 4 ECSS‐M‐ST‐80C 31July2008 7 Risk management requirements 25 7.1 General 25 7.2 Risk management process requirements 25 7.3 Risk management implementation requirements 28 Annex A (normative) Risk management policy document - DRD 30 Annex B (normative) Risk management plan - DRD 33 Annex C (normative) Risk assessment report - DRD 36 Annex D (informative) Risk register example and ranked risk log example 38 Annex E (informative) Contribution of ECSS Standards to the risk management process 41 Bibliography 43 Figures Figure 5-1: The steps and cycles in the risk management process 14 Figure 5-2: The tasks associated with the steps of the risk management process within the risk management cycle 14 Figure 5-3: Example of a severity–of–consequence scoring scheme 15 Figure 5-4: Example of a likelihood scoring scheme 16 Figure 5-5: Example of risk index and magnitude scheme 17 Figure 5-6: Example of risk magnitude designations and proposed actions for individual risks 17 Figure 5-7: Example of a risk trend 21 5 ECSS‐M‐ST‐80C 31July2008 Introduction Risks are a threat to project success because they have negative effects on the project cost, schedule and technical performance, but appropriate practices of controllingriskscanalsopresentnewopportunitieswithpositiveimpact. The objective of project risk management is to identify, assess,reduce, accept, and control space project risks in a systematic, proactive, comprehensive and cost effective manner, taking into account the project’s technical and programmaticconstraints.Riskisconsideredtradableagainsttheconventional known project resources within the management, programmatic (e.g. cost, schedule)andtechnical(e.g.mass,power, dependability,safety)domains. The overall risk management in a project is an iterative process throughout the project life cycle, with iterations being determined by the project progress throughthedifferentprojectphases,andbychangestoagivenprojectbaseline influencingprojectresources. Risk management is implemented at each level of the customer‐supplier network. Known project practices for dealing with project risks, such as system and engineering analyses, analyses of safety, critical items, dependability, critical path,andcost,areanintegralpartofprojectriskmanagement.Rankingofrisks accordingtotheircriticalityforprojectsuccess,allowingmanagementattention tobedirectedtotheessentialissues,isamajorobjectiveofriskmanagement. The project actors agree on the extent of the risk management to be implemented in a given project depending on the project definition and characterization. 6 ECSS‐M‐ST‐80C 31July2008 1 Scope This Standard defines the principles and requirements for integrated risk management on a space project; it explains what is needed to implement a project–integratedriskmanagementpolicybyanyprojectactor,atanylevel(i.e. customer,firstlevelsupplier,orlowerlevelsuppliers). This Standard contains a summary of the general risk management process, whichissubdividedintofour(4)basicstepsandnine(9)tasks. Theriskmanagementprocessrequiresinformationexchangeamongallproject domains, and provides visibility overrisks, with a ranking according to their criticalityfortheproject;theserisksaremonitoredandcontrolledaccordingto therulesdefinedforthedomainstowhichtheybelong. The fields of application of this Standard are all the activities of all the space projectphases.AdefinitionofprojectphasingisgiveninECSS‐M‐ST‐10. Thisstandardmaybetailoredforthespecificcharacteristicsandconstraintsofa spaceprojectinconformancewithECSS‐S‐ST‐00. 7 ECSS‐M‐ST‐80C 31July2008 2 Normative references The following normative documents contain provisions which, through reference in this text, constitute provisions of this ECSS Standard. For dated references,subsequentamendmentsto,orrevisionsofanyofthesepublications donotapply.However,partiestoagreementsbasedonthisECSSStandardare encouragedtoinvestigatethepossibilityofapplyingthemostrecenteditionsof the normative documents indicated below. For undated references the latest editionofthepublicationreferredtoapplies. ECSS‐ST‐00‐01 ECSSsystem‐Glossaryofterms ECSS‐M‐ST‐10 Spaceprojectmanagement–Projectplanningand implementation 8 ECSS‐M‐ST‐80C 31July2008 3 Terms, definitions and abbreviated terms 3.1 Terms from other standards ForthepurposeofthisStandard,thetermsanddefinitionsfromECSS‐ST‐00‐01 apply,inparticularforthefollowingterms: risk residualrisk riskmanagement riskmanagementpolicy 3.2 Terms specific to the present standard 3.2.1 acceptance of (risk) decisiontocopewithconsequences,shouldariskscenariomaterialize NOTE1 Ariskcan be acceptedwhen itsmagnitude is less than a given threshold, defined in the risk managementpolicy. NOTE2 Inthecontextofriskmanagement,acceptancecan meanthateventhoughariskisnoteliminated,its existence and magnitude are acknowledged and tolerated. 3.2.2 (risk) communication all information and data necessary for risk management addressed to a decision–makerandtorelevantactorswithintheprojecthierarchy 3.2.3 (risk) index score used to measure the magnitude of the risk; it is a combination of the likelihoodofoccurrenceandtheseverityofconsequence,wherescoresareused tomeasurelikelihoodandseverity 3.2.4 individual (risk) riskidentified,assessed,andmitigatedasadistinctriskitemsinaproject 9 ECSS‐M‐ST‐80C 31July2008 3.2.5 (risk) management process consists of all the project activities related to the identification, assessment, reduction,acceptance,andfeedbackofrisks 3.2.6 overall (risk) risk resulting from the assessment of the combination of individual risks and theirimpactoneachother,inthecontextofthewholeproject NOTE Overall risk can be expressed as a combination of qualitativeandquantitativeassessment. 3.2.7 (risk) reduction implementationofmeasuresthatleadstoreductionofthelikelihoodorseverity ofrisk NOTE Preventive measures aim at eliminating the cause of a problem situation, and mitigation measures aim at preventing the propagation ofthe cause to the consequence or reducing the severity of the consequenceorthelikelihoodoftheoccurrence. 3.2.8 resolved (risk) riskthathasbeenrenderedacceptable 3.2.9 (risk) scenario sequence or combination of events leading from the initial cause to the unwantedconsequence NOTE The cause can be a single event or something activatingadormantproblem. 3.2.10 (risk) trend evolutionofrisksthroughoutthelifecycleofaproject 3.2.11 unresolved (risk) risk for which risk reduction attempts are not feasible, cannot be verified, or haveprovedunsuccessful:ariskremainingunacceptable 3.3 Abbreviated terms Forthepurposeofthisstandard,theabbreviatedtermsofECSS‐S‐ST‐00‐01and thefollowingapply: Abbreviation Meaning IEC InternationalElectrotechnicalCommission 10 [...]... Figure 5‐2: The tasks associated with the steps of the risk management process within the risk management cycle 14 ECSS‐M‐ST‐80C 31 July 2008 5.2 Risk management steps and tasks 5.2.1 Step 1: Define risk management implementation requirements 5.2.1.1 Purpose To initiate the risk management process by defining the project risk management policy and preparing the project risk management plan. 5.2.1.2 Task 1: Define the risk management. .. a The risk management plan shall describe the risk management organization of the project b The risk management plan shall list the responsibilities of each of the risk management participants. 33 ECSS‐M‐ST‐80C 31 July 2008 a Risk management policy The risk management plan shall contain a link to the applicable risk management policy document. a Risk management documentation and follow‐up ... Project goals and resource constraints The risk management policy document shall describe the project objectives and the resource constraints of the project and name the project s critical success factors. Risk management strategy and approach a The risk management policy document shall provide an overview of the risk management approach, to include the status of the risk management ... Figure 5‐5: Example of risk index and magnitude scheme Risk index Risk magnitude Proposed actions E4, E5, D5 Very High risk Unacceptable risk: implement new team process or change baseline – seek project management attention at appropriate high management level as defined in the risk management plan E3, D4, C5 High risk Unacceptable risk: see above. E2, D3, C4, B5 Medium risk Unacceptable risk: aggressively manage, consider alternative ... Risk management documentation and follow‐up The risk management plan shall describe the structure, the rules and the procedures used to document the results of the risk management and the follow‐up process. a Project summary The risk management plan shall contain a brief description of the project, including the project management approach. a Description of risk management implementation The risk management plan ... trend are used to optimize the tradable resources. Within the risk management process, available risk information is produced and structured, facilitating risk communication and management decision making. The results of risk assessment and reduction and the residual risks are communicated to the project team for information and follow‐up. 4.3 Risk management implementation in a project Risk management requires corporate ... follow‐up of risks. Risk management draws on existing documentation as much as possible. Responsibilities The responsibilities for risk management matters within the project organization are described in the risk management plan in accordance with the risk management policy. The following approach applies: a The project manager acts as the integrator of the risk management function ... of the prevailing risk. Risk information is presented to support management decision making, including an alert system for new risks. Information about all identified risks and their disposition is kept in a record. Documentation of risk management a Risk management documents are maintained so that each step of the risk management process and the key risk management results and decisions ... are traceable and defensible. b The risk management process draws on the existing project data to the maximum extent possible, but documentation established specifically for risk management includes information on project specific risk management policy; objectives and scope; the risk management plan; the identified scenarios; likelihood of events; risk results; risk decisions; records of risk reduction and verification actions; risk trend data; and risk ... rationale of all risk related decisions made during the life of the project. The risk management documentation includes the risk management policy, which: • defines the organizationʹs attitude towards risk management, together with the project specific categorization of risk management, and • provides a high‐level outline for the implementation of the risk management process. . of risk management 11 4.1 Risk management concept 11 4.2 Risk management process 11 4.3 Risk management implementation in a project 11 4.4 Risk management. ECSS-M-ST-80C 31 July 2008 Space project management Risk management ECSS Secretariat ESA-ESTEC Requirements & Standards