This artist's illustration shows the sky crane maneuver that delivered NASA's Curiosity rover to the surface of Mars in 2012, concluding what is known as the “seven minutes of terror”—the nail-biting descent through the thin Martian atmosphere. Credit: NASA
Continuous, integrated risk management process enables NASA to develop missions with complex, state-of-the-art engineering systems designed to achieve ambitious science objectives.
When NASA prepared to land the Curiosity rover on Mars in 2012, engineers faced what they called “seven minutes of terror”—a nail-biting descent through the Martian atmosphere with no chance for real-time corrections from Earth. The landing system, a never-before-tried combination of heat shield, parachute, rockets, and a hovering sky crane, had only been tested on Earth under simulated conditions. There was no backup plan. What made the landing possible wasn’t luck—it was rigorous risk management.
NASA had to identify plausible failure modes, weigh their likelihood and consequences, and decide which risks could be mitigated and which had to be accepted – while also designing in resilience to withstand unknowns that could not be fully predicted or controlled. That process—predicting, preparing, and acting within uncertainty—is the foundation of risk management across every NASA mission.
Why Risk Management Matters to Everyone
Risk management isn’t just for rocket scientists. It’s a fundamental discipline crucial in finance, construction, healthcare, aviation, and public policy. It provides a structured way for leaders and teams to:
- Identify and Evaluate: Pinpoint potential events (risks) that could impact goals.
- Respond: Decide how to handle these risks.
This proactive approach helps balance ambitious objectives with carefully considered uncertainties. For everyone at NASA, understanding risk management means:
- For Engineers and Scientists: Systematically addressing technical challenges, foreseeing potential failure points in designs or experiments, and developing mitigation strategies to ensure mission success (like with Curiosity or the James Webb Space Telescope).
- For Contracting Specialists: Identifying and mitigating risks in procurement, supplier reliability, and contract terms, ensuring that partners can deliver as promised.
- For Financial Personnel: Understanding potential budget impacts, forecasting costs associated with risks, and allocating resources effectively to manage financial exposures.
- For All Project Team Members: Contributing to a shared understanding of challenges, enabling informed decisions, and ensuring project objectives are met safely, on time, and within budget.
- Unknown and underappreciated risks are present in all domains and can escape detection through standard analysis. NASA’s approach to risk management addresses them by encouraging diverse viewpoints, scrutinizing assumptions, and maintaining open, cross-disciplinary communication.
A key part of that process is risk assessment — identifying specific failure scenarios and estimating the likelihood and potential consequences. Once risks are assessed, project leaders and stakeholders evaluate whether those risks are acceptable in the context of mission objectives. If they are not, engineers are tasked with developing mitigation strategies to reduce or eliminate the threat.
With NASA missions, that process can be incredibly complex. For instance, during the development of the James Webb Space Telescope (JWST), there were no historical precedents for a space telescope that large or that intricate. The telescope’s enormous sunshield and segmented mirror could not be fully deployed in Earth’s gravity or tested as a complete system in a vacuum chamber. And the project reached a point where continued testing ran the risk of degrading flight hardware. NASA engineers performed an aggregate risk assessment to examine the extensive portfolio of technical risks collected during the project and reach a judgement about the overall likelihood of mission success or failure.
NASA’s thorough approach to risk management isn’t unique to JWST. Many NASA missions include complex, novel engineering systems designed to achieve ambitious science objectives. In this environment, risk management isn’t a separate process — it is embedded in how NASA operates. Agency policy defines risk management as a continuous, integrated effort that supports activities across strategic planning, project development, acquisition, and institutional operations. NASA applies a formal structure that holds individuals accountable for risk acceptance decisions, ensuring that responsibility is clearly assigned rather than diffused across committees.
Central to this is the integration of Risk-Informed Decision Making (RIDM) and Continuous Risk Management (CRM) processes.
- RIDM is used early in planning to evaluate different options and make initial choices based on a clear understanding of the risks involved.
- Once a path is chosen, CRM takes over to manage new risks that arise during execution, keeping the project on track.
This integrated framework means risks are addressed throughout a project’s entire lifecycle. It supports internal controls, boosts mission performance, and aligns with federal standards for accountability and effective management, ensuring responsible stewardship of public resources.
Defining and Measuring Risk at NASA
NASA operates where uncertainty is a given. Risk management empowers mission success by identifying, assessing, prioritizing, and managing risks that could hinder strategic goals. Whether dealing with technical, financial, operational, security, or safety-related issues, risk management supports sound decision-making, minimizes adverse impacts, improves financial performance, ensures compliance, and builds trust with stakeholders.
NASA defines risk as the potential for shortfalls in meeting objectives. Each risk is characterized by a specific scenario, its likelihood of occurring, and the consequences if it does. The formula looks like this:
Given: existing condition or scenario
It is possible that: undesired event occurs
Resulting in: consequence to the project
These scenarios can range from hardware failures during planetary landings to budget overruns or cybersecurity threats. Individual risks affect discrete areas, while aggregate risk looks at the combined impact of multiple risks on a broader objective.
This framework allows teams to discuss risks in clear, measurable terms rather than vague concerns. For instance, a problem that’s unlikely but could be catastrophic is treated very differently from one that’s almost certain but would have only a minor effect. By combining likelihood and consequence, NASA can prioritize which risks need urgent attention, which can be monitored, and which are acceptable. It turns risk from a feeling into a decision-making tool.
New Learning Opportunities from APPEL Knowledge Services
To help NASA’s entire workforce—from engineers and scientists to project managers, contracting specialists, and financial personnel—develop a thorough understanding of these vital risk management policies and procedures, APPEL Knowledge Services has developed two new courses, debuting this summer. These courses are designed to equip you with the skills to effectively manage uncertainty and contribute to NASA’s continued success. Those courses are:
Understanding Risk Management: Exploration of Core Concepts
This course provides detailed insight into NASA’s risk management principles and practices. Building on the core concepts introduced in the prerequisite course, Fundamentals of Risk Management at NASA, this course presents recommended approaches and guidance for applying Risk-Informed Decision Making (RIDM) and Continuous Risk Management (CRM) processes.
Date: June 17, 2025; Center: JSC
Applying Risk Management: From Theory to Practice
This course explores the practical applications of Risk-Informed Decision Making (RIDM) and Continuous Risk Management (CRM) in the context of NASA projects and programs. Participants will collaborate on a threaded case study as described in the Risk Management Handbook. This course builds on the foundational course Understanding Risk Management: An Exploration of Core Concepts.
Date: July 29-30, 2025; Center: KSC
To learn more about these courses, click here.
