Technical Risk Assessment Handbook - Defence Science and ...

13
linked to the key objectives of the project. A risk event can affect more than one
objective and it is important to consider and list all objectives that are impacted. The
risk assessment should be based on the highest impact where multiple objectives are
impacted by a particular risk.
Risk criteria
3.24 Risk criteria are used to evaluate the significance of risk. The AS/NZS ISO
31000:2009 standard 9 notes that risk criteria should be adapted to meet the
objectives of the organisation and of the risk assessment.
3.25 The following risk criteria have been developed to meet Defence’s requirements
of the TRA, that is, to identify technical risks and issues for risk treatment and issue
resolution, and to inform Government of the level of technical risk in a major
project 10 . In some circumstances the PSTA may consider that it may be appropriate
to adopt different risk criteria, such as for a highly-developmental project or for a
project with significant safety risks. In those cases the PSTA may develop
appropriate risk criteria in consultation with the Studies Guidance Group (SGG) of
DSTO Projects and Requirements Division, who are responsible for technical risk
policy and process in DSTO.
3.26 As part of the risk assessment, each risk event identified is examined to
estimate the likelihood of its occurrence and its impact on the project’s objectives to
arrive at the risk itself. Any risk event which is assessed as having a likelihood
greater than 50% is rated as More Than Likely, between 20-50% as Less Than
Likely, and less than 20% as Unlikely.
3.27 Once the likelihood is assessed, each risk event is examined to assess the
impact of the event, if it were to occur, on the project’s objectives in terms of the
required performance, supportability, safety, cost or schedule. The impact or
consequence is expressed in terms of either Major, Moderate or Minor as follows:
• Major: significant impact on achieving the project’s objectives, such as a
significant reduction in performance or safety or a major shortfall in
supportability.
• Moderate: moderate impact on achieving the project’s objectives.
• Minor: little impact on achieving the project’s objectives.
3.28 Once the likelihood and impact for an event are determined, the risk
assessment is expressed in terms of high (shown in Table 1 as red), medium (yellow)
or low (green) as shown in the risk matrix at Table 1.
9 Standards Australia (2009) Risk management - Principles and guidelines, AS/NZS ISO 31000:2009
10 Moon, T., Smith, J. and Cook, S.C. (2005). Technology Readiness and Technical Risk Assessment
for the Australian Defence Organisation. In Proceedings of the Systems Engineering, Test &
Evaluation Conference, SETE 2005 – A Decade of Growth and Beyond, Brisbane, Queensland.
Technical Risk Assessment Handbook Version 1.1