Home / Aerospace and defense program execution
Every program has a risk register. The question is whether it changes anything. On too many programs the register is a quarterly document that lists risks nobody is working, while the problems that actually hurt the program were never written down. Set Boundaries builds risk, issue and opportunity management that drives decisions: clear risk statements, owners, dated handling plans and a direct link to the schedule and the budget.
What does good risk management look like on a defense program?
It is a continuous process run by the people who own the work, reviewed on a fixed rhythm, and tied to the program's schedule and cost baseline. The Department of Defense describes the approach in its Risk, Issue, and Opportunity Management Guide for Defense Acquisition Programs, and most prime contractors flow similar expectations to their suppliers. The process runs in a loop: plan how risk will be managed, identify risks, analyze them, plan how to handle them, carry out those plans, and monitor the results.
The measure of success is not the size of the register. It is whether risks are being retired on schedule and whether the program saw its problems coming.
How are risks scored?
Most programs use a five by five matrix of likelihood against consequence. The value comes from defining each level in the program's own terms, so that two engineers scoring the same risk arrive at the same answer.
| Level | Likelihood (example definition) | Schedule consequence (example definition) |
|---|---|---|
| 1 | Remote | Minimal impact, absorbed within available float |
| 2 | Unlikely | Minor slip to a non-critical milestone |
| 3 | Likely | Slip to a key milestone, recoverable with replanning |
| 4 | Highly likely | Slip to a contract milestone or the critical path |
| 5 | Near certainty | Program-level slip affecting the customer's own commitments |
Equivalent definitions are set for cost and technical performance consequence. The definitions above are illustrative; each program sets its own thresholds, often in days of slip and dollars of impact, in its risk management plan.
What should a risk register contain?
| Field | Why it matters |
|---|---|
| Risk statement in if-then form | Makes cause and consequence explicit, so the risk can be handled rather than discussed |
| Owner | One named person accountable for the handling plan |
| Likelihood and consequence scores | Place the risk on the matrix and allow ranking |
| Consequence area | Cost, schedule, technical performance, or a combination |
| Handling strategy | Accept, avoid, transfer or control, with the reasoning |
| Dated handling steps | Turn intent into actions that can be tracked and scheduled |
| Target score and date | Define what success looks like, for the burn-down chart |
| Link to schedule tasks and budget | Connect the risk to the work and reserves it threatens |
| Trigger or indicator | The early sign that the risk is becoming an issue |
How do you handle a risk once it is identified?
There are four handling strategies. Accept means the program knowingly carries the risk and watches its trigger. Avoid means changing the plan, design or requirement so the risk no longer applies. Transfer means moving it to the party best placed to manage it, such as a supplier with the capability to control it. Control means acting to reduce the likelihood or the consequence, for example qualifying a second source or adding an early test.
Control plans are best shown as a burn-down: a series of dated steps, each expected to lower the score, plotted against the actual score over time. A burn-down that flattens is an early warning that the handling plan is not working.
How are opportunities managed?
Opportunities get the same discipline in the other direction: a clear statement of the potential benefit, the cost and effort to pursue it, an owner and a decision. Typical defense program opportunities include design simplifications, supplier consolidations and test combinations that save time. Programs that only manage downside tend to miss the upside entirely, even though pursuing a few well-chosen opportunities can offset realized risks.
Which risk metrics tell you the process is working?
| Metric | What it reveals |
|---|---|
| Risks retired versus burn-down plan | Whether handling plans are delivering on schedule |
| Overdue handling steps | Where ownership has lapsed |
| Issues that were never on the register | Gaps in identification; the most honest measure of the process |
| High risks without a funded handling plan | Exposure the baseline is not paying for |
| Management reserve versus assessed risk exposure | Whether reserves are realistic for the risks carried |
| Age of open risks | Registers that have become archives rather than tools |
How does risk connect to the schedule and earned value?
Risks that could affect the critical path belong in the schedule risk analysis, where they are modeled as uncertain durations or as discrete events that may add work. That analysis shows how much the program's risks threaten the finish date, in probability rather than opinion. On the cost side, handling actions that the program commits to should be planned in the baseline, and the size of management reserve should reflect the assessed exposure. When these links are missing, the risk register and the performance reports describe two different programs. Our guides to schedule risk analysis and EVMS under EIA-748 cover the connection in more detail.
What does AS9100 add?
AS9100D, the aerospace quality management standard, requires organizations to plan, implement and control a process for managing operational risks to the achievement of product and service requirements. For program teams this means the risk process must be documented, responsibilities assigned, criteria for acceptance defined and actions tracked. ISO 31000 provides the broader principles, and a well-run program risk process built on the DoD guide will usually satisfy both.
While managing a mission-critical airframe-mounted component program, Holly identified castings as a major schedule and supply chain constraint: they needed tooling, took at least 18 weeks, and defects or rejections could push schedules out further. She proposed additive manufacturing as the answer, presented it to leadership and secured funding and resources to develop the capability. The result was design changes in weeks instead of months and a U.S.-based answer to a supply chain problem. Risks and opportunities on our programs are reviewed formally every month, and the mitigation work goes into the schedule as real tasks.
How does Holly run risk and opportunity on a program?
Risks and opportunities are reviewed formally every month, with the program's leads in the room and the integrated schedule in view. The review is not a reading of the register. For each significant risk the question is what will be done, by whom and by when, and the answer goes into the schedule as tasks with owners and dates. That way mitigation competes for time and people like any other work, it appears in the weekly look-ahead, and if it slips the team sees it. A handling plan that lives only in a register tends to stay there.
Between reviews, anything that threatens the critical path does not wait for the monthly meeting. It gets immediate attention and a decision from the people who can act on it.
What does turning a constraint into an opportunity look like?
The casting example above started as an ordinary schedule observation: every design change that needed a new casting started a clock of at least 18 weeks, and a rejected casting started it again. Many programs would log that as a supplier risk and carry it for years. Holly treated it as an opportunity with a business case, took it to leadership and secured the funding to develop additive-manufactured hardware. She then worked with the aerospace customers and airworthiness organizations involved on a qualification approach that compared data from the traditionally cast part with equivalent data from additive hardware, so the two could be judged like for like.
How does Set Boundaries set up or repair a risk process?
We start by reviewing the existing register against the issues the program has actually faced; the gap between the two shows what the process is missing. Then we rewrite the top risks as clear if-then statements with owners, define scoring criteria in the program's own units, build dated handling plans and burn-downs for the highest risks, and connect them to the schedule and reserves. Finally we set a review rhythm, usually monthly with weekly attention to the top risks, that keeps the register alive. On programs in trouble this is part of program recovery; on new programs it is part of front-end planning.
If your register has not changed a decision in months, schedule a call.
References
- US Department of Defense, Risk, Issue, and Opportunity Management Guide for Defense Acquisition Programs.
- SAE International, AS9100D, Quality Management Systems: Requirements for Aviation, Space, and Defense Organizations, operational risk management.
- International Organization for Standardization, ISO 31000, Risk management: Guidelines.
- US Government Accountability Office, Schedule Assessment Guide, GAO-16-89G, best practice on schedule risk analysis.
- US Government Accountability Office, Cost Estimating and Assessment Guide, GAO-20-195G.
Questions
Common questions
What is the difference between a risk, an issue and an opportunity?
A risk is a future event that may happen and would hurt cost, schedule or performance if it did. An issue is a problem that has already happened or is certain to, so it needs corrective action rather than a probability. An opportunity is a future event that would benefit the program if pursued. The DoD guide treats all three together because they compete for the same management attention and the same reserves.
How should a program risk be written?
As a clear cause and consequence, commonly in an if-then form: if a specific event occurs, then a specific impact follows. For example: if the second-source casting supplier fails first article inspection, then engine control deliveries slip by the length of a requalification. A statement written this way can be owned, measured and handled. Vague entries such as "supplier risk" cannot, which is why they stay on registers for months without moving.
What is a 5x5 risk matrix?
A grid that scores each risk from 1 to 5 on likelihood and on consequence, placing it in a low, moderate or high zone. It is the scoring approach used in the DoD risk guide and by most defense contractors. It is useful for comparing and prioritizing risks, but the score is only as good as the definitions behind it, so each level of likelihood and consequence should be defined in measurable terms for the program.
What are the options for handling a risk?
The DoD guide describes four: accept the risk and monitor it, avoid it by changing the plan or requirement, transfer it to another party better placed to manage it, or control it by taking actions that reduce its likelihood or consequence. Each handling plan should have an owner, dated steps and a target score, so progress can be tracked on a burn-down chart rather than assumed.
How does risk management connect to the schedule and budget?
Risks that could affect the critical path should be modeled in the schedule risk analysis, and the cost of handling actions should be planned into the baseline or covered by management reserve. When risk management sits apart from the schedule and earned value data, the program cannot see how much its risks threaten the finish date or how much reserve it truly needs.
Does AS9100 require risk management?
Yes. AS9100D builds on the risk-based thinking in ISO 9001 and adds a specific clause on operational risk management for aerospace products, covering how risks to achieving requirements are identified, assessed, mitigated and accepted. A program risk process aligned with the DoD guide generally satisfies it, provided it is documented and actually used.
What are the 5 steps of ORM?
The five steps of Operational Risk Management, as used by the US military, are: identify the hazards, assess the hazards, make risk decisions, implement controls, and supervise. The cycle repeats as conditions change, and the final step checks that controls are working and that no new hazards have appeared. ORM grew out of operational safety, but the same loop maps closely to program risk management. Set Boundaries applies that discipline to aerospace and defense programs by giving every risk an owner, a dated handling plan and a regular review.
What are the 7 types of risk management?
There is no single official list of seven types, but most frameworks describe similar categories: strategic, operational, financial, compliance, technical, schedule and supply chain risk. On an aerospace or defense program the categories that matter most are usually technical, schedule, cost, supplier and programmatic risk, because those move the delivery date and the budget. The label matters less than the discipline. Set Boundaries helps programs write each risk clearly, score it consistently and tie its handling plan to the schedule and cost baseline, whatever category it falls in.
What are the 5 pillars of risk management?
Different sources name different pillars, but they usually come down to five activities: identify risks, analyze and score them, plan how to handle them, carry out those plans, and monitor the results. Some frameworks add governance or communication as a supporting pillar. The DoD Risk, Issue, and Opportunity Management Guide follows the same loop. On aerospace and defense programs, Set Boundaries treats monitoring as the pillar most often neglected, and sets a fixed review rhythm so risks are retired on schedule rather than simply listed.
Have a question that is not here? Ask Holly on a short call
