Risk is the combination of the likelihood that an adverse event will occur and the impact it would have on mission objectives. Risk management is the structured process of identifying, assessing, prioritising, and controlling these risks to keep them within acceptable bounds — and within an organisation's declared risk appetite.
RISK FORMULA
Risk Score = Likelihood × Impact
Scores range from 1 (minimal) to 25 (catastrophic) using a 5×5 matrix. Both axes are rated 1–5 using calibrated scales defined below.
RISK LIFECYCLE
1
Identify — surface risks via workshops, checklists, expert elicitation.
Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of its objectives, before corrective action is deemed necessary. It is a governance decision — set by executive leadership — that draws a threshold on the risk matrix. Risks below the appetite may be accepted and monitored; risks above it must be actively treated. Crucially, risk appetite is not fixed: it changes with the organisation's strategic phase, available capital, regulatory context, and project type.
APPETITE vs. TOLERANCE vs. CAPACITY
Appetite — the desired/preferred level of risk; a strategic choice. Tolerance — acceptable deviation from appetite before escalation triggers. Capacity — the maximum risk the organisation can absorb before insolvency or mission failure; a hard ceiling regardless of appetite.
Appetite must always be set below capacity. The gap between them is the safety buffer.
ALARP PRINCIPLE
UNACCEPTABLE — Must reduce regardless of cost
ALARP ZONE — Reduce if reasonably practicable
ACCEPTABLE — Broadly acceptable; monitor only
As Low As Reasonably Practicable — for aerospace/defence, this is a legal and contractual obligation. Residual ALARP risks must be documented with a cost–benefit justification.
Configure Your Organisation's Risk Appetite
Set the maximum risk score acceptable without treatment. Risks above this threshold will be flagged across all tabs.
Max Acceptable Score
6
Current appetite: Score ≤ 6 (MEDIUM)
Risks scoring 1–6 may be accepted. Risks scoring 7–25 require an active mitigation plan with designated owner and review date.
Regulatory approval harder to obtain in many jurisdictions
RISK AGGRESSIVE
Max acceptable score: ≤ 20 (up to Critical) — Requires Board-level declaration
⚡
Context
Reserved for transformational, once-in-a-generation programmes: first-ever crewed Mars mission, hypersonic demo vehicle, offensive/defensive DEW system, novel nuclear propulsion. These programmes accept inherently high risk because the cost of not attempting is judged to exceed the cost of failure.
Governance requirements
Explicit Board/leadership declaration of Aggressive Appetite — time-bounded
Separate ring-fenced budget for risk contingency (typically 30–50%)
Dedicated Risk Authority with authority to stop programme
📋No risks yet. Use the form above or load sample risks.
Risk Matrix Comparison
HOW TO READ THE MATRIX
The 5×5 matrix plots Likelihood (horizontal) against Impact (vertical). Each cell shows the risk score and the IDs of all registered risks that fall in that cell. Cells above the current risk appetite threshold are outlined with a dashed blue border. Risk IDs are colour-coded by band for instant triage.
INHERENT RISK MATRIX (Unmanaged)
← LIKELIHOOD →
RESIDUAL RISK MATRIX (After Mitigation)
← LIKELIHOOD →
Low (1–4)
Medium (5–9)
High (10–16)
Critical (17–25)
Exceeds Appetite
Risk appetite set to 6. Cells with score > 6 require active treatment plans. Risk IDs shown inside cells — hover for details.
Risk Movement — Inherent → Residual
📍Add risks to see movement.
Risk Appetite × Project Envelope
CONCEPT: PROJECT FEASIBILITY ENVELOPE
Not every project is feasible under every risk appetite. The Project Feasibility Envelope maps the minimum risk appetite required to undertake a project against two key dimensions: Project Type (R&D through Manufacturing) and Budget Size. Bubble size represents Required Organisational Capability. Projects in grey zones require a higher declared appetite to be sanctioned — they are literally impossible within a lower-appetite governance framework without reclassifying key risks.
Interactive Project Envelope — Bubble Chart
FILTER BY TYPE:
Projects Impossible Without Higher Risk Appetite
KEY INSIGHT
The following real-world programmes carried inherent risk scores that would have been classified as High or Critical (≥ 10) under a neutral appetite framework. They were only possible because their organisations explicitly declared a higher risk appetite — backed by governance mechanisms, dedicated contingency budgets, and leadership accountability structures. A risk-averse or neutral organisation would have been unable to sanction these programmes without major restructuring.
SpaceX Falcon 9 — Propulsive Landing R&D
SpaceX · Commercial Launch · 2011–2015
🚀
R&DDemoHigh Budget
First-ever propulsive booster recovery for an orbital-class rocket. No heritage, no validated models. First-stage landing attempts had a 50%+ failure probability in early flights.
Key risks above neutral appetite: Novel propulsive landing algorithm failure (L5×I4=20), vehicle structural failure during re-entry burn (L4×I5=20), landing pad proximity explosion (L3×I5=15). All scores well above neutral threshold of 9.
Min. appetite required
≥ 20 (Aggressive)
Impossible at Neutral
NASA Artemis I — Uncrewed SLS/Orion
NASA · Government · 2017–2022
🌙
DemoGovernmentVery High Budget
First integrated flight test of SLS + Orion. New heavy-lift vehicle with no prior flight heritage; thermal protection system partially unvalidated at entry velocities; $23B programme cost by flight day.
Mach 20 unpowered hypersonic glide vehicle. Both flight tests ended in anomaly (aerodynamic instability at hypersonic speeds). Programme was explicitly declared as "acceptable to fail" by DARPA leadership.
Key risks above neutral appetite: Aerothermal model invalidation causing loss of vehicle (L4×I5=20), flight termination system activation (L3×I4=12), classified payload exposure risk (L2×I5=10). DARPA risk appetite allows failure as a learning outcome.
Min. appetite required
≥ 20 (Aggressive)
Impossible at Averse/Neutral
ESA BepiColombo — Mercury Orbit Insertion
ESA / JAXA · Science Mission · 2018–2025
☿
Science R&DInternationalHigh Budget
First European mission to Mercury. Extreme thermal environment (up to 450°C), complex multi-gravity-assist trajectory, 7-year cruise. Solar electric propulsion in untested high-radiation environment near the Sun.
Key risks above neutral appetite: Solar panel degradation above predicted rate (L3×I4=12), propulsion system under-performance in deep solar gravity (L2×I5=10), communication blackout during Mercury orbit insertion (L3×I4=12). Accepted via ESA formal risk board.
Min. appetite required
≥ 12 (Tolerant)
Impossible at Neutral−
Saudi Space Agency — Commercial EO Constellation
SSA / Prime Contractor · Programme · 2022–2027
🛰️
ManufacturingGovernmentVery High Budget
First indigenously manufactured Saudi EO satellite constellation. Technology transfer from foreign prime, domestic workforce development, first-time integration and testing facility establishment — all concurrent.
Key risks above neutral appetite: Technology transfer failure / IP restriction (L3×I4=12), domestic supply chain immaturity (L4×I3=12), trained workforce attrition to commercial sector (L4×I3=12), regulatory framework not ready for licensing (L3×I3=9). Requires formal Tolerant appetite declaration.
Min. appetite required
≥ 12 (Tolerant)
Impossible at Neutral
Starlink Gen-2 Mega-Constellation
SpaceX · Commercial Operations · 2023–ongoing
🌐
OperationsManufacturingExtreme Budget
7,000+ satellite constellation deployment at pace of 200+ satellites/month. Orbital debris generation, spectrum coordination across 100+ jurisdictions, simultaneous new vehicle introduction (Starship) as primary launcher.
Key risks above neutral appetite: Cascading Kessler debris event trigger (L2×I5=10), ITU coordination failure blocking spectrum (L3×I4=12), mass production quality escape causing in-orbit failure campaign (L3×I4=12), regulatory shutdown in major market (L3×I4=12).
Min. appetite required
≥ 12–16 (Tolerant+)
Impossible at Neutral
Mitigation Strategies
🚫
AVOID
Eliminate the risk by deciding not to start or continue the activity. Best for Critical risks where no acceptable control exists.
🔧
REDUCE
Implement controls that lower likelihood, impact, or both. Covers engineering controls, procedures, redundancy, testing.
🤝
TRANSFER
Shift consequences to a third party via insurance, warranties, sub-contracts, or indemnity. Does not lower probability.
✅
ACCEPT
Acknowledge the risk and take no action — because cost exceeds benefit, or risk is within appetite. Must be formally documented.