C0.5 Risk leadership

NASA Risk Management Handbook v2.0, risk leadership and RIDM [11]

The component requires that every decision informed by a risk analysis name its decision authority, and that the authority be accountable for the decision rather than the analyst for the analysis; that decision authorities be named per tier of the organization; and that no decision be recorded in the framework without a named decider (C0.5) [11]. It is a short component with a long reach: L4's decision record (C4.5) [11] [18] and the named decider of the seven responses (C4.1) [9] [20] [2] both depend on it. Without it, the response column of a register fills with “mitigate” and the question of who chose that has no answer.

It comes from the aerospace handbook's second version of November 2024, which added the idea under that name: those who decide are accountable for the risk they accept, not only the analysts who describe it. The handbook says “risk-informed” rather than “risk-based” because the analysis informs a decision that other considerations also shape. What the component replaces is the habit of treating the risk function as the owner of the risk it reports. In every institution I have worked in there was a moment, after a loss, when the question was put to the risk officer rather than to the executive who had taken the position, and the component is written so that the question has a different address. It reconciles the aerospace term, decision authority, with the information-security cycle's authorizing official who signs for a system's residual risk [20] and the auditors' accountable governing body [18]; chapter 11 kept owner for the single named person who can be asked why, and the decision authority is the owner of a decision.