ARAMP-1 risk management guide for NATO acquisition programmes

What it is

ARAMP-1, NATO's Allied Risk Assessment Management Publication, is a guide to running risk management (RM) on an acquisition programme or project within NATO's System Life Cycle Management (SLCM) framework. It covers programmes of any kind and product class run under NATO or a NATO nation's acquisition policy, from a Risk Management Plan and a maintained risk register through to how risk is shared with a contractor across the life of a contract.

A guide, not an obligation

Clause 1.2 of the document is explicit: "This document is not mandatory for use but is principally focused toward NATO Nations." It is offered to "any NATO Nation or organization as well as industrial bodies, in their role as acquirer or supplier," and it is carried by STANREC 4739, a NATO Standardization Recommendation. A STANREC invites rather than commits, so ARAMP-1 has no force of its own; a supplier meets it only because a specific contract, RFP, or a national implementation of NATO's SLCM policy asks for a Risk Management Plan and risk register built along these lines.

The five-step risk management process

The document's core is a five-step process, each step described with a common structure of inputs, tasks, outputs and toolbox:

• Risk Management Planning sets the tone: who is involved, which tools and techniques apply, and how RM integrates with project management. Its output is the Risk Management Plan (RMP), a standalone document for a large project or programme, or a chapter of the Project Management Plan for a small one.
• Risk Identification produces risk statements, an event, an impact, and often a cause, written in a risk-impact format, "As a result of (X), (Y) may occur which would/could/may lead to (Z)", using top-down and bottom-up techniques, the Delphi technique, checklists, and historical data from earlier programmes.
• Risk Analysis always runs qualitative analysis first, ranking risks by probability and impact against a matrix, before any quantitative work, such as Monte Carlo simulation, on a selected, interdependent subset of risks.
• Risk Response Planning chooses a strategy per risk: avoidance, mitigation or transfer for a threat; exploit, enhance or share for an opportunity; active or passive acceptance for either. Every chosen response is checked for the residual and secondary risks it creates.
• Risk Monitoring and Control keeps the RMP and risk register current through regular risk review meetings and periodic risk audits, ideally run by auditors not immediately involved in the project.

Fitting into NATO's life cycle

The document maps this process onto NATO's system life cycle stages (AAP-48) and the programme/project management process (AAP-20). Stage transitions are controlled by decision gates at programme level; a project moves through milestones within a stage. At each decision gate, the authority responsible has to confirm that risks for the next stage are identified, that risks and actions carried over from the previous stage are accepted, and that the risk situation itself permits entering or leaving the stage.

Chapter 5 adds two NATO-specific concerns. It sets out a collaborative, rather than a purely risk-transferring, relationship between a NATO contracting authority and its contractor: a shared risk register, common definitions, and joint risk reviews across pre-contract-award, RFP development, source selection and post-contract-award phases. It also treats accelerated or rapid fielding as a distinct risk driver: reduced documentation, a compressed life cycle, and reliance on commercial or government off-the-shelf products all carry named risks, with concrete alternatives suggested rather than a blanket refusal.

What an auditor or contracting authority actually looks at

Nobody certifies against ARAMP-1; it is guidance, and the document sets up no accreditation scheme. What does happen: internal risk audits check the RM process and response plans, and on a NATO contract, a source-selection evaluation team assesses an offeror's proposal risk and performance risk, with risk management sometimes used as a selection discriminator. After award, an Integrated Baseline Review checks the pre-award risk plans against what was actually contracted.

What it does not cover

ARAMP-1 does not tell a reader whether it applies to their programme; that is set by the contract and the customer's quality clause, not by this guide or by us. It does not certify anything or anyone. And it is not a technical specification for a product: the risk register, RMP template and toolbox in its annexes are process tools, not requirements on what is being acquired.

Standards it references

• AAP-48Background
• AAP-20Background
• AQAP-2070Background
• IEC 31010Background