Typical risk sources include: 
- Threat: The sensitivity of the program to uncertainty in the threat description, the degree to which the system design would have to change if the threat’s parameters change, or the vulnerability of the program to foreign intelligence collection efforts (sensitivity to threat countermeasure).
- Requirements: The sensitivity of the program to uncertainty in the system description and requirements, excluding those caused by threat uncertainty. Requirements include operational needs, attributes, performance and readiness parameters (including Key Performance Parameters), constraints, technology, design processes, and Work Breakdown Structure (WBS) elements.
- Technical Baseline: The ability of the system configuration to achieve the program’s engineering objectives based on the available technology, design tools, design maturity, etc. Program uncertainties and the processes associated with the “ilities” (reliability, supportability, maintainability, etc.) must be considered. The system configuration is an agreed-to description (an approved and released document or a set of documents) of the attributes of a product, at a point in time, which serves as a basis for defining change.
- Test and Evaluation: The adequacy and capability of the test and evaluation program to assess attainment of significant performance specifications and determine whether the system is operationally effective, operationally suitable, and interoperable.
- Modeling and Simulation (M&S): The adequacy and capability of M&S to support all life-cycle phases of a program using verified, validated, and accredited models and simulations.
- Technology: The degree to which the technology proposed for the program has demonstrated sufficient maturity to be realistically capable of meeting all of the program’s objectives.
- Logistics: The ability of the system configuration and associated documentation to achieve the program’s logistics objectives based on the system design, maintenance concept, support system design, and availability of support data and resources.
- Production/Facilities: The ability of the system configuration to achieve the program’s production objectives based on the system design, manufacturing processes chosen, and availability of manufacturing resources (repair resources in the sustainment phase).
- Concurrency: The sensitivity of the program to uncertainty resulting from the combining or overlapping of life-cycle phases or activities.
- Industrial Capabilities: The abilities, experience, resources, and knowledge of the contractors to design, develop, manufacture, and support the system.
- Cost: The ability of the system to achieve the program’s life-cycle support objectives. This includes the effects of budget and affordability decisions and the effects of inherent errors in the cost estimating technique(s) used (given that the technical requirements were properly defined and taking into account known and unknown program information).
- Management: The degree to which program plans and strategies exist and are realistic and consistent. The government’s acquisition and support team should be qualified and sufficiently staffed to manage the program.
- Schedule: The sufficiency of the time allocated for performing the defined acquisition tasks. This factor includes the effects of programmatic schedule decisions, the inherent errors in schedule estimating, and external physical constraints.
- External Factors: The availability of government resources external to the program office those are required to support the program such as facilities, resources, personnel, government furnished equipment, etc.
- Budget: The sensitivity of the program to budget variations and reductions and the resultant program turbulence.
- Earned Value Management System: The adequacy of the contractor’s Earn Value Management (EVM) process and the realism of the integrated baseline for managing the program.
Additional areas, such as manpower, ESOH, and systems engineering, that are analyzed during program plan development provide indicators for additional risk. The program office should consider these areas for early assessment, since failure to do so could cause significant consequences in the program’s latter phases. 
AcqLinks and References:
- MIL-STD-882E “Standard Practice for System Safety” – 11 May 2012
- Air Force System Safety Handbook – July 2000
-  DoD Risk Management Guidebook – Section 3.3 – Aug 06