NOM is built on the LOSA Threat and Error Management model, redeveloped for the ramp. Threats are conditions in the environment that may increase risk. Variations are where work as done differs from work as planned or prescribed, with no cause inferred. Each one is managed (resilient action resolves it), unmanaged (no action) or mismanaged (action that doesn't work). NOM also records the enablers that support work going well.
The NOM model. Red: how unmanaged or mismanaged threats and variations can get through the organisation's defences to an undesired state, and on to an incident or accident. Green: where managing it returns the operation to normal.