Risk management

Project → Risk is the risk file, using your domain profile's method: a severity-probability matrix, HARA with ASIL, FHA with DAL, a risk graph with PLr, LOPA with SIL, FMEA with RPN or action priority, energy classes, or your organisation's own.

1. 1Hazard draftedfrom a source, or written by hand
2. 2Ratedbefore controls
3. 3Controls linkedeach with a verification
4. 4Rated againafter controls
5. 5Residual risk accepteda separate signed decision

#Working with hazards

• Hazards can be drafted from meetings and documents like other records, citing their source.
• For matrix methods, a heat map shows risks before and after controls; click a cell to filter.
• Results are computed from the factors you enter. Accepting a risk is always a signed human decision.

#Residual-risk acceptance

Approving a hazard approves the analysis. Whether the residual risk is acceptable is a separate, signed decision on the approved revision: an approver who didn't write it decides acceptable, acceptable on benefit-risk grounds (with the written case) or not acceptable. It needs the initial and residual risk rated and an approved control. While a control has no passing verification result, the acceptance is provisional.

#Profile rules

Your domain profile can add trace rules, for example "an approved failure mode needs a control", which raise alerts until they're met.