The Risk Expert Corner

ONEWhere the after begins

The after does not begin with a slogan. It begins with seven things already in place:

• A new process. Fourteen SRA steps, clearly established, made to be revisited as information improves.
• RIQ+, Requirement Importance Quantified. Worthiness (what it is worth and how far that worth reaches), then Effort (what it costs), then Readiness (whether the team can start now). Urgency is a date, not a digit, so the urgency trap is bypassed without touching the score.
• The evidence fork. Defect history splits the empirical path from the expert judgment one.
• Branch A, RPN+. Impact first, ranked on hard data.
• Branch B, RE+. Impact first, ranked on expert judgment: the dangerous fairy tales realm, named as such.
• The consistency test. RIQ+ against RPN+ or RE+: the importance of the requirement crossed with the impact of its failure.
• The end of the buckets. FMEA and its flavors, hazard analysis, MoSCoW and Action Priority, their silos, their endless tables and their spreadsheets that nobody reads twice.

The purpose behind all of it is the one ISO 31000 states for risk management: the creation and protection of value. It improves performance, encourages innovation and supports the achievement of objectives. The legacy lost sight of that purpose under its paperwork. The after is measured against it.

TWOThe legacy on trial: nine exhibits

No opinion is needed to convict the legacy method. Its own arithmetic is the witness. Every figure below can be checked with a pencil and a small notebook: write the tables by hand, and count.

The two defendants, in plain words. The Risk Priority Number, RPN, comes from the automotive FMEA handbooks. It promised an order: which failure to work on first, judged on how bad the harm is, how often the failure happens, and how hard it is to catch. The AIAG & VDA handbook retired it in 2019 (Exhibit 5). Risk Exposure comes from insurance and finance, by way of software risk management, where Barry Boehm made it the core of the discipline in 1991: the probability of an unsatisfactory outcome times the loss it causes. It promised an amount: how much a risk puts at stake, the chance of the bad outcome weighed against what it costs. Both were built by multiplying ratings, and both broke their promise the same way, as the exhibits show. SRA brings them back reinforced with elegant mathematics: RPN+ in Branch A and RE+ in Branch B, impact first. A third defendant ranks requirements rather than risks: MoSCoW, four buckets with fuzzy limits and no order inside them. SRA answers it with RIQ+, in the Second step. And no legacy tool ever checked the one ranking against the other: SRA’s consistency test does: early, in the Fifth step, before the cause analysis is paid for, and in full in the Eleventh step.

THREEThe sins behind the numbers

Four sins of arithmetic

• Averaging. A catastrophe multiplied by a low probability comes out medium. A system does not fail at its average; it fails at its worst.
• Masking. Hundreds of trivial rows bury the three that matter. A long list looks diligent and hides the danger by volume.
• Smoothing. Treating ruin as something that averages out over time. It does not. Ruin is a hard stop; there is no later to recover in.
• Discarding. A measured rate — a control chart, a capability study, a field count — is reduced to a one-to-ten rating, and the rating is multiplied. The measurement is thrown away at the moment it was needed. SRA keeps it: in Branch A the count and its source go on the record, and the rating says it was counted.

Eleven sins of the trade

• The slogan shield. "Holistic", "synergistic", "agile resilience". Words that cannot be proven wrong, used where data is missing. Slogans are the dark matter of management: placeholders for what nobody measured.
• The black box. Proprietary weights, 0.35 for this and 0.65 for that. Change one by a hundredth and the list reorders. If the logic cannot be shown, it cannot be audited.
• The complexity tax. Fifty-column spreadsheets that only their author can read. Complexity creates dependency, and hides that the inputs are guesses.
• The HIPPO. The Highest Paid Person's Opinion. When the matrix is soft, the loudest voice in the room sets the number, and the number then defends the voice.
• The coarse habit. The coarsest score in use — impact times likelihood on a five-by-five chart, where roughly one pair of risks in thirteen ties — is trusted every day wherever a failure can harm a person: at the concept phase, with no evidence behind it, when every decision is built into the product. It is chosen because it is familiar, not because it fits the stakes. RE+ replaces it today. The same two ratings on the same scales, ten times impact plus likelihood, and every one of the 25 combinations gets its own score, impact first. No chart to color, no ties to argue, nothing new to learn. It is as easy to use as the habit, and easier to defend. There is no reason to wait. See Exhibit 6.
• Normalization of deviance. A deviation happens and nothing bad follows, so the next one is accepted more easily, until the deviation is the standard and nobody remembers it was ever a warning. O-ring erosion on earlier flights and foam strikes on earlier missions both became routine this way. The name is Diane Vaughan's, from her study of the Challenger launch decision. SRA counters it by rule, not by vigilance: impact is rated from the consequence and never lowered by a good history; history counts only inside the conditions it was gathered in; every waiver is a signed acceptance, held by the authority its impact requires; and a deviation that recurs is a finding, not a precedent. See the case files.
• The liability shield. Plausible deniability, and the sin that keeps the others alive. Collisions, buckets and averaging survive because they protect the people who use them. After a failure the organization points at the matrix: "it was rated Remote, so its priority was appropriately low." Nobody decided anything; the table did. A band blames the table, while a ranking names who decided: when every mode has its own place, someone chose the order and someone signed it. That is why the legacy prefers buckets to order, and why scoring every mode defensively feels safer than screening by a written rule. SRA removes the shield on purpose: every gate has an authority, every acceptance a signature, every revision a date.
• Compliance theater. The study is written for the auditor, not for the product. Every column filled, every mode scored, every form signed, and nothing in the design changed. Compliance becomes the goal and stops being the floor: the audit is passed and the risk is untouched. A contract may require a deliverable, and SRA supplies it, but the deliverable is the receipt, not the work. SRA measures the work by what moved: the digit an action targeted, the cause it removed, the control verified. A study that moved nothing complied with everything and protected no one.
• The sin of the bottom row. IEC 31010 asks that the lowest step of the likelihood scale be an acceptable likelihood for the highest consequence; otherwise, it says, every activity with that consequence is intolerable and “cannot be made tolerable” (B.10.3.1). Read with “multiple fatalities” at the top of the consequence scale, that is a death made acceptable by being rare enough. Nobody argues the acceptance; the scale does it, the day it is drawn. That is the reasoning of the night before Challenger, written into a standard. SRA’s gate refuses it: a catastrophic impact is acted on whatever its likelihood. See the Fifth step.
• The inverted proof. The question is turned around: not “show us it is safe”, but “show us it is unsafe, or we go”. On a condition nobody has tested there is never proof of danger, so the missing test becomes the case for going ahead. The night before Challenger, Roger Boisjoly heard it put plainly: “it was up to us to prove beyond a shadow of a doubt that it was not safe to do so. This is in total reverse to what the position usually is in a preflight conversation or a flight readiness review” (Rogers Commission, Vol. 1, Ch. V). Seventeen years later the Columbia board found it again: program managers “required engineers to prove that the debris strike created a safety-of-flight issue”; the engineers “had to produce evidence that the system was unsafe rather than prove that it was safe” (CAIB, Finding F6.3-22). It is the sin that lets the others win in the room: once the burden is reversed, the deviance needs no defense and the senior voice needs no argument. SRA’s rule: the burden of proof lies with whoever lowers the risk. Keeping a rating, raising it or holding a mode open needs no proof. Lowering a rating, screening a mode out, calling a cause eliminated or accepting a risk needs the evidence, written down, and a name. Nobody is ever asked to prove that something is unsafe.
• The gap. One object divided among several studies, by teams that never meet. The parts team does not look at the operator, the process team does not look at the bolts, and the hazard lives in the space between them. No better table closes the gap; only one analysis, one team and one record do. See One tool is enough.

A score is an opinion written as a number. That is not a crime; every method starts there. The crime is treating the number as a fact once it is written. The legacy did, and the auditor of the after does not: every rating is a hypothesis until the evidence behind it is shown.

FOURTwo case files: Challenger and Columbia

These are told precisely, because an expert reader will check them, and because the real lesson is sharper than the legend.

Challenger, 28 January 1986

The legacy system did not miss the solid rocket booster field joint. NASA's own failure analysis classified it Criticality 1: failure means loss of the vehicle and crew. The classification was right. What failed was what happened around it. After severe O-ring erosion on earlier flights, a mandatory pre-launch review of the joint was waived flight after flight. On the night before launch, Thiokol engineers recommended not launching below 53°F, the coldest condition they had experience of. The forecast was far colder. NASA managers objected, and the burden of proof was turned upside down: the engineers were asked to prove the launch was unsafe, rather than anyone proving it was safe. Thiokol management reversed its engineers. Seven people died 73 seconds after liftoff: Dick Scobee, Michael Smith, Judith Resnik, Ellison Onizuka, Ronald McNair, Gregory Jarvis and Christa McAuliffe.

Read with SRA. At that temperature there was no history. The launch was in Branch B, the fairy tales realm, and the managers were using absence of evidence as evidence of absence, the exact trap the fork exists to name. The impact digit was a 10 and nothing could move it; no RIQ+ for the schedule, however high, could be weighed against it, because SRA never blends the two. And a waiver is an acceptance: in SRA it is a signature on the record, held by an authority matching the impact level, not a silence.

The honest limit. Elegant mathematics alone does not stop a manager determined to launch. A signed, dated record of who accepted what, against which evidence, makes that decision visible and owned. That is what SRA adds, and it is why the auditor exists.

Columbia, 1 February 2003

Foam shedding from the external tank had happened on many earlier flights. It was known, it was counted, and because no flight had been lost to it, it was reclassified in practice from a safety issue to a turnaround and maintenance issue. During Columbia's flight, a large piece of foam struck the left wing. Engineers assessed the strike with Crater, a model built for small debris such as ice; the foam piece was hundreds of times larger than the test data behind the model. Requests for imagery of the wing were not pursued. The orbiter broke up on re-entry, and its seven crew died: Rick Husband, William McCool, Michael Anderson, Kalpana Chawla, David Brown, Laurel Clark and Ilan Ramon.

Read with SRA. This was Branch A done wrong: the history was real, but it was used to rate the impact, and "it never hurt us" lowered a digit that only physics can lower. Impact is rated from the consequence, never from the frequency. The model's verdict carried no evidence at all, because history only counts inside the conditions it was gathered in; outside them, the mode is back in Branch B, and says so. And the imagery request was a low-worth task attached to a catastrophic failure: the consistency test's second shape, flagged in plain sight. And when the mode crossed back to Branch B, its impact would have crossed with it, never rated again: a 10 in Branch A is a 5 in Branch B, the top band, critical in either branch. A critical mode is never left to the budget or the schedule. The request for imagery of the wing would have been the first action funded, not a favor to be argued for.

Two disasters, seventeen years apart, the same pattern: the classification existed, and the decision process let it be argued down. That pattern has a name, the normalization of deviance, and the answer to it is not a better table. It is an auditor whose only job is to find the contradiction before the signature.

Fourteen people are named here because each of them was a person, not a number in a column. May the heroes of Challenger and Columbia not have died in vain.

FIVEAssumptions to surrender

The change is less about new formulas than about old beliefs. These are the ones to let go.

SIXWhat the legacy leaves worth keeping

Destroying the buckets does not mean throwing away what the people inside them learned. Seven things survive, each in a better place.

• The habit of exhaustive search. The best of FMEA was the discipline of asking "what if" of every part. SRA keeps it, structured: the 6M across two domains for breadth, the 5 Whys for depth.
• Detection. FMEA's real insight was that knowing a failure happened is not the same as preventing it. It lives on as the units digit of RPN+ in Branch A, where it can break a tie but never outrank incidence or impact, and in concept design as an unscored provision: how each failure mode will announce itself, decided while it still costs only a line on a drawing.
• Severity dominance. Action Priority got this right. SRA builds it into the elegant mathematics instead of a lookup table.
• Structured judgment. Delphi, the Nominal Group Technique and their relatives were built to keep the loudest voice from setting the number. They belong in Branch B, where judgment is all there is, and SRA's independent first ratings carry the same idea into every vote.
• Hazard is not failure. A hazard is a state that can cause harm; a failure is a function not performed. The distinction is real and worth keeping. What is not worth keeping is a second study for it: a hazard with no history is a Branch B question, and RE+ handles it.
• The ratings themselves. Impact, incidence and detection on 1 to 10, impact and likelihood on 1 to 5: every scale a team already uses survives unchanged, and so does every rating already in its records. Only the operator goes. Multiplication is replaced by placement, and the same ratings become RPN+ and RE+.
• The instruments. SPC, capability studies, gauge studies, FRACAS and field data were always on the same shelf as the FMEA. They stay, and their results finally count: in Branch A the measured rate goes on the record as evidence, instead of being reduced to a guess.

SEVENOne tool is enough

FMEA, DFMEA, PFMEA, FMECA, hazard analysis, HAZOP and all their cousins study the same thing: a function that must be fulfilled, and the ways it is not. They differ in where they stand when they start, not in what they look for. Structured Risk Analysis (SRA) alone replaces them all: one language, one workflow, one record. Each point below names the sin it kills.

The fork kills the deepest sin

Every cousin mixes what was counted with what was guessed. The fork separates them before anything is rated. Where there is a defect history, use it: the count is the answer, and no panel of experts is needed to estimate what the record already says. Where there is none, call the experts, because that is the only place their judgment is worth its cost. Branch A is empirical; Branch B is expert judgment, and it can only return a structured estimate. The record says which.

The Risk Scenario

Coming from the risk statement? The statement the team writes is built from this scenario: the same words, in a different order. The scenario is the reference that explains them; the statement is what you write. Why the orders differ is just below.

Every risk is one scenario, a line from a source of harm to the harm itself: Hazard → Root cause → Failure → Exposure → Harm or Damage. Each word of the analysis has its place on that line:

• Hazard: the source of the harm or damage.
• Root cause: why the failure happens.
• Failure: what goes wrong and opens the way.
• Target: what the hazard reaches.
• Exposure: the target meeting the hazard.
• Harm or Damage: what happens to the target.
• Impact: the size of the harm on that target.
• Incidence or Likelihood: how often the failure happens, counted in Branch A or estimated in Branch B.
• Risk: not a step on the line. It is the score of the whole scenario: RPN+ in Branch A, RE+ in Branch B.

Note: the scenario is not a causal order. It is the sequence of events, every step that intervenes from the hazard to the harm: the hazard is there first; then a root cause acts; then the failure happens; then the target meets the hazard; then the harm or damage follows. From the root cause on, each step produces the next, which is why the 5 Whys can walk it back and why breaking one link stops everything after it.

Where the hazard seems to reach the harm with no failure in between, dig a bit more: a missing sign, a barrier built too low, a warning never given. The failure was there, not yet found. In natural catastrophes, harm and damage reach people and assets through failures: a barrier too low, alarms missing or malfunctioning, an evacuation issued late or never issued, and sometimes prevention disregarded altogether.

The fork, read on the failure. A defect history is four facts at once: the failure has had the chance to happen and the record shows whether it did, somebody witnessed it, somebody recorded it, and the record comes from the conditions the item will now meet. The fork reads the evidence on the failure: has it happened, and are its defects on record? If yes, Branch A: the incidence is counted. If no, Branch B: the likelihood is estimated. A record of events with no failure behind it, such as floods or earthquakes, counts the hazard, not the failure; it stays in Branch B until the failure is found. Both branches share the hazard, the target and the harm; what changes is the evidence behind the failure.

What a Branch B likelihood leans on. With no record to count, the likelihood is a judgment, and a judgment is only as good as what it rests on. The tool asks for it on the line where Branch A cites its defect history: Likelihood basis, one of comparable items, changed conditions, a simulation or model, the team’s unrecorded experience, or a write-in, and one sentence saying what exactly. The basis is printed beside the RE+ score. It lets the auditor see why the likelihood is a 3 and not a 4; and once the item gathers its own record, it lets the team learn whether the experts’ basis held. A critical-impact likelihood with no basis stated is a finding. The full explanation, with what each option means and what the tool does with it: the Seventh step, the Likelihood Basis.

Where mitigation acts. Mitigation follows the branch: in Branch A, Correction, action to eliminate the root cause; in Branch B, Prevention, because there is not a physical object yet and the only opportunity is planning and communicating. On the scenario line, each action breaks one link:

• Correction and Prevention act at the root cause.
• A safeguard acts between the hazard and the target.
• Redundancy acts between the failure and the harm.
• A detection control catches the failure before the harm.

Residual risk, as the standards read it. ISO 31000 defines it plainly: the risk remaining after risk treatment. ISO 12100 and ISO 14971 say what deciding it takes. Risk is reduced in a fixed order: inherently safe design first, then protective measures, then information for use, and the last is the residual risk handed to the user. Each residual risk is evaluated against criteria set before the analysis. The control measures are themselves checked for the new risks they bring in. And the overall residual risk is judged at the end, across all of them. The legacy sheet has one column for it, the revised RPN, and a column filled in before the action is proven records a hope as a result. SRA takes the residual risk from the rating made after the action is done, on its evidence; a corrected item with no record of its own is rated as an estimate until it has one; and a critical mode stays critical, decided by a signature. The procedure: the Fourteenth step, the residual risk.

Acceptance breaks no link: the scenario stays open, covered by a signature and a contingency.

Safety engineers will recognize the line: it is the bow-tie, hazard, threats, top event and consequences, with the barriers drawn where they break the chain. SRA reads it the same way, and keeps it in one record.

How the team thinks, how it tells. The scenario is how the team thinks; the risk statement is how it tells everyone else: the manager who funds the action, the auditor who checks it, the operator who lives with it. The scenario is for building the analysis right; the statement is for passing it on intact.

Why the statement has a different order

The scenario, the sequence of events: Hazard → Root cause → Failure → Exposure → Harm or Damage.
The statement, in the order the method works: If the failure, exposing the target to the hazard, it will result in the harm or damage, because of the root cause, with this incidence or likelihood.

A connoisseur will find the SRA risk statement out of order. The classic risk metalanguage (Hillson, 2000) follows causality: as a result of the cause, the event may occur, which would lead to the effect. The SRA statement puts the cause fourth, after the failure, the exposure and the harm. The sequence of events was dropped deliberately. Nature runs forward; inquiry runs backward, from the harm to its cause.

The statement is the summary of the analysis, in the order the analysis was done: what fails and what it does first, then why, then how often. The failure, its exposure and its harm are written together in the Fourth step, where impact is ranked, then screened at the gate of the Fifth step; the root cause follows in the Sixth step, only for the modes that pass the gate; how often follows in the Seventh step. Read the sentence and you read the analysis as a whole. Impact first, in the sentence as in the score: the consequence stands where nobody can skip it, and the cause is searched for only where the harm justifies the search. Everywhere else in SRA, the statement is the law: its order and its words. See the Eighth step.

Even Mother Nature

An earthquake, a flood or an epidemic has no root cause anybody can correct. It does not need one to be analyzed. It enters SRA as a cause in the Mother Nature category of the 6M, against the requirement it threatens, and its harm reaches people and assets through failures: the barrier too low, the warning too late, the generator in the basement. Its cure is Prevention in the physical world: evacuation, vaccination, quarantine, the seawall. And its wonder tool is expert judgment, people working for years to find a pattern, the same goal a failure history serves in Branch A: to advance, to create and to protect value.

Even the actuaries, with care

Actuaries price risk with real quantities, claims per year and money per claim, and multiplying real quantities is legitimate; SRA does not claim to improve their pricing. Where the two meet is elsewhere. The heat maps in enterprise and operational risk registers, insurers’ own among them, are the five-by-five matrix of Exhibit 6, and RE+ fixes them on the same ratings. Credibility theory, the actuaries’ long-standing way of weighing a company’s own experience against a prior estimate, makes the same distinction the fork makes: a precedent that supports it, graduated where the fork is a switch. And when SRA chooses Transfer, the actuary takes over: the root causes in the register give the insurer’s loss-control engineers the one thing a premium cannot buy, the fix.

SRA for insurers

SRA does not set premiums; the insurer gains elsewhere, in five places:

• Underwriting. A client who keeps an SRA register shows the underwriter what was counted and what was guessed: every failure mode carries its branch, A for a counted history, B for an expert estimate. A heat map hides that difference.
• Loss control. For every scenario, the register holds the root cause, the action aimed at it and the link that action breaks: the fix the insurer’s risk engineers would otherwise have to find for themselves.
• Natural catastrophe. Catastrophe models count the hazard, how often the floods, quakes and storms come. SRA puts the part that can be mitigated on the scenario line: the failure, the barrier too low, the generator in the basement. It fits the premium credits property insurers already give for mitigation. The hazard cannot be changed; the failure can.
• Claims. The scenario and the risk statement follow the questions a claim investigation asks: what failed, what it exposed, what harm followed, and why. A register written that way makes the cause easier to establish.
• The insurer’s own register. Insurers must assess their own risks, under Solvency II in Europe and the ORSA requirement in the United States, and many of those registers are the five-by-five matrix of Exhibit 6. RE+ fixes them on the same ratings.

Two limits. RPN+ and RE+ are not money: an insurer must never read them as an expected loss or price from them. And whether the Branch A counts are good enough to feed a frequency model is for the actuary to say.

One logic, one language

Before: four studies of one object, by isolated teams that never talked. After: one team that can work everywhere, the same steps, the same tables and the same words in design, process, safety and management. Less training, and help available next door, because the engineer next door speaks the same language.

Compliance: what SRA replaces, and what it does not

SRA does not ask anyone to break a contract. Where a standard requires a documented method but names no formula, SRA is that method; where a contract names a scheme, the scheme is supplied as written, and SRA gives the order inside it.

• Action Priority (AIAG & VDA, 2019). Supply it as published. Do not customize the table to make it fit: an edited table is no longer the Action Priority the contract asks for, and its edges become nobody’s reasoning. Rank inside each band with RPN+ (see Exhibit 5).
• IEC 60812:2018 (FMEA and FMECA). The standard itself describes alternative means of calculating the RPN, a criticality matrix, and tailoring for the application. RPN+ is an alternative calculation on the same three ratings, severity leading.
• ISO 31000, ISO 9001, AS9100, IATF 16949. They require risk to be identified, evaluated and acted on with a documented, consistent method. They name no score. SRA’s written criteria, versioned tables and recorded screening are that method.
• ISO 14971 (medical devices). The manufacturer sets its own criteria for estimating and accepting risk. RPN+ and RE+ serve, written into the risk management plan.
• MIL-STD-882E (defense programs). Its risk assessment codes are the deliverable. SRA works beside them, not instead of them.

What an auditor gets. The same documented rating tables. A deterministic score: two people with the same ratings get the same number. A score that reads back to its ratings by hand. The classical RPN printed beside it for whoever asks. Compatible is not certified: SRA is not yet recognized by any standard, and the claims above are to be checked against the full text of each.

The sin we found on the way

The gap. Dividing one object among several studies creates groups; groups mean miscommunication; and the hazard lives in the space between them. The parts team does not look at the operator, the process team does not look at the bolts, and the cat that chews the wire belongs to nobody’s study. No better table closes the gap. Only one analysis, one team and one record do.

EIGHTHow to survive the change and do your job better

Nothing here asks a practitioner to start from zero. Your experience is the input SRA was designed for.

• Keep your scales. Your company's 1 to 10 impact, incidence and detection tables still work. The only change is the operator: place the ratings instead of multiplying them.
• Keep your knowledge of failure. Years of FMEA sessions are years of 6M and 5 Whys. That is exactly the cause work in the sixth step.
• Spend less time on what never mattered. The impact gate removes the low-impact rows before anybody discusses them. The hours come back to you.
• Still answer your customer. Classical RPN and RE are printed beside every plus score. Where a contract requires an AIAG-VDA Action Priority deliverable, provide it, required by contract, not by reason, and rank inside it with RPN+.
• Stop defending guesses. Branch B lets you say "we do not know yet" on the record, without being penalized for it. The record shows you reasoned well, not that you predicted the future.
• Become the auditor. The problem solver's questions are the auditor's questions. The rest of this page shows how.

NINEThe SRA Auditor: job description

The legacy auditor checked that boxes were filled. The SRA Auditor checks that the reasoning holds. The job is to find contradictions, not to recompute scores.

Purpose

Protect and create value by making sure every risk decision rests on stated evidence, follows the written Criteria, and is owned by the right person, before it is signed.

Position

A role, not a department. Any engineer trained in SRA can hold it. The auditor reports findings to the Risk Leader, who holds the Criteria, the tables and the register.

Independence

The auditor never audits a study they took part in. Peer audit is the rule: engineers audit each other's analyses.

Responsibilities

Audit an analysis at the impact gate, before sign-off, and at each scheduled review. Run the audit questions below. Write each finding with the evidence behind it. Follow every finding until it is answered in writing.

Authority

The auditor may raise a finding on any rating, branch, screening decision, action or signature, and may require a written answer before sign-off.

Limits

The auditor does not change a rating, move a score or make the decision. Like the consistency test, the auditor makes a disagreement visible; the analysis team corrects it and the approver decides.

Tools

The SRA steps, the organization's Criteria and ranking tables, the RIQ+, RPN+ and RE+ scores, the consistency test findings, the register search, and the audit questions.

Output

A short list of findings, each naming the step, the item, the contradiction and the evidence, printed with the analysis report so a reader sees what was questioned as well as what was decided.

Competencies

The engineering judgment to read a failure mode; the elegant mathematics to read a plus score back into its digits; the knowledge of the Criteria; and the steadiness to ask a senior person the question the data raises.

Measure of contribution

Not the number of findings. The contradictions found before sign-off rather than after a failure, the findings answered, the controls verified on time, and the value each audited decision protected.

TENThe auditor's tools and mechanics

Thirteen audit questions, in the order of the steps. Each one targets a specific way an analysis can go wrong.

When the auditor works

• At the gate. Before cause work starts, so the screening is checked, and every importance caveat settled, while it is still cheap to change.
• Before sign-off. The full set of questions. No signature while a finding is unanswered.
• At each review. Questions 3, 4 and the last row: has history arrived, has anything crossed the fork, did the actions work, are the controls still verified.

How to read the plus scores in ten seconds

RPN+: impact decides, incidence orders, detection breaks ties. RE+: impact decides, likelihood breaks ties. A plus score is its own audit trail. RPN+ 754 is impact 7, incidence 5, detection 4. RE+ 43 is impact 4, likelihood 3, on the simplified scales: Branch B, so the 3 is a judgment, not a count, and there is no detection digit. The auditor asks what the likelihood rests on and whether the Detection Provision is written. Its 4 is a Branch A 7 or 8 in consequence. The length tells the branch: a two-digit risk score is RE+, three or four digits is RPN+. RIQ+ 144 is worthiness 1 with the best effort and readiness ratings: a requirement worth little that happens to be cheap and ready. The auditor reads the first digit first, always, and asks why the team is spending time where the first digit is low while somewhere else it is high.

Asking the senior person

The auditor does not argue. The auditor points at the pair and asks the question the data raises: "This requirement is a Must, and by our own ratings its failure is catastrophic. Show me what protects it." Or: "This is rated incidence 2. Where is the count?" The record does the rest.

ELEVENEvery engineer an auditor

An engineer who solves problems already asks the auditor's questions. What is the requirement? What is the evidence? What is the cause, really? Did the fix work? SRA gives those questions a fixed place in a sequence and a record to write them in.

The one rule

Audit somebody else's study, never your own. Reading your own work, you rerun the reasoning that produced it: the mistake is mechanized, repeated faithfully on every pass, and each pass makes you surer of it. You will never find it. Nobody sees the hole in their own reasoning; that is why it is a hole.

A first audit, start to finish

• Read the steps once. The fourteen SRA steps are the map. Read them before your first audit and keep them open during it.
• Audit a closed study. Take an analysis already signed off, ideally one whose outcome is known. Run the thirteen questions. Compare what you find with what actually happened.
• Audit a live study with a partner. One experienced auditor, one new. Both write findings independently, then compare.
• Audit alone. From then on, take your turn in the peer rotation.

What it gives back

Fewer meetings spent chasing fairy tales. Decisions that do not have to be argued again at the next review, because the reasoning was written down. And the plain satisfaction of signing a record you know to be honest: the risk named, the evidence shown, the fix verified.

The legacy needed a priesthood to interpret its tables. The after needs engineers who read four digits and ask one good question. That is the democratization of risk analysis: not a new specialist, but every specialist, auditing.

TWELVEThe principles: what a science demands

Risk analysis is not a science of its own, but it can be held to the standards a science demands. These eighteen come from science, measurement, the theory of risk and decision-making, not from this method. Structured Risk Analysis (SRA) is not a science either; of the methods in everyday use, it is the one that comes closest. It is built on all eighteen. The legacy breaks the ten that decide the outcome. Beneath them all lies one boundary, the last row of the table, set out after it: observation is not prediction.

Observation is not prediction. Under every one of these principles lies a boundary science drew a century ago. In 1921 Frank Knight separated risk, where the odds can be measured from experience, from uncertainty, where they cannot be measured and can only be judged. Probability carries the same two meanings — a frequency observed, or a degree of belief — and engineers name the same split aleatory and epistemic. All of them impose one rule: a measured frequency and a judged likelihood are never mixed, never disguised as each other, and each holds only inside the conditions it came from. The fork is that boundary, respected. Branch A observes; Branch B predicts. The legacy erased it by putting a guessed occurrence in the same column as a counted one.

A method that breaks its simplicity, its stability, valid scales, the limits of its categories, resolution, strength of knowledge, the tails, the bounds of its evidence and the line between what it observed and what it predicted cannot be rescued by reviews and signatures. SRA does not ask to be trusted. It asks to be checked.

THIRTEENCaveat: not yet

Before the jury votes, the defense asks for the floor. Its forensic team went back to the accused’s birth certificate, and found testimony nobody had read in thirty years.

What the defense concedes

The instrument had one defect. 1629A read its grid along a diagonal of “increasing criticality,” and 882C’s indices were “assigned somewhat arbitrarily,” so a frequent marginal hazard ranked 7 and a remote catastrophe 8. Frequency could still argue a consequence down.

What happened to the instructions

The copyists kept the grid and lost the manual. The instructions were never stolen; they were garbled, one edition at a time, and never put back. The standard itself let them go: 882D (2000) defined neither severity nor probability, and 882E (2012) replaced the twenty indices with four levels, High, Serious, Medium and Low, where a remote catastrophe and a frequent marginal hazard read the same. Outside the standard, the fork was dropped. The one-index-per-cell rule was dropped. The numbers were multiplied, against the standard’s own warning, and the result was painted red, amber and green. The compass hanging on the wall today is not the instrument the standards issued: it is a colourful copy with the instructions torn out.

The defense rests

The original compass is acquitted, with one defect noted. The copy on the wall is not. SRA restores the instrument, a little easier to read and use: the fork and the crossing as 1629A wrote them, one place for every cell as 882C demanded, and the defect they left repaired, impact first by placement, never along a diagonal, and a critical impact acted on whatever its likelihood.

SOURCESWhere the facts on this page come from

• ISO 31000:2018, Risk management — Guidelines, clause 4: the purpose of risk management as the creation and protection of value.
• MIL-STD-1629A, Procedures for Performing a Failure Mode, Effects and Criticality Analysis, 24 November 1980: Task 102, criticality analysis, the qualitative and quantitative approaches and the criticality matrix.
• MIL-STD-882C, System Safety Program Requirements, 19 January 1993: 4.5.1 to 4.6, and Appendix A, 30.5.2 to 30.6.1 with Figures 1 to 3.
• Rodriguez, L., “MIL-STD-882E: Mandatory Definitions”, NDIA Systems Engineering Conference, 24 October 2012: 882D without definitions of severity and probability; 882E’s Risk Assessment Code in place of the Risk Assessment Value (1-20).
• Report of the Presidential Commission on the Space Shuttle Challenger Accident (Rogers Commission), 1986.
• Columbia Accident Investigation Board, Report Volume I, 2003.
• AIAG & VDA FMEA Handbook, 2019: the retirement of RPN in favor of Action Priority.
• Bowles, J. B., "An Assessment of RPN Prioritization in a Failure Modes Effects and Criticality Analysis", Journal of the IEST, 2003.
• Cox, L. A., "What's Wrong with Risk Matrices?", Risk Analysis, 2008.
• IEC 31010:2019 (ISO 31010), Risk management — Risk assessment techniques: clauses 6.3.5.2 (likelihood, its period and population), 6.3.7 (measures of risk), 6.4.2 (uncertainty and sensitivity), B.2.3 (FMEA), B.10.3 (the consequence/likelihood matrix).
• Hubbard, D. and Evans, D., "Problems with Scoring Methods and Ordinal Scales in Risk Assessment", IBM Journal of Research and Development, 2010.
• Wheeler, D. J., "Problems With Risk Priority Numbers", Quality Digest, 2011: the SOD code.
• Wiegers, K. and Beatty, J., Software Requirements, 3rd edition, 2013: the limits of MoSCoW.
• Boehm, B., “Software Risk Management: Principles and Practices”, IEEE Software, 1991: risk exposure as probability times loss.
• Hillson, D., “Project risks: identifying causes, risks and effects”, PM Network, 2000
• Bühlmann, H., “Experience Rating and Credibility”, ASTIN Bulletin, 1967: credibility theory, own experience weighed against a prior estimate.
• Knight, F. H., Risk, Uncertainty and Profit, 1921: risk measured from experience, uncertainty only judged.
• National Research Council, Risk Assessment in the Federal Government: Managing the Process (the “Red Book”), 1983: assessment kept separate from decision.
• The RPN and RE counts in Exhibits 1, 3 and 6, and the RE+ scores beside them, are full enumerations of every rating combination, and can be reproduced by anyone.

RPN+ and RE+, from Structured Risk Analysis by Jorge A. Parra. RIQ+ — Requirement Importance Quantified, from Structured Risk Analysis by Jorge A. Parra. Free to use, with credit. See Risk for the full statement.

Back to Risk