Welcome back to Morris Medical Monthly: a monthly series for medical device development companies (and companies who are related to such companies), providing some useful information about Polarion solutions and Polarion extensions.

Today we will start on the subject of Polarion’s RiskPack extension, and have a look into RiskPack’s Basics.

Risk analysis: Identify sequences of events

After the first collection of ideas described in the previous section, you need to define complete sequences of
events. You need to create a new sequence of events work item for each sequence of events, and the – according to
your data model – link the data entered in the previous step with the roles starts with, contains and ends with. In any
case, a harm should be the end of the sequence of events and of course, one sequence of events can lead to
multiple harms or can have multiple starting points.

After that, you have defined a complete and detailed description of how your device can lead to a harm. The
Sequences Of Events Table helps you to keep control over your data.

Risk analysis: Identify risks

Up to this point, you only modeled how your device can lead to a harm, but not how likely that is. That’s exactly
what you need the work item type “Risk” for. Create a new Risk work item and link the sequence of events it considers
via the link role “considers” with the sequence of events. After that, set the “risk probability” attribute of the risk to the
correct value according to your analysis. Every such Risk entry will produce a line in the Risk Table and an entry in
the Risk Control Matrix. Depending on your risk policy settings, the RiskPack can automatically identify whether the risk is acceptable or not.

How a risk can be linked to harms and sequences of events

Every risk needs an information on the severity of harm it considers. As the severity of harm is an attribute of a harm
work item, every Risk type work item somehow needs to be linked to a Harm type work item. There are multiple ways this can
be achieved.

A harm is linked via a sequence of events

In the example above, a risk is linked to a sequence of events (via “considers”) and that sequence of events end
with a harm. Therefore, it is clear which harm is considered by the risk. If only a sequence of events is linked to a
risk, the severity of the harm linked with that sequence of events is taken for risk consideration.

Multiple harms are linked via a sequence of events

If multiple harms are linked, the RiskPack takes the most severe severity for estimation of the risk.

A harm is directly linked to the risk

Sometimes, one sequence of events can lead to different harms in the same way, but the harms have different
probabilities of occurrence. For example, a sequence of events can lead to death with a significant lower probability
than to skin burn. In risk management, that leads to two risks: death (high severity, low probability) and skin burn
(medium severity, high probability). In the RiskPack, you will model this by creating two risk entries, both linking to
the same sequence of events, but one also linking to death and the other one linking to the sequence of events and
the harm “skin burn”. If a Harm work item is directly linked to a Risk work item, the severity of that directly
linked Risk is taken for risk estimation. In the end, you will have two rows in your Risk Table and two entries in
your risk matrix, with possible different acceptance levels.

Multiple sequences of events are linked

One Risk can be linked to any number of sequences of events. There will always be only one entry in the Risk Table
and the Risk Matrix. Doing this can be useful if the same risk control measure can be used to reduce the probability
of occurrence of all the sequences of events considered.

Sequences of events that are absolutely impossible to ever take place

If you have identified and documented a sequences of events in an early stage of risk analysis and later you find out
that this sequence of events absolutely cannot take place, there is a special attribute you can use for this. You
can still create a Risk work item and link it to the sequence of events, but you set the “risk type” to “impossible risk”
and leave the probability value unset. This will lead to an entry in the Risk Table for documentation, but not to any
entry in the Risk Matrix.

Sequences of events that only take place after application of a risk control measure

Sometimes, a risk control measure can lead to a new sequence of events that was not possible before application of
the risk control measure. Such sequences of events can be entered just like any other and can be estimated by
using a risk work item just like described above. But there is one difference in that case: Such risks should not be
shown in the “Risk Matrix before mitigation”. You can use the “risk type” attribute to tell the RiskPack that this is an
“Introduced Risk”, meaning, it was not present before application of risk control measure. It will not show up in the
“Matrix before mitigation” then.

For more information about Polarion’s RiskPack visit our Extension Portal using following link:

http://extensions.polarion.com/extensions/184-polarion-alm-riskpack-iso-14971.

I hope you liked this article and you will visit our Blog again when there is another Morris Medical Monthly article.

---