Risk Assessment modification

[Mickey_Cegon]

We currently use the Risk Assessment for Change Management, and would like to add additional criteria to the process. I'm not sure how to do this, or if it's even possible.

In our current process, we have 7 questions, and a Threshold of Score greater than 14 is High. Currently, if the Risk is High, the Change goes to CAB. If it's Low, it does not go to CAB, just needs Manager approval. These are the changes that are raising the concerns, and some, even though they score low on the Risk Assessment, may need to still be reviewed by CAB.

The requested change includes 3 distinct areas of assessment, Probability, Impact, and Recoverability. Each of these areas has 2 questions, with 3 answers ranging in value of 1, 3, 5. If a combination of scores in the Recoverability, Probability, or Impact areas exceeds 7, the change will be flagged as requiring CAB review and approval. In addition, if the total score for the change exceeds 15, the change will be flagged requiring CAB review and approval.

I'm not seeing a way I can do this, using the current method of calculation. The only thing I can think of to do is to not use the Risk Assessment, and have each of the new questions be a Choice List on the form, and do separate calculations on each area of assessment.

Has anyone run into this before, where the straight calculation is not getting the results needed?

Thanks,

Mickey Cegon
FBL Financial Group, Inc.

[eric_szonyi]

I don't believe there is a simple way to do this although it could be done. The challenge is it would require changing the logic in a Script Include called RiskAssessmentCalculator to change how the thresholds are exceeded.

Additionally you would need to tag the Assessment questions with Probability, Impact or Recoverability so those tags could be read by the Script Include to evaluate the responses in groups in addition to the whole list of responses.

[Mickey_Cegon]

Thanks for the direction on this. I will try your suggestions.

Mickey

[Mickey_Cegon]

So, I decided to go a different direction with this, and am trying the following to come up with the scores needed.

I created the following new fields on the change_request table:

U_rfc_complexity (choice field)
U_rfc_tested(choice field)
U_probability_score - integer

U_rfc_outage_impact(choice field)
U_rfc_multiple_systems(choice field)
U_impact_score - integer

U_rfc_backout_complexity(choice field)
U_rfc_data_loss_risk(choice field)
U_recoverability_score - integer

U_total_score - integer

Each of the choice fields has 3 choices, with values of 5, 3, and 1.

What I'd like to do is for each of the sets of choices, add the values of the 2 choices to the corresponding score field, and then add all three scores into the total score field. Then, I should be able to have logic that says if the total of any of the 3 sub-scores is greater than 7, do X, if the total score is greater than 15, do Y.

What would be the appropriate method to accomplish this? I'm picturing this where the staff member would fill out the initial Risk Assessment when they first log the request, but at some point, the answer to one or more of the questions may change as more information regarding the change is gathered. Once the request moves into the approval stage, the form is locked down, and the assessment is no longer editable.

Is this doable?

Thanks,

Mickey Cegon
FBL Financial Group, Inc.