Skip to main content

​
Prerequisites

  • A populated HARA Analysis with risk records
  • Pre-mitigation P1 and P2 probability values assigned
  • Harm severity assigned on linked harm work items

​
Accessing the Report

  1. Navigate to the project wiki pages
  2. Open Hara Risk Matrix Report
  3. Alternatively, from the Home dashboard under “Explore More Views,” click HARA Report (the HARA report links to the risk matrix)

​
Understanding the Matrix Layout

The report renders two 5x5 matrices:

​
Axes

  • Y-axis (rows): Combined Probability P (1-5, from bottom to top)
  • X-axis (columns): Harm Severity S (1-5, from left to right)

​
Cell Content

Each cell displays the count of risk records that fall into that P-S combination. Cells are color-coded by the risk acceptability classification:
ColorClassificationMeaning
GreenAcceptableRisk is within tolerable limits
Amber/OrangeInvestigationRisk requires further evaluation
RedUnacceptableRisk exceeds acceptable limits; controls required
Matrix cells include hover effects with opacity change and box shadow. The HTML title attribute on each cell shows the P value, severity ID, and item count as a tooltip.

​
Pre-Mitigation Risk Distribution Matrix

The first matrix shows initial risk distribution before risk controls are applied.

​
How Probability Is Calculated

For each risk record, the combined probability P is computed from two factors:
  1. P1 (preHazardProbability): probability that the hazardous situation occurs
  2. P2 (preHarmProbability): probability that the situation leads to harm
The product P1 x P2 is mapped to a probability bucket:
P1 x P2 Product RangeProbability Bucket
1 — 31 (Improbable)
4 — 82 (Remote)
9 — 153 (Occasional)
16 — 204 (Probable)
21 — 255 (Frequent)

​
How Severity Is Resolved

Severity is not stored directly on the risk record. Instead, the report:
  1. Gets linked work items from the risk record via linkedWorkItems().direct()
  2. Finds the first linked item of type harm
  3. Extracts the severity enum value (1-5) from that harm item

​
Post-Mitigation Risk Distribution Matrix

The second matrix shows residual risk distribution after risk controls are applied, using postHazardProbability and postHarmProbability fields.
The post-mitigation matrix is completely hidden when no risk records have post-mitigation data. It only appears when at least one risk record has post-mitigation probability values assigned.

​
Residual Risk Summary

Below the post-mitigation matrix, the report displays a summary with conditional alerts: diagram The alerts follow this priority:
  1. Danger box (red) — if any unacceptable risks remain post-mitigation
  2. Warning box (amber) — if investigation risks remain but no unacceptable
  3. Success box (green) — if all risks are acceptable

​
Interpreting the Risk Shift

Compare the two matrices to assess the effectiveness of your risk controls:
PatternInterpretationAction
Red cells move to greenControls are effectiveDocument in risk control plan
Red cells move to amberPartial improvementConsider additional controls or benefit-risk analysis
Red cells remain redControls insufficientImplement stronger controls per ISO 14971 Clause 7.4
Cells shift left (lower S)Severity reducedUnusual — verify data accuracy
Cells shift down (lower P)Probability reducedExpected outcome of effective controls
Risk controls typically reduce probability (P) but not severity (S). If you observe a shift in severity between pre- and post-mitigation matrices, verify that harm severity values are correct — severity is an inherent property of the harm, not affected by controls.

​
Technical Details

PropertyValue
Data sourcetype:riskRecord work items via Lucene query
Probability fieldspreHazardProbability, preHarmProbability (pre) / postHazardProbability, postHarmProbability (post)
Severity resolutionLinked harm work item severity field
Risk classification5x5 decision matrix with nested if/elseif logic (hardcoded thresholds)
CSS scoping.risk-matrix-report-container
Print supportpage-break-inside:avoid on sections
Report dateFalls back to “Auto-generated” if page timestamp unavailable

​
Next Steps

Report template: .polarion/pages/spaces/_default/Hara Risk Matrix Report/page.xml | Data: type:riskRecord work items | Bucketing: P1xP2 product mapped to 5 buckets (1-3, 4-8, 9-15, 16-20, 21-25) | Severity: resolved via linked harm work item