These three levels implement the ISO 14971:2019 risk evaluation outcome categories. The Investigation tier corresponds to the ALARP (As Low As Reasonably Practicable) principle, where risks require further analysis or benefit-risk justification before acceptance.
Classification Levels
| ID | Name | Description | Color | Action Required |
|---|---|---|---|---|
acceptable | Acceptable | Risk is tolerable without further action | Dark #330000 | None — risk is within acceptable limits |
investigation | Investigation | Risk requires further analysis or benefit-risk justification | Amber (implied) | Perform benefit-risk analysis per ISO 14971 Clause 7.4, or apply additional risk controls |
unacceptable | Unacceptable | Risk requires mandatory risk reduction | Red #dd0000 | Apply risk controls to reduce probability or eliminate the hazard |
Where This Enumeration Is Used
Therisk enum is applied to two fields on the Risk Record work item:
| Field | ID | Purpose |
|---|---|---|
| Pre-mitigation risk | preRisk | Initial risk level before any risk controls are applied |
| Post-mitigation risk | postRisk | Residual risk level after risk controls are applied |
Risk Matrix Derivation
The risk classification is determined by the intersection of composite probability P (columns) and harm severity S (rows) in the 5x5 acceptability matrix:| P=1 | P=2 | P=3 | P=4 | P=5 | |
|---|---|---|---|---|---|
| S=1 Negligible | A | A | A | A | I |
| S=2 Minor | A | A | I | I | U |
| S=3 Serious | A | I | I | U | U |
| S=4 Critical | I | I | U | U | U |
| S=5 Catastrophic | I | U | U | U | U |
Risksheet Visual Styling
Risk classification values are color-coded in the HARA risksheet using CSS cell decorators:| CSS Class | Risk Value | Color | Visual |
|---|---|---|---|
rpn1 | Acceptable | Green | Green cell background |
rpn2 | Investigation | Amber | Amber cell background |
rpn3 | Unacceptable | Red | Red cell background |
rpn4 | Benefit-Risk Acceptable | Purple | Purple cell background (HARA only) |
The
rpn4 purple styling is a fourth visual state unique to the HARA risksheet. It is not an option in the risk enum itself — it appears only in the Final Risk Classification and is rendered when the finalRisk field is set to benefitAcceptable.Three-Stage Risk Resolution
The risk classification feeds into a three-stage evaluation pipeline on each Risk Record:- preRisk — initial classification from the risk matrix (before controls)
- postRisk — residual classification from the risk matrix (after controls)
- finalRisk — conclusive determination including benefit-risk analysis (see Final Risk Classification)
Configuration Details
| Property | Value |
|---|---|
| Source file | .polarion/tracker/fields/riskRecord-risk-enum.xml |
| Enum type | riskRecord-risk |
| Applied to | Risk Record (preRisk, postRisk) |
| Computed by | riskValuePre / riskValuePost formulas in risksheet |
| Used in reports | Risk Matrix Report, ISO 14971 HARA Report (Sections 4-7) |
Related Pages
- Harm Severity Levels — vertical axis of the risk matrix
- P1 Hazard Probability Levels — input to composite probability
- P2 Harm Probability Levels — input to composite probability
- Final Risk Classification — the conclusive risk determination after benefit-risk analysis
- Evaluate Initial Risk (Pre-Mitigation) — how-to guide for initial risk evaluation
- Evaluate Residual Risk (Post-Mitigation) — how-to guide for residual risk evaluation
Sources
Sources
Code:
riskRecord-risk-enum.xml, riskRecord-custom-fields.xml, risksheetTopPanel.vm, risksheet.json (HARA), Hara Risk Matrix Report page.xml