> ## Documentation Index
> Fetch the complete documentation index at: https://learn.nextedy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Multiple Risk Types

> Nextedy RISKSHEET is a generic tool for risk management — it supports any methodology, including FMEA, HARA, TARA, STRIDE, and CVSS.

export const LastReviewed = ({date}) => {
  if (!date) return null;
  const formatted = new Date(`${date}T00:00:00Z`).toLocaleDateString("en-US", {
    year: "numeric",
    month: "long",
    day: "numeric",
    timeZone: "UTC"
  });
  return <p className="mt-10 text-sm text-gray-400 dark:text-zinc-500 not-prose">
      Last reviewed on {formatted}
    </p>;
};

Start from the closest solution template (the functional safety template is the simplest entry point) and adjust the sheet configuration to add the types your process needs.

## Define the Risk Data Type

Every Risksheet has a primary row type defined under `dataTypes.risk` in the sheet configuration. This is the main work item type the grid renders.

```yaml theme={null}
dataTypes:
  risk:
    type: failureMode
    role: has_risk
```

| Property              | Description                                                                                       |
| --------------------- | ------------------------------------------------------------------------------------------------- |
| `dataTypes.risk.type` | Polarion work item type ID for the main row item (for example, `failureMode`, `hazard`, `threat`) |
| `dataTypes.risk.role` | Link role connecting upstream items to risk items                                                 |

The names `risk` and `task` are naming conventions, **not constraints**. The two-entity data model supports any pair of Polarion work item types — for example, `dataTypes.risk.type: requirement` and `dataTypes.task.type: testcase` to render a verification matrix.

## Add a Downstream Task Type

To pair the risk type with a second work item type — typically a mitigation, control, or test case — define `dataTypes.task`:

```yaml theme={null}
dataTypes:
  risk:
    type: hazard
    role: has_risk
  task:
    type: mitigationAction
    role: mitigates
    name: Mitigation
    zoomColumn: mitigationId
```

| Property     | Description                                                                                            |
| ------------ | ------------------------------------------------------------------------------------------------------ |
| `type`       | Polarion work item type ID. Since v25.3.1, accepts a comma-separated list to allow multiple task types |
| `role`       | Link role between risk items and task items                                                            |
| `name`       | Display name shown in the toolbar and menus                                                            |
| `zoomColumn` | Column used as the target for zoom navigation after task creation                                      |
| `document`   | Restricts tasks to a specific LiveDoc path                                                             |
| `query`      | Lucene query for additional task filtering                                                             |
| `canCreate`  | Set to `false` to globally disable task creation (default: `true`)                                     |

Set `dataTypes.task.canCreate: false` together with column-level `canCreate: false` to restrict users to linking pre-existing items from a shared library.

## Configure Visual Levels for the Hierarchy

Multiple visual rows per risk item — such as Item, Failure Mode, Cause — are achieved through **cell merging**, not through extra work item types. The data model still has only two entities (risk and task); the visual tree comes from the `levels` array. Each level names a control column whose value triggers vertical cell merging when consecutive rows share it.

```yaml theme={null}
levels:
  - name: Item
    controlColumn: item
    zoomColumn: item
  - name: Failure mode
    controlColumn: failureMode
    zoomColumn: failureMode
  - name: Cause
    controlColumn: systemItemId
    zoomColumn: causes
```

Every level entry **must** include three properties:

| Property        | Description                                                    |
| --------------- | -------------------------------------------------------------- |
| `name`          | Display name in the zoom and navigation menu                   |
| `controlColumn` | Column ID used as the grouping key for cell merging            |
| `zoomColumn`    | Column ID used as the target for zoom or drill-down navigation |

## Set the Project Property for Multiple Document Types

When a project contains more than one risk document type, configure the project property in Polarion Administration with parentheses around the list:

```
nextedy.risksheet.riskDocumentType=(riskAnalysis URRA)
```

<Warning title="Parentheses are required for multiple types">
  When specifying more than one document type for `nextedy.risksheet.riskDocumentType`, enclose values in parentheses with space separation: `(type1 type2)`. Without parentheses, only the first type is recognized.
</Warning>

## Assign Columns to Levels

Columns are placed into the visual hierarchy through the `level` integer. **The `level` property is 1-indexed**: `level: 1` maps to `levels[0]`, `level: 2` maps to `levels[1]`, and so on. Columns bound to task fields carry no level.

```yaml theme={null}
columns:
  - id: item
    bindings: item
    header: Item
    level: 1
  - id: failureMode
    bindings: failureMode
    header: Failure Mode
    level: 2
  - id: severity
    bindings: severity
    type: rating:severityScale
    header: S
    level: 3
  - id: occurrence
    bindings: occurrence
    type: rating:occurrenceScale
    header: O
    level: 3
  - id: rpn
    bindings: rpn
    header: RPN
    formula: commonRpn
    level: 3
  - id: mitigationTitle
    bindings: task.title
    header: Mitigation
```

The column property is `bindings` (plural). Use `linkedItem.fieldId` patterns such as `bindings: task.title` to display fields from the linked task, and the `task.$item` form to expose the entire linked work item to a `serverRender` template.

Severity, occurrence, and other rating scales are not declared in the sheet configuration — they come from Polarion enumerations. Columns reference them via `type: rating:<enumId>` or `type: enum:<enumId>`.

<Tip title="Multiple sheet configurations per project">
  A single project can contain multiple risk documents, each with its own sheet configuration, columns, work item types, and rating scales. New upstream items can be stored inside the current document via the `createInCurrentDocument` property on link columns.
</Tip>

## Configure Rejection Handling

When a review workflow rejects an item, behavior is governed by `removeStrategy` and the related rejection properties on `dataTypes.risk`:

```yaml theme={null}
dataTypes:
  risk:
    type: failureMode
    role: has_risk
    removeStrategy: rejected
    rejectedAction: reject
    rejectedStatus: rejected
    rejectedResolution: invalid
```

| Property             | Description                                                      |
| -------------------- | ---------------------------------------------------------------- |
| `removeStrategy`     | One of `delete`, `rejected`, `recycle_bin`, or `hide` (v23.7.7+) |
| `rejectedAction`     | Workflow action executed when a risk item is rejected            |
| `rejectedStatus`     | Status value set on the item on rejection                        |
| `rejectedResolution` | Resolution value set on the item on rejection                    |

Pick `delete` to remove items permanently, `rejected` to keep them filterable, `recycle_bin` to move them to a hidden bin, or `hide` to keep them present but filtered out by `rejectedStatus`.

## Verify Your Changes

Open the document in Polarion and confirm that:

* Work items of every configured type appear, grouped by your level hierarchy.
* Cells in each level's control column merge vertically when consecutive rows share the same value.
* Items whose type is not in `dataTypes` are filtered out of the grid.

## See Also

* [Configure FMEA Workflows](/risksheet/guides/risk-management/fmea-configuration) — multi-type FMEA configuration
* [Configure HARA Workflows](/risksheet/guides/risk-management/hara-configuration) — hazard and ASIL structures
* [Configure Downstream Tasks](/risksheet/guides/risk-management/downstream-tasks) — task configuration
* [Display Multi-Level Hierarchies](/risksheet/guides/columns/multi-level-hierarchy) — column-to-level assignment
* [Implement STRIDE Analysis](/risksheet/guides/risk-management/stride-analysis) — cybersecurity threat configuration

<LastReviewed date="2026-06-08" />