> ## Documentation Index
> Fetch the complete documentation index at: https://learn.nextedy.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Set Up Risk Matrices
> Configure severity, occurrence, and detection rating scales with Risk Priority Number (RPN) formulas and conditional cell formatting to implement risk evaluation matrices in Nextedy RISKSHEET.
export const LastReviewed = ({date}) => {
if (!date) return null;
const formatted = new Date(`${date}T00:00:00Z`).toLocaleDateString("en-US", {
year: "numeric",
month: "long",
day: "numeric",
timeZone: "UTC"
});
return
Last reviewed on {formatted}
;
};
## How Rating Scales Are Defined
Rating scales such as severity, occurrence, and detection are NOT defined inside the sheet configuration. They are standard Polarion enumerations, and Risksheet binds to them like any other Polarion field.
The setup follows four steps:
1. **Define the enumeration in Polarion.** In **Administration > Enumerations**, create an enum (for example `severity-enum`, `occurrence-enum`, `detection-enum`). Each enum entry has an ID (used in formulas), a name (shown in dropdowns), and an optional description.
2. **Add a custom field on the risk work item type.** In **Administration > Work Items > Custom Fields**, add a field (for example `severityRating`) whose type points at the enumeration you created.
3. **Bind a Risksheet column to the custom field.** In the sheet configuration, declare a column with `type: rating:` and `bindings: `.
4. **Reload the document.** The server loads enum values automatically — there is nothing to register in the sheet configuration file.
This is why no `ratings`, `enums`, or `relations` section appears in any real production sheet configuration. Those sections do not exist in the Risksheet engine. Rating scales live in Polarion, where they benefit from the platform's permissions, audit trail, and reuse across projects.
## Configure Rating Columns
Once the Polarion enumerations and custom fields exist, declare the rating columns in the sheet configuration. Use `type: rating:` for the rating dropdowns and a `formula` reference for the calculated RPN column:
```yaml theme={null}
columns:
- id: sev
bindings: severityRating
header: S
type: rating:severity-enum
- id: occ
bindings: occurrenceRating
header: O
type: rating:occurrence-enum
- id: det
bindings: detectionRating
header: D
type: rating:detection-enum
- id: rpn
bindings: rpn
header: RPN
formula: commonRpn
```
Three rules of thumb:
* `bindings` (plural) is the property name. It carries the Polarion custom field ID, not the enumeration ID.
* `type: rating:` tells Risksheet to render a dropdown sourced from the named Polarion enumeration.
* A column that sets `formula` becomes read-only by default — the value is calculated, not user-entered.
## Add RPN Formulas
Define named formulas in the `formulas` section. The standard FMEA RPN multiplies severity, occurrence, and detection:
```yaml theme={null}
formulas:
commonRpn: "function(info){ var value = info.item['occ']*info.item['det']*info.item['sev']; return value ? value : null; }"
commonRpnNew: "function(info){ var value = info.item['occNew']*info.item['detNew']*info.item['sevNew']; return value ? value : null; }"
```
* `commonRpn` calculates the initial RPN before mitigation (S x O x D).
* `commonRpnNew` calculates the revised RPN after mitigation actions are applied.
The `info.item['']` accessor reads the current row's value for a given column ID. Returning `null` when any input is missing keeps the RPN cell empty until all three ratings are entered.
For probability/severity matrices (without detection), implement a `riskValue` function that maps severity and probability combinations to risk categories such as acceptable, further investigation, or unacceptable. See [Set Up Action Priority Matrix](/risksheet/guides/risk-management/action-priority-matrix) for this approach.
## Apply Conditional Formatting
Use `cellDecorators` and `styles` to color-code the RPN cell based on numeric thresholds. The decorator toggles a CSS class on the cell; the `styles` section defines what each class looks like:
```yaml theme={null}
cellDecorators:
rpn: "function(info){ var val = info.value; $(info.cell).toggleClass('boldCol', true); $(info.cell).toggleClass('rpn1', val > 0 && val <= 150); $(info.cell).toggleClass('rpn2', val > 150 && val <= 250); $(info.cell).toggleClass('rpn3', val > 250); }"
styles:
".boldCol": "{ font-weight: 600; }"
".rpn1": "{ background-color: #eaf5e9 !important; color: #1d5f20 !important; }"
".rpn2": "{ background-color: #fff3d2 !important; color: #735602 !important; }"
".rpn3": "{ background-color: #f8eae7 !important; color: #ab1c00 !important; }"
```
This creates a three-tier visual risk matrix:
| RPN Range | CSS Class | Color | Risk Level |
| ---------- | --------- | ------ | ---------- |
| 1 -- 150 | `.rpn1` | Green | Low |
| 151 -- 250 | `.rpn2` | Yellow | Medium |
| > 250 | `.rpn3` | Red | High |
Thresholds are deployment-specific. The 150/250 split shown here matches several Nextedy reference configurations, but production teams often tune the boundaries to their own risk acceptance criteria. Always use `$(info.cell).toggleClass(...)` rather than inline styles — grid cells are reused as you scroll, and toggle calls clean up correctly on each render.
When configuring severity from a linked item (for example an Accident or Harm), verify that the formula references the correct field binding. The formula accesses `info.item['fieldBinding']` — if the severity value comes from a different work item type in the hierarchy, adjust the binding path accordingly.
## Configure Row Header Risk Indicator
Apply the risk level to row headers for at-a-glance assessment using the `headers.rowHeader.renderer` property:
```yaml theme={null}
headers:
rowHeader:
renderer: rowHeaderRpnNew
cellDecorators:
rowHeaderRpnNew: "function(info){ var val = info.item['rpnNew']; $(info.cell).toggleClass('rpn1', val > 0 && val <= 150); $(info.cell).toggleClass('rpn2', val > 150 && val <= 250); $(info.cell).toggleClass('rpn3', val > 250); }"
```
This colors the row header based on the post-mitigation RPN (`rpnNew`), giving engineers instant visibility into which risk items still require attention after mitigations are applied.
Complex matrix logic — multi-dimensional lookups, ASIL classification, role-based thresholds — is best placed in the top panel configuration (`risksheetTopPanel.vm`) rather than inline formulas in the sheet configuration. The sheet configuration then contains thin wrappers that delegate to top-panel functions, which keeps the declarative grid configuration stable when calculation logic changes.
## Verify Your Changes
After reloading the document you should see:
* Rating dropdowns populated from the Polarion enumerations, with descriptions visible as tooltips.
* The RPN column calculating automatically as soon as severity, occurrence, and detection are all entered.
* Cells displaying green, yellow, or red formatting based on the RPN thresholds.
* Row headers reflecting the post-mitigation risk level.
If the dropdowns are empty, the most likely cause is that the custom field is not bound to the correct enumeration in Polarion — fix it in **Administration > Work Items > Custom Fields**, not in the sheet configuration.
## See Also
* [Configure FMEA Workflows](/risksheet/guides/risk-management/fmea-configuration) -- complete FMEA setup with risk matrices
* [Configure HARA Workflows](/risksheet/guides/risk-management/hara-configuration) -- HARA risk matrices with probability/severity
* [Set Up Action Priority Matrix](/risksheet/guides/risk-management/action-priority-matrix) -- alternative to RPN scoring
* [Apply Conditional Formatting](/risksheet/guides/styling/conditional-formatting) -- additional formatting patterns
* [Configure Calculated Columns](/risksheet/guides/columns/calculated-columns) -- formula configuration details