SC QUALITY GUILDRisk register and heat map
SCQUALITYGUILD.COM/TOOLS/RISK-REGISTER-HEAT-MAP.HTML
Record each risk with its cause and effect, score likelihood and impact against criteria you set, choose a treatment, and see the risks on a heat map before and after the planned actions.
ON THE EXAM · CQE VII.B, VII.C.1, CQPA II.C.4, CSSBB VI.C.1, CSQP II.A, II.B, CMDA IV.A · FREE · NOTHING YOU TYPE LEAVES YOUR BROWSER
Q-BotClick for an explanation of this tool.For educational use. This page is a study aid. The method behind it has far more depth and detail than one page and one tool can cover, and what you see here is not everything the method offers or everything this site offers. For full understanding and application, use the governing standards and texts, and seek further education, training or qualified advice. Results depend on the data you enter, so check them before relying on them.
What a risk register is
A risk register is the working record of a risk management process. Each line is one risk: what could happen and why, how likely it is, how bad it would be, what is being done about it, who owns it and when it will be looked at again. A register that is written once and never reviewed is a list, not risk management.
Writing a risk
Write each risk as cause, event and effect: because the seal comes from a single source, there is a risk of a supply interruption, which would stop the line. The cause tells you what to act on. The effect tells you how to score the impact. "Supplier problems" tells you neither.
Risk criteria and scoring
Before scoring, agree the risk criteria: what each likelihood and impact level means, and which scores are acceptable. Here both are scored 1 to 5 and the risk score is likelihood × impact. The two thresholds turn the score into low, medium and high. A risk matrix, or heat map, shows the same thing as a grid, so a group of risks can be compared at a glance.
A score is a ranking aid, not a measurement. A likelihood of 1 and an impact of 5 scores the same as 5 and 1, and they are not the same risk. That is why the highest-impact risks are flagged whatever their score.
Treatment
- Avoid: do not do the risky thing, or do it another way.
- Reduce (mitigate): lower the likelihood, the impact, or both, with controls.
- Transfer or share: insurance, contract terms, a second party. It usually moves who pays, not what happens to your customer.
- Accept: a deliberate decision, at the right level, to live with the risk. Accepting a risk is not the same as ignoring it.
Residual risk is the risk expected once the actions are in place. Comparing the two heat maps shows what the plan is expected to achieve. Check later that it did.
Risk register, FMEA or fault tree?
A register covers risks of every kind: project, supplier, financial, regulatory. An FMEA looks at the failure modes of one product or process step by step. A fault tree works down from one undesired event to its causes. A register often points to where an FMEA or a fault tree is needed.
On the exam
The CQE has a whole section on risk management (VII): risk criteria, risk matrices and acceptability (VII.B.2), and documenting risks and controls in a risk register (VII.C.1). CQPA covers types of risk and avoidance, reduction, prevention, segregation and transfer (II.C.4). CSSBB VI.C.1 asks you to assess and prioritize enterprise, operational, supplier and product risk. CSQP II covers supplier risk and mitigation plans, and CMDA IV.A risk analysis, evaluation and control under ISO 14971.