Quality approves the risk management plan, which fixes the severity and probability scales, the acceptability matrix and the criteria for residual risk before risk analysis begins. As requirements and risk controls are written, quality checks that each risk control traces to a requirement and each requirement traces to a verification protocol. The phase 1 design review closes the stage, with at least one reviewer who did not do the work.
On the map: Approve the risk management plan. Check traceability. Independent phase 1 reviewer.
Rows are disciplines, columns are stages 1 to 8. Select a square to open that task.
Back to the full map
Approve the risk plan before engineering scores hazards, and run the Phase 1 review with a reviewer who did not write the documents. Check the trace from risk to requirement to test.
The matrix is set before any hazard is scored, so the criteria cannot drift to fit the results. Senior management signs off on acceptability. Many teams add a middle zone that requires every practicable risk control while still allowing release.
Requirements with no verification, risk controls with no requirement, and requirements that trace to nothing upstream. A reverse trace from design features back to requirements exposes hidden assumptions.
The regulation asks for someone without direct responsibility for the stage under review. In a small company this is a person from the same organization who was not involved in writing the documents, or an outside consultant with comparable expertise.
User needs and requirements are approved, the risk plan is approved, the first risk analysis is done, and open issues have owners. Unresolved concerns are tracked under change control.
See the open positions and apply.