Risk Matrix & Assessment
Reliatic implements a 5×5 Probability of Failure × Consequence of Failure risk matrix aligned with API 581 quantitative methodology and ISO 31000 governance principles. Risk scores are live—they recalculate automatically when inspection data, thickness readings, or damage mechanism parameters change.
The 5×5 Risk Matrix
Risk Score = PoF Level × CoF Level. The platform computes both axes quantitatively from asset data; qualitative overrides are permitted with justification but require engineer sign-off.
Probability of Failure (PoF)
Under the API 581 Annex 2A methodology, PoF is calculated as the product of a generic failure frequency (from the API 581 equipment database) and a damage factor (DF). The DF is computed from thickness loss fraction, time in service, and inspection effectiveness category.
PoF = Gff × Df_thinning Where: Gff = generic failure frequency (API 581 Table 3.1) Df = damage factor Df_thinning = f( art, // allowable remaining thickness fraction time, // inspection age (years) insp_eff, // NDE effectiveness category A–E n_insp // number of qualifying inspections ) Example (V-2041, CS carbon steel, HCl service): Gff: 6.1e-5 failures/yr Df: 420 PoF: 2.56e-2 → Level 4 (High)
Thinning DF > 1000 or corrosion rate > 3× expected
Thinning DF 100–1000
Thinning DF 10–100
Thinning DF 1–10
Thinning DF < 1
Consequence of Failure (CoF)
CoF is assessed across three categories. The highest category score is used. Category thresholds are configurable to match your organisation's risk tolerance and regulatory environment (Settings → Operations → Risk Matrix → CoF Thresholds).
| Level | Label | Safety | Financial | Environmental |
|---|---|---|---|---|
| 5 | Catastrophic | Fatality or permanent disability | > $10M | Major release, off-site impact |
| 4 | Critical | Serious injury, hospitalisation | $1M–$10M | Significant release, on-site |
| 3 | Moderate | Medical treatment required | $100K–$1M | Minor release, contained |
| 2 | Minor | First aid treatment | $10K–$100K | Negligible, no reportable |
| 1 | Negligible | No injury | < $10K | No release |
Governance Thresholds
Each risk band maps to a specific governance response. Thresholds are configurable per tenant but must be approved by the platform administrator. Changes are logged in the immutable audit trail.
Governance event fired immediately. Asset state → LOCKED. Mitigation Action or Risk Acceptance required within 48 hours. Escalation to VP-level if not actioned.
Governance event created. Governed artifact required within 14 days. Escalation to senior engineer if unactioned.
Risk event logged. Planned mitigation required in next maintenance window. Review in 90 days.
Monitor and review on standard inspection cycle. No governance event required unless score trend is increasing.
Critical threshold enforcement: The LOCKED state cannot be bypassed by any user role. Once an asset reaches a Critical risk score, the governance workflow must be completed before operational sign-off is available. This is an enforced platform invariant.
Risk Assessment Workflow
Navigate to an asset, then select Risk → New Assessment to initiate a structured assessment. The platform guides the assessor through each step and validates completeness before the score is committed.
Identify applicable damage mechanisms from the platform library (corrosion, fatigue, SCC, erosion, etc.). Each mechanism carries a default PoF contribution that is adjusted by inspection history.
For API 581 assessments: PoF = generic failure frequency × damage factor (DF). The DF is calculated from corrosion allowance consumed, time-in-service, inspection effectiveness, and NDE results.
CoF is calculated across four categories: Safety, Environmental, Financial, and Production Loss. The highest category determines the CoF level used in the matrix.
PoF level (1–5) × CoF level (1–5) = Risk Score. The score determines the risk band and associated governance response.
Inspection type, NDE method, and interval are derived from the risk score. High-risk assets receive shorter intervals and more rigorous NDE coverage.
After mitigation or inspection, the assessment is rerun with updated inputs. Residual risk must fall to an accepted band before the governance event is closed.
Matrix Configuration
Administrators can adjust the following parameters under Settings → Operations → Risk Matrix Configuration. All changes create an immutable audit record with the approving administrator's identity and timestamp.
Adjust the financial, safety, and environmental breakpoints for each CoF level to match your organisation's risk appetite.
Set the minimum score at which each governance response is triggered. The minimum Critical threshold is 15 (cannot be set above 25 or below 10).
Maximum days allowed for a compliance deviation before escalation. Default 90 days per standard; configurable 1–365 days.
Days before a due date at which the status changes to Due Soon and notifications are sent. Default 30 days.
Maximum interval between mandatory risk re-assessments regardless of score level. Default 3 years per API 581 recommendations.