Advanced (JSON) Risk Configuration

Risk Factor Configuration

interface IRiskConfig {
    factors?:IRiskConfigFactor[], //  a list of factors contributing to risk levels, see below
	....
}


interface IRiskConfigFactor {
    type:string, // an unique identification of the factor
    label:string, // the label displayed in the UI, where user can enter some text, e.g. "Cause" or "Effect"
    weights: IRiskConfigFactorWeight[] // an array of definitions describing how the factor contributes to the risk level, each weight is a a drop down of values
    hideTextInput?:boolean, // default: false, set to trueif there should not be a text input field to specify details 
    readonly?:boolean, //  default: false, can be set to true if user should not be able to change the field 
    inputType?:IRiskConfigFactorInputType, // default:text (a single line text input), can be used to overwrite the input as a drop down selection or a text area 
    options?: IRiskConfigFactorOption[], // if inputType is "select" this contains the values which can be selected 
}

type IRiskConfigFactorInputType = "text"|"select"|"textarea";

interface IRiskConfigFactorOption {
    value:string, // a unique identifier
    label:string, // text to display
    changes:IRiskConfigSelectChanges[] // for input select only. Allows to automatically change other inputs / weights when the select changes 
}

interface IRiskConfigSelectChanges {
    changesFactor?:string, // identifier (type) the factor to be modified OR
    changesWeight?:string, // identifier (type) the weight to be modified 
    value:number // the new value to set
}

interface IRiskConfigFactorWeight {
    type:string, // an identifier of the contributing factor
    help:boolean, // if set true a help popover will explain the values
    label:string, // the label displayed in the UI, where the user can select a value from the drop down, e.g. "Probability", "Severit"y or "Detectability"
    readonly?:boolean, // default false, set to true, if an input field should not be changeable by the user  
    hidden?:boolean, // default false, set to true, if field should be hidden
    values:IRiskConfigFactorWeightValue[] // an array of options of the drop down
}

interface IRiskConfigFactorWeightValue {
    shortname:string,// name displayed in the UI, can omitted to only show the factor
    help:string,// name displayed in tool tip help
    factor:number //factor which goes into calculation of risk
}

Definition Risk Assessment Method

interface IRiskConfig {
    method:IRiskConfigMethod, // "+" or "*" whether to add or multiply the risk factors, "lookup" to get values from lookup table
    ...
    rbm?:IRiskConfigRT,// allows to overwrite the default text used for Risk Before Mitigation fields. 
}

type IRiskConfigMethod = "+"|"*"|"lookup";


interface IRiskConfigRT { 
    short:string, // text used in UI just before the field
    long:string, // text used in tooltip in UI
    report:string, // text used in report
    hidden?:boolean // default:false, set to true if this should not be displayed/reported
}

Sum or Product of Weights

interface IRiskConfig {
    ...
    maxGreen?:number, // the maximum risk level value which will be shown in green (low risk)
    maxYellow?:number, // the maximum risk level value which will be shown in yellow (moderate risk), all above will be red (high risk)
    ... 
}

Lookup of Weights

interface IRiskConfig {
    ...
    charts?:IRiskConfigZone[], // colors and text per risk class
    rpns?:IRiskConfigRPN[], // lookup table to determine for risk priority numbers based on weights
 
    ... 
}


interface IRiskConfigZone {
     zone?:string, // unqiue ID
     foreground?:string, // foreground color in the user interface
     background?:string, // background color in the user interface
     textColor?:string, // text color in reports
     label?:string // text to be displayed
}

interface IRiskConfigRPN { // e.g. { "probability":5, "severity":4, "zone":"LOW", "text":"5 x 4 = 20" }
    zone:string, // ID of zone
    text:string, // for below combination of numbers: the resulting zone(char) and text
    [key:string]:string|number // properties for each weight defining the lookup value for this lookup entry
}

Risk Reduction Settings

interface IRiskConfig {
    ...
    mitigationTypes?:IRiskConfigMitgationType[], // a list of categories which can be used as risk controls, see below. If there are no mitigations the RBM section will not be shown.
    reductions?:IRiskConfigReduction[], // a list describing how risk levels can be reduced by risk controls, see below.
    postReduction?:IRiskPostReduction // option for user selection after risk controls
    ...
}

Risk Reduction per Risk Control

interface IRiskConfigReduction {
    name:string,// a unqiue id of the reduction factor
    options:IRiskConfigReductionOptions[] // an array of reductions factors describing how the risk level can be reduced. These show up as drop down of values:
}

interface IRiskConfigReductionOptions {
    shortname:string, // the string shown in drop down
    by: number,  // the amount by which a factor of the risk is changed (so negative values reduce the risk level)
    changes:string, // defines which weight is reduced.
}

Global Risk Reduction

interface IRiskPostReduction {
    weights:IRiskConfigFactorWeight[] 
}

Definition Risk Assessment Method

interface IRiskConfig {
    ...
    ram?:IRiskConfigRT,// allows to overwrite the default text used for Risk After Mitigation fields. 
}

interface IRiskConfigRT { 
    short:string, // text used in UI just before the field
    long:string, // text used in tooltip in UI
    report:string, // text used in report
    hidden?:boolean // default:false, set to true if this should not be displayed/reported
}