Risk Analysis Calculator

The Risk Analysis calculator determines how the change affects business critical services. It uses the change category, the estimated effort, and a group of questions to determine the risk level of the change.

The Risk Analysis calculator appears on the Risk tab of an RFC. The risk level is determined to be either Low, Medium, or High based on the above criteria. The default ranges are: Low is less than or equal to 20; Medium is 21 to 40; High is greater than 40.

Note: Total Risk Score contains the summation of the weighted answers to the survey.

On the Risk tab, the risk level is only displayed when the Risk Analysis Completed field is set to Yes. This ensures that users have answered the risk survey before calculating the risk level. If the risk survey has not been completed and Risk Analysis Completed remains set to No, the risk level displays Questionnaire Not Completed.

Tip: When creating a report to show high risk items, remember to include both items that have a high Total Risk Score and items that have a change category set as Major and their Risk Analysis Completed field set as No. Items without a completed risk survey will show a lower overall risk level since the risk level sums the survey responses and a null response is given a weight of zero.

The following are the default questions and weighted answers (default weights) in the Risk Analysis questionnaire:

Does the change affect business-critical services?
- High Impact: Service temporarily unavailable / major changes (10)
- Low Impact: Small upgrade, some features temporarily unavailable (5)
- No Impact (0)
Does the change affect major IT infrastructure components?
- High Impact: Components taken offline / major service impact (10)
- Minor upgrade or temporary performance degradation (5)
- No Impact (0)
Will the change be tested prior to implementation in a development or test environment?
- Yes (3)
- No (7)
Is the implementation well understood and documented?
- This process has been done in the past and is repeatable (0)
- This process is similar to one done in the past (5)
- This is a completely new process or implementation (10)
What is the implementation time? (This field is set automatically based on the value entered in the Estimated Effort field for the change request. It can also be manually modified by choosing a selection in the list. The Estimated Effort field appears on the Implementation tab for a change request. This tab appears when approving a change.)
- 4 hrs or less (0)
- 4 hrs to less than 1 day (5)
- More than 1 day (10)
What is the change complexity? (This field is set automatically based on the value of the Change Category field.)
- Minor (0)
- Significant (5)
- Major (10)

Modifying the Risk Calculator and Survey

You can modify the risk calculator and survey so that it reflects your company's processes. This topic describes how to do this.

The Risk Calculator uses a summation field to add the values of the weighted selections. The summation value is then evaluated using a JavaScript which adds a risk level of either Low (0-20), Medium (21-40), or High (>40).

The Risk Level is configured to only display a result when the Risk Analysis Completed field is set to Yes. This field is automatically updated by a JavaScript to Yes if any of the four survey fields contain an answer. After being set to Yes, the weighted values are summed and the results displayed. If not, the Risk Level displays Questionnaire Not Completed.

You can modify the risk survey and calculator, such as the risk level thresholds, the questions, or the weightings of the answers. The modifications are performed in SBM Composer, and then deployed to your server.

The following are some changes that you could make to the survey:

Make the survey mandatory by marking all of the fields as Required.
Modify the weighted responses to questions by editing the field and setting the weighted values on the Options tab of the Property Editor for the field.
Change existing questions and answers by modifying the field names and descriptions in the Property Editor for the field.
Add new questions by adding Single Selection fields with weighted values. To add the new questions:
- Modify the Total Risk Score Summation field to include the weighted value in the result.
- Add the new field to the Risk tab on every form in the Change Management process application.
- Add the field name to the JavaScript contained in the calcRisk_Transition HTML/JavaScript widget. This script checks whether the question was answered. The following JavaScript excerpt is an example of how to add a new field:
```
AddChangeCallback("ESTIMATED_EFFORT", funcLinkEstimatedEffort); 
AddChangeCallback("RISK_ANALYSIS_Q1", funcAnalysisCompleted); 
AddChangeCallback("RISK_ANALYSIS_Q2", funcAnalysisCompleted); 
AddChangeCallback("RISK_ANALYSIS_Q3", funcAnalysisCompleted); 
AddChangeCallback("RISK_ANALYSIS_Q4", funcAnalysisCompleted); 
AddChangeCallback("RISK_ANALYSIS_Q5", funcAnalysisCompleted); 
AddChangeCallback("NEW_FIELD_NAME", funcAnalysisCompleted); 
```

Change the range for how risk is calculated by editing the JavaScript on the state forms. The JavaScript is contained in the calcRisk_State HTML/JavaScript widget. For example, you would make the following change to add an additional risk category for Medium-High for risk scores between 31 and 40:

<script type="text/javascript">
AddLoadCallback(calcRisk);
function calcRisk() \{
var answered = GetFieldValue("RISK_ANALYSIS_COMPLETED");
if(answered == "Yes") \{
var score = parseInt(GetFieldValue("TOTAL_RISK_SCORE",  0));	
if(score > 40) \{ SetFieldValue("RiskScoreLabel", "(High Risk)"); }
else if( score > 30) \{SetFieldValue("RiskScoreLabel", "(Medium-High Risk)"); }
else if( score > 20) \{SetFieldValue("RiskScoreLabel", "(Medium Risk)"); }
else \{ SetFieldValue("RiskScoreLabel", "(Low Risk)"); }
\}
else \{
SetFieldValue("RiskScoreLabel", "(Questionnaire Not Completed)"); 
\}
\}
</script>

Change how the estimated effort is weighted by modifying the JavaScript on the transition forms. The JavaScript is contained in the calcRisk_Transition HTML/JavaScript widget. For example, to set everything to less than one-half of a day (12 hours) as low impact and everything else as high impact:

<script type="text/javascript">
var funcLinkEstimatedEffort = function()\{
	var effort = GetFieldValue("ESTIMATED_EFFORT", "");
	var implTimeFld = GetFieldByName("RISK_ANALYSIS_Q5");

	if(effort != "") \{
        //Convert Estimated Effort field from milliseconds to hours
		var hours = effort / 3600000;

		if(hours > 12) \{ implTimeFld.selectedIndex = 3; \}
		else \{ implTimeFld.selectedIndex = 1; \}
		
		DisableField("ESTIMATED_EFFORT");
	\}	
\}

For more information on working with fields, refer to the SBM Composer Guide.