Customized Risk Assessment Method

[Former Member]

Hi

Our client is asking for a customized risk assessment method where we need to add one more component in the risk matrix (Standard method).

Rating will be calculated on (Probability X Severity X Detectability),the bigger the risk, more important to addresses the issue.

i need to know the end to end steps to be followed for configuring the same  in SPRO.

Regards

John Zacharia

[Former Member]

Hi John,

The component extension of EHSM 2.0, 3.0 would fulfill your exact requirement.

Using this model, you can calculate 'initial, inherent & residual risk' based on the rating Probability X Severity X Detectability by suggesting new & existing controls. It is well defined functionality when compare old one.

Thanks

Mahes

[Former Member]

HI John,

This is not possible in SAP standard method to add one more component "Detectability" to the standard method of risk matrix.

Option 1 -

Here you have to see, how this detectability can be maintained in the risk assessment method.

whether this detectability is some how related/ connected to the Probability (or) Severity. check whether the client have any techniques to quantify the value of detectability based on the other values (probability &severity).

for ex - when probability - HIGH, Severity - HIGH, then the Detectability value = HIGH

If this is the case, you can maintain the custom table with the entries and you can call the "Rating" fromt the custom table itself. Because the Risk matrix Rating values, maintained in the config table no more valid, as one more new component (Detectability) is coming into picture, which will impact the result.

for this entire process, you can use the BADI - EHSI_ANNC_RATCP (Calculation of rating for standardized criteria) to extract the final rating from the 3 components as mentioned above.

Option - 2 -

If the value of the detectability, is no more relevant to the values of Probability/ Severity. then you have to go for screen enhancement.

SPRO > Environment, Health & Safety > Industrial Hygiene and Safety > Risk Assessment > Analysis Methods > Assign Analysis methods to Agent types.

Here, you can add new analysis method (similar to "CNC - standard Criteria"). Program "SAPLCBIH_LB32". you have to tweak the same program and add additional component to the same.

In both the cases, Risk Matrix values maintained in the config. may not be useful as the rating was maintained in 2 dimensional (2 components). now one more component addition (3 dimensional)would differs the final rating.

below path to be extended in the custom table with new component consideration -

SPRO > Environment, Health & Safety > Industrial Hygiene and Safety > Risk Assessment > Set Up Risk Matrix.

If that is the case, the BADI mentioned above to be used to calculate the same.

check whether the client required the present standard criteria also in addition to the new one.

If client already dealing the risk assement proecess in production, take care while dealing with this enhancement - there is a chance of negative impact to the old assessments.

Regards

kamal

[Former Member]

Hi kamal

Client requires the standard method to made available in the system so we are planning to create a new analysis method. The new analysis method will have the 3 components ( Probability, Severity & Detectability). As per the sap documentation we need to follow the below steps

1.  Create a customer structure

   2.  Create a function group for the analysis method

  3.  Adapt Customizing

can you please explain the 1 & 2 step, i went through the document but not clear on what it does.

Regards

John Zacharia

Pls find below risk matrix  to be incorporated in to the new analysis method

S ( Severity)		P (Probability)		D (Detection)		RISK INDEX (RI)
5	VH	5	VH	5	IMP	95 to 125	VH
4	H	4	H	4	S	55  to 94	H
3	M	3	M	3	M	35 to 54	M
2	L	2	L	2	Q	20 to 34	L
1	N	1	N	1	VQ	1 to 19	N

[Former Member]

Hi John,

the 1& 2 steps you are asking about is - to use the short cuts (or) best practices to the ABAPer while doing the enhancement.

1. create a customer structure -

If you check the tables behind the screen of the analysis methods - for ex - standard criteria,

Table name appear as - CCIHS_ANNCIOT (input output table) and the data element - CCIHE_RATING

If you check the table values for this, you can find the structures CCIHT_AM01, CCIHT_AM02, etc.,

If you want to add additional fields, like "Detectability" in your case, you have to enhance the above mentioned structure to hold this additional value.

2.  Create a function group for the analysis method -

As I mentioned in my previous post, you have to copy the standard functions and edit them as per your requirement.

function group - CBIH_LB34 (Template for cust. analysis methods), can be used for your requirement.

by doing this you can copy most of the functionality including the function modules working in this group. after that it can be edited according to your requirement.

this will be a easier way to the developer.

after doing this, the new program details and screen details must maintain in the config as i mentioned in my previous post.

As I mentioned earlier, eventhough you are adding the new field "detection", the final rating would be considered based on "Probability"and "Severity" only. because in config - we are maintaining the ratings based on these 2 components. not considering the component like "Detection".

you have to develop the BADI - EHSI_ANNC_RATCP, in addition to the above.

system considers the "Detection" value, whenever the rating calculation happens.

Regards

kamal