← CQE Quest · All cheat sheets

Section VII — Risk Management

~13% of CQE exam

← Section VI All cheat sheets ↑

Risk Management Framework

Risk = Probability × Consequence (Severity)

Risk management process (ISO 31000)

Context: define scope, objectives, criteria
Identification: find sources, events, and consequences
Analysis: qualitative or quantitative; likelihood × impact
Evaluation: compare against risk criteria; prioritize
Treatment: avoid, reduce (likelihood or consequence), share/transfer, retain/accept (ISO 31000 also allows taking risk to pursue an opportunity)
Monitor & review: track residual risk; update with new info

Risk matrix (typical)

Severity →	Negligible	Minor	Major	Critical
Likely	Low	Medium	High	Extreme
Occasional	Low	Low	Medium	High
Unlikely	Negligible	Low	Low	Medium

Fault Tree Analysis (FTA)

Top-down, deductive; starts with undesired top event
Works downward through logic gates to root causes (basic events)

Gate symbols

Gate	Logic	FTA meaning
AND gate	All inputs must occur	Top event requires ALL child events
OR gate	Any one input sufficient	Top event if ANY child event occurs

AND vs. OR probability

P(AND) = P(A) × P(B) [independent events]

P(OR) = 1 − (1−P(A))(1−P(B)) [independent events]

An AND gate models redundancy: the top event needs all inputs, so its probability is the product (smaller)
An OR gate models a series weakness: any input causes the top event, so its probability is larger
Minimal cut set: smallest combination of basic events that causes top event

FMEA (in Risk Context)

RPN = Severity × Occurrence × Detection [1–10 each]

High severity alone demands action — RPN doesn't capture this adequately
Actions target: reducing occurrence (design change) or improving detection
Severity can only be reduced by redesign; never by control plans alone

FMEA vs. FTA

	FMEA	FTA
Approach	Bottom-up (inductive)	Top-down (deductive)
Starting point	Component failure modes	Undesired top-level event
Output	List of failure modes with RPN/AP	Logic diagram; cut sets
Best for	New designs; comprehensive coverage	Specific scenarios; dependent failures

Hazard Analysis Techniques

Technique	Application
Preliminary Hazard Analysis (PHA)	Early concept stage; identify major hazards; define initial safety requirements
HAZOP	Hazard and Operability study; process piping/equipment; systematic what-if using guide words (no, more, less, as well as, part of, reverse, other than)
What-If analysis	Brainstorming-based; less structured than HAZOP; quick screening
Event Tree Analysis (ETA)	Forward, inductive; starting from initiating event; traces consequences through system responses
Failure Modes, Effects & Criticality Analysis (FMECA)	FMEA + criticality ranking; adds criticality number (severity × probability)

Risk Treatment Strategies

Strategy	Description	Example
Avoidance	Eliminate activity or hazard entirely	Don't use a dangerous process
Reduction	Reduce probability or consequence	Add safety interlocks, training
Transfer	Shift financial impact to another party	Insurance, warranty contracts
Acceptance	Consciously accept residual risk	Document and monitor low-risk items

Hierarchy of controls

Elimination — most effective; remove hazard entirely
Substitution — replace with lower-risk alternative
Engineering controls — guards, interlocks, ventilation
Administrative controls — procedures, training, warnings
PPE — least effective; last resort

Key Terms Glossary

Term	Definition
Hazard	Source with potential to cause harm; inherent property
Risk	Probability × consequence; potential for harm to be realized
Residual risk	Risk remaining after controls have been applied
Cut set	Set of basic events whose joint occurrence causes the top event
Minimal cut set	Smallest cut set; no proper subset also causes top event
Criticality	Combined measure of severity and probability of a failure mode
ALARP	As Low As Reasonably Practicable — reduce risk until the cost of further reduction is grossly disproportionate to the benefit

Related Learn Pages

FMEA: RPN vs. Action Priority Fault tree analysis Risk-based thinking (ISO 9001) Risk matrix vs. FMEA