One risk model.
Every module.
Register, FMEA, JHA — every assessment in one workspace, scored on your org's own risk matrix. A register risk imports straight into the MOC that changes it — scores, controls and lineage copied in one step. No spreadsheets, no reconciliation.
Risk Register
· 142 active · 7 above toleranceFILTER · OPERATIONALThree disciplines, one workspace.
Risks in the Register for governance, FMEAs for design and process work, JHAs for safety walks — scored on the same scales, banded by the same thresholds.
Risk Register
Strategic and operational risks, severity × likelihood scoring, treatments, owners, review dates. Above-tolerance risks surface to the unified Actions queue automatically.
FMEA
Design and Process FMEAs in the same workspace. S × O × D scoring with the RPN derived, recommended actions that open in the action register, and separate revised columns so the re-score after a mitigation sits beside the original instead of overwriting it.
JHA / Job Safety
Step-by-step task hazards with control hierarchies. PPE, engineering, administrative — every control linked to the action that delivers it, or to the approved document version — down to the section.
Import from the register, assess in context.
An MOC or an exemption imports a risk straight out of the register — header, dimension scores, controls and their links copied in one step, with the original recorded as its source. It stays its own assessment on purpose: "how risky is this operation" and "how risky is this change to it" are different questions, and answering the second shouldn't rewrite the first.
The assessment decides who signs.
A change's risk level is derived from the highest residual score across every assessment on it — recomputed as you score, so the record always shows where it stands. Submitting freezes it, and the approval chain is selected from that frozen level, so the people who have to sign can't change after the decision was routed.
FMEA, the way engineers think.
Process or Design — same workspace. Severity, Occurrence, Detection scored consistently. Recommended actions open in the action register, and revised S/O/D columns record the re-score once one lands.
Characteristics, not just steps
An FMEA row can name the product characteristic it analyses, picked from the linked products and their whole bill of materials — because an FMEA is written against an assembly while the features that fail live on its children.
RPN you can act on
Severity, Occurrence and Detection are scored per row and the RPN is derived, so it can't disagree with its inputs. A row's recommended action opens in the action register with an owner and a due date, where it is tracked like any other.
The re-score is kept, not overwritten
Revised Severity, Occurrence and Detection sit in their own columns beside the originals, so the row shows what the mitigation was worth rather than just its current state. Every edit lands in the Part 11 record history.
Walk the job. Log the hazard. Close the loop.
JHAs structured the way safety leads actually work — step by step, with control hierarchies (elimination → substitution → engineering → administrative → PPE). Each control points back to the approved document that delivers it — pinned to the version, down to the section — or the action that will.
The system that pulls every other module along.
Risk doesn't sit on a quarterly review cycle. Cross-module triggers route every change through the right gate, automatically.
MOC routing by risk score
An MOC that touches a risk above your threshold is automatically routed for safety/quality/operations approval before it can ship. No more changes slipping through review.
Capture the risk behind the NCR
One click on a non-conformance drafts the register risk it exposed: title, scoring suggestion and candidate controls built from the NCR's own losses and root-cause analysis, ready for your review.
Reviews come due on schedule
Every risk carries a review cadence and a next-review date, so periodic review is a queue to work, not a date to remember.
Losses set the severity
Loss lines on an NCR total against your monetary and hours thresholds and band the severity automatically — and severity decides whether closure demands a root-cause analysis.
One risk model, every module.
Stop reconciling spreadsheets that disagree. Start running risk where the work happens.