Risks

What. The risk register. Each risk has likelihood × impact scoring, a treatment strategy, and a residual score after the treatment is in place. Where. /risks.

Lifecycle

Identified → Analyzed → Treatment Planned → Treatment In Progress → Closed
                                                              ↘ Accepted

Create a risk

1. Side nav → Risk Register → New Risk.
2. Fill Risk Title (required).
3. Fill Description, Cause, Consequence (free text, all optional).
4. Pick a Category (e.g. Operational, Compliance, Strategic). (Currently optional - see Known gaps if you hit a save error.)
5. Pick Owner (a user) and Site (optional).
6. Risk Assessment - pick Likelihood (Rare / Unlikely / Possible / Likely / Almost Certain) and Impact (Insignificant / Minor / Moderate / Major / Catastrophic).
7. Inherent Risk auto-computes (Likelihood × Impact, 1-25). The level (Low / Medium / High / Critical) is derived from the score.
8. Residual Risk (Post-Treatment) - set after treatment is planned.
9. Risk Management - pick Status (Identified / Analyzed / Treatment Planned / In Progress / Closed / Accepted) and Treatment Strategy (Avoid / Reduce / Transfer / Accept).
10. Review Date - when this risk should be re-assessed.
11. Save → status defaults to Identified.

Generated columns. inherent_risk_score and residual_risk_score are auto-computed by the database from likelihood × impact. The Dart model doesn't send those fields on insert.

List page

KPIs: Total, High Risk (score ≥ 15), Requires Treatment, Closed.

Filters: Status, Category, Levels (Low / Medium / High / Critical).

Default sort: highest inherent score first, then by created date.

Each row shows: risk number (auto-assigned RISK-NNNNNN), title, level chip (color-coded), status chip, owner avatar.

Treatments

A risk can have multiple treatments that link to CAPAs. Treatment table = risk_treatments. From the risk detail:

• Add Treatment → pick a CAPA → status starts as Planned.
• When the linked CAPA flips to Closed, the treatment auto-flips to Implemented.
• Use treatments to build up the case for residual scoring.

Linkages

A risk may link to:

• A Site (risks.site_id).
• One or more CAPAs (via risk_treatments).
• One or more Audits (via risk_links polymorphic table).

Linkages render on the risk detail page in side panels.

Test it

• Create a risk with title, likelihood = Possible, impact = Moderate. Inherent Risk auto-computes 9 (Medium).
• Save → DB row has risk_number like RISK-000003, inherent_risk_score = 9.
• Edit the risk, set Residual Likelihood = Unlikely + Residual Impact = Minor → Residual score auto-computes 4 (Low).
• Add a treatment → pick a Closed CAPA → treatment status = Implemented.
• Open the linked CAPA detail; "Linked Risks" section shows this risk.
• On the list page, filter by High Risk → only score ≥ 15 risks show.