With the 7.12.2 RiskView Live update, we have implemented a new feature that allows user to assign mitigative risk controls as severity reducers.
Instead of reducing the likelihood flow within the bowtie, severity reducer, like the name described, reduces the severity of the consequence that it is connected to.
To enable severity reducing controls in RiskView, navigate to the Configuration Editor > Register Policies > Analysis > Enable Severity Reduction On Risk (this is disabled by default)
Once that option is enabled, navigate to the bowtie that you want to work on. A new option will appear in the Analysis Options tab (note that this option will not be visible for bowties in Simple Risk Analysis Type).
Once the bowtie option is enabled, you can then change the mitigative risk controls from likelihood reducers to severity reducers (the default being likelihood reducers). When the mitigative risk control is switched over to severity reducer, the bowtie will automatically recalculate the likelihood and severity for the bowtie.
In the example below, the mitigative risk control has an effectiveness of “Excellent”, which has 2 orders of magnitude in risk reduction factor. For a likelihood reducing controls, it should reduce the likelihood by 2 orders of magnitude, which should bring the current likelihood down to “Very Likely (1)” as that is the lowest option. Instead, what the screenshot is showing us is that it is not reducing any likelihood, as the mitigative risk control is a severity reduction control.
Delving into the related consequence, we can see that the mitigated severity is shown in the consequence details and it has been reduced by 2 orders of magnitude (from the mitigative risk control).
You can use the mitigated severity as the source for the consequence risk rating, as shown below.