Skip to main content
A risk entry records a concern or opportunity associated with another Alforse entity. It has a type, independent 1–5 ratings for severity and likelihood, an assignee, and a status that moves from "Open" to "Closed" or "Accepted". The quality module’s provides the company-wide view; each source entity also displays its related risks. Open Quality → Risks for the company-wide register. You can also create risks from item, customer, supplier, job, quote-line, and maintenance-dispatch pages.

​
What a risk entry holds

Every entry is one riskRegister record (validated by riskRegisterValidator in apps/erp/app/modules/quality/quality.models.ts). The fields you set:

​
Rating severity and likelihood

Both ratings use the same 1–5 scale, rendered by RiskRating.tsx as a row of colored bars — one bar per point, colored by level: 1–2 emerald, 3 yellow, 4 orange, 5 red. On an entity card the severity bars sit behind a warning icon and the likelihood bars behind a dice icon, so you can read both at a glance without a number. Because the two ratings are independent, a low-likelihood, high-severity risk (a rare but catastrophic failure) and a high-likelihood, low-severity one (a frequent nuisance) both show honestly rather than collapsing to the same middle score. You decide how to weigh them.

​
Status lifecycle

Status is a free-set enum (riskStatus in quality.models.ts). Alforse does not enforce a state machine — any status can move to any other; you set where the entry stands.
There is no separate “mitigation action” entity: treatment is tracked by moving the status through "In Review" → "Mitigating" and recording detail in the notes field, then landing on "Closed" (treated) or "Accepted" (tolerated).

​
Attaching risks to entities

The same register surfaces as a card on the pages of the things it protects. Each entity page mounts the shared card with a fixed source and passes the record’s id, so the card shows only that entity’s risks and new entries inherit the right source. Wired entry points:
  • Items — parts, materials, tools, consumables, and services, via ItemRiskRegister.tsx (source="Item", which also fills the dedicated itemId foreign key).
  • Customers — CustomerRiskRegister.tsx, at the customer’s Risks tab.
  • Suppliers — SupplierRiskRegister.tsx, at the supplier’s Risks tab.
  • Jobs — JobRiskRegister.tsx (source="Job", which also fills the item).
  • Quote lines — QuoteLineRiskRegister.tsx (source="Quote Line").
  • Maintenance dispatches — the dispatch page mounts the card with source="Work Center", keyed to the dispatch’s work center.
The Work Center source has no card of its own on the work-center page; its risks appear on maintenance dispatches and in the company-wide list, which joins the work center name through the riskRegisters view. A standalone risk created from Quality → Risks with no entity gets source="General".

​
Who can do what

Creating a risk requires only that you’re an employee of the company — the new-risk route gates on role: "employee", not a quality create permission, so anyone on the floor can raise one. Editing and deleting are stricter: the edit route requires quality update and the delete route requires quality delete, and the database enforces the same split. When you set or change an assignee, Alforse fires a RiskAssignment notification to that person (a background notify job). On edit it only notifies when the assignee actually changed, so re-saving an entry doesn’t re-ping the same owner.

​
Relation to issues and CAPA

The risk register is its own table and is not linked to non-conformances or their corrective/preventive actions in code — a risk does not spawn an issue, and closing an issue does not touch a risk. They’re complementary: an issue records a defect that already happened and drives it to closure through workflow tasks, while a risk register entry is forward-looking, capturing something that might go wrong (or an opportunity worth pursuing) so you can weigh and treat it before it does. Use the risk register for proactive assessment and the issue system for reactive containment.