Identification of hazards and Risk file

That's a good point and great way of tackling the use error related risks the same format as the rest (while acknowledging their specific nature). I understand the danger of misusing the 'probabilities', but I've found discussion about actual probability of occurrence / harm sometimes interesting (as a part of medical device file or outside) to assess the need for practical mitigations - especially for low severity issues.

Still the same question - would the 'probabilities' be mandatory aspect of use error risk analysis or not from standard perspective?

Not mandatory as such, but you do need to document your risk estimation.
Then you need to evaluate this documented estimation, for whether it's acceptable or not.

What would you replace the probabilities with?

Koskis said:

would the 'probabilities' be mandatory

Click to expand...

Just to add to the response from @ThatSinc, as you apply risk controls, you're generally only going to lower the probability score.

yodon said:

Just to add to the response from @ThatSinc, as you apply risk controls, you're generally only going to lower the probability score.

Click to expand...

Quite.
And once you've implemented controls and verified their effectiveness - you *should* be able to apply a probability to the Hazardous Situation (and harm, depending on how you've defined your HS and tested your controls) occurring.

So it's likely that scoring a pre-controls probability at 100% or whatever qualitative rating you have to state "we've got no ruddy idea, there's a lotta stupid people out there" and then re-assessing with an actual value once you've put controls in and tested them will be easier. Though if you think of a new way to do it - please do share!!

Makes sense - and I think this is the best way Thought came from one project where client had used IEC62366 examples as only quantitative criteria for assessing risk - and I started exploring whether this could actually work. But would have real challenges on telling the story of how mitigations decrease the risk as you pointed out. Thanks!

Koskis said:

Question: Based on your interpretation of these two standards: in the "final" risk analysis for user error based hazards - is it mandatory to document probability of occurrence in addition to severity?

Click to expand...

I don't know if I would use the word mandatory, but specifically for usability (in this case, it looks like this is a failure modes type of analysis) occurrence ratings. I have a couple of points to introduce:

• The usability team had better have a member capable of assessing relative ratings for occurrence, and if the don't it is time for a long weekend at the library checking references.
• If the usability team cannot reach consensus on the relative rankings, then I believe that the usability testing (could be formative, could be summative) should include dimensions to help inform the final choice.