Almirah — Free, Open Requirements & ALM Framework for Regulated Industries

Risk Registers

Almirah renders risk management the same way it renders everything else: risks are Markdown files in a risks/<register>/ folder, and the register — with computed risk priority numbers, colour bands, and links into the requirements — is generated from them.

Configuring a register

A register is declared in project.yml: which folder it lives in, which record sections appear as columns, and how the risk priority number (RPN) is computed:

risks:
  - folder: fmea
    columns: [Failure Mode, Severity, Occurrence, Detection, Mitigation, Affected Documents, Status]
    rpn:
      - name: Initial
        inputs: [Severity, Occurrence, Detection]
        thresholds:
          acceptable: 50
          unacceptable: 200
      - name: Residual
        inputs: [Residual Severity, Residual Occurrence, Residual Detection]
        thresholds:
          acceptable: 50
          unacceptable: 200

Each RPN group multiplies the values of its input sections. The thresholds drive the colour coding: at or below acceptable is green, at or above unacceptable is red, and the band between is amber. A group with a single input (for example, a precomputed CVSS score) is surfaced unchanged — no product is computed.

Anatomy of a record

A risk record is a Markdown file whose sections carry the data: a Status history table (Identified, Analysed, Mitigating, Accepted, Closed — current status marked with *), the descriptive sections your methodology calls for, one numeric section per RPN input, and the traceable tail — an Affected Documents controlled table linking the proposed controls up to requirements, plus a Monitoring section:

# Severity

9

# Occurrence

4

# Detection

6

A record without residual scores simply leaves its Residual cell blank in the register — an honest picture of what is mitigated and what is not.

One mechanism, four methodologies

The RPN configuration is generic enough to express very different risk approaches — each of these is a live demo:

FMEA (IEC 60812) — Initial and Residual groups over Severity × Occurrence × Detection.
Fault Tree Analysis (IEC 61025) — criticality as Severity × Likelihood, one record per minimal cut set, fault trees as SVG images right in the register overview.
Security risks with CVSS (ISO 27005) — a single-input group surfacing the CVSS v3.1 base score, thresholds on the CVSS severity boundaries.
Project risks — the simplest form: one Probability × Impact group, no residual scoring.

Building it

Nothing new to learn — a register is part of the ordinary build:

$ almirah please my_project
parsing specifications ..... 2 ok
parsing risk records ....... 5 ok
risk links ................. 5 ok
rendering HTML ............. my_project/build/index.html

The register table, the colour-coded RPN columns, the per-record pages, and the links between risks and requirements all appear in the rendered output. Records whose status is not Closed count as open in the registries summary — your open-risk list is always one build away.