Risk assessment using Failure mode and effects analysis

Revision as of 16:40, 7 April 2023

This article is under construction

Abstract

Failure mode and effect analysis (FMEA) is a risk assessment tool used in project management. It is used to systematically identify and eliminate known or potential failures in complex systems to provide data and information for risk management decisions. The tool can be traced back till the 1940’s where it originated in the US military and were used for complex development projects. The tool identifies possible failure modes, causes and resulting effects in relation to either a product, process, or service, it then evaluates the causes and proposes proper countermeasures to overcome these effects. The tool is a qualitative method but has quantitative traits and provides the user with a numerical output value. The way of doing this is using the risk priority number (RPN), which in the aspect of risk assessment is a vital part of the FMEA. In brief the 3 parameters of the RPN are discussed: severity (the consequence of the failure happening), occurrence (probability/frequency of the failures occurrence) and detection (the likelihood that the failure is detected before the impact of it happens), these numbers can all be between 1-10. The scale of these numbers has been criticized in other articles (such as Garcia et al., 2005) and therefore a standard scale for evaluation of the parameters is presented ^[1] .

Before diving into the specifics of the tool the article will explain the purpose of risk assessment, its placement in the risk management process and hereby also the purpose of the tool usage. This is followed by a thorough explanation of the application of the FMEA tool as well a discussion of the limitations of the tool, based on when and how it is applied. ^[2] . As the knowledge of the people using the tool also effects the RPN number, a discussion of diversity in relation to the tool is made to help project managers get the most effective tool usage.

FMEA and its placement in the risk management world

Describe the tool, concept or theory and explain its purpose. The section should reflect the current state of the art on the topic. Explanation of tool and risk assessment Here will be a figure with boxes describing each step in the risk assessment process with steps focused on marked out.

Depending on what organization one consults the major steps to be taken in the process of analyzing and managing risks is somewhat inconsistent. ISO has one approach, Society for Risk Analysis (SRA) has another and finally the Project Management Institute (PMI) has a third one. This is the one used for the following sections and is shown below in the figure.^[3].

Figure 1 - Risk management process with risk assessment steps marked with the blue area and risk analysis with the green area. ^[4]

As it has also been outlined on the figure, marked with the blue area, risk assessment is a part within risk management and makes up a few of the steps of the whole process. The risk assessment then again has a subpart which is the risk analysis. As the figure shows this can be either quantitative or qualitative. In the case with FMEA, the method is used both to identify risk, analyze them (using a mostly qualitative risk analysis) as well as proposing plans for risk response. Therefore, the FMEA covers more than just the risk analysis.

Introduction to risk assessments and their purpose

Before we dive into a further explanation of the FMEA tool, we begin with the purpose of the tool. This starts with a basic description of what a risk assessment is. First, we must understand what risk means. Thus, the following definition from PRINCE2 is used as a baseline for what risk is in this article. An uncertain event or set of events that, should it occur, will have an effect on the achievement of objectives. A risk is measured by a combination of the probability of a perceived threat or opportunity occurring, and the magnitude of its impact on objectives. ^[5]. Other definitions exist but this is the one that will be used here. As seen from the quote PRINCE2 define risk as both threats and opportunities, however most risk assessments mainly focus on the threats. The reason for this is the negative impact threats can have for projects and thus the need to evaluate and assess risks using risk assessments arises.

Risk assessments are relevant in the project management world as all projects undergo phases and parts that include uncertainties in the form of risks. Therefore, part of the project managers task is to be able to manage these risks. Part of the risk management process involves assessing the threats and vulnerabilities in the project. From this information the project manager must enforce countermeasures that are to be implemented to reduce the risks. A strong basis for making these decisions is vital and this is where a good risk assessment tool plays an important role in helping the project manager to respond the best way.

An example from the world of security management gives a pretty good explanation of what risk assessments is: “A risk assessment is a quantitative, qualitative, or hybrid assessment that seeks to determine the likelihood that an adversary will successfully exploit a vulnerability and the resulting impact (degree of consequence) to an asset.” ^[6]. This is quite intuitive and the very same process that is used to make a risk assessment in a project management environment. The only difference is that the adversaries are the things that can go wrong, and the asset is the project. So, to sum up, a risk assessment is one or more methods/tools that are used to discover what can go wrong and how big the impact will be if it happens.

Qualitative and Quantitative risk assessments

So multiple types of risk assessments are used for many different industries and purposes, but all of them are either quantitative or qualitative - or a hybrid, and all seek to identify risks and implement countermeasure. The qualitative approach relies heavily on the skills and knowledge of the people performing the analysis and are very useful to identify and a gain understanding of individual risks and their probability of occurring. As it is not a number-based approach it therefore also leaves a subjective result however it is the fastest of the methods to perform. The quantitative approach is evidence based and relies on numbers to evaluate and quantify project risks. This however is only possibly if the risks have already been identified using the qualitative approach. As the quantitative methods are time consuming and resource intensive, they are usually only applied to the most critical risks and the result is a number e.g., a monetary value, time delay or similar (Ben-Daya, M. (2009)).

Regarding the FMEA method this is a qualitative risk assessment method ^[7]. However, some places it is described as quantitative. The tool however consists of mostly subjective input and the ranking of the identified risks is dependent on the person using the tool therefore it is also qualitative. However, the tool delivers a numerical output, and this might be where the confusion arises and some might see it as quantitative because of this. Therefore, the tool might also be more of a hybrid than purely qualitative.

FMEA for risk assessment

The FMEA method covers multiple steps in the risk assessment process and subsequently the risk management process. The three main things the FMEA does is:

1. Identify potential risks/failures including their causes and effects.
2. Evaluate and prioritize identified risks/failure modes since not all risks are equally important (Qualitative risk analysis)
3. Find and suggest actions that can reduce or eliminate the chance that the potential risk/failure occurs (plan risk response)

So, the FMEA is a systematic approach to analyze potential failure modes aimed at preventing the failures before they happen and thus reduce the risk of a project, product, service or system. This is intended to be a preventive action and thus the method performs best when applied early in a project or process. Using a highly skilled and diverse team consisting of team members from many different areas with multidisciplinary educational backgrounds such as engineering, design, management, manufacturing etc. with a knowledge of the project type (be it product development, construction, system implementation etc.) yields an effective FMEA that will identify corrective actions required to prevent failures/risks from reaching the project/customer/end user etc. depending on what the case the FMEA is applied to.

The way of evaluating the risk is using the RPN number that is based on ranking the severity, occurrence, and detection of each failure mode on a 1-10 scale and then calculating the RPN as: Risk Priority Number = Severity x Occurrence x Detection. The ranking of each element is based on the subjectivity of the individual ranking it. To counter this a standard scale is presented in the application section. However, the newest studies from 2021 show that performing a fuzzy hierarchical FMEA (FH-FMEA) can improve the reliability of the model, as it makes the method able to work with subjectivity in the data and evaluation process. ^[8]. For further reading about the fuzzy hierarchical mythology see the reference material. Using the fuzzy approach is however much more complex and therefore the standard approach is described in the application section.

Application

Provide guidance on how to use the tool, concept, or theory and when it is applicable. In-depth explanation of how and when to apply the tool as well as detailed examples.

Applying the FMEA consist of multiple steps and results in a worksheet containing the RNP along with failure modes. A typical FMEA process is a proactive methodology that usually follows the following steps:

1. Assemble a team of carefully selected people with different job responsibilities and levels of experiences. The purpose is to bring a range of perspectives and experiences to the project.
2. Review the process steps
3. Brainstorm and list potential failure modes.
4. List potential consequences, causes and detection systems for each failure mode.
5. Assign severity, occurrence, and detection ratings for each effect.
6. Calculate the risk priority number (RPN) for each effect.
7. Prioritize the failure modes for action using RPN and recommend action to reduce or eliminate the failure mode.

In total there are 10 steps in the worksheet. An example of how that can look is shown in the figure below.

Figure 2 – FMEA worksheet with explanations. ^[9]

When to apply FMEA

Where in the project management face does one need to be to use it?

Most of the time FMEA is used in development projects and it was also primarily these sorts of projects it was developed for. The main thing is that the method is designed to find/describe failure modes in a system and evaluate them. Usually the following three types of development projects represent the use case for FMEA quite well.

   -product development projects
   -processe development projects
   -service development projects

How to apply FMEA

Here will be a figure showing the elements in matrix of the FMEA. So the FMEA always does the following three things

   -Identify possible failure mode
   -Identify consequence
   -Identify causes

Identify the possible failure modes

Consequence if failure happens and severity rating

Cause of failure and occurrence rating

Detection rating

RPN number

This is the severity x occurrence x detection multiplied and gives a number that suggested which is risk is most important.

Example of FMEA application

Here will an in depth example of the FMEA be explained using an example with an airplane from a world wide airline.

Step 1 - Failure mode identification

Step 2 - Severity, occurrence, detection rating

Step 3 - RPN number interpretation

Limitations

Critically reflect on the tool/concept/theory. When possible, substantiate your claims with literature

What the tool cannot do or where it meets its limitations

Discuss the importance of diversity in the team using the tool. How to get the most useful outcome based on limitations.

The weaknesses of the FMEA tool

Despite the advantages of FMEA, there are a number of weaknesses with the method: Bullet points:

• Multiple Failures: It is not possible to consider where multiple failures occur at once as there is no linking between failures.

• Time Consuming and people dependent: I might be very time consuming to list all potential failure modes and I relies heavily in the expertise of the people identifying them.

• Updates Required Frequently: Even with the best people and staff FMEA might miss some failure modes or new ones will be discovered as people gain experience and knowledge during the project development. This means frequent assessment ant updates.

• Underestimating Risk: If the people performing the analysis fails to consider a possible failure mode the associated risk might be underestimated.

• Potential Waste of Resources: Conversely, it might be that the analysis is to time consuming compared to what is gained from it and resources thereby are wasted.

Best usage of tool based on weaknesses

Annotated bibliography

1. ↑ Nuchpho, P. (2014). Risk Assessment in the Organization by Using FMEA Innovation: A Literature Review.
2. ↑ Ben-Daya, M. (2009). Handbook of Maintenance Management and Engineering
3. ↑ Project Management Institute Inc (PMI), (2019). Standard for Risk Management in Portfolios, Programs, and Projects
4. ↑ PMI risk management framework overview. Created by: Niels Peter Lindegaard
5. ↑ AXELOS. Managing Successful Projects with PRINCE2, The Stationery Office Ltd, 2017.
6. ↑ Risk assessments. (2007). I: Karim H.. Vellani (Red.), Strategic Security Management. Elsevier Inc.
7. ↑ Damnjanovic, I. (2019). Project Risk Management Fundamentals. Springer.
8. ↑ L. Pokoradi, S. Kocak and E. Toth-Laufer, Fuzzy Hierarchical Failure Mode and Effect Analysis, 2021 IEEE 19th International Symposium on Intelligent Systems and Informatics (SISY)
9. ↑ FMEA worksheet. Created by: Niels Peter Lindegaard