Skip to content
Operational Excellence
Module 3 of 4

Design Controls, Not Just Risk Scores

11 minutes · Advanced

Learning objective

By the end of this lesson, you can write a complete failure chain and distinguish prevention, detection and residual-risk evidence.

Why it matters

An FMEA table can look precise while hiding vague reasoning. A number cannot tell a team what to redesign unless it is connected to a function, failure, effect, cause and real control.

Core concept: preserve the causal chain

Write each row in this order:

  1. intended function;
  2. failure mode;
  3. effect and severity;
  4. cause and occurrence evidence;
  5. prevention control;
  6. detection control;
  7. action and residual-risk evidence.

Prevention acts on the cause. Detection reveals the cause or failure before the effect escapes. Planned actions do neither until they are implemented and verified.

Visual explanation

Text alternative: a cause produces a failure mode and effect. Prevention acts on the cause, detection reveals the problem before escape, and verified actions strengthen those controls.

Worked example

An AI refund assistant selects an obsolete account. The effect is financial loss and customer delay; the cause is reliance on historical attachments. A rushed reviewer sees only a fluent summary.

The stronger action is to obtain eligible destinations from the transaction system, block unsupported accounts and display destination evidence separately. The rating changes only after tests show that mismatches are blocked without unacceptable false holds.

Common mistake

Mistake: treating a high Risk Priority Number as the only trigger for action.

Two failure chains can share the same product of ratings while one has catastrophic severity and the other is frequent but minor. Review the dimensions and control weakness, not only the total.

Quick check

When may a team lower the detection rating?

A. When an action is assigned.
B. When training is scheduled.
C. After an implemented control demonstrates earlier, reliable detection.
D. When the total score feels too high.

Answer: C. Residual risk must follow verified control performance.

Practical prompt

Choose one AI-assisted decision. Write its function, a failure mode, effect, cause, current prevention and detection. Then replace one attention-dependent control with a testable system control.

Summary

  • Start with function and causal logic, not ratings.
  • Separate failure, effect and cause.
  • Distinguish prevention from detection.
  • Give severe effects explicit judgement.
  • Update residual risk only after verified action.

Next lesson

Apply the method in Stress-Test the Refund Assistant, where fluent output hides a consequential account-selection risk.

Next step

Mistake-Proof the AI Action Boundary

Continue