For findings and non-conformities it can be required that a risk assessment is carried out — a **risk level**, resulting from the combination of **severity** and **likelihood** through the configured risk matrix. Whether this is required is decided **per category**, so a non-conformity can demand it while an observation does not.

This applies to every module using the same finding editor, among them incident reports, risk assessments, safety reports, ship defect reports and site management.

## When the risk matrix appears

The matrix is only shown in the finding when **all** of the following are true, configured under *Audit / Item Categories*:

* the **root cause analysis** is switched on for the category, **and**
* the option **show additional risk analysis** is set, **and**
* an **approved default risk matrix** exists.

If one of them is missing, no matrix appears. This behaves identically whether a finding is being created or an existing one edited.

## When it is mandatory

If the category additionally has **mandatory** set, a risk level has to be assigned before the finding can be saved or closed. This is the usual setting for non-conformities. Without it the risk level is optional.

## Where the requirement is enforced

* **While editing** an open finding, it cannot be saved without a risk level — the message *Please assign risk level first.* appears.
* **When closing on board** (*Completed on Board*), the risk level is checked as that status is set.
* The **office** afterwards only checks correctness during approval; it is not blocked a second time for a missing risk level.

## Findings that were already closed

Findings closed before the requirement was introduced have no risk level. They can still be opened and saved — the requirement is **not applied retroactively**, so historical records are never blocked.

If the entire audit is closed, the finding opens read-only regardless of the risk level; see [Closed Audits](/HSSEQ/Audit-and-Inspect/Closed-Audits.md).

## When no risk matrix is available

If the risk assessment is set to mandatory but **no approved default risk matrix** exists, the assessment is switched off and the finding can be saved **without** a risk level, so no work is lost. The message *No default approved risk matrix available* points to it — in that case check the risk matrix configuration and approve a matrix.

*[PO]: Purchase Order  
*[AZA]: local folder
*[(PO]: Purchase Order  
*[RQ]: Requisition  
*[(RQ]: Requisition  
*[RfQ]: Request for Quotation  
*[(RfQ]: Request for Quotation  
*[SO]: Service Order  
*[(SO]: Service Order  
*[SQ]: Service Requisition  
*[(SQ]: Service Requisition  
*[SRfQ]: Service Request for Quotation  
*[OoB]: Open on Board  
*[(OoB]: Open on Board 
*[ART]: Average Running Time (operation hours per day) 
*[MC]: Master Contract
*[ADS]: Advantage Database Server (database engine used in previous versions of the ZeeBORN software)
*[.replic]: file extension for replication files (aka data transfer files)