How the ADG Risk Assessment Engine Works

1The model in one paragraph

Every risk carries two coordinates on a 0–100 scale: a probability that the harm occurs, and a severity of the harm if it does. Multiply them together and you have the rating. Controls sit in a five-tier hierarchy. Each control of a given tier contributes a diminishing share of that tier's base reduction. Total reductions cannot push a coordinate below zero, and the total rating cannot drop more than one band below where it started — unless the hazard is genuinely eliminated, in which case both coordinates fall to zero and stay there.

2The pre-rating

Probability and severity are entered on a discrete matrix of size N, where N is between 3 and 10 inclusive (configurable per account). Each matrix position v from 1 through N maps to a percentage:

Position 1 always yields 0 %. Position N always yields 100 %. For a 5×5 matrix, the five positions land on 0 %, 25 %, 50 %, 75 %, and 100 % respectively. For a 10×10 matrix the same span is covered in nine equal steps of roughly 11.1 % each. The underlying arithmetic never changes — only the granularity of what the user can pick.

The pre-rating for a single risk is then the product of the two percentages, divided by 100:

The result is a number between 0 and 100. It maps to a band:

3The control contribution series

Controls are grouped by tier. There are five tiers, and each tier has a base reduction expressed as a percentage pair (probability, severity):

Within a tier, the k-th control of that tier contributes base divided by k. The first control of a tier gives the full base. The second gives half. The third gives a third. The k-th gives 1/k:

Sum all controls of tier t and you get the tier's total reduction, which is the base multiplied by the k-th harmonic number H(k):

The harmonic number grows logarithmically. Here it is for the first ten integers:

In plain English: the first control of a tier gives the greatest reduction. The second gives half of that. The third gives a third of that. Adding ten administrative controls is not ten times as effective as adding one — it is about H(10) ≈ 2.93 times as effective, and no amount of paperwork will ever match a single engineering change.

For large n, the harmonic number converges to the natural logarithm plus the Euler–Mascheroni constant:

4The band-floor feasibility constraint

Reductions alone would let a user pile administrative controls on a Critical risk and quietly push it into Low. The engine refuses this. Let β(r) be the band of rating r. The post-rating must satisfy:

In words: the post-rating band cannot fall more than one band below the pre-rating band. A Critical risk can drop to High; it cannot drop to Medium without elimination. A High risk can drop to Medium; it cannot drop to Low without elimination. The engine solves for the maximum reduction that still satisfies this constraint, and stops there.

5The elimination override

Elimination is the only control tier that fully removes a hazard. When at least one Elimination control is present on a hazard, the band-floor constraint is dropped and the post-coordinates are forced to zero:

Other controls are still listed against the hazard for record-keeping and print, but they play no part in the calculation. Elimination is rare by design — you cannot eliminate a moving machine, you can only guard it.

6The post-rating

With the reduction totals R_P and R_S settled (capped by the floor rule if not eliminated), the post-coordinates and the post-rating follow:

The new band is read from the same table as the pre-rating. The difference between the two is the risk reduction achieved.

7Statistical properties

The model has four invariants that hold for every assessment:

• Convergence. The series H(n) grows without bound but never in a straight line. Total reduction from a tier of k controls is at most B·H(k), which for practical k stays below 3·B. Adding controls asymptotically saturates.
• Monotonicity. Adding a control — of any type — never increases the post-rating. The model is strictly non-worsening.
• Floor feasibility. Absent elimination, the post-rating never drops more than one band below the pre-rating. This is enforced by construction, not by validation afterwards.
• Determinism. No random sampling, no shuffling of inputs, no hidden state. The same tree in produces the same numbers out — on every server, in every session. This is what makes the printed assessment legally defensible.

8Why this matters

A risk assessment that ignores diminishing returns inflates the impact of administrative controls. A risk assessment without band-floor constraints permits workers to “engineer away” residual risk with paperwork. Most spreadsheets do both, silently. This engine refuses to.

The result is not a conservative assessment. It is an honest one. The numbers on the printed page reflect what the mathematics supports, not what the assessor wishes were true.