A data quality risk analysis is an analysis with regards to data quality.

Objective of a DQMS is that the data quality requirements are met. A risk analysis shows which situations or events could lead to these objectives not being met and which measures should be taken to reduce the risk to an acceptable level.

Purpose of a risk analysis is to determine actions that prevent data issues.

• Risk analysis is part of a data quality management system
• Risk analysis is aimed at meeting data quality requirements.
  
• Risk analysis prevents data issues.
  
• Risk analysis is assess in a internal audit.
  
• Risk analysis is discussed in management review.
• Risk analysis leads to action.

A risk analysis consists of the next elements:

1. Asset that has effect on the objectives, e.g., supplier, input file, producer, applications, infra structure, communication, procedures, metadata, etc.
2. Situation with regard to the asset that can cause an event
3. Event that can take place that has a negative effect on the objectives
4. Measures already taken to prevent or correct the situation or event
5. Exposure: frequency that the situation can occur
6. Probability: chance that the event will take place
7. Severity: gravety of the effect on the objectives
8. Risk-index: Exposure x Likelyhood x Severity
9. Additional measures needed to decrease the risk-index if the risk index is too high (preventive actions).

The Fine and Kinney method shows which values should be assigned to exposure, probability and severity.

The factor exposure indicates the duration that a risk can occur. The scale varies from 0.5 to 10.

• 0,5 Very rarely (less than once a year)
• 1 Rarely (yearly)
• 2 Sometimes (monthly)
• 3 Occasionally (weekly)
• 6 Frequently (daily)
• 10 Constantly (multiple times a day)

The probability or (mathematical) chance an incident will occur. The expectation is represented by ascribing a value from 0.1 to 10.

• 0,1 Next to impossible / unthinkable
• 0,2 Almost unimaginable
• 0,5 Highly unlikely, but conceivable
• 1 Unlikely, but possible in the long term
• 3 Unusual (but possible)
• 6 Possible
• 10 To be expected

The factor severity indicates the possible damage, effects and consequences linked to a hazard. The scale reaches from 1 to 40.

• 1 Slight effect
• 3 Important effect
• 7 Severe effect
• 15 Very severe effect
• 40 Disaster

The result of multiplying the parameters defines the risk-index: R = S x E x P.

• R < 21 Slight risk; acceptable
• 21 < R = 71 Little risk; attention required
• 71 < R = 201 Moderate risk; apply simple measures
• 20 < R = 401 High risk; apply large measures immediately
• R > 401 Risk is too high; stop activities / operations

Objective: Timely reporting to an external party.

Euronorm. Fine and Kinney Method.