Risk significance assessment on the basis of a fuzzy model

. The paper considers the problem of risk significance assessment in the activity of a testing laboratory. The accreditation criteria of such laboratories include requirements for implementation of risk management in the organization of their activity. To optimize the risk management process, it is proposed to create an expert system based on fuzzy modelling of the derivation of the risk significance assessment. The expediency of this approach is justified by the expert nature of information on the parameters of risks, subjectivity and uncertainty in their assessments. A description of the subject area “Risk significance assessment” is given, groups of input features and an output parameter are established, the corresponding linguistic variables are introduced, basic and extended term-sets are defined, membership functions are constructed. A fuzzy expert knowledge base has been created, the fuzzy inference of assessing the significance of risks is based on. The proposed algorithm for assessing the significance of risk was tested, confirming its suitability and effectiveness for creating an expert system.


Introduction
In modern conditions, the role of risk management is increasing, in particular, in the activity of testing laboratories. The accredited testing laboratories that meet international requirements can count on internationally recognized test reports [1]. Testing laboratories test products from various areas of the production sphere, including enterprises of the agroindustrial complex. The choice of the accredited testing laboratory is relevant for enterprises targeted both for the domestic market and the external one. The availability of accreditation with the laboratory promote confidence for the test reports, and accordingly increases its competitiveness. For compliance with the requirements of ILAC (International Laboratory Accreditation Cooperation), Rosaccreditation introduced new criteria for national accreditation, as close as possible to the international ones [2]. In 2019, a requirement for the laboratory to have a risk management system in the field of laboratory activities was introduced into these criteria [3].
At present, risk management is defined as coordinated actions to control and analyze risk in an organization [4] and is understood as a part of the organization's quality management system. According to GOST ISO 17025-2019, the risk and opportunity management system can be an element of the laboratory management system [5]. The testing laboratories face the urgent task of implementing such a risk management process that will be optimal in the operating conditions of the laboratory. Currently, several qualitative and quantitative methods of risk assessment are used [6,7], some of them are standardized [8]. For effective risk management and obtaining reliable and accurate test results, the risk analysis tool (Ishikawa diagram), failure cause and effect analysis (FCEA), fault tree analysis (FTA), event tree, project risk analysis and risk matrix can be used [7,9,10], etc. To analyze risks, taking into account external and internal factors, special economic and mathematical methods are used [11,12]. Their use, as a rule, assumes that the failure events are statistically independent and have an accurate probability. However, a considerable part of information in the field of risk assessment, their significance and consequences, is of an expert nature. As a result, the role of subjectivity in assessing risk parameters is great; in addition, most of the parameters are of a qualitative nature. This obviously indicates the fuzzy nature of the expert information. The influence of measurement uncertainty on risks is noted in [11], where a binary rule is applied to make a decision within the framework of a probabilistic approach to risk assessment. In [13], the apparatus of the theory of fuzzy sets and Bayesian networks were used to describe uncertainties, combine expert opinions, and update a priori probabilities.
In this paper, to assess the significance of risks in testing laboratories, it is proposed to create a decision support information system (expert system) based on fuzzy modelling. Such expert systems have shown their effectiveness in various areas, including the management of various processes. For example, this approach was successfully applied in to assess the level of maturity of the organization in the quality management system [14]. The relevance of the stated problem at present is becoming even more important not only in connection with modern requirements to quickly and effectively respond to risks, but also in view of appearing more and more non-routine risks [15].

Materials and methods
As far as is known, the risk assessment process includes several stages: identification, analysis, and assessment of risks, impact on risks, as well as an analysis of the results of this impact and subsequent improvement [8]. All the stages are carried out according to the principle of a systematic approach. The main risks have been identified for the testing laboratories: risk of violation of storage conditions for measuring instruments; the risk of losing a supplier; the risk of violation of the calibration schedule; the risk of violation of the verification conditions of the calibration procedure. The level of risk significance is the main characteristic of risk depending on the probability and severity of the consequences of the risk realization.
The general diagram for setting the problem of fuzzy inference for assessing the significance of risk is presented in fig.1.
According to the general concept of the linguistic approach [16] to describe the object domain "Assessment of risk significance", two groups of risk assessment indicators were introduced: "Risk probability" and "Severity of risk consequences" and the corresponding input linguistic variables. Output linguistic variable is "Risk significance".
As a result of the analysis, a generalized model of the object domain "risk significance assessment" in the form of a composition of fuzzy relations of the considered semantic spaces was obtained: where R is risk significance; P is risk probability; S is severity of risk consequences. The relation R is taken as a fuzzy set on the direct product РuS.
Based on the knowledge of experts, linguistic descriptions of the probabilities and severity of risk consequences have been constructed. These descriptions are based on the following: whether the risk situation occurred at all, how often it happened, and what consequences, in terms of reputation and income of the laboratory, it resulted in. For the risk probability, a normalization procedure was performed since the probability values vary from 0 to 1. Questionnaires have been developed to determine specific values of the probabilities and severity of risk consequences on the basis of expert knowledge. The weights of the attributes were determined by the hierarchy analysis method, on the basis of which a grade scale was created. So, to assess the severity of risk consequences 16 criteria were introduced, for the purposes of illustration, table 1 shows some of them, their weight and the corresponding grades.

Results of investigations
Basic and extended term-sets of linguistic variables were constructed on the basis of the analysis of the object domain. Five-term models were chosen for the input variables, and a three-term model -for the output linguistic variable. The subsequent analysis of the paired and general consistency of the expert models carried out according to the methodology [17] confirmed the optimality of this choice. Tuples of the linguistic variables "Risk probability", "Severity of risk consequences", and "  fig.2. When averaging the parameters, an assumption was made about equal weighting of experts in terms of work experience and level of training, and all judgements of experts were assigned equal weights. If necessary, when constructing a generalized membership function, the opinions of experts can be ranked and the weighted average values can be used [17]. As a result of the analysis of the object domain, a knowledge base was created, the logical inference of solution is based on. Here we present a fragment of the knowledge base: 1. If Risk probability is Very low and Severity of risk consequences is Very low then Risk significance is Acceptable (1) 2. If Risk probability is Very low and Severity of risk consequences is Low then Risk significance is Acceptable (1) 3. If Risk probability is Very low and Severity of risk consequences is Moderate then Risk significance is Acceptable (1) …………………………………………………………………………………… 24. If Risk probability is Very high and Severity of risk consequences is Serious then Risk significance is Critical (1) 25. If Risk probability is Very high and Severity of risk consequences is Dangerous then Risk significance is Critical (1) The block for acquiring and adjusting expert knowledge contains information about all currently existing risks and their consequences and is organized in such a way that it allows the addition of information on new emerging risks and information updating on existing risks. An important special feature of the block is the possibility of correction in case of significant inconsistency of expert knowledge [17].
To obtain an assessment of the significance of the risk, the method proposed in [18] was used. Fuzzy logical inference of the solution is the application of the maximin composition as a compositional rule of fuzzy inference and the operation of taking the minimum as a fuzzy implication and is performed, for example, using application software package Fuzzy Logic Toolbox (MatLab). The constructed response surfaces ( fig.3) obviously show the consistency and validity of the created system of production rules. Various combinations of input data were introduced to test the model in order to obtain a specific assessment of the risk significance. The defuzzification procedure was carried out by the "center of gravity" method, the results for several combinations of input data are presented in Table 2. Adjusting actions are tied to each risk classification, which makes it possible to manage risks efficiently.

Conclusions
A study of the object domain "Assessment of risk significance" has been carried out, an approach to determining the significance of risks based on fuzzy modelling has been proposed. A linguistic description of input and output attributes has been given, the expert knowledge base has been created. The application software package Fuzzy Logic Toolbox (MatLab) was used to illustrate the fuzzy logic inference. Response surface and approbation of the model have shown the adequacy and effectiveness of the proposed model. Thus, the foundations have been created for developing the expert system that allows to obtain reliable assessments of significance of risks in testing laboratories. The availability of a tool for determining the significance of risks will ensure constant monitoring of the state of the risk management system, the effectiveness of its operation, and will allow timely decisions on risk management in order to eliminate or minimize them and then improve.