Evidence determines the usable risk method

Method selection is a decision about the evidence that can bear the proposed inference. It should follow the decision question, the mechanism and the consequence of being wrong. An analyst should not begin with a preferred simulation package and then search for enough numbers to populate it. Equally, a committee should not insist on a heat map when comparable monetary consequences and credible event records are available. The right method preserves what is known, makes the uncertain part inspectable and produces an output that can legitimately inform the requested act.

The first separation is between a factual observation, a classification and a parameter estimate. A dated maintenance log can establish that a specified inspection was recorded. It does not automatically establish that the safeguard operated successfully in every relevant operating state. A classification can describe an incident as dispatch interruption. It does not by itself estimate the probability of another incident. A parameter estimate requires a defined population, exposure period, inclusion rule and treatment of incomplete records. A decision model can accept a number without supplying any of these foundations.

The recurring dispatch example therefore has a deliberately limited evidential status. Its parameter values are stipulated. They allow a reader to inspect the difference between shared operating support and a continuously available surrogate. They do not show what availability a real safeguard attains. The positive annual value in the base case is an arithmetic consequence of the fixture. Moving it into an implementation paper as a measured benefit would change its epistemic status without changing its digits. The evidence custodian must prevent that change from becoming invisible.

Evidence can be relevant without being sufficient. A supplier specification may describe the safeguard's intended prevention performance under stated conditions. An installation certificate may describe completion of work. An operating test may demonstrate a response in the tested state. An incident history may describe observed failures within a recorded period. None of these is interchangeable with the others. The committee should name the proposition supported by each item and the proposition that remains unresolved. A collection of impressive documents can still leave the decisive operating dependency untested.

Availability is especially vulnerable to denominator error. A numerator of successful test responses becomes informative only alongside the occasions on which the safeguard was required and the rule for recognising a failure. Scheduled tests may exclude the periods of power loss, staff shortage or communications failure that matter most to the event. Conversely, a control may be unavailable for harmless planned shutdowns that should not be included in the relevant exposure window. The appropriate denominator follows the causal claim. A generic uptime percentage cannot be substituted without explaining why its operating states match that claim.

Historical data can also mix changing systems. An incident series spanning different equipment, operating practices and reporting rules may describe no stable mechanism. A recent period may be more relevant but less informative about rare events. A long series may contain useful adverse conditions but require careful segmentation. The model does not decide which history transfers to the proposed safeguard. That transfer is an argument the analyst must preserve, including the conditions under which the old experience would cease to support the new decision.

Expert judgment can help when direct observations are sparse, but its role should be named. Experts may identify a missing causal path, assess whether a test represents a demanding condition or supply a bounded parameter judgment. These are different contributions. Agreement among participants is not a substitute for independent evidence, particularly when the participants share the same operating assumptions or supplier information. The record should preserve the question asked, the information available, the reason for the judgment and the alternatives that would change it. A single precise-looking probability can conceal disagreement that matters more than its nominal precision.

This record produces an adverse answer without pretending that a real safeguard has failed. The favourable arithmetic proposal remains eligible for further examination, while the implementation request is held because the decisive evidence has not been supplied. The expensive proposal fails the stated optional economic condition even under its favourable stipulated availability, so an availability certificate alone would not rescue that proposal. It would need a changed cost basis, a different intervention or a separately justified mandatory objective. The information request can therefore be narrower for the first branch than for the second.

The information mandate has a bounded completion rule. The custodian can record a source as received, accessible and relevant, but the Operating Owner must address its applicability to the dispatch mechanism. The Chair may accept the resulting decision record or stop at the cap and gate. The Assurance Reviewer can challenge whether the evidence was used within scope. No role can substitute a source title for an operating finding, and no report can renew the spending mandate merely by reporting that more research would be useful.

An interval or scenario may be more useful than a point estimate when the evidence cannot resolve a critical input. In this study, the canonical stress settings are declared adverse scenarios rather than estimated confidence bounds. They answer what the supplied mechanism would produce under specified changes. They do not state how often that combination occurs. Treating a stress result as a percentile would require a distribution and dependence structure that the demonstrator does not provide. A reviewer should ask which uncertainty the scenario tests and which uncertainty it leaves untouched.

Evidence sufficiency depends partly on the proposed exposure. A reversible information purchase can proceed on the basis of a plausible mechanism and a clear unanswered question. An irreversible installation that could interrupt critical service demands a stronger case about implementation, operating support and failure response. A permissive screening standard cannot silently become an implementation standard because the proposal has progressed through meetings. The gate record should change the required evidence when the permitted act changes, even if the original model remains useful for selecting what to investigate.

The cost of additional evidence should be assessed against the decision it could change. A test that cannot alter the selection, the implementation terms or the stop rule may have little decision value, even if it improves a technical estimate. A narrow test of shared availability can be decisive when the optional proposal's benefit depends on that support. A broader information exercise can be justified when it reveals unmodelled consequences or a mandatory constraint. The analyst should identify the alternative answer before commissioning the work; otherwise evidence collection tends to expand without a clear completion condition.

Missing evidence is not a negative observation. The fictional availability certificate has not been provided. That absence does not prove the safeguard is unavailable, nor does it justify assigning a convenient availability. It limits what the committee can authorise. An analyst may run declared values to reveal sensitivity while retaining an implementation hold. This is a useful distinction between analytical exploration and factual inference. It allows progress on the decision without converting uncertainty into either pessimistic certainty or optimistic assurance.

Evidence access is itself a condition. A promised test report is different from a report received and read. A report may be accessible only to a supplier, may omit raw observations or may concern another operating configuration. The custodian should record the actual object reviewed, the relevant passage or dataset and any access restriction. Public institutional guidance is accessible in this research record, but its existence does not grant access to a fictional operator's logs. The record therefore separates verified public guidance and reproducible arithmetic from unresolved operating evidence.

A method is usable when its material assumptions can be challenged at the level the decision requires. A deterministic calculation can be suitable for a controlled counterexample. A qualitative mechanism record can be suitable for identifying missing dependencies. A probabilistic model can be suitable when the event, exposure and distribution are supported. None has automatic priority. The mistake is to use a method's familiar format as evidence that its conclusion is fit for the requested act. Method selection should leave a record of why simpler and more elaborate alternatives were considered insufficient or unnecessary.