CAIQ: the cloud questionnaire worth filling in before anyone asks
The CAIQ is a spreadsheet of a few hundred yes-or-no questions about your cloud service. Completing it once turns most incoming security questionnaires into a file attachment.
An FMEA that ends in a scored table has produced nothing. The output is the list of things you changed, and most teams stop one step before it.
FMEA — failure mode and effects analysis — is a structured way of asking, before a product is made or a process is run, what could go wrong, what the consequence would be, and what you are going to do about the combinations that matter. It exists in two main forms: design FMEA, which examines the product, and process FMEA, which examines how it is manufactured or delivered.
It is a team exercise, not a document exercise. The value comes from the argument between the engineer who designed the part, the person who assembles it and the one who fields the complaints — and the document is the residue of that argument. Which is why an FMEA written by one person at a desk, however neatly, is usually worthless.
Older practice multiplied severity, occurrence and detection into a risk priority number, and teams then set a threshold — act on anything above a hundred, say. The predictable happened: ratings were tuned downwards until the number cleared the threshold, and severity-ten failures with low occurrence went untouched because the product was small. The current AIAG-VDA approach replaces the arithmetic with an action priority table that treats severity as decisive rather than as one factor among three. Whichever your customer requires, the rule that matters is unchanged: a high-severity failure deserves attention regardless of how the arithmetic comes out.
Detection ratings measure your controls, not your optimism. If the only control is an operator noticing something, the detection rating is poor no matter how experienced they are — and improving detection is always the weaker answer. Reducing occurrence changes the process; improving detection only catches it more often.
An FMEA is meant to be a living document: reopened when the process changes, when a new failure appears in the field, when a customer complaint arrives that is not in the table. In practice most sit untouched from launch to audit, which is visible immediately — a warranty issue that has been happening for a year appears nowhere in the analysis that was supposed to anticipate it. The habit that fixes this is small: whenever a complaint or a scrap event goes through root cause analysis, ask whether the failure mode is in the FMEA, and add it if not.
FMEA is a table with a lot of columns and a lot of revisions, which makes the tool question mundane: Ettex Sheets holds the worksheet with the ratings and the action list, filterable by severity so the high-severity rows are visible without scrolling, Ettex Records keeps the revisions per part and per process with the linked control plan and complaints, and Ettex Docs holds the meeting notes behind the ratings — the reasoning that nobody can reconstruct two years later.
Being direct: this is a spreadsheet and a record, not FMEA software. There is no AIAG-VDA form template, no automatic action priority table, no linkage to a control plan and no customer submission format. Dedicated tools do those, and where a customer specifies one, that is what you use.
Failure mode and effects analysis — a structured review of how a design or process can fail, how severe each failure would be, how often it is expected and how well it would be detected, leading to actions.
DFMEA examines the product design and its functions; PFMEA examines the manufacturing or delivery process and its steps. They are separate documents with different scopes.
It is still used in many organisations, but the current AIAG-VDA method replaces it with an action priority table that gives severity more weight and discourages threshold-chasing.
When the design or process changes, when a new failure appears in production or in the field, and whenever a complaint reveals a failure mode not in the table.
The CAIQ is a spreadsheet of a few hundred yes-or-no questions about your cloud service. Completing it once turns most incoming security questionnaires into a file attachment.
Collecting certificates is easy. The failure is always the same one: a policy expires in month seven of a two-year contract and nobody finds out until there is a claim.
The OSHA 300 log is not a list of everything that went wrong. Recordability has a definition, and both over-recording and under-recording cause problems.