How to use quality risk management in validation testing

Step 4. Document the results and communication

The results of the quality risk management process must be communicated to the relevant stakeholders, including management and those operating the process or system who may be affected by those results.

This requires that each step of the quality risk management process be documented at an appropriate level. The purpose of the output from the risk management process is:

– To share and communicate information about the risks and how they are controlled.

– To obtain the appropriate approval of the decisions taken.

– To demonstrate to stakeholders that there has been a properly conducted systematic approach.

– To provide a record of the risks that enable decisions to be reviewed and the process to be audited.

– To facilitate ongoing monitoring and review and to sustain the process.

The output from the risk assessment must specify a risk owner i.e. a person responsible for ensuring that any actions are implemented and that the risk is managed.

For an informal risk assessment, results and controls can be documented as part of the activity that triggered the assessment, for example:

– Assessment/investigation section of a Deviation form.

– Change Control

Step 5. Approval of the results – risk review

Approval of a completed risk assessment is required to confirm acceptance of the risk evaluation, any identified risk controls, and the residual risk. The final approval of the results of a quality risk assessment must be by the quality authority.

For example:

– An impact assessment for an engineering or information systems project should be approved by the quality representative on the project team;

– A risk assessment conducted as part of an unplanned deviation at the manufacturing site should be approved by the site quality authority.

The risk authority can take either of the following options with a view to the appropriate level of risk mitigation.

Risk Control

Risk control describes the actions taken to deal with the identified quality risks and the acceptance of any residual quality risks.  Risk control must address the following questions:

– Is the risk acceptable without further action?

– What can be done to reduce, control or eliminate risks?

– What is the appropriate balance among benefits, risks and resources?

– Are new risks introduced as a result of the identified risks being controlled?

Risk Reduction

Risk Reduction focuses on processes for mitigation or avoidance of quality risk when the risk exceeds an acceptable level. Risk reduction includes:

– Actions taken to mitigate the severity and probability of risk; or

– Processes or methods that improve the ability to detect risk

Implementation of risk reduction measures may introduce new risks into the system or increase the significance of other existing risks.

Therefore, the risk assessment must be repeated to identify and evaluate any possible change in the risk profile.

Risk Acceptance

Risk Acceptance is a decision to accept risk. The risk acceptance decision shall be:

– A decision to accept known, residual risk;

– A decision to accept residual risks, which are partially assessed, based upon limited information; or

– A combination of these circumstances.

The risk assessment (such as a component level impact assessment) for a system or process should also be included as part of the change management for that system or process to ensure that any changes to the intended use or design are assessed appropriately and risk controls are added, removed or modified as appropriate.

Risk assessments that are conducted in response to a specific incident or deviation may be a useful reference but represent a point in time and are not “live” documents, so would not need to be included in change management.