RISK-BASED CHANGE CONTROL - Risk Management Applications in Pharmaceutical and Biopharmaceutical Manufacturing - page 371

TABLE 13.4 Calculation of Risk Priority Ranking (RPR)

RISK CLASSIFICATION

Occurrence

Low Medium High

Level 2 Level 1 Level 1 High

Severity Level 3 Level 2 Level 1 Medium

Level 3 Level 3 Level 2 Low

RISK PRIORITY RANKING

Detection

Low Medium High

MEDIUM HIGH HIGH

Level 1

Risk
classification

LOW MEDIUM HIGH

Level 2

LOW LOW MEDIUM

Level 3

13.6.6 Step 6: Mitigate Risk to an Acceptable Level
If the RPR exceeds the agreed-upon value in Step 1 (risk tolerance), the team
decides what additional mitigation steps will be taken to reduce residual risk (risk
remaining after remediation efforts have been completed) to an acceptable level.
In certain circumstances, the team may decide to accept risks that have been
reduced to as low as reasonable practicable (ALARP) , based on a documented
risk-benefit analysis [6].
The “law of unintended consequences” also applies to change control. Imple-
mentation of mitigation actions can create additional risks. It is therefore impor-
tant to repeat the risk assessment process after mitigation has been implemented
to verify that no new risks have been introduced.

13.6.7 Step 7: Communicate Acceptance of the Residual Risk to the
Appropriate Level
The last step in the risk management process for change control is to make sure
that the acceptance of any residual risk has been communicated to the appropriate