RISK MANAGEMENT: REGULATORY EXPECTATION, RISK PERCEPTION, AND ORGANIZATIONAL INTEGRATION - Risk Management Applications in Pharmaceutical and Biopharmaceutical Manufacturing - page 51

TABLE 3.2 Regulatory Expectations and Practical Considerations When
Executing Risk Assessments [12-14]

Regulatory Expectations when
Executing Risk Assessments Practical Considerations

Clearly identify the process being
assessed and what it is
attempting to achieve.

Properly plan and scope risk assessments. Questions
to ask:
• Is the assessment ad hoc/for cause (such as a
deviation/failure/change), or a life cycle/living
assessment (manufacturing operations)
• At what part of the process will the assessment
start and where will it end?

Be based on systematic
identification of possible risk
factors

Procedures must exist which provide guidance on
the risk assessment tool being used (e.g., FMEA)
and have standard ranking indications (e.g., a
value of 1 for occurrence has a descriptive
indicator such as “less than 1 in 1,000, 000”)

Take full account of current
scientific knowledge

Instead of an “I think” approach, use of an “I
know” approach using existing literature, clinical
data, using experiments.

Be conducted by people with
experience in the risk
assessment process and the
process being risk assessed

Risk assessments must be conducted by a team that
has been fully trained on the organizations risk
procedures. Facilitators should have advanced
training on the tools and facilitation techniques.

Use factual evidence supported
by expert assessment to reach
conclusions

Severity and occurrence rates should be determined
by clinical, development, and manufacturing data
guided by subject matter expertise.

Do not include any unjustified
assumptions

Do not guess. It is okay to say “We don't know”
and collect the information, so accurate
evaluations can occur

Identify all reasonably expected
risks—simply and clearly
along with a factual assessment
and mitigation where required

Do not shortchange the risk assessments or omit
items. Additionally, do not list hazards that
clearly cannot occur. These are common errors
that are easily rectified by a good facilitator and
with proper review during the assessment
execution phase. Remember, risk assessments are
tools to assist in the continuous improvement
cycle. The better the data that enters the
assessment, the more robust the improvement
cycle.

Be documented to an appropriate
level and controlled/approved

Organizations must have policies and procedures
which detail how risk assessments are approved,
controlled, and reviewed. The level and formality
of risk assessments can vary, although they all
need to be documented.

( continued )