Over the last several years, industry associations, and the FDA as well as other regulatory agencies have been putting more emphasis on risk assessment in every aspect of the quality system. I have not seen a lot of how-to articles on risk analysis and in fact most of the guidance you see mentions that there are several methods you can employ, the most popular of which (in no particular order) are:
Failure Modes and Effects Analysis (FMEA)
Process Hazard Analysis (PHA)
Hazard and Operability study (HAZOP)
Hazard Analysis and Critical Control points (HAACP)
Fault Tree Analysis (FTA)
So how do you, as the person responsible for a risk assessment, decide on which method to use and how do you approach this risk assessment if you have never done one?
The decision on which method to use should not occupy a lot of your time. Most of the methods mentioned above are similar in that they look at what could go wrong, assess the probability of it going wrong followed by what mitigation measures can be put in place to reduce that possibility. The more important thing in my mind is to be thorough in your analysis. Perhaps try to use the same method each time, so you get comfortable with it and good at it. So pick a method, and if you have not used it before, use your favorite search engine to find templates, articles, or videos to learn how to use it properly.
Once you have a method selected, the real work begins. The process you are analyzing may be fairly simple or relatively complex, but the first step is trying to determine what you want to achieve with the process in question. As an example, let’s suppose you are using risk assessment to determine how to qualify a clean compressed air (CCA) system. If you ask the question about what this compressed air system is trying to achieve, you might come up with the answer of needing a certain volume and pressure of clean, oil free, dry, air for product contact. To get even more specific, you might say that the air needs to be delivered to the use points at 90psig, and needs to have less than X number of particles per cubic foot, less than Y mg/ft3 of vaporized water, and less than Z mg/ft3 of hydrocarbon content. Further, you might assess that 5 use points will need to be in use at one time and that constitutes a volume requirement of 50 cfm. Let’s call these the critical quality attributes or CQAs. These CQAs are the things you will keep at the forefront of your mind when you start your evaluation.
Next, you will want to assemble a group of folks who know the different aspects of the system you are evaluating. Continuing with our compressed air example, this might be maintenance techs, engineers, operations folks, and quality assurance representatives. It is important to include all of the relevant stake holders in order to do a thorough job. Assemble this group and go through whichever analysis method you chose. In our CCA qualification example you would go through the system perhaps using a Piping and Instrumentation Diagram (P&ID) as your roadmap. The first aspect you might look at is the compressor itself. Does the compressor have a direct impact, an indirect impact or no impact at all on the CQAs? Is the impact on one CQA, or several? Clearly, in this example, it has a direct impact on most if not all of the CQAs, so you would assign it a relatively high number for impact. Then you would ask what mitigating factors are in place to affect the impact on the CQAs. Questions such as:
Is there a back-up compressor?
Is there back-up power for the compressor?
Are the receiver tank(s) and distribution lines sized such that a short outage would have a minimal or no effect?
Are there filters in place with redundancy?
Are the dryers the desiccant type and do they have a maintenance plan in place?
Are there point of use filters and regulators in place?
Etc?
The reason you ask these questions is because the next step is to assess the probability of the compressor to have a deleterious effect on the CQA’s. For example. If we need 90psi of pressure at the use points, you might initially think that the compressor is critical to that parameter. But if you start looking at the mitigating factors, you might discover that the receiver tanks and distribution lines were designed very conservatively and there is a back-up compressor on emergency power. Therefore the probability of the pressure being reduced at the use point is very low. This probability needs to be factored in, regardless of how high the impact might be.
Now you can go through each part of the system in a similar fashion looking at the impact and mitigating factors. After finishing with each part and sub-part of your system, you then rank them from highest risk, to lowest risk. One way to do this ranking is to assign a numeric value to the risk level and another number to the probability. The product of these two numbers can then be put in numeric order from highest to lowest.
Once this ranking is complete, establish one or more threshold points to delineate high, medium or low risk items. In our example, perhaps the decision might be that high risk items need to have full qualification, medium risk need only Installation Qualification, and low risk items only need commissioning. This is in no way set in stone, and it is up to the company doing this analysis how to assign these risks and how to handle them.
There are many places in the biopharma and medical device industries where risk assessments can and should be used. Regulatory agencies expect it. It will reduce the chances of doing more work than is necessary or than makes sense. That in turn will free up more resources to be more thorough on the important aspects of your system.