Regulatory and validation
Risk assessment: design, process, equipment and CSV FMEA
One FMEA per subject from four templates: the AI drafts the register, the team scores severity, occurrence and detection, RPN thresholds class every risk and fix the follow-up, Critical and High risks carry mitigation actions, are reassessed from evidence once implemented, and the residual risk is accepted or sent back for further action.
In the portal: /app/risk
The risk assessment life cycle
- Person
1. Create from a template
Design, process, equipment or CSV FMEA; subject, scope, thresholds
- AI drafts
2. Draft the register
Failure modes scored S × O × D, action for every Critical and High risk
- Person
3. Score and plan
Rescoring with a reason; owners, due dates, expected scores
- E-signature
4. Assessment approval
Records Assessment approved; the record stays open
- Person
5. Implement the actions
Evidence, implemented, verified effective
- Person
6. Reassess post mitigation
Reassessed S, O, D from evidence; residual RPN and class
- Person
7. Accept the residual risk
QA accepts with a justification, or sends it back for further action
- E-signature
8. Closure
Risk accepted: close
- A residual risk at or above the acceptable RPN cannot close without QA's acceptance and justification, or further action and a new reassessment.
Templates
| Template | Subject | Register rows |
|---|---|---|
| Design FMEA (DFMEA) | A product, formulation, container closure or device design | Function or component against its design requirement |
| Process FMEA (PFMEA) | A manufacturing, packaging or laboratory process | Process step against its parameter or limit; causes in the 6 Ms |
| Equipment FMEA (EFMEA) | Equipment, a facility or a utility | Function or component against its performance requirement; wear, calibration, maintenance causes |
| CSV FMEA | A computerized system (GAMP 5 functional risk assessment) | Function, data flow or Part 11 control against its user requirement |
Each template carries its own guidance for the item, failure mode, effect, cause and controls, names the sources the AI reads (batch records and deviations, maintenance and calibration records, the URS and supplier assessment) and offers a worked example on the form.
RPN thresholds and follow-up
Every failure mode is scored 1 to 10 for severity, occurrence and detection; RPN = S × O × D. The thresholds come from your risk management procedure and are set when the assessment is created; changing one on the record reclasses the whole register and always needs a reason.
| Class | Default | Follow-up |
|---|---|---|
| Critical | RPN ≥ 200 or severity ≥ 9 | Action required before approval; verified effective; reassessed; residual below the acceptable RPN or accepted by QA with a justification |
| High | RPN ≥ 100 | Action required with owner, due date and expected scores; reassessed from evidence; residual acceptable or accepted |
| Medium | RPN ≥ 50 | Action recommended; otherwise accepted as it stands and watched through periodic review |
| Low | below 50 | Acceptable without action; reviewed when the subject or the data changes |
Rule: The acceptable residual RPN (default: the High threshold) decides what counts as mitigated. A reassessed row at or above it is flagged not acceptable; severity does not change with controls, so a row at the critical severity keeps its class and stays visible for review.
Register and assessment
- Step 1: Open Risk assessment, choose a template and describe the subject: steps, functions or components, parameters and limits, controls in place, history. Attach batch records, specifications, drawings, the URS or deviation data on the record.
- Step 2: Draft the register (AI): the summary, method, assumptions and questions for the team, and 8 to 150 failure modes scored with a mitigation action, owner role, due date and expected scores for every Critical and High risk.
- Step 3: Open a failure mode to edit its text, rescore it (always with a reason) or plan its mitigation. Add a failure mode for anything the AI missed; remove one with a reason (it stays in the audit trail).
- Step 4: The register view ranks rows by RPN with the Pareto, the severity × occurrence matrix and the rating scales. Export gives the risk assessment report as a locked PDF (register, follow-up, reassessment, signatures, audit trail): it opens without a password and cannot be edited. There is no spreadsheet or Word export; every export is logged in the audit trail.
- Step 5: Draft the register again (with a reason) replaces only the AI rows the team has not touched.
Before Assessment approval: subject, scope and team stated, valid thresholds, at least one failure mode, and every Critical and High risk with an action, an owner (person or role), a due date and the expected scores, where the expected residual is acceptable or a justification is written.
Follow-up, reassessment and acceptance
- Assign a person from the directory to each action (they are emailed); reassigning needs a reason.
- Statuses: Planned, In progress, Implemented (evidence required; who and when are stamped), Verified effective (stamped), Not required and Cancelled (reason required). Moving a done action back needs a reason.
- Attach evidence files to an action (change control closure, test report, photo, training record) or to a reassessment (monitoring data, audit result). The file joins the record's documents, fingerprinted and audited, and is linked to the row; a document already on the record can be linked too. Reviewers and approvers open the files from the follow-up while the record is in review, unlinking needs a reason, and nothing can be withdrawn once the record is signed, so the evidence stays with the record.
- Reassess once the action is implemented: record the reassessed severity, occurrence and detection and the evidence they rest on. The residual RPN and class update; a new reassessment reopens an earlier acceptance decision.
- A residual risk that is not acceptable needs further action in the register and another reassessment, or QA's Accept the residual risk with a justification.
Before Closure: every planned action done (with evidence) or cancelled, Critical risks verified effective, every Critical and High risk reassessed with evidence, every unacceptable residual accepted with a justification, the outcome Risk accepted: close recorded and the closure summary written. Approval signs and locks the record.
Tip: The outcome "Residual risk not acceptable: further action" keeps the record open: link the change control or CAPA that carries the work, reassess, then record Risk accepted: close.