Risk assessment forms a key component of any risk management program. Risk analysis and risk evaluation together represent the two fundamental parts of the risk assessment phase of a risk management process cycle. The assessment of risk involves either the quantitative or qualitative determination of one or more risks. Risks are generally recognized as being related to a situation, event, or scenario in which a recognized hazard may result in harm. Quantitative risk assessment requires a type of calculation. This is often based upon the magnitude or severity of the risk and the probability that the risk will occur.

This drive towards risk-based approach has been spurred by three main events:

1. a. The ‘Pharmaceutical cGMPS for the 21st century: A Risk Based Approach’ initiative by FDA.
2. b. Annex 15 to the EU GMP Guide
3. c. The ICH Guideline titled Quality Risk management., (ICH Q9). The ICH-Q9 guideline concerning Quality Risk Management in the pharmaceutical field.
4. d. For medical devices, a specific guideline is in place. This is the European harmonised standard, ISO 14971:2000/ A1:2003, Medical Devices, Application of Risk Management of Medical Devices, supports the essential requirements of the European Directives related to risk.

The risk management approaches, and risk assessment tools should be integrated into the QMS and not sit separate from it. The advantage of applying quality risk management to the scope of quality systems extends to:

• • Ensuring that product is available to patients, when needed.
• • Avoiding the potential to release of unacceptable product to the market.
• • Ensure that new product introductions to the marketplace are on time.
• • Avoid delays during implementation of changes and improvements to processes.
• • Allow new technologies or continuous improvements to the products or processes to be implemented.
• • Enable scarce resources to be optimally allocated.
• • Ensure that appropriate and meaningful data is available to evaluate risk most effectively.

Some typical quality System integration targets would include:

• • Product and Process Lifecycle
• • Facilities, Utilities, and Equipment Life Cycle
• • CAPA/Discrepancy Management
• • Change Management
• • Computer System Controls
• • Packaging & Labelling
• • Medical Devices & Combination Products.

It is important that risk assessments are documented, approved, and regularly reviewed.