Risk management is a systematic process of assessing, controlling, communicating, and reviewing risks associated with equipment, processes, materials, facilities, distribution, and patients. It involves identifying potential failure modes and their causes and effects, analyzing risks, and prioritizing critical risks. Tools like Failure Mode and Effects Analysis (FMEA) are commonly used to structure the risk analysis and management process. The goal is to design quality into processes and products throughout the product lifecycle to maintain quality and minimize risks.

1. Every Equipment, product or process has associated risks. Protection of patient by
managing this risk in the quality system and manufacturing process is being given
prime importance in the pharmaceutical world.
Product quality shall be maintained throughout the product lifecycle. The Risk management
approach is carried out by industry with recognized management tools along with support of
statistical tools..
Risk Management is a systematic process for the assessment, control, communication and
review of risks.
Scope for Quality Risk Management
 Equipment
 Process
 Materials
 Facilities
 Distribution
 Patient
Risk analysis is structured statistical analysis to estimate the risk how much involved in the
process/facility/equipment and system. Quantitative analysis is a statistical analysis and is a
combination of Severity, Probability and Detectability.
Risk Priority Number (RPN) can be established during quantitative risk analysis and it is
evolved by multiplication of identified values of
 Severity (S),
 Probability (P), and
 Detectability (D)
Risk = Probability x Severity x Detectability
QualitybyDesign
RiskManagementisaboutmaking valueoutofuncertainty

2. Probability Severity Detectability
Likely to
occur
High
(10)
Serious GMP non-
compliance
Patient injury
possible
Critical
(10)
An specific detection
System or Indicator
exists
Easily
Detectable
(1)
May occur Medium
(7)
Significant GMP
non- compliance
Impact on patient
possible
Moderate
(7)
No specific detection
system but can be
detected on daily
inspections
Moderate
Detectability
(4)
Unlikely to
occur
Low (4) Minor GMP non-
compliance
No patient impact
Minor (4) May be detected
accidentally
Probably
Detectable
(7)
Very
unlikely to
occur
Remote
(1)
No mentionable
Impact
None
(1)
Un-detectable Hardly
Detectable
(10)
The RPN rating scale can be established in three levels i.e. Low, Medium and High to
estimate the identified risks are at which level.
The image below provides an overview of a typical QRM process:
Basic Risk Management Tools

3. We can assess and manage the risks by using recognized management tools. Below is the
non-exhaustive list of some of the tools.
 Failure Mode Effects Analysis [FMEA]
 Failure Mode, Effects and Criticality Analysis [FMECA]
 Hazard Analysis and Critical Control Points [HACCP]
 Hazard Operability Analysis [HAZOP]
 Preliminary Hazard Analysis [PHA]
The most commonly used Tool is Failure Mode Effect Analysis (FMEA) which is simple
and effective.
Failure Mode Effective Analysis
FMEA is an effective tool for an evaluation of potential failure modes it methodically breaks
down the analysis of complex processes into manageable steps. FMEA can be used to
prioritize risks and monitor the effectiveness of risk control activities.
An overview of some of the most critical steps are as follows:
 Identify an area where risk exists.
 Describe the system and function.
 Create a block or process flow diagram indicating relationships within the process
 Create a worksheet containing information about the system
 What is important is that you have a process to analyze potential failure modes (i.e.
problems that could happen) AND the potential effects of that failure on your process.
Following are the steps to be followed…:
Step 1: Selecting the High Risk Process/Area/Equipment
You can identify the high risk processes with the following criteria but not limited to:
 Lengthy process with more stages
 High risk of failures in the process
 Top failed product in the history
 Process that is heavily dependent on human intervention
 Process executed in the oldest facility
 Process/facility with rapid changes
Step 2: Team Formation
The assessment team should have the following capabilities
 Subject matter expert
 Cross functional
 To cover all levels
 Solid understanding to the process being assessed
 Strong analytical skills
Step 3: Process Flow
Define the process in to very simple steps.
 Cover all the processing steps
 Put them in to the flow chart
 Each sub-step shall be clearly defined

4.  Define the people involved and their level in each sub step.
Step 4: Identify the Potential Failure Modes
Process can have multiple failure modes and each failure mode can have multiple effects.
Address the following questions during failure modes identification.
 What could fail with this step? (Failure modes)
 Why would this failure occur? (Causes)
 What could happen if failure occurs? (Effects)
Step 5: Assess the Failure Modes and Causes
 Risk mitigation requires an understanding of the Severity, probability and
detestability of the exposure.
 Use clear scale for rating of risk consistently.
 Keep the scales simple and ensure they are appropriate to the exposure and
organizations risk tolerance.
 Causes identification should be transparent to mitigate the risk effectively.
Step 6: Assessment of Critical Failure Modes
The highest RPN’s should be focused on first and should be considered as critical. Ask the
following questions during assessment
 What might cause the failure to occur?
 When might the failure occur?
 Where might the failure occur?
 Why might the failure occur?
.Step 7: Risk Evaluation
Based of Quantitative or Qualitative outputs, Risks are categorized as follows:
 Intolerable – work to eliminate the negative event or introduce detection controls is
required as a priority
 Unacceptable – work to reduce the risk or control the risk to an acceptable level is
required
 Acceptable – the risk is acceptable and no risk reduction or detection controls are
required
Step 8: Risk Control
Risk control includes decision making to reduce and / or accept risks. It focuses on following
Questions..
• Is the risk above an acceptable level?
• What can be done to reduce or eliminate risks?
• What is the appropriate balance among benefits, risks and resources?
• Are new risks introduced as a result of the identified risks being controlled?.
Step 9: Redesign the process
Considerations for the re-designation of the process.
 If identified the critical failure mode.
 If inadequate controls are exists.

5. If existing process not robust, Direct the re-designated process prior to its wide spread
implementation.
Step 10: Risk Communication
Risk communication is the sharing of information about risk and risk management between
the decision makers and others.
Frame work for Failure Mode Effect Analysis
 The highest RPN’s should be focused on first.
 Assesses the steps of the process and identify where the problems may occur.
 Identify consequences of each failure mode should it occur.
 Scores the exposures quantifiably.
Conclusion
The risk-based approach provides a consistent method for decision making which is easily
associated with resource allocation and ensuring patient safety. Ultimately, applying risk
management will reduce the issues or minimize its impact through the consistent use of the
tools/methods and periodic review.