CCA

Component criticality assessment belongs to the era when qualification worked downward: a System Impact Assessment classified each system as direct, indirect or no impact, then a CCA walked every component inside a direct-impact system and labelled it critical or non-critical. The labels then drove which components appeared in IQ and OQ. It is thorough, traceable, and expensive in proportion to the component count rather than to the risk.

The risk- and science-based approach that followed inverts the question. Instead of classifying every component and testing those marked critical, it identifies the critical aspects — the design features and functions that actually affect product quality — and derives verification from those, using good engineering practice and supplier documentation wherever they are adequate. The distinction matters because the two methods can produce the same test list for different reasons, and only one of them records why.

CCA persists in many quality systems, and it is not wrong; it is a heavier route to a similar answer. What fails an inspection is not the method but its execution as a labelling exercise, where components are marked critical by category rather than by any argument about product impact.

• —Legacy step: System Impact Assessment first, then component-by-component classification inside direct-impact systems.
• —Cost scales with component count rather than with risk.
• —The risk-based alternative identifies critical aspects first and derives verification from them.
• —Both can reach the same test list; only one records the reasoning.
• —Fails as a labelling exercise — critical by category rather than by product-impact argument.

ISPE Baseline Guide Vol. 5, Commissioning and Qualification (1st ed., 2001); superseded by the 2nd edition (2019).