Managed
QRM is a real process. Risk is assessed with a consistent method and drives proportionate decisions across the quality system.
What a stage is not
The stages are SPEQ’s organising device for building a risk-based quality system, not a regulator’s mandated sequence. Real programmes overlap and revisit them, and no inspection asks which stage you are in.
Risk management has become a real process with owners, a register that is maintained rather than reconstructed, and assessments that feed change control and CAPA. It works. What it does not yet do is look forward: the process is excellent at handling the risks somebody has already named, and largely blind to the ones nobody has thought to write down.
- ·A consistent risk method is applied, with effort proportionate to impact
- ·Risk assessments are living documents that get reopened when things change
- ·Risk output visibly shapes CAPA depth, change control, and validation scope
WHY ORGANISATIONS STOP HERE
Managed is the most comfortable stage to stop at, because it is genuinely good and it survives scrutiny well. The register is current, the method is consistent, the outputs are used. The limitation is invisible from inside — a well-run process for known risks looks identical to a well-run process, and nothing in the day surfaces the question of what is missing from the list.
- Instrument the system: trend where risks cluster and which controls fail most
- Integrate QRM into the PQS elements (deviation, change, supplier, validation) rather than as a parallel activity
- Bring risk trends to management review so leadership steers by them
- ·Proportionate formality: more rigour where patient risk is high, less where it is not
- ·Risk assessments are maintained, not archived at issue
- ·Decisions cite the risk basis explicitly