RISK ASSESSMENTREFERENCE OUTLINE

Quality Risk Assessment (QRA) — Type 1

Standard QRA template for process and change control risk assessment using FMEA methodology. Maps directly to ICH Q9(R1) formality guidance.

What a template is not

A template is a document baseline to adapt inside your own quality system. SPEQ does not approve, validate, or take responsibility for what you issue from it, and using one is not evidence of compliance.

CHECKING ACCESS

Checking your Professional access…

REGULATIONS MAPPED
ICH Q9(R1)ICH Q10
DOCUMENT TYPE
Risk Assessment
LAST UPDATED
June 2024
PURPOSE

A standard quality risk assessment for a process, change, or system, structured as an FMEA and sized to the formality ICH Q9(R1) asks for — enough rigour to support the decision, without ceremony that adds no information. The assessment answers one stated risk question; its usefulness collapses when that question is left vague, which is why the template opens by fixing it.

What's Inside

✓The risk question and scope, stated precisely enough that a reader can tell what is in and out
✓Team composition and the functions represented, because a single-function risk assessment sees single-function failure modes
✓Scoring scales for severity, occurrence, and detectability, defined before scoring rather than during it
✓Process or step breakdown at the level of granularity the risk question requires
✓Failure mode identification with effects traced to product quality and patient impact
✓RPN calculation, risk ranking, and the criticality overrides that stop a high-severity item hiding behind a low RPN
✓Risk control actions, residual-risk re-evaluation, and the risk-acceptance sign-off

How to Use It

1State the risk question first and have the team agree it — a shifting question is the most common cause of an unusable assessment
2Fix the severity, occurrence, and detectability scales before scoring, and use the same scales across the assessment
3Break the process down only as far as the question requires; excessive granularity buries the findings it was meant to surface
4Trace each failure effect to product quality or patient impact, not merely to operational inconvenience
5Rank by RPN but override on severity — a rare, undetectable, patient-harming failure outranks a frequent nuisance
6Re-score residual risk after controls are defined, and record what the organisation is knowingly accepting
DOCUMENT CONTENTS

The full section structure of this template — every section and sub-section, so you can use it as a baseline for your own site document.

—Document Control
› Document Information› Approval Signatures› Revision History› Distribution List
1Risk Question and Scope
2Team, Method, and Scoring Scales
› Assessment team› Severity (S) scale› Occurrence (O) scale› Detectability (D) scale
3Process / Step Breakdown
4Failure Mode Identification
5Severity, Occurrence, Detectability Scoring
6RPN Calculation and Risk Ranking
7Risk Controls and Residual-Risk Assessment
8Conclusions and Risk-Acceptance Sign-off
REGULATORY CONTEXT

ICH Q9(R1) sets the expectation that formality and effort are proportionate to risk, and that risk management is a lifecycle activity rather than a one-off document. It deliberately prescribes no scoring scale, no RPN threshold, and no acceptance criterion — those are the organisation's to define and justify. The FMEA structure and the criticality override embedded here are SPEQ synthesis of common practice, offered as a defensible starting point; the scales you adopt and the risks you accept remain your determination, recorded under your quality system.

MAPPED STANDARDS
ICH Q9(R1)ICH Q10
Browse the standards catalog →