GxP Quality Risks

A risk is what goes wrong when a control is absent or ineffective. Each one here is shown from the other end: the controls that reduce it, and where in the quality system they are performed.

13 risks in library

RSK-UNAUTHORIZED-SYSTEM-ACCESS

Unauthorized system access

A person without the required authority reads, enters or alters a regulated record because access is shared, over-provisioned, or never withdrawn when a role changed.

IS REDUCED BY

9 controls

RSK-UNATTRIBUTABLE-RECORD-CHANGE

Unattributable record change

A record is created or modified with no reliable link to who did it and when, so the change cannot be attributed to a named individual after the fact.

IS REDUCED BY

2 controls

RSK-UNDETECTED-RECORD-ALTERATION

Undetected record alteration

A regulated record is changed or deleted and nobody notices, because the trail that would have surfaced it is disabled, unreadable, or never reviewed.

IS REDUCED BY

5 controls

RSK-PERMANENT-DATA-LOSS

Permanent data loss

Regulated data becomes unrecoverable through media failure, corruption, or a deletion no backup can reverse — the record no longer exists to be produced.

IS REDUCED BY

2 controls

RSK-UNREADABLE-ARCHIVED-RECORD

Unreadable archived record

An archived record survives physically but can no longer be rendered or interpreted, because the application, format or key needed to read it was retired before the retention period ended.

IS REDUCED BY

3 controls

RSK-INVALID-SYSTEM-BEHAVIOUR

System does not perform as intended

The system computes, records or enforces something other than what the process requires, and the discrepancy reaches product or patient decisions unchallenged.

IS REDUCED BY

6 controls

RSK-REPUDIATED-SIGNATURE

Repudiated signature

A signatory credibly denies having applied a signature, because the signature was not uniquely theirs, not bound to the record, or not manifest in a readable form.

IS REDUCED BY

6 controls

RSK-TRANSCRIPTION-ERROR

Undetected transcription error

A value entered by hand, or passed between systems, differs from the source and is carried forward into a decision because nothing checked it.

IS REDUCED BY

2 controls

RSK-UNCONTROLLED-CHANGE

Uncontrolled change

A configuration, version or interface changes without assessment, approval or revalidation, silently invalidating the qualified state the system was released in.

IS REDUCED BY

4 controls

RSK-SUPPLIER-QUALITY-FAILURE

Supplier or service-provider quality failure

A vendor, hosting provider or integrator does not perform to the agreed quality obligations, and the regulated organisation discovers it only after the defect reaches its own records.

IS REDUCED BY

Assess and re-assess suppliers and service providers

1 control

RSK-UNTRAINED-OPERATOR

Untrained operator

Someone performs a regulated task on a system without the education, training or experience the task demands, and the resulting error is treated as a system fault rather than a competence gap.

IS REDUCED BY

2 controls

RSK-PROLONGED-SYSTEM-OUTAGE

Prolonged system outage

A system supporting a critical process becomes unavailable and no workable alternative arrangement exists, so the process either halts or continues with no record of what happened.

IS REDUCED BY

Arrange and exercise continuity for critical systems

1 control

RSK-OUT-OF-SEQUENCE-PROCESSING

Out-of-sequence processing

Process steps are performed or recorded in an order the procedure forbids, and the system permits it, so an operation completes without its prerequisite ever being satisfied.

IS REDUCED BY

Enforce operational sequencing in the system

1 control

COMPLETE INDEX — ALL 13 RISK

WHAT IS FACT AND WHAT IS SPEQ’S READING

The requirement statements are faithful restatements of the regulations they cite, each carrying its clause and source. The controls, risks, evidence types and processes — and every line drawn from an obligation to a control — are SPEQ synthesis: a practitioner’s reading of how an obligation is customarily discharged. No regulator publishes this mapping. 21 CFR 11.10(d) requires that system access be limited to authorised individuals; it does not say “run a quarterly access review”. That inference is what SPEQ adds, and it is labelled rather than presented in a regulator’s voice.