![]() |
||
![]() |
| |
The very point of using the FMEA analysis is that on completion of the initial assessment, if the risks are found to be excessive, then there is a bases to proceed in investigating methods of reducing the these risks to acceptable levels. In some cases, it may be appropriate to revise the initial risk assessment based on the assumption (or the fact) that the recommended actions have been completed. This provides an indication of the effectiveness of corrective actions and can also be used to evaluate the value to the organization of performing the FMEA. To calculate revised RPNs, the analysis team assigns a second set of Severity, Occurrence and Detection ratings for each issue (using the same rating scales) and multiplies the revised ratings to calculate the revised RPNs. If both initial and revised RPNs have been assigned, the percent reduction in RPN can also be calculated.
If the initial ratings (1) for a potential problem are S = 7, O = 8 and D = 5 and the ratings post any mitigating actions are S = 7, O = 6 and D = 4, then the percent reduction in RPN from the original to the revised is (280-168)/280) × 100, or 40%. This indicates that the organization was able to reduce the risk associated with the issue by 40% through the performance of the FMEA and the implementation of corrective or mitigating actions.
| Risk Assessed | Severity | Occurrence | Detection | RPN |
| Initial | 7 | 8 | 5 | 280 |
| Reworked | 7 | 6 | 4 | 168 |
| Percentage Reduction in REN | 40% | |||
Risk Assessment (RA) in the pharmaceutical / biotech / medical device industry, is often misunderstood. In the industry in general RA’s are used at various stages in the product development, production and in testing. Practically always to assure that the product or equipment is robust and fit for purpose.
Generally in these tasks there are many ways of mitigating risk. Whether it is by adjust design parameters, introducing controls or retraining staff, sometimes the choice is endless.
In validation this range of solutions are not there. There are regulatory requirements about documenting justifications, and requirements for critical and none critical software; but not a lot more.
So it actually makes sense to appraise this task in a reverse order; and start with what degree of validation can we define with reasonable accuracy. It becomes apparently that we have not got an infinite variety. Certainly not one we could easily define. So what do we have?
No Validation
Simple validation, basically registering the equipment.If we use the likes of an Faulure Mode & Effect Analysis we will have a cumbersome analysis result that becomes difficult to use to attribute the correct degree of validation. If we develop a Validation Risk Assessment that only has four outcomes; we can match these outcomes to the four requirements detailed above.
This is the method Validation Online has adopted and used for many years now. The regulators want to see a documented justification for the scope of validation that you have applied, and they require a documented judgement about 21 CFR Part 11, applicability. These requirements are satisfied in our Validation Risk Assessment, where the risk being mitigated is the risk of not being compliant with the regulatory requirements.