In the Validation Risk Assessment, Document I felt that the work was only half done. It was very well laid out and very intuitive to follow. But while I was able to determine the Risk Category and Validation extent I felt that it did not deal with any of the Business process or system risks. Is that a separate document?

From everything I had read till now it seemed that once you determine if you need to validate you then need to determine your risk with using the system and the system risks. Some articles even talk about initiating the Risk process prior to buying the system and starting to identify the risks with the current process or old system being updated. Thanks ------------------------------------------------------------------------------------------------------------

Validation Online Reply:

The FDA (along with EC and WHO) realized a long time ago that the scope of any validation task must be allowed to be adjusted to avoid over burdening companies with repetitive and or unnecessary tasks. However this adjusted validation scope must be reviewed to verify that all applicable aspects of the task will be adequately validated. This review must be justified and documented.

We are all aware that risk assessment’s come in many formats; for instance, we have on our site a fully approvable FMEA which we use ourselves for all aspects of concept development and design development; however the Validation Risk Assessment (VRA) is a very different document and was specifically designed to assess and define the appropriate scope of any validation task. As such; it is a very important document which is mandated by the FDA and regularly reviewed by them.
Is the scope of your validation adequate? Is probable the most important question in validation and the VRA must give assurance that it is.

The pit-fall(s) of using multiple event Risk Assessments (such as FMEA’s) is simply that there are not (in validation) multiple variations or answers available. At the validation stage the system / process / equipment / program has already been bought / built / written / installed and commissioned. All aspects of design / functionality / safety / operability will have been fully debated and integrated at the URS stage and reviewed and approved at the DQ stage.

Hope this explains the use and importance of the VRA.
Regards
Alex

Customer Response:

Thank You for your response, I do understand and see the value of the Validation Risk Assessment, it was money well spent and I also agree with your comments about doing risk Assessments after the product is in the door and we in validation are only told after the fact. “By the way we need you to validate this next week” is a usual user response.

The FMEA is it a protocol and Spreadsheet or just a spreadsheet? Is there instructions on how to use it like the VRA? Is it possible to get a preview? I will need more information in order to receive authorization to purchase it.