Risk assessment and impact analysis

Initial impact assessmentA first-pass determination of whether a system has GxP impact at all. It directs effort at the outset – non-GxP systems are documented and set aside, GxP systems proceed to detailed assessment; proportionality begins here.

What we produce. A documented GxP impact assessment – decision and rationale – for each system.
Regulatory anchor. GAMP 5 · ICH Q9

Risk register (FMEA-based)A functional risk assessment that scores severity, probability of occurrence and detectability for each critical function, with the mitigations that reduce them. It concentrates validation on the functions that carry patient, product and data-integrity risk, and records the reasoning an inspector will ask to see.

What we produce. A GAMP 5 FMEA-based risk register with prioritised, mitigated and traceable risks.
Regulatory anchor. ICH Q9 · GAMP 5

Control-to-risk mappingThe link between each identified risk and the specific control and test that addresses it. It demonstrates – to the business and to the regulator – that test coverage is driven by risk rather than habit, and that no critical risk is left unverified.

What we produce. A control-to-risk map connecting each risk to its validation activity and acceptance criteria.
Regulatory anchor. GAMP 5 · ICH Q9