Skip to content

Risk assessment

Assurance effort follows risk (GAMP 5, FDA CSA). Risk is assessed twice: once for the whole system, then for each requirement.

System Risk Assessment

The SRA asks four GxP impact questions and the GAMP software category:

  • Can a failure affect patient safety?
  • Can a failure affect product quality?
  • Does the system create, modify or maintain GxP records?
  • Does the system apply electronic signatures?
  • GAMP category: 1 Infrastructure, 3 Non-configured, 4 Configured, 5 Custom.

The result is shown live as you answer:

System risk When Recommended deliverables
High Patient safety or product quality impact, and GAMP category 4 or 5 Full lifecycle: VP, SRA, URS, FS and DS; per-requirement risk assessment; Tier 1 functions scripted with objective evidence; independent QA approval.
Medium Any other GxP impact VP, SRA, URS and FS (DS where the system is configured or custom); per-requirement risk assessment; scripted testing for Tier 1 and 2.
Low No GxP impact Document the rationale in the SRA; formal validation may not be required.

Record your reasoning in the Rationale field. The SRA is a lifecycle document: it is signed and approved like the others.

Requirement tiers

Each requirement is assessed with two questions:

  • Q1: Is the requirement GxP-critical?
  • Q2: Is its impact direct or indirect? An indirect impact needs a named compensating control.
  • The undetectable flag marks a failure that would not be noticed.
Answers Tier
Q1 = No Tier 3 Not high
Q1 = Yes, Q2 = Indirect with a named compensating control, and detectable Tier 2 Medium
Q1 = Yes, and Q2 = Direct, or undetectable, or no compensating control Tier 1 High

Anything contested or incomplete escalates to the higher tier. A requirement with no answer to Q1 is not assessed, which is the RTM gap risk-not-assessed.

Required assurance

Tier Required assurance
Tier 1 High Pre-approved scripted testing (automated or manual) including negative paths; objective evidence per requirement; executor independent of the test author.
Tier 2 Medium Pre-approved scripted testing (automated preferred); pass/fail record; results reviewed independently.
Tier 3 Not high Unscripted (exploratory) testing with a session record, or scripted testing.

The RTM checks these rules and reports a gap where the testing does not match the tier.