Risk-based validation: deciding how much is enough

Risk-based validation replaces 'test everything equally' with 'test in proportion to risk'. For a temperature-controlled space, the highest-risk elements are the parameters that directly affect product — temperature at product locations, alarm response, monitoring data integrity — and the lowest are cosmetic or convenience features.

A simple approach

• List functions and parameters from the URS.
• Score each for impact on product quality, likelihood of failure and likelihood of detection.
• Assign test depth: full challenge testing, functional check, or supplier documentation.
• Record the rationale and revisit it at periodic review.

Risk assessment justifies doing less where appropriate; it never justifies skipping the mapping of a space in which product is stored.

Scoring, with a worked example

The usual instrument is a severity–occurrence–detection score, borrowed from FMEA and endorsed in spirit by ICH Q9(R1). Each function from the URS is scored on how badly a failure would affect product, how likely that failure is, and how likely it is to be noticed before it does damage. The product of the three is a priority number, and the priority number selects the depth of testing rather than deciding it outright.

Note that detection drives the third row above its severity. Data integrity failures are not dramatic and not obvious; nobody notices a broken audit trail until someone goes looking for an entry that should be there. A low detectability score is the mechanism by which quiet failures earn attention.

What risk assessment cannot be used for

The distinction worth holding onto is between reducing effort and removing evidence. Risk assessment legitimately decides that a backup compressor gets a functional check rather than a full challenge, that supplier documentation is accepted for a component with no product contact, or that a chamber is mapped at three set points rather than six. It cannot conclude that a space holding product does not need mapping, that alarms need not be challenged, or that an acceptance criterion may be relaxed because meeting it is inconvenient. Those are the findings inspectors cite, and the risk assessment is usually what they cite them from.

Keeping it alive

• Record the rationale, not just the score. A number with no sentence behind it cannot be defended or revisited.
• Name who scored it and when. Risk assessments age, and an unattributed one cannot be challenged.
• Revisit at periodic review, and immediately on change: a new product with tighter limits raises severity on every row above it.
• Feed real history back in. Three excursions in a year is evidence about occurrence that beats anybody's original guess.