Risk-based validation: deciding how much is enough
ICH Q9 and Annex 15 expect the extent of qualification to follow a documented risk assessment — more effort where product quality is at greater risk, less where it is not.
Risk-based validation replaces 'test everything equally' with 'test in proportion to risk'. For a temperature-controlled space, the highest-risk elements are the parameters that directly affect product — temperature at product locations, alarm response, monitoring data integrity — and the lowest are cosmetic or convenience features.
A simple approach
- List functions and parameters from the URS.
- Score each for impact on product quality, likelihood of failure and likelihood of detection.
- Assign test depth: full challenge testing, functional check, or supplier documentation.
- Record the rationale and revisit it at periodic review.
Risk assessment justifies doing less where appropriate; it never justifies skipping the mapping of a space in which product is stored.
Frequently asked questions
- Which tool should be used — FMEA, HACCP, something simpler?
- ICH Q9 lists several; the choice should match the complexity of the system. A structured table is often enough for a storage area.
References
- [1]ICH Q9(R1): Quality Risk Management
- [2]EudraLex Volume 4, Annex 15: Qualification and Validation (2015)
General technical guidance written against the cited sources. It is not regulatory or legal advice and does not replace the applicable standard, guideline or a qualified reviewer's judgement.
Have a question on this topic?
Ask ValiTrac AI and see the evidence and calculation behind the answer.
Ask ValiTrac AIFree calculator: MKT & logger data check
Paste logger readings and get MKT per ICH Q1A(R2) alongside min, max, mean and out-of-limit runs with durations.
Open the calculatorRelated articles
What a validation master plan should contain
The VMP is the site-level statement of validation policy, scope, responsibilities and schedule. It tells an inspector how the organisation decides what to validate and how.
Computerised system validation for monitoring and mapping software
Software that produces GxP records must be validated for its intended use: requirements, risk assessment, testing, audit trails, access control and change control.