Example SOP for Risk Assessment of IT Systems

This SOP describes how a risk assessment for an IT systems is conducted. A risk assessment is applied to discover the GxP-relevant functions of an IT system in order to 

The risk assessment is carried out on the basis of the URS/functional description. 

The owner of the IT system is responsible for the investigation and evaluation of risks that emerge from the GxP operational process. Application man-agers/system operators are responsible for the investigation and evaluation of the risks that emerge from the IT technical realization. 

The following representation gives an overview of the risk assessment. The parts belonging to the risk assessment are in bold. 

The functions and sub-functions and if necessary further sub-functions are derived from the URS/functional description and are recorded in the first columns of Table A1 for the risk assessment. Additionally, a reference is made to the corresponding position in the URS/functional description. If no GxP relevance is determined for the investigated functional level, then affiliated sub-functions are not examined further. 

---