Risk assessment audits

Mock, R., U. Barth, A. Franz, S. Brunner A. Leksin 2012. Computer-assisted risk assessment audit on operational level. In Proc. PSAMll ESREL12 Vol. 5. Helsinki, Finland 4093-4102. 

Leadership/Culture - EHS management systems and best practices performance metrics risk assessment audits supervisor safety selling executives. 

The focus of MANAGER is somewhat different, in that it was primarily developed to provide a numerical output for use in risk assessment. Nevertheless, the qualitative dimensions included in the audit trail will undoubtedly provide information which can be used as part of an error prevention program. 

Because of the complexity of computer hardware and software and because of the intricacy of a risk assessment, the FDA has to all intents and purposes adopted an indirect regulatory posture. Regulated companies are informally urged to conduct independent audits of Part 11 compliance, utilizing in-house or consultant expertise. The agency can then review the details of the audit report and the credentials for experience, expertise, and independence of the auditor. Follow-up investigation of speciflc points can then be laser-focused on specific areas of concern. 

The effectiveness of a QA-related independent Part 11 audit is dependent on the checklist or audit plan utilized. Here, provided as a model, is a two-part audit checklist. The depth of the evidence and support required is dependent on the results of the risk assessment All high-, medium-, or low-risk systems should be subject to the same general questions. 

Appropriate design, risk assessment, 91 Arkansas warehouse incident, 159 Audience, training and communication, 110 Audits, management practices, 70,114-115 Augusta, Georgia incident, 164-165 Auxiliary system sizing, risk assessment, 95... 

Compatibility. See incompatible materials Compliance, audits, 114—115 Concept stage, life cycle issues, 20-23 Consequence analysis, risk assessment, 91 Corporate memory, documentation,... 

Identifying and analyzing fire hazards and scenarios is the next step in a fire risk assessment. The hazard identification should be structured, systematic, audit-able, and address all fire hazards, including nonprocess fires. The result of the hazard identification is a list of potential fire hazards that may occur at the facility, for example, jet, pool, flash, BLEVE, electrical, or Class A fires. This list should also include the location where each fire could occur. Hazard identification techniques used to identify potential hazards are shown in Table 6-1. 

Allowing time in the early stages of design for critical reviews and evaluation of alternatives would involve studies such as an early hazard and operability (HAZOP) study, using flowsheets, before final design begins,4 Fault tree analysis, quantitative risk assessment (QRA), checklists, audits, and other review and checking techniques can also be very helpful. These techniques are extensively discussed in the technical literature and will not be discussed in detail here. 

Quality assurance and quality control (QA/QC) A system of procedures, checks, and audits to judge and control the quality of measurements and reduce the uncertainty of data. Some quality control procedures include having more than one person review the findings and analyzing a sample at different times or using different laboratories to see if the findings are similar Quantitative risk assessment (QRA) A process that relies on mathematical modeling and estimations usually derived from animal test results and the probability of risk for a chemical substance at the low dose to which the human population is normally exposed Radionuclide A nuclide with radioactive properties... 

The preparation for inspections shonld inclnde a risk assessment based on the drug product being processed, the production process involved, and the technology mix including the use of computer systems and a review of the company s internal audit and regulatory inspection history. 

Typically, a BMS is a mixture of software categories it is important, therefore, that the Validation Plan identihes what are the categories of software which make up the system, as well as incorporates the results of the system and component risk assessment into the overall validation strategy. Another important element that feeds into the validation plan is the result of the supplier audit. The validation life cycle presented here is consistent with GAMP Guidance and related case study material. - ... 

The principle of GEP for the BMS system controlling offices, restrooms, and corridors was adopted. The project milestones were then planned and auctioned in accordance with the combined (cGMP/GEP) plan. The suppher was audited and commissioned with the understanding that it must participate in the risk assessments. It was agreed that savings in project costs would be shared however, the company s QA audit group would assess the whole project and fines could be applied if breaches in quality were detected. 

Electronic records requiring particular regulatory control should be identified based on critical process control points and associated critical parameters that directly impact product quality or product safety. A defined process should be used to conduct this analysis, and it should be one that builds on or is complementary to any assessment conducted as part of product registration. Consistency is key. There may be additional records identified by predicate rules but care must be taken not to extend beyond these records. A risk assessment should be conducted to determine appropriate electroific record management controls such as audit trail and archiving. Electronic records will need to be archived for retention periods specified in predicate rules. Other data related to process performance rather than product quality or product safety requires only basic data maintenance and may be retained for much shorter periods before being purged. 

The agency stated that they will exercise enforcement description on the issue of audit trails. The new guidance document also revises the former interpretation that the audit trails are only accepted in the form of a computer-generated log. The implementation of an audit trail should be subject to a risk assessment. 

---