Proceso: Risk Management

Código:
Documento:
Fecha de Efectividad:
Procedimiento de Fecha de Revisión:
Risk Management N° de Revisión:
Página: 1 de 9

Procedimiento de
Risk Management

Acción Responsable Nombre Fecha

Administrado por:

Revisado por:

Este documento es propiedad de Gascó Industrial Corp., y para uso exclusivo de su personal.
No puede ser reproducido, transmitido o cedido a terceros, sin autorización escrita y expresa de la Gerencia General de la organización.
Proceso: Risk Management

Código:
Documento:
Fecha de Efectividad:
Procedimiento de Fecha de Revisión:
Risk Management N° de Revisión:
Página: 2 de 9

Aprobado por: Gerente General Dan Bigman

1. OBJETIVO
The purpose of this procedure is to ensure control over the entire process of risk management applicable to drug
products.

2. ALCANCE
This procedure applies inside Gascó Industrial Corporation and is mandatory for all departments involved in
medical device production and distribution.

3. TÉRMINOS Y DEFINICIONES
Harm: Damage to health, including the damage that can occur from loss of product quality or availability.
Hazard: The potential source of harm (ISO/IEC Guide 51).
Product lifecycle: All phases in the life of the product from the initial development through marketing until the
product’s discontinuation.
Quality risk management: A systematic process for the assessment, control, communication,and review of risks
to the quality of the drug product across the product lifecycle.
Risk: The combination of the probability of occurrence of harm and the severity of that harm (ISO/IEC Guide 51).
Risk acceptance: The decision to accept risk (ISO Guide 73).
Risk analysis: The estimation of the risk associated with the identified hazards.
Risk assessment: A systematic process of organizing information to support a risk decision to be made within a
risk management process. It consists of the identification of hazards and the analysis and evaluation of risks
associated with exposure to those hazards.
Risk control: Actions implementing risk management decisions (ISO Guide 73).
Risk evaluation: The comparison of the estimated risk to given risk criteria using a quantitative or qualitative scale
to determine the significance of the risk.
Risk identification: The systematic use of information to identify potential sources of harm (hazards) referring to
the risk question or problem description.
Risk management: The systematic application of quality management policies, procedures, and practices to the
tasks of assessing, controlling, communicating, and reviewing risk.
Risk reduction: Actions taken to lessen the probability of occurrence of harm and the severity of that harm.
Risk review: Review or monitoring of output/results of the risk management process considering (if appropriate)
new knowledge and experience about the risk.
Severity: A measure of the possible consequences of a hazard.
Trend: A statistical term referring to the direction or rate of change of a variable(s).

4. ASPECTOS NORMATIVOS
4.1. Guidance for Industry – Q9 Quality Risk Management, June 2006

Este documento es propiedad de Gascó Industrial Corp., y para uso exclusivo de su personal.
No puede ser reproducido, transmitido o cedido a terceros, sin autorización escrita y expresa de la Gerencia General de la organización.
Proceso: Risk Management

Código:
Documento:
Fecha de Efectividad:
Procedimiento de Fecha de Revisión:
Risk Management N° de Revisión:
Página: 3 de 9

5. PROCEDIMIENTO
5.1. General Process
The following principles apply to quality risk management:
 The evaluation of the risk to quality should be based on scientific knowledge and ultimately link to the
protection of the patient
 The level of effort, formality, and documentation of the quality risk management process should be
commensurate with the level of risk
The risk management process is described in Fig. 1.

Fig. 1: Overview of a typical quality risk management process (Guidance for Industry – Q9 Quality Risk
Management, June 2006)
5.2. Responsibilities
Management coordinates the quality risk management activities and ensure that this procedure is deployed and
reviewed.
Management ensures the availability of resources for the quality risk management activities, including the
designation of an interdisciplinary risk management team.
The risk management team perform the quality risk management activities.
5.3. Initiating a Quality Risk Management Process
Gascó Industrial Corporation performs the following activities to initiate and plan a quality risk management
process:

Este documento es propiedad de Gascó Industrial Corp., y para uso exclusivo de su personal.
No puede ser reproducido, transmitido o cedido a terceros, sin autorización escrita y expresa de la Gerencia General de la organización.
Proceso: Risk Management

Código:
Documento:
Fecha de Efectividad:
Procedimiento de Fecha de Revisión:
Risk Management N° de Revisión:
Página: 4 de 9

 Define the problem and/or risk question

 Assemble background information and/or data on the potential hazard, harm or human health impact
 Identify a leader and critical resources
 Specify a timeline, deliverables, and appropriate level of decision making for the risk management process
5.4. Risk Assessment
Risk assessment consists of hazard identification, followed by the analysis and evaluation of risks associated with
exposure to those hazards. The process begins with a well-defined problem description or risk question and the
use of an appropriate risk tool, the following questions being recommended:
 What might go wrong?
 What is the likelihood (probability) it will go wrong?
 What are the consequences (severity)?
Risk assessment will be performed by following the next steps:
 Risk identification – systematic use of information to identify hazards referring to the risk question or
problem description (“What might go wrong?”) and the identification of possible consequences
 Risk analysis - estimation of risk associated with the hazard, based on a qualitative or quantitative process
of linking likelihood and severity of harms (depending on the risk management tool, detectability might also
be included)
 Risk evaluation – comparison of analyzed risk against given risk criteria
5.5. Basic Risk Management Facilitation Methods
The following methods will be used to organize data and facilitate decision making:
 Flowcharts
 Check sheets
 Process mapping
 Cause and effect diagrams (Ishikawa/fishbone diagrams)
5.6. Preliminary Hazard Analysis (PHA)
Gascó Industrial Corporation will use PHA as a tool to identify, based on prior experience or knowledge, future
hazards, hazardous situations and events that might cause harm. Using form …, this method will be considered
when analyzing existing systems, prioritizing hazard, analyzing a product, process or facility design, or types of
hazards for general product type. PHA will be used early in the development of a project, when the available
information on procedures and design is limited.
Qualitative risk acceptability criteria will be established for each product/process/equipment using the following
example, based on the expertise of the risk management team:

Frequent Low Medium High High High

Probable Low Medium Medium High High
Occasional Low Low Medium Medium High
Remote Low Low Low Medium Medium
Improbable Low Low Low Low Medium
Negligible Minor Serious Critical Catastrophic

Qualitative Probability Levels

Term Description
Frequent Likely to happen frequently
Probable Likely to happen several times during the shelf life of the product
Occasional Likely to happen a few times during the shelf life of the product
Remote Unlikely to happen, rare
Improbable Not likely to happen

Este documento es propiedad de Gascó Industrial Corp., y para uso exclusivo de su personal.
No puede ser reproducido, transmitido o cedido a terceros, sin autorización escrita y expresa de la Gerencia General de la organización.
Proceso: Risk Management

Código:
Documento:
Fecha de Efectividad:
Procedimiento de Fecha de Revisión:
Risk Management N° de Revisión:
Página: 5 de 9

Qualitative Severity Levels

Term Description
Negligible Results in inconvenience or temporary discomfort
Minor Results in temporary injury or impairment not requiring medical or surgical intervention
Serious Results in injury or impairment requiring medical or surgical intervention
Critical Results in permanent impairment or irreversible injury
Catastrophic Results in death

5.7. Failure Mode Effects Analysis (FMEA)

FMEA will be used for an evaluation of potential failure modes for processes and their likely effect on outcomes
and/or product performance, utilizing the form . This method relies on product and process understanding and
will be used for summarizing the important modes of failure, factors causing these failures, and the likely effects of
these failures.
Gascó Industrial Corporation will use FMEA to analyze equipment, facility and manufacturing operations, identifying
the elements/operations within the system that render it vulnerable.
The risk acceptability criteria will be established for each product/process/equipment using the following example,
based on the expertise of the risk management team:

Severity (S)
Description Rank
Failure with such minor consequences that it probably won’t be detected by the customer. 1-2
Failure will cause minor nuisance to the customer and/or minor performance decline. 3-5
Failure will cause dissatisfaction or nuisance to the customer and/or performance decline. 6-7
Failure will cause great dissatisfaction to the customer and will make the drug fail to function. 8-9
Failure will cause great dissatisfaction to the customer and failure of product or violation of the 10
statutory and regulatory requirements

Probability of Occurrence (O)

Description Rank
Extremely small probability that the failure will occur. 1-2
Very small probability that the failure will occur. 3-5
Small probability that the failure will occur. 6-7
Moderate probability that the failure will occur. 8-9
High probability that the failure will occur. 10

Detection of Failures (D)

Description Rank
Very high chance for failure detection. Present controls or verification methods are able to detect 1-2
any defect or failure.
High chance for failure detection. Present controls or verification methods are most likely able to 3-5
detect any defect or failure.
Moderate chance for failure detection. Present controls or verification methods are likely able to 6-7
detect any defect or failure.
Low chance for failure detection. Present controls or verification methods are not likely able to 8-9
detect any defect or failure.

Este documento es propiedad de Gascó Industrial Corp., y para uso exclusivo de su personal.
No puede ser reproducido, transmitido o cedido a terceros, sin autorización escrita y expresa de la Gerencia General de la organización.
Proceso: Risk Management

Código:
Documento:
Fecha de Efectividad:
Procedimiento de Fecha de Revisión:
Risk Management N° de Revisión:
Página: 6 de 9

Very low (or zero) chance for failure detection. Present controls or verification methods are not 10
able to detect any defect or failure.

The risk management team will estimate the severity of failures, probability of occurrence and detection and will
calculate the Risk Profile Number (RPN) using the formula:

RPN = S x O x D

Depending on the RPN value, the actions required will be determined based on the table below (as an example):

RPN Actions Required

>224 Unacceptable risk – review adequacy of current controls, implement further controls
76-224 Investigate further controls
0-75 Acceptable risk

5.8. Risk Control

Risk Management Team will evaluate the risks and decide on risk controls to be implemented, focusing on the
following questions:
 Is the risk above an acceptable level?
 What can be done to reduce or eliminate risks?
 What is the appropriate balance among benefits, risks and resources?
 Are new risks introduced as a result of the identified risks being controlled?
The amount of effort used for risk control will be proportional to the significance of the risk.
Risk reduction is considered when a quality risk exceeds a specific level and must be mitigated or avoided. Risk
reduction might include actions to mitigate the severity and probability of harm or to improve detectability. When
implementing risk reduction measures, the responsible team will revisit the risk assessment to identify and evaluate
any new risks introduced by the risk control measures or any change in the known risks.
Risk acceptance is a decision to accept risk. Risk acceptance will be a formal decision to accept the residual risk.
The acceptable level of risk will depend on many parameters, including, when applicable, risk-benefit analysis, and
will be decided on a case-by-case basis.
5.9. Risk Communication
Risk management information will be shared between the decision makers and others, at any stage of the risk
management process. The output of the quality risk management process will be appropriately communicated and
documented, as applicable, to patients, within the company, industry or regulatory authority.
5.10. Risk Review
Risk management will be an ongoing part of the quality management process. Gascó Industrial Corporation will
implement a mechanism to review or monitor events.
When gaining new knowledge and experience, the output of the risk management process will be reviewed
considering the new information. The quality risk management process will be used for events that might impact
the original quality risk management decision, including planned events (e.g., results of product review, inspections,
audits, change control) or unplanned events (e.g., root cause from failure investigations, recall). The frequency of
the review will be based upon the level of risk.
Risk review might include reconsideration of risk acceptance decision.

6. REGISTROS GENERADOS
Tipo de Registro Tiempo de Retención

Este documento es propiedad de Gascó Industrial Corp., y para uso exclusivo de su personal.
No puede ser reproducido, transmitido o cedido a terceros, sin autorización escrita y expresa de la Gerencia General de la organización.
Proceso: Risk Management

Código:
Documento:
Fecha de Efectividad:
Procedimiento de Fecha de Revisión:
Risk Management N° de Revisión:
Página: 7 de 9

Nombre del Medio de

Código Ubicación / Custodio Interno Externo Activo Inactivo
Registro Archivo

7. ANEXOS

Anexo 1:

ANEXO 1
Nombre del Anexo

Este documento es propiedad de Gascó Industrial Corp., y para uso exclusivo de su personal.
No puede ser reproducido, transmitido o cedido a terceros, sin autorización escrita y expresa de la Gerencia General de la organización.
Proceso: Risk Management

Código:
Documento:
Fecha de Efectividad:
Procedimiento de Fecha de Revisión:
Risk Management N° de Revisión:
Página: 8 de 9

Colocar capture del anexo

8. CONTROL DE MODIFICACIONES

Este documento es propiedad de Gascó Industrial Corp., y para uso exclusivo de su personal.
No puede ser reproducido, transmitido o cedido a terceros, sin autorización escrita y expresa de la Gerencia General de la organización.
Proceso: Risk Management

Código:
Documento:
Fecha de Efectividad:
Procedimiento de Fecha de Revisión:
Risk Management N° de Revisión:
Página: 9 de 9

Fecha de No. de
Modificación Sección Páginas Aprobación
Revisión Revisión

Este documento es propiedad de Gascó Industrial Corp., y para uso exclusivo de su personal.
No puede ser reproducido, transmitido o cedido a terceros, sin autorización escrita y expresa de la Gerencia General de la organización.