• (919) 844 2494
  • Risk Management

    Organizations should use risk management to determine the appropriate strategy towards validating and maintaining all computer systems.

    Text of Annex 11 Section 1 Risk Management

    Risk management should be applied throughout the lifecycle of the computerised system taking into account patient safety, data integrity and product quality. As part of a risk management system, decisions on the extent of validation and data integrity controls should be based on a justified and documented risk assessment of the computerised system.

    Interpretation

    The validation documents should include a risk mitigation strategy. Risk mitigation strategy can be defined globally in a site validation plan or computer system inventory, or for specific computer systems within the validation documents.

    Implementation

    Organizations should perform a risk assessment on all of their computer systems. The results of this risk assessment should determine the validation strategy. Systems that are considered to have a higher compliance and business risk should receive an appropriate proportion of Quality and Compliance resources.

    Frequently Asked Questions

    Q: Does every computer system require a documented risk assessment?
    A: System risk should be assessed for every system, but that does not necessarily mean that a specific Risk Assessment document is a regulatory requirement for every system. For example, your organization could categorize certain computer systems by type or purpose and state that for these systems the risk assessment is classified within the project validation plan.

    Q: Does Annex 11 require that every single program requirement is evaluated for risk?
    A: There are some computer compliance guidances which suggest that every requirement in the User Requirement document is assessed for risk. This approach certainly has significant value, but it is very time-intensive and not specifically required in Annex 11.

    Don’t see your question answered?
    Contact us and ask us your question. You can also call us at (919) 844 2494.