Risk Assessment in Pharma: FMEA Explained with a Practical Example

Risk assessment in the pharmaceutical industry helps identify potential problems before they affect product quality, patient safety, or regulatory compliance. Pharmaceutical manufacturers use structured risk assessment methods to evaluate hazards, understand their possible consequences, and implement appropriate controls.

Risk Assessment in Pharma: FMEA Explained with an Example is an important topic for Quality Assurance (QA), Quality Control (QC), production, validation, and pharmaceutical microbiology professionals.

Failure Mode and Effects Analysis (FMEA) is a systematic risk assessment tool used to identify how a process, system, or activity could fail, what effects the failure might have, and which controls may reduce the risk. It supports the principles of Quality Risk Management (QRM) described in ICH Q9(R1).

FMEA can be applied to activities such as manufacturing, laboratory testing, equipment qualification, environmental monitoring, cleaning, and pharmaceutical documentation. When performed correctly, it helps teams make evidence-based decisions and prioritize risk-reduction activities.

What Is Risk Assessment in Pharma?

Risk assessment in pharma is the systematic evaluation of potential risks associated with pharmaceutical materials, products, processes, equipment, and quality systems.

Its purpose is to understand what could go wrong, how serious the consequences could be, and what actions are needed to prevent or reduce harm.

Risk assessment is an important part of Quality Risk Management (QRM). According to ICH Q9(R1), pharmaceutical quality risk management should be based on scientific knowledge, linked to patient protection, and appropriate to the level of risk.

Why Is Risk Assessment Important?

Risk assessment helps pharmaceutical organizations:

• Identify potential failures before they occur.
• Protect patients from risks associated with poor product quality.
• Prioritize critical quality issues.
• Improve manufacturing and laboratory processes.
• Support deviation investigations and CAPA.
• Evaluate proposed changes to equipment, processes, or procedures.
• Strengthen contamination control and data integrity.
• Maintain documented, risk-based decision-making.

For example, a pharmaceutical microbiology laboratory may assess the risk of an incubator operating outside its approved temperature range. If the problem affects the reliability of microbial test results, appropriate controls may be needed to detect the temperature excursion and evaluate the validity of affected tests.

What Is FMEA in Pharmaceutical Quality Management?

FMEA stands for Failure Mode and Effects Analysis.

It is a structured method used to identify potential failure modes, assess their effects, evaluate their causes, and determine whether additional controls are needed.

A failure mode describes how a process, component, or system could fail. The effect describes the consequence of that failure, while the cause explains why it might happen.

For example:

• Process: Incubation of microbiological test samples.
• Failure mode: Incubator temperature deviates from the approved range.
• Possible effect: Microbial growth or test results may be affected, potentially making the results unreliable.
• Possible cause: Temperature controller malfunction or inadequate monitoring.
• Potential control: Qualified equipment, calibrated monitoring devices, alarms, and an approved excursion-handling procedure.

FMEA is generally performed by a cross-functional team that understands the process and its quality risks.

Key Components of FMEA

FMEA commonly evaluates three factors: Severity, Occurrence, and Detectability.

1. Severity (S)

Severity measures the seriousness of the potential effect if a failure occurs.

Examples include:

• Low severity: A minor documentation issue with no impact on product quality or data reliability.
• Moderate severity: A process interruption that requires investigation and correction.
• High severity: A failure that could compromise a critical test result or product quality and potentially affect patient safety.

The exact rating definitions must be established in the organization’s approved risk assessment procedure.

2. Occurrence (O)

Occurrence estimates how likely the failure is to happen.

The assessment may consider historical deviations, equipment performance, process knowledge, trend data, and the effectiveness of existing controls.

A failure that repeatedly occurs may receive a higher occurrence score than a failure with little supporting evidence of recurrence.

3. Detectability (D)

Detectability evaluates how likely the failure is to escape detection before it causes its intended or downstream effect.

For a typical FMEA scoring system, a high detectability score means the failure is difficult to detect. A low score means it is more likely to be detected promptly.

For example, continuous temperature monitoring with an effective alarm may improve the likelihood of detecting an incubator excursion compared with relying only on an infrequent manual check.

Important: Scoring direction and rating definitions should be explicitly stated in the site’s FMEA procedure.

What Is the Risk Priority Number (RPN) in FMEA?

The Risk Priority Number (RPN) is a commonly used numerical method for prioritizing failure modes in some FMEA systems.

It is calculated by multiplying the Severity, Occurrence, and Detectability scores:

RPN = Severity × Occurrence × Detectability

For example, assume a hypothetical failure receives the following scores:

• Severity = 4
• Occurrence = 3
• Detectability = 4

The calculation is:

RPN = 4 × 3 × 4 = 48

The resulting value can help the team compare risks and decide which issues need further assessment or additional controls.

However, ICH Q9(R1) does not prescribe one universal RPN scoring system or acceptance threshold for every pharmaceutical process. Organizations define their own scales and decision criteria. A low RPN should not automatically make a severe patient-safety or product-quality risk acceptable.

Step-by-Step FMEA Process in Pharma

A typical FMEA assessment includes the following steps.

Step 1: Define the Process

Clearly identify the process, system, equipment, or activity being assessed.

Examples include:

• Sterilization of equipment.
• Environmental monitoring in a cleanroom.
• Microbial testing in a QC laboratory.
• Batch record review.
• Pharmaceutical water system operation.

Defining the scope helps the team focus on relevant risks.

Step 2: Identify Potential Failure Modes

Determine how each process step could fail.

Examples include:

• Incorrect test sample identification.
• Failure to maintain the approved incubation temperature.
• Inadequate cleaning of equipment.
• Missing entries in a controlled record.
• Failure to detect an environmental monitoring excursion.

Step 3: Identify Effects and Causes
https://pharmavk.com/Why-is-CAPA-Correct/

For every failure mode, identify its potential effects and possible causes.

For example, an incorrectly identified sample could lead to results being attributed to the wrong sample, compromising traceability and potentially leading to an incorrect quality decision.

Possible causes may include similar sample labels, manual transcription errors, or inadequate verification.

Step 4: Review Existing Controls

Identify the controls already in place to prevent the failure or detect it.

Examples include:

• Approved SOPs.
• Equipment qualification and calibration.
• Automated alarms.
• Independent verification.
• Electronic access controls and audit trails.
• Routine monitoring and trend review.

Step 5: Assign Risk Scores

Use the site’s approved scoring criteria to evaluate severity, occurrence, and detectability, where the selected FMEA method uses these factors.

Scores should be supported by available evidence and process knowledge rather than personal opinion alone.

Step 6: Prioritize Risks and Plan Actions

Determine which risks require additional controls, investigation, or escalation.

Possible actions include improving monitoring, revising procedures, providing targeted training, introducing a technical control, or improving equipment maintenance.

Step 7: Implement and Verify Controls

Assign responsibility and target dates for the agreed actions. After implementation, assess whether the controls are effective and whether the remaining risk is acceptable under the approved procedure.

Step 8: Document and Review the Assessment

Record the rationale for decisions, supporting evidence, assigned actions, approvals, and residual-risk assessment. Review the assessment when significant changes, deviations, new information, or adverse trends may affect the original conclusions.

FMEA Example in Pharmaceutical Microbiology

Consider a pharmaceutical microbiology laboratory that uses an incubator for a microbiological test. Maintaining the approved incubation conditions is important for obtaining reliable results.

The following example illustrates how an FMEA may be structured.

Note: The scores below are hypothetical and are intended for learning purposes. They are not regulatory acceptance criteria.

Proposed Risk-Reduction Actions

For the incubator temperature excursion risk, the team could consider:

1. Confirming equipment qualification and calibration status.
2. Implementing appropriate temperature monitoring and alarm controls.
3. Defining clear responsibilities for reviewing temperature records.
4. Establishing an approved procedure for handling excursions.
5. Training personnel to document and escalate abnormal conditions.
6. Evaluating potentially affected tests before deciding on result validity.

After these actions are implemented, the team should reassess the risk using the approved scoring criteria and evidence of control effectiveness.

For illustration, if the revised scores were Severity = 4, Occurrence = 1, and Detectability = 2, the revised RPN would be 8.

The reduction from 48 to 8 would suggest improvement within this hypothetical scoring system. However, the reduction alone does not prove that the risk is acceptable. The team must verify that the new controls work as intended and that any remaining high-severity concerns have been addressed.

FMEA Template for Pharmaceutical Risk Assessment

A pharmaceutical FMEA worksheet may contain the following fields:

Not every FMEA uses exactly the same worksheet. The structure should suit the process, the selected method, and the site’s quality system.

FMEA vs Other Risk Assessment Tools in Pharma

FMEA is one of several tools used in Quality Risk Management. The appropriate tool depends on the problem and the information available.

ICH Q9(R1) describes FMEA and other tools as options within quality risk management. A tool should be selected according to the problem rather than used simply because it is familiar.

Common Mistakes in FMEA

1. Assigning Scores Without Evidence

Scores based only on individual opinion can make risk assessments inconsistent.

Best practice: Use defined rating criteria, process data, historical events, and subject-matter expertise.

2. Focusing Only on the RPN

Two failure modes can have the same RPN but very different consequences. A severe risk should not be overlooked simply because its numerical score is relatively low.

Best practice: Review severity, the underlying effects, and applicable risk-acceptance criteria in addition to the overall score.

3. Ignoring Existing Controls

An assessment that does not account for current controls may misrepresent the actual risk.

Best practice: Document relevant preventive and detective controls, including evidence of their effectiveness.

4. Closing Actions Without Checking Effectiveness

Completing a training session or revising an SOP does not automatically demonstrate that the risk has been reduced.

Best practice: Define how effectiveness will be checked, using appropriate evidence such as monitoring trends, recurrence data, or control performance.

5. Failing to Update the Assessment

A risk assessment may become outdated when a process, equipment, material, or control changes.

Best practice: Review the assessment when new information could affect the original risk decision, following the organization’s QRM procedure.

Frequently Asked Questions (FAQs)

1. What is FMEA in pharma?

FMEA stands for Failure Mode and Effects Analysis. It is a structured tool used to identify potential failures, assess their effects, and prioritize actions to reduce risk.

2. What is the RPN formula in FMEA?

In a commonly used scoring approach, RPN is calculated by multiplying Severity × Occurrence × Detectability. The scoring scales and interpretation criteria must be defined by the organization.

3. Is FMEA required for every pharmaceutical process?

Not necessarily. ICH Q9(R1) supports selecting appropriate risk management methods according to the problem and level of risk. A specific method may be required by a site’s procedure or an applicable requirement, but FMEA is not the only accepted tool.

4. What is the difference between FMEA and CAPA?

FMEA is a risk assessment method used to anticipate and evaluate potential failures. Corrective and Preventive Action (CAPA) is a quality-system process for addressing identified problems and preventing recurrence or other potential issues, as appropriate. Information from deviations and CAPA may be used to update an FMEA.

5. What is residual risk in FMEA?

Residual risk is the risk that remains after risk-reduction measures have been implemented. It should be evaluated using the approved method and supported by evidence that the controls are effective.

6. Who should perform FMEA in a pharmaceutical company?

FMEA is commonly conducted by a cross-functional team that includes people with relevant process, technical, quality, and risk management knowledge. QA may coordinate or review the assessment according to the site’s procedures.

7. What is the difference between risk assessment and risk management?

Risk assessment involves identifying hazards and analysing and evaluating risks. Risk management is broader: it includes assessment, control, communication, and review throughout the relevant lifecycle.

Conclusion

Risk assessment is an important part of pharmaceutical quality management because it helps organizations identify potential failures and make informed decisions to protect product quality and patients.

FMEA provides a structured approach to evaluating failure modes, their effects, possible causes, and the effectiveness of existing controls. Its value depends on sound scientific reasoning, consistent scoring, appropriate risk-reduction actions, and documented follow-up.

For pharmaceutical QA, QC, microbiology, production, and validation professionals, understanding FMEA is useful for risk assessments, change control, investigations, and continuous improvement.

Remember: FMEA is not just about calculating an RPN. It is about understanding the risk, applying appropriate controls, and verifying that those controls protect product quality and patients.

References

1. International Council for Harmonisation (ICH). ICH Q9(R1): Quality Risk Management. Official guideline and supporting resources: https://www.ich.org/page/quality-guidelines
2. European Medicines Agency (EMA). ICH Q9 Quality Risk Management — Scientific Guideline. https://www.ema.europa.eu/en/scientific-guidelines/ich-q9-quality-risk-management
3. U.S. Food and Drug Administration (FDA). Q9(R1) Quality Risk Management: Guidance for Industry. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/q9r1-quality-risk-management