Let's talk CAPA risk/impact assessment

When solving problems, it's important to appreciate the sense of urgency, the priorities amongst other activities and the depth to which a problem should be solved. To help us with perspective, we perform a risk or impact assessment (risk vs impact depends upon the industry in which this CAPA is being performed).

The framework of a risk/impact assessment commonly will evaluate the severity of the defect (S), the occurrence of the defect (O), and the ability to detect the defect (D). And any such assessment tool should include definitions of the risk of the severity, the risk of the occurrence, the risk of the ability to detect the defect, to aid in the determination. With this risk/impact assessment, each organization sets a threshold for when a defect or problem should be addressed via a full CAPA process or whether containment/correction is sufficient. This is typically done by multiplying the severity x occurrence x detection (S*O*D) to come up with a risk priority number (RPN) and then defining, with words, the thresholds for further action.

Ok, let's take a look at a simple risk/impact assessment tool.

First we need to assess the risk/impact:

example CAPA risk/impact definitions

Second, we need to define response levels:

Again, the RPN is based on the severity x occurrence x risk. Example: a given problem may have a low severity (1) with medium occurrence (2) and medium detection (2). This would results in an RPN of 1 * 2 * 2 or RPN = 4, ie. medium.

example CAPA response level

Third, we define the thresholds for the response required:

example CAPA risk definitions L-M-H

This is a basic risk or impact assessment tool that can be applied in your quality system when assessing defects and potential CAPAs.