Process family
Risk management: six templates for assessing, escalating and accepting a risk
Risk management templates for a quality system, a project, a laboratory and a security function: the assessment cycle, the register a project runs, the escalation decision tree, the formal acceptance test and batch release as a disposition.
Risk management is the decisions an organization makes about what could go wrong before it does: identify and score a risk, choose a treatment, decide who must know, and either treat it or formally accept it with a named signature and an expiry date. The six templates are those decisions as a quality department, a project, a laboratory and a security team make them, grouped, not sequenced, because each is a complete cycle in its own setting.
The risk assessment process is the general cycle: agree criteria and appetite, identify and describe risks, score them before and after controls, choose a treatment and set a review date. Project risk management runs that cycle on every risk in a register at every review, not once in a kick-off workshop, and the risk escalation decision tree decides from written tests, not judgment, whether a risk stays with its owner, goes to the project board or executive risk committee, or is raised now as an incident. The laboratory version scopes the same cycle to one activity.
The two decision templates are where it usually goes wrong. The risk acceptance decision is the test before a residual risk is accepted instead of treated: was treatment evaluated, is the risk within appetite, who may sign, when it expires. Those questions separate acceptance from neglect. Batch release is the same kind of decision: every investigation on the batch closed, the record reviewed, the testing finished and a qualified person certifying it against the marketing authorization before it is saleable. The usual failures: a register nobody re-scores, an escalation that depends on who noticed, an acceptance with no owner and no end date.
Risk scoring is the first step of grading a CAPA and the substance of most of change control's impact assessments, so this family sits upstream of nonconformance to CAPA. The escalation and acceptance decisions are also what a security incident response ends in when a vulnerability is not going to be fixed, and the project members belong with project delivery as much as here: a project risk that materializes is raised as an issue, leaves this family and enters that one.
Templates in this family
- Risk assessment process flowchart — Risk assessment process flowchart covering scope and criteria, risk identification, likelihood and impact scoring, control effectiveness, the four treatment options and the review cycle.
- Project risk management process flowchart (register to closure) — Project risk management process flowchart: log the risk, assess probability and impact, escalate, choose a response, review it, and close it or raise an issue.
- Risk escalation decision tree template — A risk escalation decision tree covering tolerance, impact threshold, authority and urgency, with named outcomes from manage locally to raise as an incident.
- Risk acceptance decision flowchart — A risk acceptance decision flowchart: was treatment evaluated, is the residual risk within appetite, who is authorised to sign it, and when acceptance expires.
- Laboratory risk assessment process flowchart — A laboratory risk assessment workflow for clarifying activity scope, identifying hazards and existing controls, assigning further controls or approval, documenting rationale and escalating unaccepted assessments.
- Batch release process flowchart (QP certification to despatch) — Batch release process flowchart for GMP manufacture: batch record review, analytical testing, OOS and deviation closure, QA review, QP certification, disposition, certificate of analysis and stock unblocking.
Related guides
- How to create a risk assessment process — How to design a risk assessment process: agree the criteria and appetite before scoring, describe risks as cause, event and consequence, score inherent and residual separately, and approve acceptance.
- How to create a decision flowchart — How to create a decision flowchart: write each decision as a question, make the exits exhaustive and exclusive, state the criteria, and give every outcome an ending. With a live bug-triage example.