Risk assessment at the process step, not in Excel

Cover image “Risks at the process step”: risk matrix and flow from risk via assessment and risk class to test case.

In many projects, the risk register lives in one spreadsheet, the test cases in another tool and the process in a third. Then nobody can tell at a glance whether a critical step has been tested.

Who it’s forRisk management, quality management, validation in regulated industries and test managers.

WhatRisk assessment at the process step with risk class, controls and test depth.

HowSeverity, probability and detectability give the risk class, the class gives the test depth. The diagram shows the gaps.

WhyRisk register, tests and processes lived in separate tools. We wanted you to see at the step whether a risk is covered.

The method is well known

Whether ISO 31000, FMEA or GAMP 5 in regulated environments: risks are identified, assessed, treated and monitored. The problem is rarely the method, but the link to the process.

Briefly explained: FMEA (failure mode and effects analysis) asks what can go wrong, how serious it would be and whether it would be noticed in time. GAMP 5 is a guide for computerised systems in regulated industries such as pharmaceuticals and medical technology; ICH Q9 describes quality risk management in the pharmaceutical industry. TAOM does not prescribe a method – it is chosen per risk.

Risk, class, test depth

In TAOM, the risk is attached to the process step. Severity, probability and detectability give the risk class – and the risk class determines the test depth. Controls can be stored for each risk; the risk register shows the coverage.

Risk at the stepWhere it arises.

AssessmentSeverity · probability · detectability

Risk classDetermines how deeply to test.

Test caseAt the same step.

EvidenceSigned and filed.

Gaps are visible at once

A test-relevant step without a test case is immediately visible in the diagram. If a step changes, Change Impact shows which risks need to be reassessed.

Across all models, the attribute directory answers the same question with one click: “risk without control” or “test-relevant but without a test case”. In regulated environments, equipment qualification is added (IQ, OQ, PQ) – also at the step.

A risk that is not attached to the process gets assessed – but not managed.

In short

If you link risk, test case and process step, you can see at a glance where it is critical, how deeply you need to test and where a test is still missing.

About TAOM: TAOM is the method and platform of Traniva AG (Switzerland) for people, processes and AI working together – with Process Studio Editor and Viewer, TAOM Training and Support. Our principle: AI supports, responsibility stays with people.

Share this article

LinkedIn X Facebook Email

Risks at the process step instead of in a spreadsheet

The method is well known

Risk, class, test depth

Gaps are visible at once

Leave a Reply Cancel reply