Risk Assessment: Hybrid Record Data Integrity

This is a ready-to-use risk assessment for one hybrid record, or for a defined group of hybrids that share the same architecture. Replace every <<FILL: ...>> placeholder, set your document numbers and dates, and route it through your normal document control, review, and approval. A worked filled specimen with fully scored rows follows. The scales below are deliberately five-point rather than ten-point, because a ten-point scale invites false precision that two assessors cannot reproduce. Verify each cited regulation against the current source before you rely on it, and treat this as general guidance to adapt rather than legal or regulatory advice.

The output of this assessment feeds two other documents: the risk class column of the hybrid system inventory register, and the prioritisation score in the hybrid retirement plan. Keep the three consistent.

Document control header

1. Purpose

This assessment identifies how the paper-and-electronic seam of <<FILL: hybrid or hybrid group>> can fail, scores each failure mode for severity, occurrence, and detectability, assigns a risk class, defines the mitigations that reduce the risk, and records the residual risk that <<FILL: COMPANY NAME>> accepts. The output determines the controls applied to the hybrid now and its position in the retirement sequence.

2. Scope

This assessment covers the creation, execution, review, correction, retention, and retrieval of the hybrid record identified in the header, including both halves and the mechanism that links them. It covers failure modes arising from the seam between the halves, from the electronic component, and from the paper component where the paper carries part of the original record.

It does not replace the validation risk assessment for the electronic component, governed by <<FILL: SOP-ID for CSV risk assessment>>, nor the product quality risk assessment for the process itself. Where this assessment and a system-level assessment reach different conclusions about the same control, the difference is reconciled and the reason recorded rather than left standing.

3. Responsibilities

4. Definitions

• Failure mode: a specific, observable way the hybrid record can stop being a trustworthy account of what happened.
• Severity: the consequence if the failure mode occurs and is not detected, judged against product quality, patient or subject safety, and the reconstructability of the record.
• Occurrence: how likely the failure mode is to arise in the current process, before considering whether anything would catch it.
• Detectability: the likelihood that an existing, operating control would catch the failure before the record is used to support a decision. A high detectability score means the failure would probably not be caught.
• Risk priority number (RPN): severity multiplied by occurrence multiplied by detectability, ranging from 1 to 125.
• Risk class: the band the risk falls into after applying the thresholds and the override rules in section 5.5.
• Residual risk: the risk remaining after the agreed mitigations are in place and operating.

5. Method

5.1 Sequence

1. Describe the hybrid factually, by observing an execution, not by reading the procedure. Record who does what, on which half, in what order.
2. Identify failure modes. Start from the catalogue in section 6, which covers the failure modes that recur across hybrids, then add anything specific to this record.
3. Score each failure mode for severity, occurrence, and detectability using the anchored scales in sections 5.2 to 5.4. Score the current state, before any mitigation you intend to add.
4. Calculate the RPN, apply the thresholds and override rules in section 5.5, and assign a risk class.
5. Define mitigations for every failure mode above the acceptance threshold. Re-score with the mitigations assumed in place and operating.
6. Record the residual risk and route it for acceptance.
7. Record actions, owners, and target dates, and feed the outcome into the hybrid inventory register and the retirement plan.

5.2 Severity scale

Score the consequence assuming the failure occurred and nothing caught it. Do not discount severity because you believe the failure is unlikely; that belongs in occurrence.

5.3 Occurrence scale

Score how often the failure mode arises in the current process as it is actually executed. Where you hold data, use it: deviation history, prior audit findings, and reconciliation exception rates are all better evidence than opinion.

5.4 Detectability scale

Score the probability that an existing, operating control catches the failure before the record supports a decision. Score the controls that actually run, not the controls in the procedure. If second-person review is defined but the reviewer signs without opening the audit trail, that is not detection.

Detectability is where assessments most often flatter themselves. The test to apply: name the control, name the person or system that performs it, and name the record that proves it was performed on the last five occasions. If that cannot be done, the score is 4 or 5.

5.5 Risk class thresholds and override rules

Two override rules apply regardless of the calculated RPN, because a low occurrence score should not be allowed to hide a failure whose consequence is unrecoverable:

1. Severity 5 with detectability 4 or 5 is classified Critical. A failure that could reach product, patient, or subject and that nothing would catch is not made acceptable by being rare.
2. Severity 4 with detectability 5 is classified High or above. Loss of reconstructability that no control would notice cannot be accepted on the basis of low occurrence, because the absence of detection also means the occurrence estimate is unverifiable.

Record any application of an override rule explicitly in the assessment table, so a reviewer can see the class was set by rule rather than by arithmetic.

5.6 Re-scoring after mitigation

Re-score with the mitigation assumed to be in place and operating, and be honest about which score it moves. Most mitigations for hybrids move detectability, not occurrence. A reconciliation step does not stop a transcription error from being made; it catches it. Only a design change, such as removing the transcription entirely by interfacing the instrument, moves occurrence. An assessment in which every mitigation conveniently reduces all three scores has not been challenged.

6. Assessment table

Complete one row per failure mode. The rows below are pre-populated with the failure modes that recur across hybrids; add, remove, and adapt them for the specific record. Scores are left blank because they are specific to your process.

7. Mitigation catalogue

Select from these where they fit, and write the specific implementation rather than the generic name. A mitigation recorded as “improve access control” cannot be verified as complete.

8. Residual risk statement

State the residual risk in language a reader outside the assessment team can evaluate. “Residual risk is acceptable” is not a statement; it is a conclusion with the reasoning removed.

9. References

21 CFR 211.68, 211.180, 211.194. 21 CFR Part 11, in particular 11.10, 11.50 (signature manifestations), and 11.70 (signature and record linking, including handwritten signatures executed to electronic records). EU GMP Annex 11 (Computerised Systems) and EU GMP Chapter 4 (Documentation). FDA guidance, Data Integrity and Compliance With Drug CGMP, Questions and Answers (December 2018). MHRA GXP Data Integrity Guidance and Definitions (March 2018). PIC/S PI 041, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments. ICH Q9, Quality Risk Management, for the risk management framework and the expectation that the effort is proportionate to the risk.

Confirm the current version and clause numbers of each reference before issue.

10. Revision history

11. Approvals

Filled specimen

The following shows four rows fully scored for an example standalone chromatography workstation used for release testing, hybrid inventory reference HYB-001. Company, names, dates, and scores are illustrative; the reasoning is the part worth copying.

Row 1: shared operating system login on the acquisition workstation

Row 2: printout treated as the original for dynamic chromatographic data

Row 3: unverified transcription of results to the worksheet

Row 4: no reconciliation between the electronic sequence and the worksheet

Residual risk statement for the specimen

Two things in this specimen are worth copying. The first is row 3, where a severity of 5 does not produce a Critical class because a real and evidenced detection control exists; the override rules are written so that severity alone does not drive everything, which is what keeps the scale usable. The second is the residual risk statement, which names a limitation on historical audit trail retention that no mitigation fixes, and says so plainly instead of scoring it down to Low.

Common inspection findings this risk assessment prevents

• Hybrid records are operated with no documented assessment of how the seam between the halves could fail.
• Every hybrid receives the same controls regardless of what depends on the data, so effort is spread evenly and the highest-risk hybrids are undercontrolled.
• Detectability scores assume controls that are written down but not performed, so the assessment concludes that risks are managed when the evidence shows otherwise.
• A severe failure mode is scored down to an acceptable class purely because occurrence was judged low, with no evidence supporting the occurrence estimate and no control that would have detected the failure.
• Residual risk is recorded as “acceptable” with no statement of what risk remains or what would change the conclusion.
• Mitigations are recorded in general terms that cannot be verified as implemented.
• The assessment was written from the procedure rather than from an observed execution, so the workarounds that create the real risk are absent from it.
• The risk assessment, the hybrid inventory, and the migration plan disagree about which hybrids are highest risk.

How to adapt this risk assessment

1. Set the document number, owner, and the hybrid inventory reference in the header, and name the assessment team including at least one person who executes the process.
2. Observe an execution before scoring. Budget the time for it. The difference between an assessment written at a desk and one written after watching the activity is usually two points of occurrence on at least one row.
3. Keep the scales exactly as written across every hybrid assessment you perform, or change them once, centrally, and re-baseline. Scales that vary between assessments make risk classes incomparable, which defeats the prioritisation the retirement plan depends on.
4. Add failure modes specific to your record. A cell and gene therapy chain of identity record will have failure modes around subject and product identity linkage that no chromatography hybrid has. A distribution hybrid will have failure modes around temperature record continuity during transfer.
5. For each mitigation you select, write the specific implementation, the owner as a named individual, and the record that will evidence it. Then check in six months whether that record exists.
6. Where a mitigation is compensating rather than preventive, say so in the notes column and carry the difference into the residual risk statement.
7. Feed the final risk class into the hybrid inventory register and the prioritisation score in the retirement plan on the same day, so the three documents cannot drift.
8. Confirm every regulation in section 9 against the current published version before issue.