vaayaa Inclusive Education
Industrial risk assessment

Pharmaceutical and Medical Device Manufacturing Risk Assessment: Contamination, Records and Supply Controls

A worked example of how a manufacturing site finds, scores and controls the risks that threaten patient safety, product quality, records, equipment, supply and people in pharmaceutical and medical device production.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Pharmaceutical and Medical Device Manufacturing course

Executive summary

This assessment shows how a manufacturing site can find, rate and control the risks that matter most to patient safety and product quality. Eight risks were chosen because they are plausible in everyday sterile and device production, records, supply and people management. Contamination in clean areas and weak supplier control carry the highest inherent scores, because a single failure can reach many patients. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once added controls are in place, but contamination and harm reporting remain Medium because the impact stays serious. The first actions are tighter intervention control, contemporaneous batch records, removal of shared logins and a timed mock recall. This is a teaching example, so every score illustrates method, not a real organization.

Focus area
Pharmaceutical and medical device manufacturing
Setting
Licensed manufacturing site producing medicinal products and medical devices for supply to clinical settings
Method
Likelihood and impact risk register with inherent and residual scoring

Scope

This assessment covers a manufacturing site making medicinal products and medical devices, from raw material receipt and production to packaging, release and distribution. It looks at risks to patient safety, product quality, records, people and supply. Jurisdiction, product type and site layout are assumptions made for teaching. It does not replace formal quality risk management or licensed regulatory advice.

Context

The site has a sterile filling suite with graded clean rooms, a sterilization area, a device assembly line, a packaging hall and a cold store. Production uses electronic batch records alongside some paper forms and spreadsheets. Active ingredients and components come from a small number of approved suppliers. A quality unit reviews batches before release, and staff work in three shifts with a mix of permanent and temporary operators. Each risk is scored before controls to show its natural level, then again after existing and added controls.

Objectives, assets and stakeholders

The objective is to make products that are safe, effective and consistent, release them only when records support them, and keep the trust of patients, clinicians and regulators. The assets in scope are sterile and clean areas, production equipment, batch and quality records, electronic systems, raw materials, stored stock and the site's reputation. Stakeholders include patients, clinicians, operators, the quality unit, management, suppliers, distribution partners and regulators. Each risk has one owner role. The head of quality keeps the register current and reports to senior management each quarter, and any harm report is escalated to the complaints and vigilance lead the same day.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H02 Likelihood 4, impact 4, score 16, high: H05 Likelihood 4, impact 5, score 20, critical: H01
3 Possible Likelihood 3, impact 3, score 9, medium: H04 Likelihood 3, impact 4, score 12, high: H03 H06
2 Unlikely Likelihood 2, impact 4, score 8, medium: H07 Likelihood 2, impact 5, score 10, high: H08
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 3, score 9, medium: H05
2 Unlikely Likelihood 2, impact 2, score 4, low: H04 Likelihood 2, impact 3, score 6, medium: H02 H03 H06 H07 Likelihood 2, impact 4, score 8, medium: H01 H08
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Microbial or cross-contamination in aseptic and clean areas 20 Critical 8 Medium Head of aseptic production
H02 Batch record and documentation errors 12 High 6 Medium Quality assurance manager
H03 Data integrity failures in electronic systems 12 High 6 Medium Information systems manager
H04 Equipment failure or drift out of calibration during production 9 Medium 4 Low Engineering manager
H05 Supplier and raw material quality failure 16 High 9 Medium Supplier quality lead
H06 Staff competence gaps and handover errors across shifts 12 High 6 Medium Production manager
H07 Cold chain and storage temperature excursion 8 Medium 6 Medium Warehouse manager
H08 Delayed handling of adverse event reports, complaints and recall 10 High 8 Medium Complaints and vigilance lead
H01

Microbial or cross-contamination in aseptic and clean areas

Safety Before 20 After 8

Microorganisms, particles or foreign material enter sterile or clean areas through gowning lapses, airflow failure or equipment interventions, so product is unsafe for patients.

Who or what is affected: Patients, operators and quality staff

Causes

Human movement in clean rooms, worn gowns, damaged seals and interventions made under time pressure.

Consequences

Patient infection, product recall, batch rejection and regulator action.

Existing controls

  • Gowning and entry procedures are followed and checked by supervisors.
  • Environmental monitoring samples are taken at set points each shift.

Control gaps

Monitoring is periodic, so a short airflow or gowning lapse can pass between samples.

Additional controls

  • Prevent: Qualify interventions in advance and limit people in the room during critical filling steps.
  • Detect: Trend particle and microbial results daily and act on any rising pattern before batch release.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Head of aseptic production Target: Within 30 days Early warning: Repeated alert level results at the same monitoring point over a single week.
H02

Batch record and documentation errors

Legal and compliance Before 12 After 6

Batch records are incomplete, signed late or filled in from memory, so the history of a batch cannot be shown and release decisions rest on weak evidence.

Who or what is affected: Quality assurance, release staff and patients

Causes

Heavy batch workload, paper and electronic forms used side by side, and unclear rules on signing.

Consequences

Batch rejection, delayed release, findings against the site and a gap in patient supply.

Existing controls

  • Batch records are checked by a second person before release.
  • Entries use controlled templates with required fields.

Control gaps

Reviews focus on the final page, so gaps in middle steps can be missed.

Additional controls

  • Prevent: Make entries at the time of each step and block release of any batch with an open field.
  • Detect: Run a weekly review of deviations and missing signatures across all open batches.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Quality assurance manager Target: Within 45 days Early warning: Batches released with a late signature or a correction made without a stated reason.
H03

Data integrity failures in electronic systems

Technology and data Before 12 After 6

Shared logins, disabled audit trails or manual transfers between systems allow records to be changed or lost, so the accuracy of results cannot be relied on.

Who or what is affected: Quality staff, information technology teams and patients

Causes

Shared accounts used on the line, legacy spreadsheets and copy and paste between systems.

Consequences

Untrustworthy results, regulator findings, recall of affected batches and loss of credibility.

Existing controls

  • Individual user accounts are required for all production systems.
  • Audit trails are switched on for the main quality and batch systems.

Control gaps

Spreadsheets used for calculations sit outside audit trail coverage.

Additional controls

  • Prevent: Remove shared logins and set role based permissions that are reviewed each quarter.
  • Detect: Review audit trail exceptions for deleted or back dated entries each month.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Information systems manager Target: Within 60 days Early warning: An audit trail entry showing a change made after the record was already signed.
H04

Equipment failure or drift out of calibration during production

Operational Before 9 After 4

Filling machines, sterilizers, pressure gauges or balances fail or drift out of calibration during a run, so product is made outside its validated limits.

Who or what is affected: Operators, patients and production planners

Causes

Wear over time, missed calibration dates and settings changed without authorization.

Consequences

Out of specification product, rework, batch rejection and delayed supply.

Existing controls

  • Equipment is calibrated on a written schedule with labels showing due dates.
  • Operators check key settings at the start and end of each run.

Control gaps

Alarm limits are set wide and are not reviewed after equipment changes.

Additional controls

  • Prevent: Fit alarms to critical settings that stop the line when limits are exceeded.
  • Recover: Hold and assess all product made since the last good check before any release.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Engineering manager Target: Within 90 days Early warning: A calibration due date has passed on a critical instrument that is still in use.
H05

Supplier and raw material quality failure

Supplier Before 16 After 9

A raw material, active ingredient or component arrives out of specification, counterfeit or without a valid certificate, and enters production before it has been tested.

Who or what is affected: Production staff, patients and purchasing staff

Causes

Cost pressure, single source suppliers and certificates accepted without checking.

Consequences

Contaminated or ineffective product, recall, legal action and damaged supplier relations.

Existing controls

  • An approved supplier list is maintained and reviewed each year.
  • Incoming materials are sampled and tested before release to use.

Control gaps

Audits of minor suppliers are paper based and rarely verified on site.

Additional controls

  • Prevent: Audit critical suppliers on site or by a qualified questionnaire before the first order.
  • Detect: Check each certificate against the supplier record and quarantine any mismatch on receipt.
Likelihood 4 x impact 4 before; 3 x 3 after Owner: Supplier quality lead Target: Within 60 days Early warning: A certificate of analysis that does not match the result from the site sample.
H06

Staff competence gaps and handover errors across shifts

People Before 12 After 6

New or temporary staff, or staff moving between shifts, miss steps or pass on incomplete information, so a process is run without the training or context it needs.

Who or what is affected: Operators, supervisors and patients

Causes

Overtime, staff turnover, short notice cover and handover sheets that are brief.

Consequences

Process errors, deviations, injury and inconsistent product quality.

Existing controls

  • Training records are kept for each role and checked before a task is assigned.
  • A written handover sheet is completed at each shift change.

Control gaps

Competence sign off is not repeated after a long gap in carrying out a task.

Additional controls

  • Prevent: Assign tasks only to staff whose competence is signed off for that specific step.
  • Respond: Require a supervisor to confirm open issues face to face before the next shift begins.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Production manager Target: Within 45 days Early warning: Deviations or near misses clustered on one shift or within one new starter's work.
H07

Cold chain and storage temperature excursion

Operational Before 8 After 6

Temperature controlled product is stored, moved or delivered outside its stated range, for example during a power cut or a delayed transport, so its stability is in doubt.

Who or what is affected: Patients, warehouse staff and logistics partners

Causes

Power loss, a door left open, failed refrigeration and transport delay.

Consequences

Loss of potency or safety, wasted stock and a supply gap for patients.

Existing controls

  • Storage temperatures are logged continuously with alarms.
  • Stock is kept in designated cold storage with labelled locations.

Control gaps

Alarms reach one phone number and have no backup contact after working hours.

Additional controls

  • Detect: Review temperature logs at the start of each day and investigate any excursion at once.
  • Recover: Quarantine affected stock and assess it against stability data before any release.
Likelihood 2 x impact 4 before; 2 x 3 after Owner: Warehouse manager Target: Within 30 days Early warning: A temperature alarm that is not acknowledged within the set response time.
H08

Delayed handling of adverse event reports, complaints and recall

Reputational Before 10 After 8

Complaints or reports of harm from patients or clinicians are logged late, not assessed for patient impact or not linked to a batch, so a recall or safety notice is delayed.

Who or what is affected: Patients, clinicians and the company

Causes

Reports arriving by phone or informal channels and unclear thresholds for reporting.

Consequences

Continued patient harm, a late recall, regulator action and reputational damage.

Existing controls

  • Complaints are logged in a central system with a reference number.
  • A recall procedure is written and reviewed each year.

Control gaps

The mock recall is not timed and does not include distribution partners.

Additional controls

  • Prevent: Train all customer contact staff to pass any harm report to quality on the same day.
  • Respond: Run a mock recall exercise and time how quickly affected batches are located.
Likelihood 2 x impact 5 before; 2 x 4 after Owner: Complaints and vigilance lead Target: Within 60 days Early warning: Complaints about the same batch or product type arriving within a short period.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score is a guide for ordering work, not a measurement. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls. Impact to patients always weighs most, so a risk with possible harm is never rated down only because it has not yet happened. Anything Critical or High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Quality, production and information staff should challenge every rating, and the register is reviewed whenever an indicator reaches its threshold or after any deviation, complaint or recall.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Repeated alert level results at the same clean room monitoring point.Escalate to the head of aseptic production at once, and to the head of quality if two alerts occur within a week.
Batches released with open fields, late signatures or unexplained corrections.Escalate to the quality assurance manager on any occurrence, and hold the batch until the gap is closed.
Audit trail exceptions showing changes made after a record was signed.Escalate to the information systems manager and head of quality within one working day.
Certificates of analysis that differ from the site sample result.Escalate to the supplier quality lead at once, quarantine the material and inform the head of quality.
Complaints or harm reports about the same batch or product type within a short period.Escalate to the complaints and vigilance lead the same day, and to senior management if a patient harm link is possible.

Contingency arrangements

If a serious event occurs, such as contamination in a filling run, a data integrity breach or a confirmed patient harm report, production of the affected line stops at once. The quality unit quarantines related batches and preserves records and samples. The information systems manager isolates affected systems and restores data from the latest tested backup. The head of quality informs senior management and, through the regulatory lead, the relevant authorities as the jurisdiction requires. Supply staff plan alternative stock and inform customers early and plainly.

Prioritized action plan

  1. Tighten intervention control and gowning checks in clean rooms, owner head of aseptic production, within 30 days.
  2. Require contemporaneous batch records and block release of any batch with open fields, owner quality assurance manager, within 45 days.
  3. Remove shared logins and review audit trail exceptions monthly, owner information systems manager, within 60 days.
  4. Audit critical suppliers and verify every certificate on receipt, owner supplier quality lead, within 60 days.
  5. Time a mock recall and route all harm reports to quality the same day, owner complaints and vigilance lead, within 60 days.

Conclusion

Safe products depend on steady habits: disciplined gowning and monitoring, contemporaneous records, individual accounts, calibrated equipment, verified suppliers, clear handovers and a rehearsed recall. The highest scores sit with contamination, supplier quality and harm reporting, and each has actions that lower the residual score. Treat the register as a living record, review it on the stated cycle, and seek qualified regulatory, clinical and legal advice for any real manufacturing, device or product decision.

Assumptions and limitations

Assumptions

  • The site holds the licences needed to manufacture and supply its products, and jurisdiction is not specified.
  • Products include both a sterile medicine and a single use device, so aseptic and design controls both apply.
  • Staff are trained and qualified, and equipment is maintained under a written schedule.

Limitations

  • The scores are educational examples and do not describe any real site or product.
  • Manufacturing and device requirements vary by country and change over time, so specialist regulatory and quality review is needed.
  • This is not medical, pharmaceutical or legal advice.

Related frameworks to study

  • Hazard analysis and critical control points
  • Failure mode and effects analysis
  • Root cause analysis
  • Quality risk management principles
  • Hierarchy of controls

Industrial Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Pharmaceutical and Medical Device Manufacturing course Read the best practices for this course

More Industrial risk assessments

Hourly Active: 45,552 Learners