vaayaa Inclusive Education
Professional risk assessment

Research, Development and Testing Services Risk Assessment: Validity, Privacy and Integrity Risks

A worked example of how a research, development and testing team finds, scores and controls the risks that threaten valid results, participant privacy, research integrity and reliable test data.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Research, Development and Testing Services course

Executive summary

This assessment shows how a research, development and testing services team can identify, rate and control the risks that threaten valid results and the trust placed in them. Eight hazards were chosen because they are plausible in study design, laboratory testing, data handling and client delivery. Privacy and consent carry the highest inherent score, rated Critical, while weak methodology and sampling bias follow as High. Each hazard is scored before controls and again after existing and additional controls. Most residual scores fall to Low or Medium once added controls are in place, but privacy and methodology risks stay Medium because the consequences remain serious. The first actions are a pre-registered protocol, a consent and data map, locked calibration schedules and a licence register for third-party data. The team is a teaching example, so every score illustrates method, not a real organization or study.

Focus area
Research, development and testing services
Setting
Contract and in-house research, development and laboratory testing teams delivering studies and test results to clients
Method
Five by five likelihood and impact risk register

Scope

This assessment covers a research, development and testing services team that designs studies, runs laboratory and product tests, analyses data and reports results to clients. It covers study design, sampling, measurement, data handling, participant involvement and reporting. It does not cover a specific clinical trial, product safety certification or any real client. Jurisdiction, sector, sample sizes and systems are assumptions made for teaching.

Context

The team has a principal investigator for each project, laboratory technicians, data analysts, a quality lead and an IT administrator. Measurements come from calibrated instruments and automated pipelines, with spreadsheets and statistical software used for analysis. Some studies involve human participants and personal data collected under consent, while others use licensed third-party datasets. Each hazard is scored before controls to show its natural level, then again after the existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to produce valid, reproducible results and test data, protect participant privacy and client information, keep research integrity, and deliver services on time and within agreed quality. The assets in scope are study protocols and datasets, calibrated instruments and test rigs, analysis pipelines and software, consent records, licensed third-party data, laboratory samples and the reputation of the team. Stakeholders include research and laboratory staff, clients, study participants, the ethics review body, data protection contacts, regulators where they apply, and suppliers of instruments and datasets. Every risk has one owner role, and the quality lead reports the register to senior management each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H02 H06 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H03
3 Possible Likelihood 3, impact 3, score 9, medium: H04 H08 Likelihood 3, impact 4, score 12, high: H05
2 Unlikely Likelihood 2, impact 5, score 10, high: H07
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H06
2 Unlikely Likelihood 2, impact 2, score 4, low: H02 H04 H08 Likelihood 2, impact 3, score 6, medium: H01 H05 H07 Likelihood 2, impact 4, score 8, medium: H03
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Weak methodology and irreproducible results 16 High 6 Medium Principal investigator
H02 Sampling bias and poor data quality 12 High 4 Low Lead data analyst
H03 Participant privacy and consent breaches 20 Critical 8 Medium Data protection lead
H04 Excessive access, retention and failed deletion 9 Medium 4 Low IT administrator
H05 Analytical errors and model bias 12 High 6 Medium Lead data analyst
H06 Instrument calibration and data pipeline failure 12 High 6 Medium Laboratory manager
H07 Research integrity and ethical review lapses 10 High 6 Medium Quality lead
H08 Third-party data licence and supplier dependency 9 Medium 4 Low Contracts manager
H01

Weak methodology and irreproducible results

Operational Before 16 After 6

Studies are designed without clear hypotheses, controls or a fixed analysis plan, so results cannot be repeated and conclusions overstate what the data show.

Who or what is affected: Clients, research staff and readers of published results

Causes

Time pressure, unclear design choices and protocols written after results are seen.

Consequences

Invalid findings, rework, client loss and damage to scientific credibility.

Existing controls

  • Protocols are reviewed by a senior scientist before work starts.
  • Raw data is stored with each study record.

Control gaps

Protocol changes are not logged, and reruns are not done for routine studies.

Additional controls

  • Prevent: Adopt a pre-registered protocol with a fixed analysis plan agreed before data collection.
  • Detect: Have a second analyst independently rerun a sample of analyses each quarter.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Principal investigator Target: Within 45 days Early warning: Protocol amendments made after data collection has started.
H02

Sampling bias and poor data quality

Technology and data Before 12 After 4

Samples are drawn from convenient groups, missing values are ignored and measurement errors go unrecorded, so the data do not represent the population being studied.

Who or what is affected: Clients, study participants and decision makers using results

Causes

Convenience sampling, low response rates and data entry shortcuts.

Consequences

Biased conclusions, misleading client decisions and wasted development effort.

Existing controls

  • Sampling frames are written into each study plan.
  • Missing data counts are reported in every final report.

Control gaps

Exclusion reasons are not recorded consistently, and profiles are never compared with targets.

Additional controls

  • Prevent: Set quotas or randomization rules and record every exclusion with a reason.
  • Detect: Compare sample profiles with the target population and flag large gaps.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Lead data analyst Target: Within 60 days Early warning: Exclusion rates above the level stated in the study plan.
H03

Participant privacy and consent breaches

Legal and compliance Before 20 After 8

Personal data is collected, shared or reused beyond what participants agreed to, so identifiable information reaches people who should not see it.

Who or what is affected: Study participants, clients and the research team

Causes

Unclear consent wording, data copied into shared folders and reuse of data for new purposes.

Consequences

Harm to participants, loss of consent, legal action and withdrawal of client work.

Existing controls

  • Participants sign an information sheet and consent form.
  • Identifiers are held separately from research data.

Control gaps

Consent scope is not checked when datasets are reused or shared with clients.

Additional controls

  • Prevent: Limit collection to the fields named in the approved consent and remove anything else.
  • Respond: Stop processing, notify the data protection lead and follow the agreed breach procedure.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Data protection lead Target: Within 30 days Early warning: Datasets shared outside the approved consent scope or access list.
H04

Excessive access, retention and failed deletion

Technology and data Before 9 After 4

Research data stays accessible to people who no longer need it or is kept beyond the approved period, so exposure grows and deletion duties are missed.

Who or what is affected: Participants, clients and former project staff

Causes

Shared drives, staff turnover and no named owner for old studies.

Consequences

Unauthorized access, breach of consent terms and unnecessary storage cost.

Existing controls

  • Project folders are restricted to named team members.
  • Retention periods are listed in each study plan.

Control gaps

Deletion is manual and no one checks that it has happened.

Additional controls

  • Prevent: Review access rights at each project milestone and remove leavers within one working day.
  • Recover: Run a scheduled deletion job and record a certificate of disposal for each dataset.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: IT administrator Target: Within 60 days Early warning: Datasets past their retention date that are still accessible.
H05

Analytical errors and model bias

Operational Before 12 After 6

Statistical models or software settings are wrong, overfitted or trained on biased inputs, so outputs look precise but mislead the reader.

Who or what is affected: Clients, analysts and anyone relying on model outputs

Causes

Untested code, default software settings and training data that reflects past bias.

Consequences

Wrong decisions, false claims and rework after release.

Existing controls

  • Analysts check code against a small test dataset.
  • Model assumptions are written into the analysis report.

Control gaps

Holdout tests are not run for every model, and bias checks are informal.

Additional controls

  • Detect: Run validation on a holdout dataset and report error rates alongside results.
  • Respond: Hold results that fail validation and reanalyze with a second method before release.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Lead data analyst Target: Within 60 days Early warning: Model error on holdout data that is worse than the agreed tolerance.
H06

Instrument calibration and data pipeline failure

Operational Before 12 After 6

Measuring instruments drift, software updates break data pipelines or sensors fail mid-study, so measurements are wrong or missing without warning.

Who or what is affected: Laboratory staff, clients and downstream analysts

Causes

Ageing equipment, unannounced software updates and manual transfers between systems.

Consequences

Invalid measurements, repeated tests, delayed delivery and added cost.

Existing controls

  • Instruments are calibrated before major studies.
  • Pipeline outputs are compared with raw file totals.

Control gaps

Control samples are not run between calibrations, so drift goes unseen.

Additional controls

  • Prevent: Lock calibration schedules and version control pipeline software before each study.
  • Detect: Run control samples at set intervals and alert when results drift outside tolerance.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Laboratory manager Target: Within 30 days Early warning: Control sample results drifting outside the agreed tolerance.
H07

Research integrity and ethical review lapses

Reputational Before 10 After 6

Results are selectively reported, data is altered, or a study starts before ethical review is complete, so the work loses credibility and may harm people.

Who or what is affected: Participants, the ethics review body, clients and the public

Causes

Pressure to publish, selective reporting and unclear ethics rules for new methods.

Consequences

Retraction, loss of approval, harm to participants and loss of clients.

Existing controls

  • Studies require approval from an ethics review body before starting.
  • Staff sign an annual research integrity declaration.

Control gaps

Approval dates are not checked against start dates in project records.

Additional controls

  • Prevent: Hold all raw data in a locked version history and block edits after sign-off.
  • Detect: Audit a sample of reported results against source data each quarter.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Quality lead Target: Within 45 days Early warning: A study task starting before its ethics approval date.
H08

Third-party data licence and supplier dependency

Supplier Before 9 After 4

Licensed datasets or testing services are used beyond their terms, expire unnoticed or fail, so projects lose data or face legal claims.

Who or what is affected: Contracts team, clients and the project team

Causes

Expiring terms, unclear use limits and reliance on one data provider.

Consequences

Loss of usable data, breach claims and delayed client deliveries.

Existing controls

  • Licences are filed with the contracts team.
  • Suppliers are reviewed before contracts are renewed.

Control gaps

Use limits are not checked against how analysts actually use the data.

Additional controls

  • Prevent: Keep a licence register with use limits, expiry dates and named permitted users.
  • Respond: Switch to a backup supplier or pause dependent work when a licence lapses.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Contracts manager Target: Within 60 days Early warning: Third-party data in use after its licence expiry date.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic, covering harm to participants, invalid results, financial loss, client trust and legal exposure. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after existing controls and additional controls, and it must never be higher than the inherent score. A risk that could harm a participant or invalidate a published result is not rated down simply because it has not yet happened. Anything still High needs senior attention and a dated plan, Medium needs routine controls with a named owner, and Low is accepted and watched. Scores are challenged by the people who run the work, by a second reviewer who was not involved in the original rating, and whenever a warning indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Protocol amendments made after data collection has started.Escalate to the principal investigator at once, and to the ethics contact before further analysis if the change affects outcomes.
Datasets held beyond their approved retention period.Escalate to the data protection lead within one working day, and to the quality lead if not deleted within a week.
Instrument checks overdue or out of tolerance.Escalate to the laboratory manager when a check is overdue, and remove the instrument from service if it is out of tolerance.
Third-party data used without a current licence entry.Escalate to the contracts manager immediately and pause use of that data until the licence is confirmed.
Reanalysis results that differ from originally reported figures.Escalate to the quality lead for review, and to the client and senior management if the difference changes a conclusion.

Contingency arrangements

If a serious event occurs, such as a data breach, a confirmed result error or an instrument fault that affects a live study, the project lead pauses affected work and preserves records, logs and raw data. The quality lead informs the client, the ethics contact and any data protection contact as applicable rules require. Affected datasets are isolated and restored from the latest verified backup, and the instrument is removed from service until recalibrated. Any delivered result that may be wrong is flagged and corrected. Staff and participants receive clear, early and plain information about what happened and what is being done.

Prioritized action plan

  1. Adopt a pre-registered protocol with independent statistical review, owner principal investigator, within 45 days.
  2. Map consent, retention and deletion rules for each dataset, owner data protection lead, within 30 days.
  3. Lock calibration schedules and record every instrument check, owner laboratory manager, within 30 days.
  4. Create a licence register for all third-party data with use limits and expiry dates, owner contracts manager, within 60 days.
  5. Run a quarterly sample of analysis code and results for reproducibility, owner quality lead, within 90 days.

Conclusion

Valid results depend on a few steady habits: a pre-registered protocol, calibrated instruments, documented sampling, consent and retention rules that are checked, and a clear licence for every third-party dataset. The highest scores sit with privacy, methodology and sampling bias, and each has controls that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified ethics, data protection, laboratory or legal advice for any real study or client question.

Assumptions and limitations

Assumptions

  • The team works to a written quality system and reports results to external clients under agreed terms.
  • Some studies involve adult volunteers whose personal data is collected with informed consent.
  • Jurisdiction is not specified, so privacy, ethics and licensing duties are described in general terms only.

Limitations

  • The scores are examples for learning and do not describe any real laboratory, study or client.
  • Research ethics, privacy and laboratory testing rules vary and change over time, so specialist review is needed.
  • This is educational content and does not replace a formal site-specific assessment or licensed advice.

Related frameworks to study

  • Risk register with likelihood and impact scoring
  • Hierarchy of controls
  • Three lines model of risk ownership

Professional Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Research, Development and Testing Services course Read the best practices for this course

More Professional risk assessments

Hourly Active: 45,552 Learners