Changes to Internal Processes and Risk Evaluation - Mitigations

ukrainka85

Starting to get Involved
#1
One of the departments in my organization implemented a CCB (Change Control Board) to review change requests for their processes. They are following change control best practices to make sure their decisions to update processes are well communicated, planned and reviewed. They are assessing risk/impacts associated with the process changes.

They are currently saying that above a certain level of risk associated with the process change, they will have mitigations in place. But this is confusing me because I have never had to think of mitigations for process changes and I am almost tempted to think that the process change is a mitigation in itself, but that's not true. Can someone please help me think this through?

What are some examples of mitigations for high-risk process change? An example I thought of: if a process change will overhaul how the department conducts client communication globally, a hands-on training is mandatory (mitigation) of all department employees to ensure that everyone knows what to do.

*These are not manufacturing processes, but processes of the project management department within a clinical trial vendor
 
Elsmar Forum Sponsor

yodon

Staff member
Super Moderator
#2
Any process change carries risk. Just consider what could go wrong if the process fails.

Just thinking out loud...
  • Transitioning from a paper-based system to electronic records could result in loss of data. Mitigation may be data transfer validation, daily audits, etc.
  • Updating forms might result in confusion on how to properly fill out a form. Mitigations may include additional supervisory / QA oversight / review for a period
  • Adoption of a software tool to help automate may allow unauthorized access to data.
 

qualprod

Trusted Information Resource
#3
One of the departments in my organization implemented a CCB (Change Control Board) to review change requests for their processes. They are following change control best practices to make sure their decisions to update processes are well communicated, planned and reviewed. They are assessing risk/impacts associated with the process changes.

They are currently saying that above a certain level of risk associated with the process change, they will have mitigations in place. But this is confusing me because I have never had to think of mitigations for process changes and I am almost tempted to think that the process change is a mitigation in itself, but that's not true. Can someone please help me think this through?

What are some examples of mitigations for high-risk process change? An example I thought of: if a process change will overhaul how the department conducts client communication globally, a hands-on training is mandatory (mitigation) of all department employees to ensure that everyone knows what to do.

*These are not manufacturing processes, but processes of the project management department within a clinical trial vendor
Ukrainka85
Mitigation is what you do to lower the risk value.
Once mitigation is done, evaluate residual risk and decide if it is time to close it.
Hope this helps
 

John Broomfield

Staff member
Super Moderator
#4
Mitigation makes something bad less worse. It is what insurance companies require of us when we’ve suffered a loss.

Better to treat adverse risks by eliminating their causes to the extent possible.

Therefore use design control principles to change process designs by validating the verified changes perhaps through a pilot or trial so only the validated change is rolled out worldwide.

Mitigation is the weakest risk treatment.
 

ukrainka85

Starting to get Involved
#5
Mitigation makes something bad less worse. It is what insurance companies require of us when we’ve suffered a loss.

Better to treat adverse risks by eliminating their causes to the extent possible.

Therefore use design control principles to change process designs by validating the verified changes perhaps through a pilot or trial so only the validated change is rolled out worldwide.

Mitigation is the weakest risk treatment.
Thank you for the feedback, John. It does help to clarify with this example of doing a pilot. We are currently doing this on a few process changes. I may have been overthinking it.

Why is mitigation the weakest in your opinion?
 

ukrainka85

Starting to get Involved
#6
Ukrainka85
Mitigation is what you do to lower the risk value.
Once mitigation is done, evaluate residual risk and decide if it is time to close it.
Hope this helps
Thank you, qualprod!
Yes, that is the process the departments are supposed to implement. I was more thinking about what are examples of mitigations for a process change.
 

ukrainka85

Starting to get Involved
#7
Any process change carries risk. Just consider what could go wrong if the process fails.

Just thinking out loud...
  • Transitioning from a paper-based system to electronic records could result in loss of data. Mitigation may be data transfer validation, daily audits, etc.
  • Updating forms might result in confusion on how to properly fill out a form. Mitigations may include additional supervisory / QA oversight / review for a period
  • Adoption of a software tool to help automate may allow unauthorized access to data.
Thank you, yodon!
Your examples were helpful to help me think through it.
 
Thread starter Similar threads Forum Replies Date
V IATF 16949 9.2.2.1 Internal Audit Program - "Process Changes" IATF 16949 - Automotive Quality Systems Standard 11
Marc ISO 9001:2015 vs. 2008 - Internal Audits - What changes are you making? Internal Auditing 44
Z Procedure Manual Changes - Internal audit necessary prior to recertification? AS9100, IAQG 9100, Nadcap and related Aerospace Standards and Requirements 7
N Internal auditing - Changes after recently changing to 9001:2000 Internal Auditing 4
E ASTM F2118 - Fatigue testing of bone cement - Changes between the 2003 and the 2014? Other Medical Device Related Standards 1
Q Documented actions and changes in the QMS by COVID 19 ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 10
B ASTM E18-2020 - Rockwell testing standard changes? General Measurement Device and Calibration Topics 2
D Recent changes to ISO 14971 - SOP required for managing standard revisions ISO 13485:2016 - Medical Device Quality Management Systems 1
I Dating controlled documents after changes - Revision History Document Control Systems, Procedures, Forms and Templates 13
F Medical devices_hong kong_post approval changes regulation (China's MOH) Other Medical Device Regulations World-Wide 3
F Medical Devices-South Africa _Post approval changes and Software Other Medical Device Regulations World-Wide 0
K Changes in process dispersion, and location hypotheses tests Using Minitab Software 3
NDesouza When Customers Make Changes to Orders Contract Review Process 24
S Managing specification changes on standard parts purchased through trading companies Document Control Systems, Procedures, Forms and Templates 2
I MSA requirement for 5 Micrometers + CP changes need customer approval? IATF 16949 - Automotive Quality Systems Standard 2
A ISO13485:2016 name and ownership changes questions ISO 13485:2016 - Medical Device Quality Management Systems 2
R What are the changes in 5th Edition of FMEA manual? FMEA and Control Plans 6
S Examples of software changes that required a 510k US Food and Drug Administration (FDA) 2
D 510K and Changes to Verification and Validation US Food and Drug Administration (FDA) 2
M What are the changes in supervising according to ISO17025? ISO 17025 related Discussions 7
M Informational New Zealand – Changes to Medical Device Adverse Event Reporting process Medical Device and FDA Regulations and Standards News 0
R Rationale for changes to ISO Standards Other Medical Device Related Standards 4
M Informational TGA Consultation: Proposed changes to medical device essential principles for safety and performance Medical Device and FDA Regulations and Standards News 0
A Changes to an already certified product (IIb, MDR) EU Medical Device Regulations 1
I Tracking Protoype Changes; 8D or simple document revision? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 5
C What if the foreign manufacturer of a medical device changes the Authorized Representative in Saudi Arabia? Other Medical Device Regulations World-Wide 0
A The latest revision number and changes in automotive core tools IATF 16949 - Automotive Quality Systems Standard 1
M Informational EU – MDCG 2018-1 v2 Guidance on basic UDI-DI and changes to UDI-DI Medical Device and FDA Regulations and Standards News 0
J Ethicon suture box design changes - 2019 Other Medical Device Regulations World-Wide 2
E Changes to medical device submitted through a variation? EU Medical Device Regulations 1
T AS9100 Maintain Approval When Business Ownership Changes AS9100, IAQG 9100, Nadcap and related Aerospace Standards and Requirements 8
M Informational TGA – Several proposed changes to classification to better align with the EU MDR Medical Device and FDA Regulations and Standards News 0
S ISO9001:2015 6.3 - Planning of Changes - OFI from auditor ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 20
M Medical Device News TGA Consultation: Changes to a number of definitions and the scope of the medical device regulatory framework in Australia Medical Device and FDA Regulations and Standards News 0
F Device Standards - Managing Changes to existing standards that apply to our devices Other Medical Device Related Standards 1
S Ballooned Drawings and Engineering Changes Inspection, Prints (Drawings), Testing, Sampling and Related Topics 0
supadrai Changes to QMS - Contract Term ISO 13485:2016 - Medical Device Quality Management Systems 4
R ISO 9001:2015 6.2 - Planning Changes ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 2
C Significant Organizational Changes - Documented Responsibilities Document Control Systems, Procedures, Forms and Templates 4
M Medical Device News Health Canada - Proposed Changes - List of Recognized Standards for Medical Devices Canada Medical Device Regulations 3
Marc 9 September 2018 - Upcoming User Group Changes Forum News and General Information 1
J Class 1 Medical Device ECR (Engineering Change Request) Changes 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 4
Douglas E. Purdy ISO/IEC 17025:2017 3rd Ed. Changes from 2nd Ed. ISO 17025 related Discussions 6
M Notifying Registrar of Significant QMS changes ISO 13485:2016 - Medical Device Quality Management Systems 2
S Medical Device Changes and How to Assess Their Impacts to Essential Requirements EU Medical Device Regulations 2
S Design changes a week after regulatory submission 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 1
L Verifying training effectiveness for procedure changes ISO 13485:2016 - Medical Device Quality Management Systems 4
2 First Article Requirements for Revision Changes of Engineering AS9100, IAQG 9100, Nadcap and related Aerospace Standards and Requirements 0
C Partial Design Validation and changes to a critical supplier 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 4
J ISO 9001:2015 Cl. 6.3 Planning Changes ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 6
Similar threads


















































Top Bottom