I don't know if I'm fully awake yet this morning but Paula's first line just "screams"
PFMEA to me. As to the second question, I suppose a blurb mentioning PFMEA and any other risk analysis methodology employed could be in the PA procedure.
As I reread this, it came to me that a Feasibility Analysis should also be included which would incorporate more of the "service" departments into the PA process.