Risk assessment
Once the products have been prioritized, a risk-assessment technique can be used to evaluate, control, and communicate the
associated risk related to a given product. Failure mode effects analysis (FMEA) is currently used to assess supplier risk.
A supplier FMEA does the following things:
- Lists each component of the product along with its function.
- Identifies possible supplier-failure modes.
- Assesses the severity of the supplier failure modes based on their effect on the end user. Product characteristics are identified
as critical if patients are harmed when the characteristics are not controlled.
- Lists possible causes of the supplier failure modes and estimates the number of occurrences for each cause.
- Lists current controls to prevent or detect the supplier failure modes or causes and estimates how effective the current controls
are.
Figure 2: Example supplier failure mode effects analysis template. RPN is risk priority number.
|
One obtains a risk priority number (RPN) by multiplying predefined rankings for severity, occurrence, and detection. These
rankings are typically numbers from 1 to 5 or 10. A threshold RPN should be identified, and suppliers whose risk exceeds the
threshold should be considered unacceptable. Figure 2 provides an example of a supplier FMEA template (1, 2).
Suppliers with RPNs that exceed the threshold value should be audited. Companies can conduct a full or modified audit, depending
on the severity of the risk that prevented the supplier from achieving an acceptable RPN ranking. Key items to focus on during
an audit include the quality of the supplier's risk-assessment program and how the supplier controls critical characteristics.
Supplier audits are discussed in more detail below.
Risk control
The manufacturer and its supplier should work together to establish a plan to reduce the risk of quality nonconformances and
agree on an approach for communicating and reducing risk. Approaches to reducing risk generally fall into two categories.
Category 1: Joint cooperative plan.
The industry prefers the easier approach, which is for the manufacturer and supplier to agree on a joint cooperative plan
that reduces the identified risk to an acceptable level. This plan frequently necessitates further risk analysis of the supplier's
suppliers and components (i.e., Tier 2 analysis, or analysis of a secondary supplier) to understand where the sources of risk
enter the supply chain. In some cases, improved controls at the Tier 1 (i.e., primary) supplier, combined with improved inspection
or processing by the finished-goods manufacturer, reduces risk to an acceptable level. Tier 3 or Tier 4) suppliers might be
investigated to achieve acceptable finished-good product risk levels if the Tier 1 controls and mitigations are not sufficient.
During the implementation of the corrective actions or risk mitigations, the supplier FMEA should be updated, and residual
risk should be assessed. All revisions and updates to formal risk-management documents and reports should be reviewed and
stored in a risk-management file established for that product. If risk controls and mitigations at the supplier and finished-goods
manufacturer are exhausted and the risk remains unmitigated, alternative approaches to achieving robust quality may become
necessary.
Category 2: Establish an alternate supplier.
A longer path toward achieving robust quality and low risk is to qualify an alternate supplier or to change the design or
process so it achieves a higher level of quality. Category 2 is generally chosen only if the all plans for reducing risk at
the current supplier have been exhausted or if the supplier does not cooperate in implementing a risk-reduction plan. It is
useful to apply tools such as design for Six Sigma to the component's critical characteristics during the development of new
or modified processes or component designs.
Figure 3: Supplier risk-assessment process. FMEA is failure mode effects analysis, and RPN is risk priority number.
|
If the finished product has a level of residual risk that is above the threshold of acceptability, even after all opportunities
for risk mitigation and control have been exhausted or found to be economically infeasible, a company should perform a medical
risk–benefit analysis to determine whether the product's benefits outweigh the harm that could result from using the end product.
Figure 3 provides a flow diagram that shows the supplier-assessment process using FMEA and RPN.
|
