Documenting a risk assessment

Risk assessment consists of risk identification, risk analysis, and risk evaluation with the output forming the basis for determining appropriate risk control. The sections of NSF 363 requiring risk assessment preload the process by defining the scope or risk question, providing the nature of hazards to be considered, and pointing to risk controls that should be implemented. The documentation necessary to demonstrate conformance to the standard should facilitate assessment of the results in terms of the risks to be controlled, the reasoning and facts leading to the conclusions, understanding the risks that were considered, and provides evidence that competent people equipped with adequate information followed a process that ensured a complete assessment. The actual process for conducting a risk assessment may vary depending on the scope of the exercise but the documentation, except where risk are either obvious or cannot possibly exist, should include (4):

• Objective and scope of assessment
• Team members and their supporting qualifications (e.g., technical expertise and/or training in conducting risk assessment)
• Description, diagram, or flow chart of what was included
• Supporting references and information relating to the assessment, including policies and procedures
• Assessment methodology
• Risk identification results
• Data, assumptions, and their sources and validation
• Risk analysis results and evaluation
• Risk criteria applied and justification
• Limitations, assumptions, and justification of hypotheses
• Critical assumptions and other factors which need to be monitored
• Discussion of results
• Conclusions and recommendations or reference to resulting controls.

As with all records, this documentation should be maintained and be available for audit as well as for use in periodic review of the assessment to ensure its continuing validity and suitability in the presence of new information. Including a summary and reference to the risk assessment reports in the quality manual helps describe the quality management system and aids in understanding the basis for controls included as part of the GMPs. To prevent the loss of a company's knowledge base, training and familiarization with the content of the risk-assessment documents should be included as part of succession planning, personnel development or job descriptions for key positions where appropriate.