At a minimum, using RARM during change management entails compiling a checklist of things to consider. Records should be kept
of what was and wasn't found on the list. Management strategies may involve additional monitoring, short-term intensive testing,
and validation. RARM methods can also be used to determine what equipment and which aspects of a process should be validated
or need not be validated.
One other important GMP quality system element that relates to RARM is the deviation subsystem, which firms call Corrective
Action & Preventive Actions (CAPA), Discrepancy and Failure Investigations, or something similar. During the investigation
of a discrepancy, the RARM should be reviewed to see if the failure was considered and, if not, why not? This is not an exercise
in blame or finger pointing. It is an attempt to improve the chances of finding a previously unidentified risk, and it also
helps make future RARMs more sensitive and effective.
ORGANIZATIONS AND RARM
RARM procedures don't exist in a vacuum. For people to perform effective and useful RARMs, the process must be integrated
with other GMP quality system elements and be proceduralized. Organizational and management structures need to support RARM
efforts by providing people, resources, time, and training.
The organizational culture must support a RARM initiative. Organizational culture refers to the values, norms, beliefs, and
practices that govern how an organization functions. Some of these elements are explicitly written down, but more often the
culture is a powerful, unwritten force that persists despite reorganizations and reassignments of personnel.
If an organization's culture is open to continual learning, improvement, and challenge, a RARM program will thrive and produce
positive benefits. Conversely, if an organization relies on past success (or lack of serious failures) as a substitute for
sound engineering practices, communicates ineffectively, over-simplifies risks, or stifles professional differences of opinion,
RARM will be ineffective and not add any real value. If you don't believe that, read NASA's Columbia accident report.16
One external culture changer is FDA. If FDA continues to move towards its goal of a more scientific basis for regulation,
firms will need to formally elucidate and document process risks, controls, and monitoring practices. At the same time, FDA
will need to significantly change the way it performs inspections to enable its investigators to properly evaluate RARM practices.
ORGANIZING THE RISK MANAGEMENT PROCESS
RARM techniques have been developed and used extensively for decades in other industries. The experienced practitioners are
chemical and aeronautical engineers, environmental experts, and workplace health and safety professionals. We must learn to
talk the established language. Fifteen basic terms are defined.
The overwhelming majority of risk management processes follow the same general 11-step approach:
1. Establish goals and an overall structure and process for conducting the RARM.
2. Establish the team to conduct the RARM. It should be a cross-functional (interdisciplinary) team of knowledgeable experts
in the product, technology, or discipline. Match team members to the scope of the RARM.
3. For a given RARM, define the scope of the process or product of interest.
4. Identify potential hazards.