Initial Risk Assessment/System Classification Assessment

Today, I will Focus on IRA/SCA. Its Full Form is Initial Risk Assessment and We also Know is System Classification Assessment. It is Very Important Part and First Level of CSV And FDA Requirement.

Its Required for classify risks with respect to effect and frequency in accordance with scales used within the organization. Combine effect and frequency to come up with a preliminary risk assessment.

The intent of this document is to perform a system GxP impact assessment and applicability of electronic records and signatures based on an understanding of business processes, user requirements, regulatory requirements and known functional areas. An overall assessment of system impact on GxP processes and other regulatory agencies requirements will be carried out.

Following Requirement Should be Required in IRA/ SCA Document.

1.      GxP and Regulatory Assessment

2.      GAMP5 Classification Assessment

3.      Electronic Record And Electronic Signatur

4.      Business Impact Assessment

5. High Level Risk Assesment

Requirment Name :- GxP and Regulatory Assessment
Requirment No.	Requirements Detail	Response Yes/No	Remark
1.	Does the Computerized system impact the patient safety?
2.	Is the system involved in capturing information that would alert the organization to take an action or support the execution of an action that impacts the product quality? (e.g. product recall, adverse event reporting)
3.	Does the system impact or store or retrieve data about the quality of the product?
4.	Does the system produce data which is used to accept or reject product? (e.g. Electronic Batch Record System or critical process chart recorder) Note: This data could be supporting data and need not be the only criteria for accepting or rejecting a product.
5.	Is the system a process control system (e.g. PLC, IPC, SCADA, DCS and EMS) that may affect product quality and is there any independent verification of the control system performance in place?
6.	Is the computerized system used to control and /or generate data and documentation to be included in a regulatory submission or otherwise submitted to the FDA, EMEA or other similar regulatory agencies?
7.	Is the computerized system used as part of the company's Quality System?
8.	Is the computerized system used to control Quality System documentation?
9.	Is the computerized system used to control Manufacturing documentation?
10.	Is the computerized system used to control Verification and Validation documentation or data?
11.	Is the computerized system used to control any packaging or labeling activities?
12.	Is computerized system used to track/perform maintenance and/or calibration of testing, laboratory, manufacturing or Quality Control equipment?
13.	Is the computerized system used to maintain purchasing, inventory, or distribution data for the company's products?
14.	Are there any Electronic Records associated with the system?

GxP Determination:If any one of the answers in the column to the right is “Yes” then the system will be deemed to be GxP applicable.

Requirment Name :- Softwere Category
Requirment No.	Requirements Detail	Response Yes/No	Remark
1.	Is this software developed specifically for Orgnation?
2.	Is this a standard product developed by a Vendor and can be configure to meet Orgnation Business process/Flow? (Software, often very complex, that can be configured by the user to meet the specific needs of the user’s business process. Software code is not altered)
3.	Is this a standard Product developed by a Vendor and Not Configurable, and is proven by very substantial industry installed base? (Run-time parameters may be entered and stored, but the software cannot be configured to suit the business process)
4.	Is this a Standard Layered software (i.e. upon which applications are built) or software used to manage the operating environment? Note:  Infrastructure Components shall not be subject to SCA.

Requirment Name :- Electronic Records, Electronic Signatures
Requirment No.	Requirements Detail	Response Yes/No.	Remark
1.	Is this system used to create, modify, distribute, store, control any records required by regulatory agency?
2.	Is this system used to approve/sign any records electronically required by regulatory agency?

Requirment Name :- Business Impact Assessment
Requirement No.	Requirements Detail	Response Yes/No	Remark
1.	Is the availability of the system essential for the continued supply of life-saving products (i.e. there is no systems redundency, and without this system, supply will stop)?
2.	Does the loss of availability of this system compromise the Integrity of any cGxP processes or record?
3.	Is the availability of the system essential for time-critical cGxP processes (e.g. product recall)?

Requirement Name :- High Level System Assessment
Requirment No.	Requirements Detail	Response	Remark
1.	Severity of system failure: - Minor: Failure of the system impacts quality system records but has no immediate impact on product quality, safety or efficacy. - Major: Failure of the system impacts product quality, safety, or efficacy.	Minar/ Major
2.	Detectability of system failure: - High - a failure will likely be detected through downstrean controls - Low - a failure is unlikely to be detected through downstream controls	High/Medium/Low
3.	Category of system