The Contamination Control Strategy is only as good as the risk assessment underneath it. Annex 1 expects every control choice to trace to a documented, science-based risk assessment, and this document is that backbone: it identifies contamination routes, scores them, drives the controls, and states the residual risk that the CCS then records. It uses a failure-mode style assessment (severity, occurrence, detection) adapted for contamination hazards, which is one accepted QRM method under ICH Q9(R1); a hazard-mapping or risk-ranking method is equally valid if your QRM procedure specifies it. Replace every <<FILL: ...>> placeholder, run the assessment with a cross-functional team, and feed the output into the CCS risk-to-control matrix. A filled specimen follows. Verify each cited requirement against the current source before you rely on it.
Why this assessment exists (regulatory basis)
Annex 1 requires contamination control to be designed using Quality Risk Management rather than assembled from habit, and ICH Q9(R1) is the method. Q9(R1) specifically cautions about subjectivity in risk scoring and about matching the formality of the assessment to the risk, so the scales and the scoring rationale here are made explicit. The assessment identifies each route by which microbial, particulate, or endotoxin/pyrogen contamination could reach the product, scores it before and after controls, and records the residual risk and its owner. That residual-risk statement is what the CCS carries forward.
Document control header
| Field | Entry |
|---|---|
| Assessment title | Contamination Route Risk Assessment, <<FILL: line / process>> |
| Document number | <<FILL: RA-ID>> |
| Version / date | <<FILL>> |
| Feeds CCS | <<FILL: CCS-ID>> |
| QRM method | Contamination FMEA (severity x occurrence x detection) |
| Team (cross-functional) | <<FILL: Micro, Manufacturing, Facilities, QA, Validation>> |
1. Scope
This assessment covers the routes by which microbial, particulate, and endotoxin/pyrogen contamination could reach the product on <<FILL: line / process>>, from <<FILL: start of scope>> to <<FILL: end of scope>>. Out of scope: <<FILL>>.
2. Scoring scales
State the scales explicitly so scoring is reproducible. Adjust the anchors to your QRM procedure; the point is that every scorer reads a “3” the same way.
Severity (S), impact if the contamination reaches product:
| Score | Meaning |
|---|---|
| 1 | Negligible: no credible product/patient impact |
| 2 | Minor: particulate/quality impact, unlikely to affect sterility |
| 3 | Serious: could compromise sterility or endotoxin limit for some units |
| 4 | Critical: direct sterility failure with patient-harm potential |
Occurrence (O), likelihood the route is realized before controls, or of a control failing:
| Score | Meaning |
|---|---|
| 1 | Remote: no history, robustly designed out |
| 2 | Low: rare, strong controls |
| 3 | Moderate: plausible, control depends on execution |
| 4 | High: recurring or control easily defeated |
Detection (D), chance the route/failure is caught before product is affected (higher score = worse detection):
| Score | Meaning |
|---|---|
| 1 | Almost certain to detect (continuous monitoring, alarmed) |
| 2 | Likely (routine monitoring with short feedback) |
| 3 | Unlikely (periodic monitoring, delayed result) |
| 4 | Very unlikely (no effective detection before use) |
Risk Priority Number (RPN) = S x O x D. Define the action thresholds: <<FILL: e.g. RPN >= 24 or any S=4 with O>=3 requires additional control>>. Do not let RPN arithmetic override judgment: any credible critical-severity route gets a control regardless of a low RPN.
3. Contamination-route assessment table
| # | Contamination route (hazard) | Type (micro/particulate/endotoxin) | S | O | D | RPN (pre) | Existing control(s) | Additional mitigation | S | O | D | RPN (post) | Residual risk / owner |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
Include at least the routes for: personnel/interventions, incoming components (stoppers, vials), water and gases, HVAC/pressure cascade, disinfection efficacy, sterilizing-grade filtration, container-closure integrity, and equipment/transfer.
4. Mitigations and actions
| Action ID | Route addressed | Action | Owner | Due | Status |
|---|---|---|---|---|---|
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
5. Residual risk statement and acceptance
For each route where risk remains after controls, state it plainly and record who accepted it and on what basis (monitoring trend, APS result, qualification data). Unaccepted residual risk is an open action, not a closed assessment.
Residual risk summary: <<FILL>>. Accepted by: <<FILL: risk authority / Quality Head>>.
6. Acceptance criteria
- Every credible contamination route (microbial, particulate, endotoxin) is identified and scored with the defined scales.
- Scoring rationale is recorded, not just the numbers, addressing the Q9(R1) subjectivity caution.
- Each route above the action threshold has a mitigation with an owner and due date.
- Every route ends with a residual-risk statement and a named owner, ready to carry into the CCS matrix.
- The assessment was run by a cross-functional team and is under change control with a review trigger.
7. References
EU GMP Annex 1 (2022), Contamination Control Strategy and QRM basis. ICH Q9(R1), Quality Risk Management (subjectivity, formality, risk-based decision-making). ICH Q10, Pharmaceutical Quality System (where the residual risk is governed).
Confirm the current version and clause numbers of each reference before issue.
Filled specimen
An extract for an aseptic vial-filling line. Scores are illustrative and would be justified by the team.
| # | Route (hazard) | Type | S | O | D | RPN pre | Existing control | Mitigation | S | O | D | RPN post | Residual / owner |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Operator shedding at fill point during intervention | Micro | 4 | 3 | 2 | 24 | Closed RABS, Grade B, gowning qual, restricted count | Reduce intervention frequency by design; qualify each operator in APS | 4 | 2 | 1 | 8 | Low; Head of Sterility Assurance |
| 2 | Sterilizing filter flaw masked, passes post-use test | Micro | 4 | 2 | 3 | 24 | 0.22 micron rated, retention validated, post-use integrity test | Add PUPSIT per assembly, or risk-justify omission in CCS | 4 | 2 | 2 | 16 | Low-medium; Manufacturing/QA |
| 3 | Endotoxin on incoming stoppers | Endotoxin | 3 | 2 | 2 | 12 | Depyrogenation validated, incoming endotoxin spec | Trend incoming endotoxin, tighten supplier control | 3 | 1 | 2 | 6 | Low; QC Micro |
Reading route 1, the team drove occurrence down (fewer interventions by design) and detection up (continuous Grade A monitoring), taking the RPN from 24 to 8, and stated the residual risk with an owner. Route 2 shows the PUPSIT decision landing where Annex 1 puts it: either perform it or risk-justify the omission, with the flaw-masking hazard named rather than assumed away. Those residual-risk lines are exactly what feeds the CCS.
Common inspection findings this assessment prevents
- Controls in the CCS with no risk assessment behind them, so the “why this control” question has no answer.
- Scoring with no recorded rationale, which reads as arbitrary under the Q9(R1) subjectivity lens.
- A critical-severity route dismissed because its RPN arithmetic came out low.
- Residual risk left unstated or unaccepted, so the CCS carries a control with no risk conclusion.
- An assessment run by one function, missing the cross-functional view a contamination route needs.
How to adapt this assessment
- Set the scales to match your QRM procedure so a “3” means the same to every scorer.
- Enumerate the real routes for your line, at least the eight categories listed in section 3.
- Record the scoring rationale, not just the numbers, and let judgment override RPN for any critical route.
- Carry each residual-risk statement and owner into the CCS risk-to-control matrix.
- Put the assessment under change control with a review trigger, and confirm the references before issue.