Temperature mapping and lane qualification address one of the four hazards GDP exists to control: degradation. This assessment addresses two others that get far less structured attention: loss or theft, and deliberate diversion of genuine product into a market or channel it was never authorized for. A route thermal FMEA and this assessment are complementary, not the same exercise, run both. This is a failure mode style assessment (severity, occurrence, detection), one accepted method under ICH Q9(R1); a simpler hazard ranking is equally valid if your quality risk management procedure specifies it. Replace every <<FILL: ...>> placeholder, run the assessment with a cross-functional team (quality, security, logistics, and a trading-partner or commercial representative), and let the output drive where custody controls, serialization checks, and trading-partner verification actually get applied. A filled specimen follows. Verify each cited requirement against the current source before you rely on it.
Why this assessment exists (regulatory basis)
EU GDP Guidelines (2013/C 343/01) frame the distribution hazard as broader than temperature: product can be lost, stolen, or diverted, and falsified product can enter the legitimate chain, alongside degradation. The Falsified Medicines Directive (Directive 2011/62/EU) and its Delegated Regulation (EU) 2016/161 build the safety-feature and verification system that detects a falsified or diverted pack at the point of dispense, and the US DSCSA builds a parallel suspect and illegitimate product handling obligation. ICH Q9(R1) supplies the risk-assessment method and warns against subjective, undocumented scoring. Neither regime tells you where in your own network the theft or diversion risk actually concentrates, that is what this assessment is for.
Document control header
| Field | Entry |
|---|---|
| Assessment title | Product Security and Diversion Risk Assessment, <<FILL: product / network segment>> |
| Document number | <<FILL: RA-ID>> |
| Version / date | <<FILL>> |
| Feeds | <<FILL: wholesale distributor qualification checklist ID, quality agreement ID, security procedure ID>> |
| QRM method | Product security / diversion FMEA (severity x occurrence x detection) |
| Team (cross-functional) | <<FILL: Quality, Security, Logistics, Commercial / trading-partner management, Serialization SME>> |
1. Scope
This assessment covers failure modes that could result in loss, theft, diversion, or counterfeit-entry involving <<FILL: product / product family>> across <<FILL: network segments: warehouse, in-transit, cross-dock, wholesale distributor handoff, returns processing>>. It covers physical security, custody-attribution, trading-partner, and serialization failure modes. It does not replace the thermal distribution route FMEA, which addresses degradation hazards separately. Out of scope: <<FILL>>.
2. Scoring scales
State the scales explicitly so scoring is reproducible across scorers. Adjust the anchors to your quality risk management procedure.
Severity (S), impact if the failure mode reaches the patient, brand, or business:
| Score | Meaning |
|---|---|
| 1 | Negligible: isolated loss with no patient, brand, or diversion consequence |
| 2 | Minor: measurable inventory loss, no evidence of onward diversion or counterfeit entry |
| 3 | Serious: product confirmed diverted into an unauthorized market or channel, or a suspect-product event requiring investigation |
| 4 | Critical: confirmed or credible counterfeit entry into the legitimate chain, or a diversion pattern with patient safety implications |
Occurrence (O), likelihood the failure mode happens before controls:
| Score | Meaning |
|---|---|
| 1 | Remote: no history in this network segment, unlikely by design |
| 2 | Low: occasional, seen rarely |
| 3 | Moderate: plausible, seen periodically (known theft hot spot, known price-arbitrage corridor) |
| 4 | High: recurring, seen on a meaningful share of shipments or partners |
Detection (D), chance the failure mode is caught before harm reaches the patient or the brand (higher score means worse detection):
| Score | Meaning |
|---|---|
| 1 | Almost certain (real-time custody scan, serialization verification at every handoff) |
| 2 | Likely (reconciliation on a short defined cadence, routine trading-partner reassessment) |
| 3 | Unlikely (reconciliation infrequent, trading-partner license status assumed rather than re-verified) |
| 4 | Very unlikely (no attributable custody record for this leg, no serialization check, no trading-partner reassessment cadence) |
Risk Priority Number (RPN) equals S multiplied by O multiplied by D. Define the action threshold: <<FILL: e.g. RPN 24 or higher, or any S4 regardless of O, requires additional control>>. Any credible severity 4 failure mode (confirmed or credible counterfeit entry) gets a control regardless of the calculated RPN.
3. Hazard assessment table
| # | Failure mode | Network segment | S | O | D | RPN pre | Existing control | Additional mitigation | S | O | D | RPN post | Residual risk / owner |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
Include, at minimum, one row for each of these hazard categories, dropping any that are genuinely not credible for this network and stating why:
- Unsecured or open-access storage for a high-resale-value product.
- Custody handoff recorded with no attributable person or controlled scan device.
- Cargo theft en route (trailer theft, hijacking, unattended vehicle at an unsecured stop).
- Insider theft or unauthorized removal from a controlled storage area.
- A wholesale distributor or trading partner shipped to without formal license or Responsible Person verification.
- A fraudulent or forged wholesale authorization presented by a prospective trading partner.
- Round-tripping: product sold into a lower-price market bought back and resold into a market it was never authorized for.
- A serialized identifier reused, reappearing after decommissioning, or surfacing in a market it was never assigned to.
- Aggregation (parent-child) records mis-mapped, masking a diversion at the case or pallet level.
- A returns process that accepts unverified product back into saleable stock without an identifier check.
- No reconciliation cadence between shipped, received, and on-hand inventory at a network node.
- A cross-dock or transfer hub with no camera coverage or access log.
4. Mitigations and actions
| Action ID | Failure mode addressed | Action | Owner | Due | Status |
|---|---|---|---|---|---|
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
5. Residual risk statement and acceptance
For each failure mode where risk remains after mitigation, state it plainly and record who accepted it and on what basis (trading-partner qualification evidence, serialization verification rate, security audit finding). Unaccepted residual risk is an open action, not a closed assessment.
Residual risk summary: <<FILL>>. Accepted by: <<FILL: risk authority / Quality Head>>.
6. Acceptance criteria
- Every credible failure mode across the hazard categories in section 3 is identified and scored with the defined scales, or its exclusion is justified.
- Scoring rationale is recorded, not just the numbers, addressing the Q9(R1) caution against subjective scoring.
- Each failure mode above the action threshold has a mitigation with an owner and a due date.
- Any severity 4 failure mode carries a control regardless of the calculated RPN.
- The assessment output is reflected in trading-partner qualification scope, custody-control procedures, and serialization verification points, not filed separately from them.
- The assessment was run by a cross-functional team, is under change control, and carries a review trigger (new trading partner, new lane, known theft or diversion event).
7. References
EU GDP Guidelines (2013/C 343/01), Chapter 5 (Operations) and the guideline’s framing of loss, theft, diversion, and falsified product as distribution hazards. Directive 2011/62/EU (Falsified Medicines Directive) and Delegated Regulation (EU) 2016/161 (unique identifier and anti-tampering device). Drug Supply Chain Security Act (Title II of the Drug Quality and Security Act 2013), suspect and illegitimate product provisions. ICH Q9(R1), Quality Risk Management.
Confirm the current version and clause numbers of each reference before issue.
Filled specimen
An extract for a high-value oncology biologic with a known price differential between two markets it is sold in. Scores are illustrative and would be justified by the assessing team.
| # | Failure mode | Network segment | S | O | D | RPN pre | Existing control | Mitigation | S | O | D | RPN post | Residual / owner |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Round-tripping between two markets with a meaningful price gap | Wholesale distributor resale, cross-market | 3 | 3 | 3 | 27 | Country-specific pack differentiation | Add serialization scan reconciliation flagging any identifier decommissioned in one market and later offered in another; quarterly trading-partner sales-pattern review | 3 | 2 | 1 | 6 | Low; Commercial / Serialization SME |
| 2 | Custody handoff at a regional cross-dock recorded as a generic delivery note | Cross-dock transfer | 2 | 3 | 3 | 18 | Delivery note with company stamp only | Require a named-person badge scan at every handoff; escalate any unscanned handoff to security review within 24 hours | 2 | 1 | 1 | 2 | Low; Logistics operations |
| 3 | New wholesale distributor account shipped to before license re-verification completed | Trading-partner onboarding | 4 | 2 | 3 | 24 | Manual license check at onboarding | Hard system gate: first shipment blocked until the wholesale distributor qualification checklist is signed off | 4 | 1 | 1 | 4 | Low; Quality / Commercial |
Reading row 1, the team judged round-tripping as the dominant hazard for this product given the known price differential, and closed most of the gap not with a physical control but with a data control, serialization reconciliation that flags a pack appearing where it should not be. Row 3 shows the highest-severity failure mode (a genuinely fraudulent or unverified trading partner) closed with a hard process gate rather than a judgment call, consistent with treating severity 4 as non-negotiable regardless of the pre-mitigation RPN.
Common inspection findings this assessment prevents
- A theft or diversion pattern discovered only after a complaint or a serialization mismatch, with no prior risk assessment showing the hazard had ever been considered.
- Custody handoffs across the network with no consistent attribution standard, so a loss cannot be traced to where it happened.
- A high-value or high-diversion-risk product with no differentiated trading-partner scrutiny, treated identically to a low-risk product.
- Risk scoring with no recorded rationale, which reads as arbitrary under the Q9(R1) subjectivity caution.
- A known price-arbitrage corridor between two markets with no serialization-based detection control in place.
How to adapt this assessment
- Set the scales to match your quality risk management procedure so a score of 3 means the same thing to every scorer.
- Walk the real network with security, logistics, and a trading-partner or commercial representative, and enumerate actual custody handoffs and known theft or diversion corridors, not a generic list.
- Record the scoring rationale, not just the numbers, and let judgment override the RPN for any severity 4 failure mode.
- Feed the output directly into trading-partner qualification scope (the wholesale distributor GDP qualification checklist), custody-control procedures, and serialization verification points.
- Put the assessment under change control with a review trigger tied to new trading partners, new lanes, or a confirmed theft or diversion event, and confirm the references before issue.