This is a ready-to-use risk assessment for the question that decides whether a data integrity investigation holds up: how far does the scope have to expand before you can say, with evidence, where the problem stops. It sits inside the investigation governed by your data integrity investigation SOP, after the first finding is identified and before the retrospective review begins. Replace every <<FILL: ...>> placeholder with your own specifics. A filled specimen follows the template. This content is educational and general; adapt it to your own quality system and, where intent or employment consequences are in play, to legal advice.
Document control header
| Field | Entry |
|---|---|
| Assessment title | Extent-of-Investigation Scope-Expansion Risk Assessment |
| Document number | <<FILL: reference, e.g. DI-SCOPE-2026-01>> |
| Linked investigation number | <<FILL: DI-INV-ID>> |
| Date | <<FILL>> |
| Assessor(s) | <<FILL: name, role>> |
| QA / data integrity lead concurrence | <<FILL>> |
1. Purpose
This assessment gives an investigator a repeatable, risk-based way to decide whether a candidate expansion of scope (another instrument, another analyst’s other work, an earlier time window, a site-wide pattern search) is required, optional with documented justification, or can be deferred. The goal is to replace “we have no evidence it goes further” with a reasoned, scored decision that a reviewer or inspector can follow.
2. Scope
This assessment applies to any candidate boundary considered during Phase 2 (scope and extent determination) of a data integrity investigation. It does not replace the investigation SOP’s requirement that every boundary ultimately chosen be justified in writing; it is the tool that produces that justification in a reproducible form.
3. Methodology
For each candidate expansion listed in section 5, score three factors on a 1 to 3 scale, using the anchors in section 4, then multiply them to get a priority number from 1 to 27.
| Band | Priority number | Action |
|---|---|---|
| Must expand | 12 to 27 | Pull the population now; this is part of the core investigation, not an option |
| Expand with documented rationale | 5 to 11 | Expand unless a specific, written reason supports stopping short, reviewed by the QA / data integrity lead |
| May defer with justification | 1 to 4 | Document why the boundary was not expanded; revisit if later findings change any factor |
The band is a decision aid, not a ceiling on judgment. An assessor may expand a boundary scored below 12 anyway; the assessment exists to make sure a boundary is never left unexpanded only because nobody asked the question.
4. Scoring scales
| Factor | 1 (low) | 2 (medium) | 3 (high) |
|---|---|---|---|
| Mechanism transferability: could the same control gap or act occur at this candidate boundary | The configuration, login, or access path is specific to the original instance and not present elsewhere | The mechanism exists elsewhere but under different conditions or controls | The exact same mechanism (shared login, deletable folder, movable clock, absent review) is present at the candidate boundary |
| Signal match strength: how closely does a quick check at the candidate boundary match the known signature | No matching indicator found on a quick check | A partial or ambiguous match | The same signature (blank-reason re-integration, favorable-direction pattern, orphan runs) found on a quick check |
| Consequence if missed: what is lost if this boundary is wrongly left unexpanded | Low-criticality data, no product or submission link | Moderate: a non-release decision or an internal record | High: a release, stability, or submission decision, or patient-exposed product |
5. Assessment table
| # | Candidate expansion | Mechanism transferability | Signal match strength | Consequence if missed | Priority number | Band |
|---|---|---|---|---|---|---|
| 1 | <<FILL: e.g. same analyst, other instruments>> | <<FILL: 1-3>> | <<FILL: 1-3>> | <<FILL: 1-3>> | <<FILL: product>> | <<FILL>> |
| 2 | <<FILL: e.g. same instrument, other analysts>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| 3 | <<FILL: e.g. same method, other products>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| 4 | <<FILL: e.g. extended time window>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| 5 | <<FILL: e.g. site-wide pattern search>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
6. Mitigations and actions
| # | Action if “Must expand” or “Expand with rationale” | Owner | Target date | Status |
|---|---|---|---|---|
<<FILL>> | <<FILL: e.g. pull 24-month CDS audit trail for instrument HPLC-07>> | <<FILL>> | <<FILL>> | <<FILL>> |
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
7. Residual risk statement
After the actions above are complete, state the residual risk of an unexamined population remaining: <<FILL: e.g. "Low. All instruments on this method, all analysts with access to the shared login, and 24 months of history have been searched for the signature; no further credible mechanism-transferable boundary remains unexamined.">>
8. Acceptance criteria
The assessment is adequate when every candidate boundary that a reasonable investigator would consider has been scored, not only the ones that turned out positive; when every “Must expand” item has a completed action before the scope statement is finalized; and when the residual risk statement names what was searched, not only what was found.
9. Approval
| Role | Name | Signature | Date |
|---|---|---|---|
| Assessor / investigator | <<FILL>> | ||
| QA / data integrity lead | <<FILL>> |
10. Revision history
| Version | Date | Author | Summary of change |
|---|---|---|---|
<<FILL: 1.0>> | <<FILL: date>> | <<FILL: author>> | Initial issue. |
Filled specimen
The scenario: a blank-reason re-integration was found on instrument HPLC-07, analyst J. Alvarez (illustrative name), affecting a release result. Five candidate expansions were scored.
| # | Candidate expansion | Mechanism | Signal | Consequence | Priority | Band |
|---|---|---|---|---|---|---|
| 1 | Same analyst, all other CDS activity, 24 months | 3 | 3 | 3 | 27 | Must expand |
| 2 | Same instrument, other analysts and the shared second-shift login | 3 | 2 | 3 | 18 | Must expand |
| 3 | Same assay method, other products | 2 | 1 | 3 | 6 | Expand with rationale |
| 4 | Extend time window beyond 24 months to the analyst’s hire date | 2 | 2 | 2 | 8 | Expand with rationale |
| 5 | Site-wide search, all CDS instruments, same signature | 3 | 2 | 3 | 18 | Must expand |
Residual risk statement: “Low. Items 1, 2, and 5 were expanded and closed; item 3 was expanded on a 12-month sample with no hits and the full population deferred with that rationale recorded; item 4 extended the window to the analyst’s start date after item 1 confirmed the pattern predated the current campaign. No further mechanism-transferable boundary identified.”
The specimen shows the point of the tool: item 3 scored low enough to defer, but the deferral is a documented, scored decision rather than a boundary nobody thought to ask about.
Common inspection findings this risk assessment prevents
- A scope boundary left unexamined because it was never explicitly considered, rather than considered and reasonably deferred.
- “Expand with rationale” items expanded informally with no record of why, so a reviewer cannot tell a considered deferral from an oversight.
- The same scoring logic applied inconsistently between investigations, so two similar findings get different extents with no visible reason.
- A residual risk statement that describes only what was found, not what was searched and came back clean.
How to adapt this risk assessment
- Set your own anchor language in section 4 to match the systems and mechanisms common at your site.
- Adjust the band thresholds in section 3 if your quality system wants a different cut point; keep the logic that “Must expand” items are never optional.
- Add rows to section 5 for any site-specific axis (for example, a specific interface or integration point) your systems create.
- Reference this document’s number from the scope section of your investigation record so the two stay linked.
- Where the scoring is done jointly with an independent party, record their concurrence alongside the assessor’s.