This is a ready-to-use risk-ranking worksheet for the events where a quality event’s tier is not obvious on the facts alone. It does not replace the patient-impact assessment, which anchors the tier for clear-cut events; it formalizes the severity, probability, and detectability judgment for the harder cases, the ones where the classification SOP’s matrix gets applied by feel rather than by a documented, reproducible score. Replace every <<FILL: ...>> placeholder with your own specifics. A worked filled specimen follows the template. Verify each cited regulation against the current source before you rely on it.
Document control header
| Field | Entry |
|---|---|
| Document title | Quality Event Severity x Probability x Detectability Risk Ranking Worksheet |
| Document number | <<FILL: RA-ID, e.g. RA-QA-032>> |
| Version | <<FILL: version, e.g. 1.0>> |
| Effective date | <<FILL: effective date>> |
| Document owner | <<FILL: role, e.g. Head of Quality Assurance>> |
| Applies to | <<FILL: sites / departments in scope>> |
| Governing SOP | <<FILL: SOP-ID for quality event classification>> |
1. Purpose
This worksheet scores a quality event on three axes, severity, probability, and detectability, and turns the score into the tier (Critical, Major, or Minor) the same way the classification SOP’s risk matrix does, except that each axis is anchored to written sub-questions instead of a reviewer’s unsupported High, Medium, or Low. It exists because an unanchored risk matrix drifts the same way an unanchored tier definition drifts: two reviewers looking at the same event choose different words for the same judgment, and neither can point to why.
2. Scope
Use this worksheet when the tier is not obvious from the patient-impact questions alone, when two reviewers have proposed different tiers for the same event, or as the working record for a classification calibration session. It is not a substitute for the patient-impact assessment, which comes first and settles most events outright; it is the documented method for the harder remainder.
3. Responsibilities
| Role | Responsibility |
|---|---|
| Event owner / initial classifier | Proposes the initial severity, probability, and detectability scores with supporting facts |
| Subject matter expert | Confirms the technical basis for the severity and detectability scores, particularly which control was meant to catch the event and whether it did |
| Quality Assurance | Reviews and approves the final score and the resulting tier; resolves disagreement between scorers |
| Quality head | Reviewed for any event where the detectability bump changes the outcome, or where the resulting tier is Critical |
4. Scoring scales
Score each axis independently. Do not let the answer you expect for the tier pull the individual scores toward it; score the facts on each axis first, then read the tier off the grid in section 5.
4.1 Severity (S): the consequence if the event does cause harm
| Score | Level | Definition | Example |
|---|---|---|---|
| 1 | Low | No effect on safety, identity, strength, purity, or quality (SISPQ); procedural or administrative only | A batch record entry initialed on the wrong line with no data lost |
| 2 | Medium | Potential quality impact with no direct patient safety concern; product may still be usable with documented justification | A room-temperature excursion later shown by stability data to leave the product unaffected |
| 3 | High | SISPQ impact is plausible or confirmed on the affected material; product may be non-compliant with the registered standard in a way that could bear on safety, identity, strength, quality, or purity | A checkweigher drift with a suspected under-fill of an injectable, effect not yet bounded |
Note. The scale stops at three levels, not four, on purpose: it reproduces the same Low / Medium / High axis the classification SOP’s risk matrix already uses, so this worksheet’s output cannot silently diverge from the SOP’s own table. A fourth “confirmed catastrophic” level is unnecessary because the patient-impact assessment, not this worksheet, is where a confirmed direct-harm event gets its tier; see section 2.
4.2 Probability (P): the likelihood the potential harm actually reaches a patient, given the event happened
| Score | Level | Definition | Example |
|---|---|---|---|
| 1 | Low | Fully contained before use or release; no plausible path to a patient exists | A suspect lot quarantined before any unit left the building, with the affected scope already bounded |
| 2 | Medium | Partially contained; the affected scope is not yet bounded, or the product is not yet distributed but the window is still open | The checkweigher case at the moment of discovery, before the calibration history is reviewed |
| 3 | High | Product is distributed, in finished-goods inventory, or the affected population could already include patient-administered units | A complaint on a lot already shipped to pharmacies |
4.3 Detectability (D): how well the existing controls would catch this before it reaches a patient
| Score | Level | Definition | Example |
|---|---|---|---|
| Good | No adjustment | A reliable, independent control exists and either caught this event or would reliably catch a recurrence | An in-process check flagged the deviation as designed |
| Moderate | Consider, document either way | The control is manual, inconsistently applied, or depends on a single reviewer with no independent check | A visual inspection step with no second check |
| Poor | Bump the tier one level (section 5.2) | The control that should have caught this before a patient was affected is the very control that failed | The automated checkweigher itself, the primary detection control, drifted out of calibration undetected |
5. Deriving the tier
5.1 Base tier from the severity x probability grid
This is the same grid as the classification SOP’s risk matrix. Cross the severity score against the probability score.
| Severity \ Probability | 1 Low | 2 Medium | 3 High |
|---|---|---|---|
| 3 High | Major | Critical | Critical |
| 2 Medium | Minor | Major | Major |
| 1 Low | Minor | Minor | Major |
5.2 The detectability bump
If detectability scored Poor, raise the base tier one level: Minor becomes Major, Major becomes Critical, Critical stays Critical. If detectability scored Moderate, document the reasoning for not bumping; a Moderate score is a signal, not an automatic escalation, but a reviewer who waves it off without a written reason is the pattern an inspector challenges.
5.3 Optional numeric cross-check
For trending relative risk across many events, an optional risk product can be computed as S x P x D, using 1, 2, or 3 for detectability (Good = 1, Moderate = 2, Poor = 3) purely as a number, not as a second classification method. This number is supplementary. It is useful for ranking a backlog of open events by relative risk or for a periodic report; it never overrides the grid-plus-bump result in section 5.1 and 5.2, because the grid is what the classification SOP actually governs.
| Field | Entry |
|---|---|
| Severity (S) | <<FILL: 1-3>> |
| Probability (P) | <<FILL: 1-3>> |
| Detectability (D, for the cross-check only: 1, 2, or 3) | <<FILL>> |
| Numeric risk product (S x P x D, 1 to 27) | <<FILL>> |
6. Worksheet
| Field | Entry |
|---|---|
| Event reference | <<FILL: deviation / OOS / complaint number>> |
| Severity score and basis | <<FILL: 1-3, with the specific fact that drove it>> |
| Probability score and basis | <<FILL: 1-3, with the specific fact that drove it>> |
| Detectability score and basis | <<FILL: Good / Moderate / Poor, naming the control and whether it was the control that failed>> |
| Base tier from the grid | <<FILL: Minor / Major / Critical>> |
| Detectability bump applied? | <<FILL: yes/no, with rationale if Moderate and not bumped>> |
| Resulting tier | <<FILL>> |
| Optional numeric risk product | <<FILL>> |
| Scored by (name, role, date) | <<FILL>> |
| QA confirmation (name, signature, date) | <<FILL>> |
7. Acceptance criteria
- Each axis is scored against the written definitions in section 4, with the specific fact recorded, not a bare word.
- The tier is read off the grid in section 5.1, not assigned first and reverse-engineered into scores that support it.
- Where detectability scored Poor, the bump was applied. Where it scored Moderate and was not bumped, the reason is on the record.
- The resulting tier is consistent with the tier this event would receive on the classification SOP’s own matrix; a divergence is investigated as a worksheet error, not silently accepted.
- QA confirmed the score before it was treated as final.
References
ICH Q9(R1), Quality Risk Management (2023 revision), severity, probability, and detectability as risk inputs, and the emphasis on reducing subjectivity in risk assessment. ICH Q10, Pharmaceutical Quality System, proportionality of effort to risk. 21 CFR 211.192 (investigation of discrepancies and failures, the basis for a defensible, reproducible severity judgment).
Confirm the current version and clause numbers of each reference before issue.
Revision history
| Version | Date | Author | Summary of change |
|---|---|---|---|
<<FILL: 1.0>> | <<FILL: date>> | <<FILL: author>> | Initial issue. |
Approvals
| Role | Name | Signature | Date |
|---|---|---|---|
| Author | <<FILL>> | ||
| Reviewer (QA) | <<FILL>> | ||
| Approver (Quality Head) | <<FILL>> |
Filled specimen
The following shows the worksheet worked at two points for the same event: at open, and after the impact assessment bounds the scope. This is the fill-line under-fill example used elsewhere in the classification SOP and form, scored here to show how the numbers reproduce the same conclusion. The company and numbers are illustrative; replace them with your own.
Event. A fill-line in-process check finds a single under-filled vial of a sterile injectable; the upstream checkweigher is later found to have drifted out of calibration for an unknown period.
At open
| Field | Entry |
|---|---|
| Severity score and basis | 3, High. Under-dose of an injectable bears on strength, an SISPQ attribute; not yet confirmed how far it extends. |
| Probability score and basis | 2, Medium. The calibration window is open and not yet bounded; product is in-process, not yet distributed. |
| Detectability score and basis | Poor. The checkweigher is the primary automated control meant to catch exactly this failure mode, and it is the control that drifted undetected. |
| Base tier from the grid | Major (High severity, Medium probability) |
| Detectability bump applied? | Yes, Poor detectability bumps Major to Critical. |
| Resulting tier | Critical |
| Scored by | A. Patel, QA, 03 June 2026 |
| QA confirmation | R. Gomez, signed, 03 June 2026 |
After the impact assessment bounds the window
| Field | Entry |
|---|---|
| Severity score and basis | 3, High. Unchanged; the attribute at risk (strength) has not changed, only the bounded quantity. |
| Probability score and basis | 1, Low. The affected window is now bounded to the interval since the last known-good calibration, statistical sampling of retained units found no further under-fills, and the quantity is small and fully contained. |
| Detectability score and basis | Moderate. The checkweigher is locked out of service and a manual verification step is in place pending recalibration and requalification; not yet back to a fully reliable automated control. |
| Base tier from the grid | Major (High severity, Low probability) |
| Detectability bump applied? | No. Moderate detectability does not trigger the bump; documented here as the reason. |
| Resulting tier | Major |
| Scored by | A. Patel, QA, 10 June 2026 |
| QA confirmation | R. Gomez, signed, 10 June 2026 |
This is the numeric trail behind “classify high at open, refine on evidence”: the same three axes, scored honestly against the facts as they stood at each point, reproduce the critical-to-major re-classification without anyone having to argue about the label directly.
Common inspection findings this worksheet prevents
- A tier assigned as a label with no severity, probability, or detectability reasoning behind it.
- Two reviewers scoring the same event to different tiers with no record of which specific axis they disagreed on.
- A detectability failure, the control that should have caught the event being the one that failed, noted in the narrative but never actually driving the classification upward.
- A re-classification from Critical to Major with no documented change in the underlying probability or detectability score to justify it.
- Scores that were clearly chosen to justify a tier decided in advance, visible because the stated facts do not match the definition selected.
How to adapt this worksheet
- Set your document number, owner, and effective date in the header.
- If your classification SOP’s risk matrix uses different cut points or more than three levels per axis, rebuild the grid in section 5.1 to match it exactly; this worksheet only has value if its output cannot diverge from the governing SOP.
- Keep the detectability bump rule (Poor bumps one tier) aligned with the language in your classification SOP so the two documents never contradict each other.
- If you want the numeric cross-check in section 5.3 to feed a periodic risk-ranking report, define the reporting cadence and who reviews it.
- Confirm every regulation in the references against the current published version before issue.