Risk assessment: In this section, there are three questions which need to be solved

during the risk assessment

i. What might go wrong? (Risk identification): It will solve by the systematic use of

information to identify the hazards. It includes use of information like historical

data, theoretical analysis, concerns of stakeholders, informed opinions. The

question gives answer related to the probability of risk refers to its past.

ii. What is the probability it will go wrong? (Risk analysis): It involves both qualitative

as well as quantitative analysis of the risk and severity of risk. It is the estimation

of risk. The question gives answer related with the detectability of risk is present.

The steps involved in risk analysis are shown in Fig. 5.4.

iii. What are the consequences? (Risk evaluation): It involves a comparison of identified

and analysed risk against the given risk criteria. The question gives answer related

with the impact of risk on future (Fig. 5.4).

Risk control: It is a decision-making activity which identifies either to reduce or

accept risk. Its fundamental purpose is to reduce the risk to an acceptable level. It

includes three questions which are to be followed (Fig. 5.5)

Fig. 5.4: The steps involved in risk analysis

WHO Guidelines for Transfer of Technology 71

i. What can be done to reduce or eliminate risk?

ii. What is the appropriate balance between benefit, risk and resources?

iii. Are new risk introduced as a result of identified risk being controlled?

Risk review: Appropriate systems should be in place to ensure that the monitoring

of the output of the QRM process is done effectively. It is done to gather new information

which may have an affect on original QRM decision, e.g. changes to equipment, process,

control systems, suppliers, etc.

Verification of QRM processes and methodologies: The verification of QRM should

be performed and documented by expert QRM team. It involves the following activities:

i. Review of QRM processes and records

ii. Review of deviation and product management control

iii. Confirmation that identified risks are being under control.