Compliance Risk Assessment Template

---
title: "Compliance Risk Assessment Template"
methodology: "universal"
complexity: "advanced"
owner: "mirichard"
updated: "2026-09-19"
primary_principles: ["risk-optimization", "stewardship"]
secondary_principles: ["evidence-based-decisions"]
principle_rationale: "Connects pharmaceutical compliance obligations and evidence gaps to assessed exposure, mitigation owners and escalation decisions."
---

# Compliance Risk Assessment Template

## When to Use

- When a regulated pharmaceutical initiative needs assessment of compliance exposure.
- When risk owners must connect specific obligations, evidence gaps, and mitigation decisions.

## When NOT to Use

- As a substitute for establishing which requirements apply to the product and activity.
- Do not use a completed template or example configuration as proof of fitness for the actual environment. See [Template as substitute for judgment](../../../../../docs/principles/anti-patterns.md#template-judgment).

## Pairs Well With

- [Regulatory Strategy Plan Template](../../../../../domains/delivery/industry-specializations/healthcare-pharmaceutical/regulatory/regulatory_strategy_plan_template.md).
- [Risk Register Template](../../../../../domains/uncertainty/project-lifecycle/02-planning/risk-management/risk-register-template.md).

Selection context: Delivery domain; universal methodology; advanced complexity. Match the situations above to project phase, risk, team size, and industry using the [decision-engine context model](../../../../../meta/architecture-research/800-801-context-assessment-model.md).

## Governance scaling recommendations

Use the [risk-based governance framework](../../../../../docs/governance/risk-based-scaling.md) to assess **technical, schedule, budget, organizational and compliance** exposure. Record each as low, medium, high or unknown, with risk IDs, dated evidence, current controls, an owner and next review.

- **Low:** combine evidence where the effective tier permits; retain weekly updates and required sponsor/acceptance gates.
- **Medium:** add dependency/contingency and change-impact evidence, weekly risk review and at least fortnightly sponsor review.
- **High or unknown:** use Rigorous controls, formal risk/control reporting and assurance at affected gates; assign evidence-gap owners and dates for unknowns.

Use the highest exposure, retaining higher context, size, team and policy floors; confirmed regulatory context remains Rigorous. Map local assessment scores to the approved exposure definitions with a rationale; do not average unlike scores. Reduce controls only after verified response effectiveness and sponsor/control-owner approval. Mandatory controls remain in force.

**Scaling decision:** [Five ratings and evidence; assessed/effective risk; tier and policy floor; affected artifacts/cadence; approval and effective date; next review].

A low residual compliance score does not remove a confirmed regulatory context or its required approvals. Have responsible owners assess the other four dimensions; preserve applicable specialist requirements.


Reference check: [Current source](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/e6r3-good-clinical-practice-gcp).


## Applying this template

Treat filled examples, dates, numerical limits, sampling frequencies, and approval outcomes as illustrations. Before execution, replace them with the approved product/site requirements, scientific rationale, method references, responsible reviewer, and acceptance evidence. Record the applicable jurisdiction and current guidance edition; a completed worksheet alone does not demonstrate regulatory compliance.

| Requirement or limit | Applicable source / edition | Product-specific rationale | Approval / date | Execution evidence |
|---|---|---|---|---|
| [Requirement] | [Source] | [Rationale] | [Reviewer / date] | [Record] |


## Document Control

| Document Information | Details |
|----------------------|---------|
| Document Title | Compliance Risk Assessment |
| Document ID | [RA-COMP-001] |
| Version | [1.0] |
| Status | [Draft/In Review/Approved] |
| Effective Date | [YYYY-MM-DD] |
| Next Review Date | [YYYY-MM-DD] |
| Document Owner | [Name/Title] |
| Department | [Department] |

### Revision History

| Version | Date | Author | Description of Changes | Reviewed By | Approved By |
|---------|------|--------|------------------------|-------------|-------------|
| 0.1 | [YYYY-MM-DD] | [Name] | Initial draft | [Name] | N/A |
| 1.0 | [YYYY-MM-DD] | [Name] | Final approved version | [Name] | [Name] |

### Approvals

| Role | Name | Signature | Date |
|------|------|-----------|------|
| Preparer | [Name/Title] | ______________ | [YYYY-MM-DD] |
| Reviewer - Quality Assurance | [Name/Title] | ______________ | [YYYY-MM-DD] |
| Reviewer - Regulatory Affairs | [Name/Title] | ______________ | [YYYY-MM-DD] |
| Reviewer - Legal/Compliance | [Name/Title] | ______________ | [YYYY-MM-DD] |
| Approver | [Name/Title] | ______________ | [YYYY-MM-DD] |

---

## 1. Introduction

### 1.1 Purpose

This document establishes a standardized methodology for identifying, assessing, and mitigating compliance risks within [Organization Name]'s pharmaceutical/healthcare operations. It provides a framework for systematically evaluating regulatory, quality, and GxP compliance risks to ensure patient safety, product quality, and regulatory compliance.

### 1.2 Scope

This compliance risk assessment framework applies to:
- All [Organization Name] facilities, systems, and processes involved in [specify relevant operations, e.g., drug development, manufacturing, distribution]
- Activities subject to regulatory oversight by health authorities
- GxP-regulated operations and systems
- Data integrity processes across the product lifecycle
- Third-party vendors and service providers involved in GxP activities

### 1.3 References

- ICH Q9: Quality Risk Management
- ICH Q10: Pharmaceutical Quality System
- FDA Guidance for Industry: Quality Systems Approach to Pharmaceutical CGMP Regulations
- EU GMP Guidelines, Annex 20: Quality Risk Management
- ISO 14971: Application of Risk Management to Medical Devices
- ISO 31000: Risk Management Principles and Guidelines
- 21 CFR Part 11: Electronic Records; Electronic Signatures
- 21 CFR Part 210 & 211: Current Good Manufacturing Practice
- [Organization Name] Quality Manual [Document ID]
- [Organization Name] Risk Management SOP [Document ID]

---

## 2. Risk Assessment Methodology

### 2.1 Risk Management Process

The compliance risk assessment follows the ICH Q9 risk management process:
1. Risk Identification
2. Risk Analysis
3. Risk Evaluation
4. Risk Control
5. Risk Review
6. Risk Communication

![Risk Management Process Diagram]

### 2.2 Risk Assessment Team

The risk assessment should be performed by a cross-functional team with representatives from:
- Quality Assurance
- Regulatory Affairs
- Operations/Manufacturing
- Validation
- Subject Matter Experts (SMEs) for the specific area being assessed
- Compliance/Legal (as needed)
- IT/Data Management (for data integrity assessments)

### 2.3 Risk Assessment Approach

This template uses a systematic approach to risk assessment:

1. **Identify Compliance Requirements**: Document all applicable regulatory requirements, standards, and internal policies relevant to the process/system under assessment.

2. **Identify Potential Compliance Risks**: Through brainstorming, process analysis, historical data review, and audit findings, identify potential risks.

3. **Analyze and Evaluate Risks**: Determine the severity, likelihood, and detectability of each risk to calculate an overall risk priority number (RPN).

4. **Develop Risk Mitigation Plans**: For unacceptable risks, identify actions to eliminate, reduce, or control the risk.

5. **Implement and Verify Controls**: Implement risk control measures and verify their effectiveness.

6. **Review and Monitor**: Establish an ongoing monitoring process to ensure continued compliance.

---

## 3. Compliance Requirements

### 3.1 Regulatory Requirements

Document all applicable regulatory requirements relevant to the process/system under assessment:

| Regulatory Body | Regulation/Guidance | Key Requirements | Applicability |
|-----------------|---------------------|------------------|---------------|
| FDA | 21 CFR Part 211 | [Specify relevant sections] | [Yes/No/Partial] |
| FDA | 21 CFR Part 11 | Electronic records and signatures | [Yes/No/Partial] |
| EMA | EU GMP Annex 11 | Computerized Systems | [Yes/No/Partial] |
| EMA | EU GMP Chapter 1 | Pharmaceutical Quality System | [Yes/No/Partial] |
| [Other] | [Specify] | [Specify] | [Yes/No/Partial] |

### 3.2 GxP Requirements

Document all applicable GxP requirements:

| GxP Area | Standard/Guidance | Key Requirements | Applicability |
|----------|-------------------|------------------|---------------|
| GMP | ICH Q7 | Good Manufacturing Practice | [Yes/No/Partial] |
| GCP | ICH E6(R3) | Good Clinical Practice | [Yes/No/Partial] |
| GLP | OECD GLP Principles | Good Laboratory Practice | [Yes/No/Partial] |
| GDP | WHO/EU GDP Guidelines | Good Distribution Practice | [Yes/No/Partial] |
| [Other] | [Specify] | [Specify] | [Yes/No/Partial] |

### 3.3 Industry Standards

Document applicable industry standards:

| Standard | Version/Date | Key Requirements | Applicability |
|----------|--------------|------------------|---------------|
| ISO 9001 | [Version] | Quality Management System | [Yes/No/Partial] |
| ISO 14971 | [Version] | Risk Management for Medical Devices | [Yes/No/Partial] |
| GAMP 5 | [Version] | Computerized Systems Validation | [Yes/No/Partial] |
| [Other] | [Specify] | [Specify] | [Yes/No/Partial] |

### 3.4 Internal Policies and Procedures

Document applicable internal policies:

| Policy/Procedure | Document ID | Version | Key Requirements |
|------------------|-------------|---------|------------------|
| Quality Manual | [ID] | [Version] | [Specify] |
| Risk Management SOP | [ID] | [Version] | [Specify] |
| Data Integrity Policy | [ID] | [Version] | [Specify] |
| [Other] | [ID] | [Version] | [Specify] |

---

## 4. Risk Assessment Matrix

### 4.1 Risk Categories

The following risk categories should be assessed:

1. **Regulatory Compliance Risks**:
   - Regulatory filing and reporting
   - Regulatory inspections
   - Change management
   - Marketing authorization compliance

2. **Quality System Risks**:
   - Documentation control
   - Training and qualification
   - Deviation management
   - CAPA effectiveness
   - Management review
   - Internal audit program

3. **GxP Compliance Risks**:
   - Facilities and equipment
   - Production/manufacturing processes
   - Laboratory controls
   - Materials management
   - Validation status

4. **Data Integrity Risks**:
   - ALCOA+ principles
   - Electronic records
   - Computerized systems
   - Data governance

5. **Supply Chain and Third-Party Risks**:
   - Supplier qualification
   - Outsourced activities
   - Material handling and distribution

### 4.2 Impact/Severity Levels

| Level | Rating | Description | Examples |
|-------|--------|-------------|----------|
| 5 | Critical | Direct impact on patient safety; potential for serious injury or death; severe regulatory action (license suspension, consent decree); significant financial penalties (>$1M) | Adulterated product released to market; Falsification of critical data |
| 4 | Major | Potential indirect impact on patient safety; significant impact on product quality; regulatory warning letter; moderate financial penalties ($250K-$1M) | Major GMP deviations; significant data integrity issues |
| 3 | Moderate | Limited impact on product quality; regulatory observations (483, inspection findings); limited financial impact ($50K-$250K) | Documentation deficiencies; minor process deviations |
| 2 | Minor | No impact on product quality; minor regulatory observations; minimal financial impact (<$50K) | Procedural errors with adequate controls; minor documentation issues |
| 1 | Negligible | No impact on regulatory compliance, product quality or patient safety; no financial impact | Administrative issues; improvement opportunities |

### 4.3 Probability/Likelihood Levels

| Level | Rating | Qualitative Description | Frequency-Based Description |
|-------|--------|-------------------------|----------------------------|
| 5 | Almost Certain | Expected to occur in most circumstances | More than once per month or >80% probability |
| 4 | Likely | Will probably occur in most circumstances | Once per 1-6 months or 60-80% probability |
| 3 | Possible | Might occur at some time | Once per 6-12 months or 40-60% probability |
| 2 | Unlikely | Could occur at some time but not expected | Once per 1-5 years or 20-40% probability |
| 1 | Rare | May occur only in exceptional circumstances | Less than once per 5 years or <20% probability |

### 4.4 Detectability Levels (Optional)

| Level | Rating | Description |
|-------|--------|-------------|
| 5 | Undetectable | Controls will not detect the risk or no controls exist |
| 4 | Poor Detection | Controls have low probability of detecting the risk |
| 3 | Moderate Detection | Controls might detect the risk |
| 2 | Good Detection | Controls will likely detect the risk |
| 1 | Certain Detection | Controls will almost certainly detect the risk |

### 4.5 Risk Scoring Method

#### 4.5.1 Risk Priority Number (RPN) Method

RPN = Severity × Probability × Detectability

Risk Acceptability:
- High Risk (RPN > 40): Unacceptable, requires immediate mitigation
- Medium Risk (RPN 20-40): Requires mitigation with defined timeline
- Low Risk (RPN < 20): Acceptable with routine monitoring

#### 4.5.2 Risk Matrix Method (Alternate)

Using a 5×5 matrix of Severity vs. Probability:

![Risk Matrix]

Risk Levels:
- Critical (Red): Immediate action required
- High (Orange): Action required with defined timeline
- Medium (Yellow): Action should be planned
- Low (Green): No immediate action required, routine monitoring

---

## 5. Risk Assessment Worksheets

### 5.1 Regulatory Compliance Risk Assessment

| Risk ID | Risk Description | Applicable Regulations | Current Controls | S | P | D | RPN | Risk Level | Mitigation Actions | Action Owner | Due Date |
|---------|------------------|------------------------|------------------|---|---|---|-----|------------|-------------------|-------------|----------|
| RC-001 | [Example: Failure to submit regulatory changes within required timeframes] | [21 CFR 314.70] | [Change control procedure, Regulatory calendar] | [1-5] | [1-5] | [1-5] | [S×P×D] | [H/M/L] | [Action] | [Name] | [Date] |
| RC-002 | | | | | | | | | | | |
| RC-003 | | | | | | | | | | | |

### 5.2 Quality System Risk Assessment

| Risk ID | Risk Description | Applicable Requirements | Current Controls | S | P | D | RPN | Risk Level | Mitigation Actions | Action Owner | Due Date |
|---------|------------------|-------------------------|------------------|---|---|---|-----|------------|-------------------|-------------|----------|
| QS-001 | [Example: Inadequate CAPA system resulting in recurrent quality issues] | [21 CFR 211.192, ICH Q10] | [CAPA SOP, CAPA effectiveness check] | [1-5] | [1-5] | [1-5] | [S×P×D] | [H/M/L] | [Action] | [Name] | [Date] |
| QS-002 | | | | | | | | | | | |
| QS-003 | | | | | | | | | | | |

### 5.3 GxP Compliance Risk Assessment

| Risk ID | Risk Description | Applicable Requirements | Current Controls | S | P | D | RPN | Risk Level | Mitigation Actions | Action Owner | Due Date |
|---------|------------------|-------------------------|------------------|---|---|---|-----|------------|-------------------|-------------|----------|
| GXP-001 | [Example: Inadequate equipment calibration program] | [21 CFR 211.68] | [Calibration SOP, Preventive maintenance] | [1-5] | [1-5] | [1-5] | [S×P×D] | [H/M/L] | [Action] | [Name] | [Date] |
| GXP-002 | | | | | | | | | | | |
| GXP-003 | | | | | | | | | | | |

### 5.4 Data Integrity Risk Assessment

| Risk ID | Risk Description | Applicable Requirements | Current Controls | S | P | D | RPN | Risk Level | Mitigation Actions | Action Owner | Due Date |
|---------|------------------|-------------------------|------------------|---|---|---|-----|------------|-------------------|-------------|----------|
| DI-001 | [Example: Shared login credentials for laboratory systems] | [21 CFR Part 11, Data Integrity Policy] | [System access controls, Training] | [1-5] | [1-5] | [1-5] | [S×P×D] | [H/M/L] | [Action] | [Name] | [Date] |
| DI-002 | | | | | | | | | | | |
| DI-003 | | | | | | | | | | | |

---

## 6. Risk Mitigation Planning

### 6.1 Risk Mitigation Strategy

For each unacceptable risk identified, define the appropriate risk mitigation strategy:

1. **Risk Avoidance**: Eliminating the risk by changing the process or system
2. **Risk Reduction**: Implementing controls to reduce probability or severity
3. **Risk Transfer**: Transferring risk to another party (e.g., insurance, outsourcing)
4. **Risk Acceptance**: Accepting and monitoring the risk (only for low-risk items)

### 6.2 Risk Mitigation Plan

Document the detailed risk mitigation plan for each high and medium risk:

| Risk ID | Mitigation Action | Action Type | Resources Required | Responsible Person | Start Date | Due Date | Status |
|---------|-------------------|-------------|-------------------|-------------------|-----------|----------|--------|
| [ID] | [Specific action] | [Avoidance/Reduction/Transfer/Acceptance] | [Budget, personnel, etc.] | [Name/Title] | [Date] | [Date] | [Not Started/In Progress/Completed] |
| [ID] | [Specific action] | [Avoidance/Reduction/Transfer/Acceptance] | [Budget, personnel, etc.] | [Name/Title] | [Date] | [Date] | [Not Started/In Progress/Completed] |

### 6.3 Residual Risk Assessment

After implementation of mitigation actions, re-evaluate the risks:

| Risk ID | Original Risk Level | Mitigation Actions Implemented | Residual Risk Assessment |||||
|---------|---------------------|--------------------------------|-----|-----|-----|------|------|
| | | | S | P | D | RPN | Level |
| [ID] | [H/M/L] | [List actions implemented] | [1-5] | [1-5] | [1-5] | [S×P×D] | [H/M/L] |
| [ID] | [H/M/L] | [List actions implemented] | [1-5] | [1-5] | [1-5] | [S×P×D] | [H/M/L] |

---

## 7. Monitoring and Review Process

### 7.1 Ongoing Monitoring

Describe the approach to ongoing monitoring of compliance risks:

| Risk Category | Monitoring Method | Frequency | Responsible Person | Reporting Method |
|---------------|-------------------|-----------|-------------------|-----------------|
| Regulatory Compliance | [Method] | [Daily/Weekly/Monthly/Quarterly] | [Role/Title] | [Report/Meeting] |
| Quality System | [Method] | [Daily/Weekly/Monthly/Quarterly] | [Role/Title] | [Report/Meeting] |
| GxP Compliance | [Method] | [Daily/Weekly/Monthly/Quarterly] | [Role/Title] | [Report/Meeting] |
| Data Integrity | [Method] | [Daily/Weekly/Monthly/Quarterly] | [Role/Title] | [Report/Meeting] |

### 7.2 Periodic Review

Describe the periodic review of the compliance risk assessment:

- Frequency: [Annual/Biannual/Other]
- Review Team: [List roles]
- Review Process: [Describe]
- Documentation: [Specify]

### 7.3 Triggers for Risk Reassessment

List events that would trigger a reassessment of compliance risks:

- Regulatory changes or new guidance
- Significant organizational changes
- Process or system changes
- New product introduction
- Merger/acquisition activities
- Significant compliance incidents or audit findings
- Changes in third-party relationships
- Trends in monitoring data

---

## 8. Appendices

### Appendix A: Risk Assessment Tools and Templates

1. **Risk Identification Checklist**

| Risk Category | Risk Consideration | Yes/No/NA | Comments |
|---------------|-------------------|-----------|----------|
| Regulatory | Are all required licenses/permits current? | | |
| Regulatory | Are regulatory submissions up to date? | | |
| Quality System | Is the quality manual current? | | |
| Quality System | Are internal audits conducted on schedule? | | |
| GxP | Are validation activities documented and approved? | | |
| GxP | Is the calibration program effective? | | |
| Data Integrity | Are ALCOA+ principles applied to all GxP records? | | |
| Data Integrity | Are system access controls appropriate? | | |

2. **Fishbone Diagram Template for Risk Identification**

[Include diagram template]

3. **FMEA Template for Detailed Risk Analysis**

[Include template]

### Appendix B: Example Risk Assessments

1. **Example: Computer System Validation Risk Assessment**

[Include sample risk assessment for a laboratory information management system]

2. **Example: Supplier Quality Risk Assessment**

[Include sample risk assessment for evaluating GMP supplier]

### Appendix C: Glossary of Terms

| Term | Definition |
|------|------------|
| ALCOA+ | Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, Available |
| CAPA | Corrective and Preventive Action |
| GxP | Good Practice regulations (GMP, GLP, GCP, GDP, etc.) |
| ICH | International Council for Harmonisation |
| Risk | Combination of the probability of occurrence of harm and the severity of that harm |
| RPN | Risk Priority Number |
| SME | Subject Matter Expert |

---

**Note:** This template should be customized to fit the specific needs of your organization and the scope of the compliance risk assessment being performed. All sections should be completed with the appropriate level of detail.