This guide describes the step-by-step process for identifying and assessing risks. Per ISO 17025 §8.5, the laboratory must identify risks and opportunities that could affect impartiality, validity of results, or QMS effectiveness.
Before you begin, make sure that:
| # | Prerequisite | Why | Page |
|---|---|---|---|
| 1 | Users | Responsible person assignment | Users |
Go to the Risk Assessments page from the main menu. A table of existing risk records is displayed.
The visible table columns are:
| Column | Description |
|---|---|
| Risk No. | Unique code (for example RISK-YYYY-0001) |
| Date | When the risk was identified |
| Risk Description | Brief description |
| Area | Which area/process is affected |
| Likelihood | Low, Medium or High |
| Impact | Low, Medium or High |
| Risk Level | Calculated from likelihood x impact |
| Status | Open, Mitigated, Accepted or Closed |
There are also hidden columns (Mitigation Actions, Responsible, Review Date, Notes). You can show them from the column settings.
Identify risks that could affect laboratory operations. Typical categories:
| Category | Examples |
|---|---|
| Impartiality | Client pressure for specific results, conflict of interest |
| Result validity | Ageing equipment, insufficient analyst training |
| Operational | Power outage, HVAC failure, reagent shortage |
| Personnel | Key staff departure, understaffing |
| External | Regulatory changes, pandemic, supply chain issues |
Click the "+" button on the toolbar to open the creation form.
Fill in the fields:
| Field | Description | Required |
|---|---|---|
| Risk No. | Leave blank for auto-numbering (for example RISK-YYYY-0001) | No |
| Date | When the risk was identified | Yes |
| Risk Description | What could happen | Yes |
| Area | Which area/process is affected | Yes |
| Likelihood | Low, Medium or High | Yes |
| Impact | Low, Medium or High | Yes |
| Responsible | Person responsible for mitigation | Yes |
| Status | Starts as "Open" | Yes |
| Review Date | When the risk will be reassessed | No |
| Notes | Additional remarks | No |
The Risk Level is calculated automatically from the combination of likelihood and impact.
Use the following tables as a guide:
| Level | Description |
|---|---|
| Low | Rare — has not occurred or occurs < 1 time/year |
| Medium | Possible — has occurred or occurs 1-3 times/year |
| High | Frequent — occurs > 3 times/year |
| Level | Description |
|---|---|
| Low | Minimal effect — does not affect results or operations |
| Medium | Significant effect — affects some analyses or processes |
| High | Critical effect — risk to result validity or accreditation |
Base the assessment on historical data, audit findings, and industry benchmarks.
Fill in the Mitigation Actions field with measures taken to reduce the risk.
Example: "Install UPS for uninterruptible power supply. Maintenance contract for HVAC units. Train a second analyst as backup."
Mitigation actions aim to reduce either the likelihood or the impact (or both).
After defining actions:
If the risk is low and acceptable without measures, change the status to "Accepted" with justification in the notes.
Close a risk when:
Change the status to "Closed".
Type in the search field for quick text filtering.
Click the filter icon to open the filter panel:
| Filter | Type | Description |
|---|---|---|
| Status | Select | Show only one status |
| Likelihood | Select | Show only one likelihood level |
| Impact | Select | Show only one impact level |
| Date (from) | Date | Identification date from |
| Date (to) | Date | Identification date to |
| Max Records | Number | Record limit for print/export (default: 200) |
How do I determine likelihood and impact?
Use historical data, audit findings, and industry benchmarks. If no data is available, start with a conservative estimate and revise during the review.
When should risks be reassessed?
At least annually or when significant changes occur — new equipment, staff changes, new methods, regulatory changes, or after a significant event.
Can I accept a risk without mitigation measures?
Yes, if the risk is low and the cost of mitigation is not justified. Document the reasoning in the notes and change the status to "Accepted".
How does auto-numbering work?
If you leave the "Risk No." field blank during creation, the application assigns the next available code (format RISK-YYYY-NNNN). You can also enter your own code.