IT Risk Management计算机风险管理

RISKBASEDAPPROACHComputerizedSystemsGMPComplianceCPAPE–Beijing-March2015Apathbornquitealongtimeago……&indifferentindustrialsectorsPreventionPredictionProtectionAnExamplefromthebeginningHAZOP:HAZardand

OPerabilitystudyICIChemicals,UK,’70SCOPO:“Identifyingpotentialhazards

and

operabilityproblemscaused

by

deviationsfromthedesignintent

ofbothnewandexistingprocessplants”Hazard-anyoperationthatcouldpossiblycauseacatastrophicreleaseoftoxic,flammableorexplosivechemicalsoranyactionthatcouldresultininjurytopersonnel.Operability-anyoperationinsidethedesignenvelopethatwouldcauseashutdownthatcouldpossiblyleadtoaviolationofenvironmental,healthorsafetyregulationsornegativelyimpactprofitabilityInternationalStandardCEI/IEC61882:2001CHAZOP

ControlSystemHazardsandOperabilityStudy

o

ComputerHazardsandOperabilityStudy

…isahighlystructuredhazardsidentificationtoolforinstrumentcontrolandcomputersystems.ThebasisofthemethodologyisverysimilartotypicalHAZOPusedintheprocessindustry.Itisusedtoanalyzethetypesoffailuremodesofnewsystem(independentlyandinconjunctionwithothernew/existingequipment)andtoensurethatsufficientredundancy/fallbackarrangementisprovidedandtheintroductionofthenewsystemdoesnotresultinunsafeplantoperationAnotherexample…Timegoesahead…anew…

«philosophy»NOTNEGLECTINGANYASPECTOFTHEPROBLEMItallowsto:DividethesysteminsinglecomponentsSortallavailabledataFOCUSINGRESOURCESONLYONCRITICALASPECTSItisasetofmethodologiesthatallowtofaceproblemswithaRATIONALandSYSTEMATICapproachWhatisRiskAnalysis?TerminologiessometimesmisusedRISKANALYSISSourceidentificationRiskestimationRISKEVALUATIONRiskacceptabilitydecisionsRISKCONTROLOptionanalysisImplementationResidualriskevaluationOverallriskacceptanceRISKASSESSMENTReviewbyexperienceRISKMANAGEMENTMultidisciplinaryTeamRequirestheformationofagroup,ledbyafacilitatorwhosepurposeistoleadthediscussioninanefficientmannerThegroupshouldbecomposedofpersonswhohavedesignedandpersonswhouseorwillusethesubjectoftheinvestigation(installation,buildingwork,systemsoftware+hardware,industrialprocess)Thefirststageconsistsofaguidedbrainstorming,thepurposeofwhichistocompilealistofalltherisksperceivedbydesignersandusersThefundamentalroleoftheSecretary!Allmethodologiesassignimportancetothesynergisticroleofgroupdiscussion.

Allthetechniquesrecognizethattheinteractionbetweendesigners,usersandmaintainersofasystemleadstoaknowledgeofthesystemgreaterthanthesumoftheknowledgeoftheindividualparticipantsinthegroupPREVENTIVEAPPROACHDescriptionofpossibles“scenarios”ofharmAssessmentofthestateofcontrolIdentificationofthemostsuitablesolutionstoreduceharmsCRITICALREVIEWOFAPROJECT

COSTSREDUCTIONANDOPTIMIZATIONOFRESOURCESAnotheraddedvalueofthismethodGeneralCaseSpecificCaseInductiveMethodDeductiveMethodItpostulatesaparticularconditionofthesystemorpartofitandtrytoidentifytheeffectthatthisconditionwouldhaveonthefunctionalityofthesystemItpostulatesthatthesystemitselfhasfailedinacertainwayandtryingtofigureoutwhichcomponentsofthesystemhavecontributedtothisfailureWHICH

whicharethepossiblefailureconditionsofthesystemHOW

howaspecificfailureconditionofthesystemcanhappenTOP-DOWNBOTTOM-UPDIFFERENTAPPROACHESRiskManagement-MethologiesISO31000:2009,ISO31010:2009,ISOGuide73:2009

(Riskmanagement--Principlesandguidelines;…techniques;…vocabulary)ISO14971(ApplicationofRiskManagementtoMedicalDevices)ICHQ9/EUGMPParteIII(exAnnex20)

(QualityRiskmanagement)ISPEBaselineVol.7(Risk-BasedManufactureofPharmaceuticalProducts)GAMP5(Capitolo5eAppendiceM3)………AllmustbeusedasreferenceandmustbechosentakingintoconsiderationthesystemtobeanalysedandtheobjectivestobereachedAfundamentalreference

ISO«Family»31000ISO31000:2009Riskmanagement-PrinciplesandguidelinesISO31010:2009Riskmanagement-RiskassessmenttechniquesISOGuide73:2009Riskmanagement-VocabularyS

c

h

emeISO31000ISO3101031Tools&Tecniques(!!!)Categorizingtechniquesinto:LOOK-UPMETHODSSUPPORTINGMETHODSSCENARIOANALYSISFUNCTIONANALYSISCONTROLSASSESSMENTSTATISTICALMETHODSISO31010GMP«QualityRiskManagement»GMP–«QualityRiskManagement»Qualityriskmanagementisasystematicprocessfortheassessment,control,communicationandreviewofriskstothequalityofthedrug(medicinal)productacrosstheproductlifecycle.InternationalConferenceonHarmonisationQualityGuideline#9(ICHQ9)S

c

h

e

m

eICHQ9ICQQ9-ContentsICHQ9Annex1–SuggestedmethodologiesBasicriskmanagementfacilitationmethods(flowcharts,checksheetsetc.)FailureModeEffectsAnalysis(FMEA)FailureMode,EffectsandCriticalityAnalysis(FMECA)FaultTreeAnalysis(FTA)HazardAnalysisandCriticalControlPoints(HACCP)HazardOperabilityAnalysis(HAZOP)PreliminaryHazardAnalysis(PHA)RiskrankingandfilteringSupportingstatisticaltoolsQ9AnnexII:PotentialapplicationsforqualityriskmanagementII.1QRMaspartofintegratedqualitymanagementII.2QRMaspartofregulatoryoperationsII.3QRMaspartofdevelopmentII.4QRMforfacilities,equipmentandutilitiesII.5QRMaspartofmaterialsmanagementII.6QRMaspartofproductionII.7QRMaspartoflaboratorycontrolandstabilitystudiesII.8QRMaspartofpackagingandlabelingApplicabilitytoComputerizedSystemsComplianceQ9II.4QRMforfacilities,equipmentandutilitiesDesignoffacility/EquipmentHygieneaspectsinfacilitiesQualificationoffacility/Equipment/UtilitiesCleaningofequipmentandenvironmentalcontrolCalibration/PreventivemaintenanceComputersystemsandcomputercontrolledequipmentselectionoftherequirementsanddesignidentificationofcriticalperformanceparametersdeterminetheextentofvalidationtheextentoftestingandtestmethodsreliabilityofelectronicrecordsandsignaturesRevisedAnnex11GeneralRiskManagementPersonnelSuppliersandServiceProviders…..Project