Quality Risk Management Methodology

1. Quality Risk Management Methodology Anthony Cumberlege SAPRAA meeting - Randpark golf club, 20 March 2009

2. Typical quality risk management process

3. Quality risk management tools • Some examples of recognized techniques: • Basic QRM facilitation methods (flowcharts, check sheets etc.). • Failure Mode Effects Analysis (FMEA). • Failure Mode, Effects and Criticality Analysis (FMECA). • Fault Tree Analysis (FTA). • Hazard Analysis and Critical Control Points (HACCP). • Hazard Operability Analysis (HAZOP). • Preliminary Hazard Analysis (PHA). • Risk ranking and filtering. • Supporting statistical tools (control charts, histograms etc.).

4. Basic QRM facilitation methods [1] • Simple tools to organize data and facilitate decision-making. • Cause and effect / fishbone / Ishikawa diagrams: • Problem statement on right-hand side. • General causes (“bones”) of the problem stem from the horizontal line (“body”). • More specific causes branch off from the main “bones”. It could also include a 3rd level or more. • More branches may be exposed using the “5 whys” technique.

5. Basic QRM facilitation methods [2] • Check sheets: • Used for repeatedly collecting real-time data in situ. • Blank sheet (template) to record quantitative / qualitative information. • Characteristic is the making of marks(“checks”) to capture data. • For example:

6. Basic QRM facilitation methods [3] • Another example:

7. Basic QRM facilitation methods [4] • Examples of check sheet types: • Classification: A trait such as a defect or failure mode must be classified into a category. • Location: The physical location of a trait is indicated on a picture of a part or item being evaluated. • Frequency: The presence or absence of a trait or combination of traits is indicated. The number of occurrences can also be indicated. • Measurement scale: A measurement scale is divided into intervals, and measurements are indicated by checking an appropriate interval. • Check list: The items to be performed for a task are listed so that, as each is accomplished, it can be indicated as having been completed.

8. Basic QRM facilitation methods [5] • Flowcharts: • A chart that represents an algorithm or process showing the steps as boxes of various kinds and their order by connecting these with arrows. • Standard symbols are used to represent the individual process steps: • Start / end  rounded rectangles. • Control flow  arrows. • Processing steps  rectangles. • Inputs / outputs  parallelograms. • Conditional test  rhombus (arrows to be labelled).

9. Basic QRM facilitation methods [6] • Process mapping: • A visual representation of the work-flow that transforms a well defined input or set of inputs into a pre-defined set of outputs. • High-level maps are used to visualize the entire process. • Detailed maps focus on process sub-steps. • Are good visual aids to explain an unfamiliar system to an external person.

10. Basic QRM facilitation methods [7] • Another example:

11. Failure mode effects analysis (FMEA) [1] • Complex processes are broken down into manageable sub-steps in which failure modes are more easily recognized, causes identified and effects listed. • For each failure mode the severity (S) must be defined, for example:

12. Failure mode effects analysis (FMEA) [2] • For each failure mode the probability (P) must be defined, for example: • For each failure mode the detectability (D) must be defined, for example:

13. Failure mode effects analysis (FMEA) [3] • Current event controls must be listed. • The risk priority number (RPN) is calculated for each failure mode: • The RPN is evaluated against pre-defined criteria, for example: ≥ 200  Critical risk, mitigation required. 70-199  Major risk, mitigation required. <70, S = 10  Critical risk, mitigation required. <70, S < 10  Acceptable risk. • If mitigation is required, proposed actions for a risk reduction strategy must be identified and the RPN re-calculated. • FMEA can be used to prioritize risks and monitor risk control activities. Typically applied to analyze equipment / utilities / manufacturing processes. • Product / process understanding is critical for FMEA.

14. Failure mode, effects and criticality analysis (FMECA) [1] • Extension of FMEA to include criticality analysis (CA). • The CA ranks potential failure modes on a criticality matrix according to combined influence of severity and probability. • Severity levels must be classified, for example: I = Catastrophic. II = Critical. III = Marginal. IV = Minor. • The failure mode criticality number (Cm) is the portion of the criticality number for the item due to one of its failure modes under a particular severity classification: β = Conditional probability of failure mode. α = Failure mode ratio. λp = Part failure rate. t = Duration of applicable phase.

15. Failure mode, effects and criticality analysis (FMECA) [2] • The item criticality number (Cr) is defined as the sum of the failure mode criticality numbers (Cm) under a particular severity classification: n = 1, 2, 3 … j (Total number of failure modes). • Output is summarized in a criticality matrix for each item: • FMECA is most often employed in manufacturing processes. • Product / process specifications must be known for FMECA.

16. Fault tree analysis (FTA) [1] • A failure analysis in which an undesired state of a system is analyzed using logic gate symbols (AND / OR etc.) to combine a series of lower-level events, all displayed graphically. • Sub-systems are considered individually to minimize the tree complexity.

17. Fault tree analysis (FTA) [2] • Each tree has only 1 undesired effect (“top event”). Not a “bottom-up” analysis. • All causes must be considered. Probabilities of occurrence is not essential. • FTA is very useful to establish root causes and to evaluate how multiple factors contribute to failures. Can be applied to investigate complaints / deviations. • Good process understanding is required to identify causal factors.

18. Hazard analysis and critical control points(HACCP) • A systematic, preventative approach to product safety that addresses physical, chemical and biological hazards as a means of prevention rather than finished product inspection. • Consists of 7 principles: • Conduct a hazard analysis. • Identify critical control points (CCPs): • A point, step or procedure at which controls can be applied and a hazard can be prevented, eliminated or reduced to acceptable levels. • Establish critical limits for each CCP. • Establish CCP monitoring requirements. • Establish corrective actions. • Establish procedures for ensuring the HACCP system is working as intended. • Establish record-keeping procedures. • Not limited to manufacturing, also applicable to other processes where CCPs can be identified. • Comprehensive product / process understanding required to identify CCPs.

19. Hazard operability analysis (HAZOP) [1] • Methodology which assumes that hazards are caused by deviations from the system design. • Process flow diagrams are commonly used: • Examined in sections. • A design intention for each section is specified. • HAZOP Team identifies possible deviations from the design intention, likely causesandconsequences. • The HAZOP Team typically includes: • Designer. • User. • Technical specialist. • Maintainer. • Parameters are selected which apply to the design intention, for example: • Flow. • Temperature. • Pressure. • Composition. • Level. • Time.

20. Hazard operability analysis (HAZOP) [2] • Deviations from the design intention of selected parameters are determined through the application of guide words, including: • No / Not. • More. • Less. • As well as. • Part of. • Reverse. • Once the causes and effects of any potential hazards have been established: • The system can then be modified to improve its safety. • The modified design must then be subject to another HAZOP, to ensure that no new hazards have been introduced. • Typically applied to manufacturing processes and evaluation of safety hazards. • Design information must be available.

21. Preliminary hazard analysis (PHA) [1] • A tool for applying prior experience or knowledge of a hazard or failure to identify future hazards. • It is a semi-quantitative analysis in which: • Hazards are identified. • Probabilities are estimated. • Severities are assigned. • Hazards are ranked according to their probability / severity relationship. • Possible controls are determined. • Historical information which may be used to identify hazards could include: • Statistical data. • Audit reports. • Deviation reports.

22. Preliminary hazard analysis (PHA) [2] • Hazard severities are assigned, for example: • Hazard probabilities are assigned, for example:

23. Preliminary hazard analysis (PHA) [3] • A matrix is compiled to rank the risks: • Risk levels may be assigned from the matrix, for example: • High  Not acceptable, mitigation required. • Medium  Acceptable with further analysis required. • Low  Acceptable. • PHA allows hazard detection in the design phase and early implementation of corrective actions. • Analysts must be able to predict hazards with little information available.

24. Risk ranking and filtering [1] • A quality risk management tool for comparing and prioritizing (ranking) risks. • Often the need for risk ranking is driven by a disparity between obligations to manage, mitigate, or reduce an array of risks and available resources.

25. Risk ranking and filtering [2] • Risk based filter: • Sufficient resources available to address all risks (above a certain risk score) simultaneously across all organizational units. • Resource based filter: • Insufficient resources available and high risk organizational units are prioritized. • Can be used by regulatory bodies to prioritize inspections. • Useful to compare and manage complex risk portfolios.

26. Supporting statistical tools • Statistical tools can support quality risk management by facilitating more reliable decision making: • Enabling effective data assessment. • Aiding in determining the significance of data. • For example: • Control charts. • Design of experiments (DOE). • Histograms. • Pareto charts. • Process capability analysis.

27. Thank you