I settled on a three-level system for a risk-based analysis. It also lends well to a graphical Boston Grid that is nice in presentations. A picture is worth a thousand words!
For our new risk programme (I supply automation systems to pharma end users), we expect the end user to perform an overall preliminary risk analysis. For say a green field site, we might be supplying the automation for the process and HVAC but the secondary packaging and USP or WFI would be from someone else so we don’t want our involvement up front to be too detailed.
Once the project enters the design phase then we do a “Functional Risk Assessment” (really just a slightly more rigorous Criticality Assessment in many ways) in parallel with the Functional Specification. We do NOT embed the FRA into the FS because they really need to be updated asynchronously and getting them signed off etc. is a royal pain. Also I have seen on many projects that as funds diminish that one or more life cycle documents starts to get neglected, so keeping them separate allows a culling process when you need to pick and chose which document to neglect (I don’t want to neglect any as the supplier, but if the customer doesn’t want to pay you because the stainless cost twice as much as they budgeted - then you’re stuck!).
Our FRA is based on Excel and the FS is based on Word - another reason to keep them separate. The Excel macros allow for 1-3, 1-5, 1-10 etc. levels so the system is flexible. There is a statistical method associated with FMEA and FMCEA for certain kinds of risk assessment in the 1-10 category but this is really aimed at someone who is making 10,000 widgets for automotive use and wants to categorise failure rates. Certainly useless for pharmaceutical.
The world of automation - last on the scene when the money has run out!