March 13, 2025
In manufacturing and in life, we can never completely eliminate risk. What matters is how you manage it.
For example, every day we accept the level of risk that driving poses, deciding to wear a seatbelt to mitigate that risk.
In manufacturing, formal risk assessments help guide the decision-making process, protecting the business by aligning action with what the organization deems acceptable and unacceptable risk.
A risk matrix is one key tool for achieving this goal, allowing you to systematically manage risks across your processes and ensure that high-risk threats receive priority attention.
Let’s look at how a risk matrix works, how to create one and where to use one in your quality management system (QMS) to continuously reduce risk.
Free case study: Learn how one cardiac device manufacturer incorporated risk into their CAPA process
What Is a Risk Matrix?
A risk assessment matrix is a table or grid, often presented as a heat map, that helps companies evaluate and prioritize risks. By plotting likelihood and severity on the two axes of the matrix, companies can calculate a numerical value for risk and make objective decisions on how to manage it.
How a Risk Assessment Matrix Works
The x-axis of a risk matrix represents probability or likelihood, while severity or impact is plotted on the y-axis. Multiplying the two values provides an overall risk calculation that determines how the risk is managed.
Creating Assessment Scales
Each company must create its own assessment scales for gauging likelihood and impact. The key is to be descriptive and yet also simple enough that users will interpret them consistently.
Below is an example of how an organization may choose to define different assessment scales.
Some risk matrices such as failure mode and effects analysis (FMEA) also incorporate detection as an additional factor. This allows companies to focus not just on high-risk events, but also those that are more difficult to detect.
Calculating Risk and Setting Risk Acceptance Thresholds
Multiplying probability by impact (and also detection in the case of FMEAs) results in a score that teams can compare against defined risk acceptance thresholds.
The upper right of the heat map typically shows risks that are not acceptable, while the lower left represents generally acceptable risk. Organizations may set risk acceptance criteria based on:
- Compliance Risk: An event may be considered high risk if a nonconformance could lead to regulatory findings.
- Requirement Maturity: Companies often have higher risk tolerance in early product development stages compared with later stages.
- Internal Audit Effectiveness: Risk thresholds can be linked to audit findings, as more frequent issues equate to an increase in perceived risk.
Prioritizing Action Based on Risk Assessment Results
Each region on the heat map should correspond with a specific course of action, for example:
- High risk: Requires immediate action.
- Moderate risk: May require revisiting SOPs or pausing operations until further assessment.
- Low risk: Managed at team level but documented for compliance.
For example, if a process has a known risk, but mitigation efforts are in place, you would want documentation to justify why the process remains in operation.
Understanding Risk Assessments in Context
Risk assessment is part of a larger closed-loop risk management process that continuously reduces risk over time. At a high level, the main steps of the risk management process are:
- Risk identification
- Risk assessment
- Control implementation
- Ongoing monitoring and adjustment
Assessing and Managing Risk Across Manufacturing Operations
Companies use different approaches to assessing and managing risk in their operations. What’s important is that you document how risk is being defined and managed within your QMS. Not only does this make for a more consistent process, it also gives you documentation to refer to should future issues arise.
One best practice approach is to look at your operations by products or services, evaluating risks by performing an FMEA on each product or service.
- Facilitate sessions with relevant stakeholders (e.g., quality, production, R&D, shipping and receiving) to map out processes from start to finish. If only quality is involved, there may be blind spots.
- Identify potential failure points and assess their impact on the business, customers, and products.
- Establish clear risk thresholds for taking action (e.g., an RPN greater than 100 triggers a CAPA).
- Identify and implement controls to prevent failures.
- Reassess risks whenever there are process changes, new regulations, or incidents.
The initial risk assessment process can take anywhere from a few weeks to a few months. Risk should be continuously assessed throughout the product lifecycle, however, with risk assessments always evolving based on new data, regulations and organizational learnings.
Validating the Effectiveness of Your Risk Matrix
One critical component of using a risk matrix is validating its effectiveness. Best practices here include:
- Post-incident analysis: Review past incidents to see if the risk matrix would have flagged them correctly and led to the appropriate action. If not, your scoring criteria may need adjustment.
- Benchmarking: You should also compare your risk assessments against any standards your organization adheres to, such as ISO 9001 for quality management systems or ISO 14971 for medical device risk management.
- QMS analytics: Companies using an automated QMS can track risk trends over time, monitor correlations between risk scores and incidents, and assess long-term risk performance.
Risk Assessment Using an Automated QMS
Risk management tools within an automated QMS give manufacturers a way to incorporate risk into data-driven decision-making.
CAPA
Assessing risk associated with an issue can help prioritize corrective and preventive action (CAPA). For example, let’s say a manufacturing deviation results in potential product contamination. The risk assessment matrix then allows you to determine whether a CAPA is required.
Nonconformance Management
Risk assessment for nonconformances can help you evaluate the impact of a nonconforming material or process to determine disposition. For instance, if a supplier delivers out-of-spec raw materials, the risk matrix helps determine whether to accept or reject them based on potential impact.
FMEA
Using an FMEA at the design phase allows you to evaluate the severity, occurrence, and detection of different failure modes. Multiplying these variables results in a risk priority number (RPN), allowing you to determine which failure points require additional controls.
Supplier Quality Management
Nonconformance records can be linked to supplier quality records to observe trends over time, such as if there’s an individual supplier repeatedly delivering defective products.
Audit Management
Audit findings can be assessed for risk to determine which issues need to be addressed first and provide visibility into compliance risks.
Change Management
Risk assessment within change management can help you identify the impact of proposed changes so you can take proactive steps to mitigate risk.
Complaint Management
Adding risk assessment into complaint documentation can provide a data-driven approach to managing product complaints and limiting risk to customers.
Conclusion
Opportunity and risk are two sides of the same coin. They represent uncertainty that must be managed effectively in order to achieve business goals. A risk matrix can help provide an objective measure for gauging that risk according to internal standards and defining how it will be handled.
By incorporating risk management at multiple points in their QMS processes, companies can take advantage of new opportunities without creating unacceptable risks for the business or its customers.
Download the AssurX Risk Management datasheet
About the Author
Stephanie Ojeda is Director of Product Management for the Life Sciences industry at AssurX. Stephanie brings more than 15 years of leading quality assurance functions in a variety of industries, including pharmaceutical, biotech, medical device, food & beverage, and manufacturing.
