Risk Acceptance Criteria

Risk assessment without defined acceptance criteria is incomplete.

Assigning severity, likelihood, or risk levels does not determine what should be done.
Acceptance criteria define whether risk is:

• Acceptable

• Requires mitigation

• Requires escalation

Without defined criteria, decisions depend on individual judgement.

This leads to:

• Inconsistent outcomes across similar situations

• Variability in escalation decisions

• Weak inspection defensibility

Risk acceptance criteria convert assessment into controlled, repeatable decisions.

What Risk Acceptance Criteria Are

Risk acceptance criteria define the thresholds used to evaluate whether a risk level is acceptable.

They establish:

• Boundaries between acceptable and unacceptable risk

• Conditions under which action is required

• Linkage between risk level and response

Criteria may be:

• Qualitative (descriptive thresholds)

• Quantitative (score-based thresholds)

• Or a combination of both

Regardless of format, they must produce consistent decisions across similar scenarios.

What “Acceptable Risk” Means in GMP

Acceptable risk does not mean absence of risk.

It means that risk is:

• Understood

• Controlled

• Justified relative to impact

In GMP systems, acceptability is tied to:

• Patient safety

• Product quality

• Data integrity

• Regulatory compliance

A risk may be acceptable in one context and not in another.

Acceptance criteria must therefore reflect:

• The type of impact

• The context of the decision

• The level of uncertainty

Acceptable vs Tolerable Risk

Acceptance criteria should distinguish between:

• Acceptable risk —> no further action required

• Tolerable risk —> acceptable only with controls or justification

This distinction is important.

Without it:

• Borderline risks are handled inconsistently

• Escalation becomes subjective

• Decisions vary across teams

Clear differentiation ensures that decisions remain predictable and defensible.

Decisions involving tolerable risk often lead to formal justification of residual risk after mitigation.

Linking Risk Levels to Actions

Risk levels must be directly linked to actions.

These decision boundaries must align with clearly defined escalation thresholds which determine when a risk requires higher-level review.

Typical structure includes:

• High risk —> escalation, formal review, stronger controls

• Medium risk —> mitigation and monitoring

• Low risk —> routine handling

Without defined linkage:

• Similar risks receive different treatment

• Escalation becomes inconsistent

• Control strategies vary without justification

Acceptance criteria must define what happens next, not just how risk is categorized.

Over-Scoring vs Under-Scoring Risk

Acceptance criteria must prevent distortion of risk levels.

Common issues include:

• Over-scoring —> excessive controls and unnecessary escalation

• Under-scoring —> insufficient response to significant risk

Both represent failure of decision boundaries.

Over-scoring leads to:

• Inefficient systems

• Unnecessary workload

• Reduced focus on critical tasks

Under-scoring leads to:

• Missed impact

• Delayed response

• Increased inspection risk

Acceptance criteria must anchor scoring to defined consequences, not perception.

Defining Escalation Boundaries (Without Owning Escalation)

Acceptance criteria should define when escalation is required, but not how escalation is executed.

This includes:

• Thresholds for higher-level review

• Triggers based on impact or uncertainty

• Conditions requiring cross-functional input

If escalation boundaries are unclear:

• Decisions remain inconsistent

• Similar risks are handled differently

• Governance becomes weak

Acceptance criteria define decision boundaries, which escalation follows.

Role of Data and Uncertainty

Acceptance criteria must be grounded in:

• Process understanding

• Available data

• Historical performance

Where data is limited, uncertainty must be considered.

For example:

• Uncertain likelihood should not be treated as low likelihood

• Incomplete data should trigger caution, not simplification

Ignoring uncertainty leads to:

• Overconfidence in decisions

• Weak justification

• Inconsistent outcomes

As process knowledge evolves, acceptance criteria and their application may require reassessment as part of ongoing Risk Review & Lifecycle Governance.

Consistency Across Systems

Acceptance criteria must be applied consistently across:

• Deviations

• CAPA

• Change control

• Validation

If different systems apply different thresholds:

• Risk levels lose meaning

• Decisions vary across functions

• System behavior becomes unpredictable

Consistency across systems is essential to demonstrate effective QRM.

Maintaining this level of consistency requires defined decision authority and oversight.

How Inspectors Evaluate Acceptance Criteria

Inspectors do not focus on whether criteria are documented.
They evaluate whether criteria are applied.

This evaluation also depends on how clearly risk decisions and their justification are documented and communicated across systems as outlined in Risk Communication & Documentation.

They assess whether:

• Similar cases lead to similar decisions

• Risk levels align with actions taken

• Escalation reflects defined thresholds

• Justification is consistent across systems

A common concern arises when criteria exist but decisions do not follow them.

This indicates that criteria are not functioning as a control mechanism.

Common Failures in Practice

Recurring issues include:

• Undefined or unclear acceptance thresholds

• Flexible interpretation of criteria

• Criteria adjusted after decisions are made

• Risk levels not linked to actions

These failures lead to:

• Inconsistent decision-making

• Weak-governance

• Inspection findings

Acceptance criteria that are not consistently applied provide false assurance of control.

What Good Looks Like

Effective systems demonstrate:

• Clearly defined thresholds for risk levels

• Consistent linkage between risk and action

• Clear distinction between acceptable and tolerable risk

• Alignment across systems

• Traceable justification for decisions

In these systems:

• Decisions are predictable

• Escalation is consistent

• Justification is clear

Acceptance criteria function as a decision control mechanism, not a guideline.

Regulatory Perspective

Regulators do not expect specific formats.
They expect consistent application.

Acceptance criteria must:

• Be defined before use

• Be applied consistently

• Align with decision outcomes

When criteria are clear and consistently applied, risk-based decisions become easier to defend.

---