# Functional Risk Assessment Template

Version 2.0 · Updated 2026-09-21 · Planning

Link each important GxP function to a failure scenario, process effect, potential consequence, controls, and required evidence.

Adapt this template to your intended use, applicable requirements, and approved procedures.

## When to use it

After intended use and requirements are sufficiently understood and before finalizing test depth.

## Information needed before starting

- Defined intended use and important requirements
- Credible failure scenarios and consequences
- Existing controls and available evidence

## Field instructions

- **GxP function or requirement:** Identify the function or requirement and its controlled reference. Explain the regulated process or record that depends on it.
- **Failure scenario:** Describe a credible incorrect, missing or delayed result and trace it to the affected process, record or decision. Distinguish severity from how often it could occur.
- **Process effect:** Describe a credible incorrect, missing or delayed result and trace it to the affected process, record or decision. Distinguish severity from how often it could occur.
- **Potential impact:** Describe a credible incorrect, missing or delayed result and trace it to the affected process, record or decision. Distinguish severity from how often it could occur.
- **Existing controls:** Describe the preventive or detective control, its owner and evidence that it works in the assessed configuration.
- **Detectability:** Explain the remaining uncertainty and consequences after controls. State how an error would be detected before it affects the regulated decision.
- **Risk rationale:** Explain the remaining uncertainty and consequences after controls. State how an error would be detected before it affects the regulated decision.
- **Mitigation or evidence needed:** List the unanswered questions or missing evidence, the action owner and due date. Explain what cannot be concluded until they are resolved.
- **Residual risk:** Explain the remaining uncertainty and consequences after controls. State how an error would be detected before it affects the regulated decision.
- **Owner:** Identify the system/service or process, version and accountable roles. Specify the scope and supporting record rather than relying on a product name alone.

Assess functions separately rather than assigning one risk to the whole system.

Describe observable failure and process effect.

Credit only controls that address the failure and can be shown to work.

Use the remaining risk and uncertainty to select evidence.

## Completed fictional example

Fictional teaching example; this is not an executed or approved validation record.

| Field | Completed example |
| --- | --- |
| GxP function or requirement | CAPA closure gate; URS-014 |
| Failure scenario | Record closes before required effectiveness approval |
| Process effect | Open corrective action is represented as complete |
| Potential impact | Ineffective action may remain undetected |
| Existing controls | Server-side transition rule and role authorization |
| Detectability | Daily exception report detects closure after the event |
| Risk rationale | High consequence; preventive gate is required |
| Mitigation or evidence needed | Scripted authorized and unauthorized transitions plus exploratory interruption and API paths |
| Residual risk | Unexpected alternate integration path |
| Owner | Quality Systems Owner |

## Blank template

System / record ID: ____________________

Prepared by / date: ____________________

Required review / approval under local procedure: ____________________

| Field | Your entry |
| --- | --- |
| GxP function or requirement | ____________________ |
| Failure scenario | ____________________ |
| Process effect | ____________________ |
| Potential impact | ____________________ |
| Existing controls | ____________________ |
| Detectability | ____________________ |
| Risk rationale | ____________________ |
| Mitigation or evidence needed | ____________________ |
| Residual risk | ____________________ |
| Owner | ____________________ |

## Related guidance

- [Assess functional risk](https://csvtocsa.com/learn/functional-risk-assessment)

- [View the risk-to-evidence worksheet](https://csvtocsa.com/worksheets/risk-to-evidence)

Canonical page: https://csvtocsa.com/templates/functional-risk-assessment