CAPA Risk Assessment & Prioritization 3 — Questions and Answers
Question 1: In ISO 9001:2015, what is the primary purpose of risk-based thinking in the context of CAPA?
- To proactively identify and address potential failures before they occur (Correct answer)
- To document all past failures in a register
- To assign blame for quality escapes
- To eliminate all inspection steps
Correct answer: To proactively identify and address potential failures before they occur
ISO 9001:2015 emphasizes risk-based thinking so organizations proactively prevent nonconformances rather than only reacting after they occur.
Question 2: A CAPA is raised for a recurring contamination event. During risk prioritization, the team determines detection is nearly impossible at current stages. How does this affect priority?
- It increases priority because low detectability raises the RPN (Correct answer)
- It lowers priority since undetectable issues are handled separately
- It has no effect on the RPN calculation
- It means the CAPA can be deferred indefinitely
Correct answer: It increases priority because low detectability raises the RPN
Low detectability increases the Detection score in FMEA, which raises the RPN and therefore elevates the CAPA's priority.
Question 3: Which of the following best describes a 'residual risk' in a CAPA context?
- The remaining risk after corrective controls have been implemented (Correct answer)
- The original risk before any assessment is performed
- Risk associated only with supplier nonconformances
- The risk transferred to a third party
Correct answer: The remaining risk after corrective controls have been implemented
Residual risk is what remains after corrective and preventive actions have been applied; it must be evaluated to confirm it is acceptable.
Question 4: A team is using a 5x5 risk matrix. A risk rated 4 for likelihood and 5 for consequence falls into which zone?
- High (critical) risk zone (Correct answer)
- Medium risk zone
- Low risk zone
- Negligible risk zone
Correct answer: High (critical) risk zone
A score of 4×5=20 on a 5×5 matrix (max 25) places the risk in the high/critical zone, requiring immediate CAPA action.
Question 5: What is the correct sequence when prioritizing multiple open CAPAs using risk-based criteria?
- Assess severity and occurrence, calculate risk scores, rank by score, assign resources accordingly (Correct answer)
- Close the oldest CAPAs first regardless of risk
- Address all CAPAs in parallel with equal resources
- Wait for customer complaints before prioritizing
Correct answer: Assess severity and occurrence, calculate risk scores, rank by score, assign resources accordingly
Effective CAPA prioritization requires scoring each issue for severity and occurrence, ranking them, and directing resources to highest-risk items first.
Question 6: Which statement about preventive actions in risk assessment is most accurate?
- Preventive actions address potential nonconformances identified through risk assessment before they occur (Correct answer)
- Preventive actions are only taken after a defect escapes to the customer
- Preventive actions require a documented customer complaint to be initiated
- Preventive actions and corrective actions are identical in scope
Correct answer: Preventive actions address potential nonconformances identified through risk assessment before they occur
Preventive actions are proactive measures triggered by risk assessment findings to eliminate the causes of potential—not actual—nonconformances.
Question 7: A pharmaceutical company uses FMEA to assess risks in its CAPA process. An occurrence rating of 9 (out of 10) signifies what?
- The failure is almost certain to occur (Correct answer)
- The failure rarely occurs
- The failure has never been observed
- The failure was detected in a previous audit only
Correct answer: The failure is almost certain to occur
In standard FMEA scales, an occurrence rating of 9-10 means the failure is very likely or almost inevitable, substantially increasing RPN.
CAPA Risk Assessment & Prioritization 3
In ISO 9001:2015, what is the primary purpose of risk-based thinking in the context of CAPA?