Risk Management
A $180M sterile manufacturing facility is eighteen months into execution when the single-source supplier of the custom isolator system announces a six-month production delay. The isolator is on the critical path. Without it, the cleanroom cannot be qualified, the filling line cannot be commissioned, and the regulatory filing cannot proceed. The project team scrambles. But the risk was identified nine months ago in the risk register, scored at 4x5 (high probability, very high impact), with a planned response: qualify an alternative supplier and maintain a parallel procurement track. The team that maintained the risk register activates the response plan within a week. The team that tracked risks in a quarterly PowerPoint discovers the problem three months late, when the delay has already cascaded.
ProBeya's Risk Management module provides a structured risk lifecycle from identification through closure, supporting both threats and opportunities. It includes qualitative analysis via a 5x5 probability-impact matrix, risk response planning, assessment history tracking, and a dashboard with exposure trends and risk breakdown structure.
Pharma Risk Categories
Pharmaceutical capital projects face risks that are categorically different from IT or commercial construction. ProBeya organizes risks into four categories:
Technical Risks
- Equipment performance not meeting URS specifications during qualification
- Process scale-up challenges during technology transfer
- Cleanroom environmental control outside acceptable parameters
- Integration failures between new equipment and existing facility systems (DCS, MES, HVAC)
Management Risks
- Resource availability: specialized commissioning engineers shared across projects
- Scope creep from evolving regulatory expectations during project execution
- Stakeholder alignment: Operations, Quality, Engineering, and Regulatory often have conflicting priorities
- Organizational change: site leadership transitions mid-project
Commercial Risks
- Vendor financial stability: single-source suppliers entering financial distress
- Currency exposure on equipment purchased from European or Asian manufacturers
- Contract disputes over change orders during installation and commissioning
- Market demand shifts that erode the business case for capacity expansion
External Risks
- Regulatory changes: new guidance documents affecting design or qualification strategy
- Supply chain disruption: raw material or component shortages
- Geopolitical factors: trade restrictions on critical equipment or materials
- Natural disasters or public health events affecting construction timelines
Risk Lifecycle
Risks follow a status progression with server-enforced transitions:
- Identified -- Initial entry with probability, impact, and category
- Analyzed -- After first formal assessment (status auto-transitions on first assessment)
- Response Planned -- After response strategy is defined and documented
- Active -- Being monitored; reassessed at defined intervals
- Closed -- Risk is no longer relevant (threat did not materialize, or project phase completed)
- Occurred -- The risk event materialized; response plan activated
Risk Scoring
Each risk is scored on a 5x5 probability-impact matrix:
| Level | Numeric Value | Probability Meaning | Impact Meaning |
|---|---|---|---|
| Very Low | 1 | < 5% chance | Negligible schedule/cost impact |
| Low | 2 | 5-20% chance | Minor: < 5% budget or < 2 weeks schedule |
| Moderate | 3 | 20-50% chance | Significant: 5-10% budget or 2-8 weeks schedule |
| High | 4 | 50-80% chance | Major: 10-25% budget or 2-6 months schedule |
| Very High | 5 | > 80% chance | Severe: > 25% budget or > 6 months schedule |
Risk Score = Probability (numeric) x Impact (numeric), yielding a score from 1 to 25.
Risk Heat Map Interpretation
| Score Range | Zone | PMO Action Required |
|---|---|---|
| 1-4 | Green | Monitor at regular risk review cadence |
| 5-9 | Yellow | Active monitoring; response plan must be documented |
| 10-15 | Orange | Escalate to project steering committee; weekly monitoring |
| 16-25 | Red | Immediate escalation to portfolio steering; dedicated response owner |
Reassess top-10 risks at every status meeting. In pharma capital projects, the risk profile shifts dramatically between phases: during engineering, technical risks dominate; during construction, commercial and supply chain risks peak; during qualification, regulatory risks become critical. A monthly reassessment cadence keeps the risk matrix current and prevents stale assessments from masking emerging threats.
Response Strategies
ProBeya supports eight response strategies aligned with PMI standards:
For Threats:
- Avoid -- Eliminate the threat by changing scope, schedule, or approach
- Transfer -- Shift the risk to a third party (insurance, fixed-price contracts, vendor guarantees)
- Mitigate -- Reduce probability or impact (dual sourcing, prototyping, additional testing)
- Accept -- Acknowledge and budget for the impact (management reserve allocation)
- Escalate -- Push the risk to a higher authority level (portfolio steering committee)
For Opportunities:
- Exploit -- Ensure the opportunity materializes (e.g., accelerate qualification to capture early market entry)
- Share -- Partner with another entity to share the benefit (co-development agreements)
- Enhance -- Increase probability or impact of the positive event
- Accept -- Acknowledge but do not actively pursue
Worked Example: Single-Source Supplier Risk
Risk: Critical isolator system has only one qualified supplier. Lead time is 14 months.
| Field | Value |
|---|---|
| Category | Commercial |
| Type | Threat |
| Probability | High (4) |
| Impact | Very High (5) |
| Score | 20 (Red zone) |
| Response Strategy | Mitigate |
| Response Description | Qualify alternative supplier; negotiate penalty clauses for late delivery; maintain 8-week schedule buffer in WBS |
| Trigger | Supplier misses first interim milestone by more than 2 weeks |
| Owner | Procurement Lead |
Risk Dashboard
The dashboard provides executive-level risk visibility:
- Top 10 risks by score, with trend arrows showing whether each risk is improving or worsening
- Total risk count and total exposure (sum of all scores across the project)
- Counts by status: identified, analyzed, response_planned, active, closed, occurred
- Counts by type: threats vs. opportunities
- Exposure trend: monthly average assessment scores over the past 12 months
The 12-month exposure trend is particularly valuable for pharma portfolios. A rising trend line across the portfolio signals systemic risk accumulation, often caused by resource constraints, vendor market tightness, or regulatory environment changes that affect multiple projects simultaneously.
Risk Breakdown Structure
Risks grouped by category (technical, management, commercial, external) with per-category counts and total exposure. This view helps the PMO identify which risk category carries the most aggregate exposure and direct mitigation resources accordingly.
Use the opportunity risk type for positive risks. In pharma capital projects, opportunities are often overlooked: early equipment delivery enabling accelerated qualification, favorable regulatory guidance reducing validation scope, or a technology partner offering an upgraded system at the contracted price. Tracking opportunities alongside threats gives the steering committee a balanced risk picture.
Escalation and Closure
- Escalate: Sets the response strategy to "escalate" with optional notes, signaling that the risk requires portfolio-level attention
- Close: Marks the risk as closed (prevented if already closed); records the closure rationale
Both actions are logged via the activity system for GxP traceability.
A risk score of 20 or above (high probability x very high impact, or the inverse) should trigger immediate escalation and steering committee attention. In pharma capital projects, risks at this level typically involve regulatory, supply chain, or technical showstoppers that can delay the entire project by six months or more. Do not wait for the next scheduled risk review.
Permissions
| Action | Required Role |
|---|---|
| Create/edit risks | Project Manager, Risk Owner, or Admin |
| Assess risk | Any project member with risk access |
| Plan response | Project Manager, Risk Owner, or Admin |
| Close/escalate risk | Project Manager, PMO, or Admin |
| View risk matrix | Any project member |
| View dashboard | PMO Director or Admin |
Related Features
- Projects -- Each risk belongs to a PPM project and feeds into health status computation
- EVM -- Risk-driven cost overruns surface through CPI degradation
- Gates -- Risk register status is a standard input to every gate review
- Budgets & Costs -- Contingency budget lines fund risk response plan execution