Version 2.0 · Updated 2026-09-21 · Planning
Connect a specific failure to its consequences, controls, tests and residual-risk decision.
Adapt this template to your intended use, applicable requirements, and approved procedures.
When to use it
Use when you need to connect a specific failure to its consequences, controls, tests and residual-risk decision.
- Defined AI use, authority limits and assessed configuration
- Controlled sources and independent reference results relevant to this worksheet
- Applicable risk assessment, acceptance basis and responsible reviewers
Field instructions
- Requirement or function: Identify the specific intended behavior and stable requirement ID.
- Failure and cause: Describe a missed, wrong, unauthorized or unavailable behavior and credible contributing factors.
- Consequence and severity: Trace the process effect and apply the organization’s severity rubric.
- Existing control: Identify the control that interrupts the failure, including its owner.
- Control evidence: Link tests or other evidence showing the control works.
- Remaining gap: Record uncertainty, failed criteria and unresolved controls.
- Residual-risk decision: State accept, restrict, defer or other locally defined disposition with rationale.
- Owner and trigger: Identify who acts and which change or result triggers reassessment.
Completed fictional example
Fictional risk rows from PRA-01. No universal numerical risk score is implied.
Blank template
System / record ID: ____________________
Prepared by / date: ____________________
Required review / approval under local procedure: ____________________
Blank results or assessment rows
Relevant regulations and guidance
These sources apply within their stated scope. The suggested worksheet fields, test designs and fictional decisions are practitioner recommendations, unless a source requirement is expressly identified. Completing a template does not establish compliance.
Regulatory guidance / GMP guideline · United States · February 2026
Scope: Medical-device manufacturers assuring software used in production or their quality management system.
Relevance: For medical-device production or QMS software, supports selecting assurance activities from intended use, risk and available evidence. It is nonbinding guidance and does not determine other sectors’ obligations.
Status: Final / published · Checked 2026-09-21
Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Read source details and applicability →Regulatory guidance / GMP guideline · European Union · January 2011 revision
Scope: Computerised systems supporting activities in the applicable EU pharmaceutical GMP context.
Relevance: For computerised systems used in EU GMP activities, informs lifecycle, supplier and record controls. Confirm applicability to the actual activity; the example does not establish it.
Status: Final / published · Checked 2026-09-21
The Commission index confirms the January 2011 operative revision. The linked PDF could not be retrieved in this check; retained detailed section mappings need review against an authorized copy.
Read source details and applicability →Industry guidance / framework · United States · AI RMF 1.0 (2023); GenAI Profile (2024)
Scope: Cross-sector AI governance and risk management, including generative AI.
Relevance: A voluntary framework for describing AI risks, evaluation and ongoing management. Its suggested practices are not regulatory requirements.
Status: Final / published · Checked 2026-09-21
Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Read source details and applicability →