Document No.

QA-SOP-41
Revision No “1”
UDL Pharmaceuticals Issue Date: 01.12.2016
Revision Date: 01.12.2018
(A Division of First UDL Modaraba)
Standard Operating Procedures Quality Assurance Department
Subject / Title
BUSINESS RISK AND OPPORTUNITY ASSESSMENT & PAGE 01 of 02
MANAGEMENT
Prepared By: Reviewed By: Approved By:

Q. A. MANAGER Q.C. MANAGER G.M. PLANT

1. PURPOSE

The purpose of this procedure is to define following;

a) Mechanism to identify and control risk and opportunity associated with product
quality and delivery.

b) Techniques and tools to be used for risk identification, assessment and mitigation

2. SCOPE:

2.1. Following activities comes under preview of this procedure:

a) Production and Operations

b) Facility/equipment availability and maintenance

c) Supplier performance and material availability / supply

d) Delivery of nonconforming product

e) Availability of competent personnel

2.2. Note: this procedure has adopted definitions for key terms developed specifically by UDL
Pharmaceuticals and determined appropriate for its use within the unique requirements of
its management system. It does not adopt current ISO definitions, which UDL
Pharmaceuticals has determined are not sufficient for its use.

2.3. Note: the QMS documentation occasionally uses the term “opportunity for improvement”
when discussing internal audit findings or management review actions; that term does not
have the same context as the term “opportunity” used herein.

3. DEFINITIONS:

3.1. Risk: A negative effect of uncertainty.

3.2. Opportunity: A positive effective of uncertainty.

3.3. Uncertainty: A deficiency of information related to understanding or knowledge of an

event, its consequence, or likelihood. (Not to be confused with measurement uncertainty.)
 Document No. QA-SOP-41
Revision No “1”
UDL Pharmaceuticals Issue Date: 01.12.2016
Revision Date: 01.12.2018
(A Division of First UDL Modaraba)
Standard Operating Procedures Quality Assurance Department
Subject / Title
BUSINESS RISK AND OPPORTUNITY ASSESSMENT & PAGE 01 of 02
MANAGEMENT
Prepared By: Reviewed By: Approved By:

Q. A. MANAGER Q.C. MANAGER G.M. PLANT

3.4. Risk Assessment: a systematic investigation and analysis of potential risks, combined
with the assignment of severities of probabilities and consequences. These are used to
rate risks in order to prioritize the mitigation of high risks.

3.5. Risk Mitigation: a plan developed with the intent of addressing all known or possible risks
and preventing their occurrence.

3.6. FMEA (Failure Mode Effects Analysis): a specific risk treatment method which ranks
risks by probability and consequence.

4. RESPONSIBILITIES:

Management Representative along with risk assessment team is responsible for

implementation of this Procedure.

5. PROCEDURE:

5.1. GENERAL

5.1.1. UDL Pharma considers and manages risks and opportunities differently.

5.1.2. Risks are managed with a focus on decreasing their occurrence, minimizing their
severity and enhance the detection if they should occur.

5.1.3. Opportunities are managed to increase their likelihood, to maximize their benefits
and enhance the detection if they should occur.

5.2. MANAGEMENT OF RISKS

5.2.1. A cross functional risk assessment team will perform process mapping starting
from supplier evaluation →purchasing →order receiving through to delivery of
product before processing risk assessment exercise

5.2.2. Additional risks may be identified by any employee at any time.

5.2.3. Risk assessment shall be performed on all steps coming in preview of following
parameters;

a) Production and Operations

 Document No. QA-SOP-41
Revision No “1”
UDL Pharmaceuticals Issue Date: 01.12.2016
Revision Date: 01.12.2018
(A Division of First UDL Modaraba)
Standard Operating Procedures Quality Assurance Department
Subject / Title
BUSINESS RISK AND OPPORTUNITY ASSESSMENT & PAGE 01 of 02
MANAGEMENT
Prepared By: Reviewed By: Approved By:

Q. A. MANAGER Q.C. MANAGER G.M. PLANT

b) Supplier performance and material availability/supply

c) Facility/equipment availability and maintenance

d) Delivery of nonconforming product

e) Availability of competent personnel

5.2.4. Each process is defined through separate detailed procedure and FMEA study will
be performed for teach process.

5.2.5. Risk Assessment Team will perform P-FMEA on “Process Failure Effect & Mode
Analysis” to identify potential risk (s).

5.2.6. The P-FMEA document includes the identification and mitigation plans for key risks
associated with the defined process. UDL Pharma management reviews these
risks and takes action to minimize them.

5.2.7. Risks identified as part of the P-FMEA exercise is logged within the “Process
Failure Effect & Mode Analysis” to identify potential risk (s). This indicates a rough
priority, as well as a selected risk treatment method.

5.2.8. Detailed methods may include P-FMEA (failure mode effects analysis), SWOT
(strength, weakness, opportunity and threat) or other tools. No single method is
used for all risk assessments; the tool selected should be the best tool applicable
to that particular risk analysis.

5.2.9. Risk register will be filled up to identify potential risks in each area, identify severity,
occurrence and detection ratings as per following table 1, 2 & 3 respectively.

5.2.10. Where P-FMEA style risk treatment is deemed optimal, an entry shall be made in
the P-FMEA Register. When using the P-FMEA Register, the following steps are to
be followed:

a) Identifying the risk.

b) Identifying the process for which the risk most likely dominates.

c) Assigning an Occurrence rating to the identified risk; the occurrence is given

a score from 1 (lowest probability) to 10 (highest probability).

d) Assigning a Severity rating if the risk were to be encountered; the severity is

given a score from 1 (lowest consequence) to 10 (highest consequence).
 Document No. QA-SOP-41
Revision No “1”
UDL Pharmaceuticals Issue Date: 01.12.2016
Revision Date: 01.12.2018
(A Division of First UDL Modaraba)
Standard Operating Procedures Quality Assurance Department
Subject / Title
BUSINESS RISK AND OPPORTUNITY ASSESSMENT & PAGE 01 of 02
MANAGEMENT
Prepared By: Reviewed By: Approved By:

Q. A. MANAGER Q.C. MANAGER G.M. PLANT

e) Assigning a Detection rating to the identified risk; the detection is given a

score from 1 (easiest detection) to 10 (difficult detection).

5.2.11. Risk Priority Number (RPN) will be calculated as per following formula

RPN = Occurrence X Severity X Detection

5.2.12. For risks with a final Risk Factor rating equal to or greater than the 100 set in the
Risk Register, management will decide whether to reject the subject due to the risk,
or accept the risks after the development of a risk contingency plan. The
contingency plan must be documented, either in the Risk Register or in another
document which must be referenced on the form.

5.2.13. Risks with a factor less than the risk threshold may be accepted without a
mitigation plan, unless otherwise directed by management.

5.2.14. The final column allows for entry of an estimated risk factor after mitigation, which
is an estimate on what the risk should be reduced to if the risk treatment is
successful.

5.2.15. If a risk includes a potential positive aspect, management may elect to conduct an
opportunity pursuit assessment on the positive aspect, as defined below.

5.3. MANAGEMENT OF OPPORTUNITIES

5.3.1. UDL Pharmaceuticals actively seeks out opportunities which could enhance its
financial viability and market position. For example:

 obtaining new contracts

 obtaining access to new markets

 identification of new industries which may be served by UDL Pharma

 development of new offerings that are within the scope of capabilities of UDL
Pharmaceuticals

 streamlining existing processes to improve efficiency and reduce costs

5.3.2. A cross functional opportunity assessment team will perform process mapping
starting from supplier evaluation →purchasing →order receiving through to delivery
of product before processing risk assessment exercise
 Document No. QA-SOP-41
Revision No “1”
UDL Pharmaceuticals Issue Date: 01.12.2016
Revision Date: 01.12.2018
(A Division of First UDL Modaraba)
Standard Operating Procedures Quality Assurance Department
Subject / Title
BUSINESS RISK AND OPPORTUNITY ASSESSMENT & PAGE 01 of 02
MANAGEMENT
Prepared By: Reviewed By: Approved By:

Q. A. MANAGER Q.C. MANAGER G.M. PLANT

5.3.3. Additional opportunities may be identified by any employee at any time.

5.3.4. Risk assessment shall be performed on all steps coming in preview of following
parameters;

a) Production and Operations

b) Supplier performance and material availability/supply

c) Facility/equipment availability and maintenance

d) Delivery of nonconforming product

e) Availability of competent personnel

5.3.5. Discussing and analyzing opportunities shall be done by top management. If made
part of the management review activities, these shall be recorded in the
management review records.

5.3.6. To help determine which opportunities should be pursued, the Opportunity Register
may be used to conduct an “opportunity pursuit assessment.” This register is
similar to the P-FMEA Register, but ranks potential positive opportunities by their
likelihood of success and potential benefit.

5.3.7. The opportunity pursuit assessment is conducted by:

a) Identifying the opportunity.

b) Identifying the process for which the opportunity most likely falls under.

c) Assigning an Occurrence rating to the identified opportunity. The occurrence

is given a score from 1 (lowest probability) to 10 (highest probability). The
final probability rating is the higher of the two elements.

d) Assigning a Benefit rating to assess potential benefits if the opportunity is

won. The benefit is given a score from 1 (lowest benefit) to 10 (highest
benefit).

e) Assigning a Detection rating to the identified opportunity; the detection is

given a score from 1 (easiest detection) to 10 (difficult detection).

5.3.8. Opportunity Priority Number (OPN) will be calculated as per following formula

OPN = Occurrence X Benefit X Detection

 Document No. QA-SOP-41
Revision No “1”
UDL Pharmaceuticals Issue Date: 01.12.2016
Revision Date: 01.12.2018
(A Division of First UDL Modaraba)
Standard Operating Procedures Quality Assurance Department
Subject / Title
BUSINESS RISK AND OPPORTUNITY ASSESSMENT & PAGE 01 of 02
MANAGEMENT
Prepared By: Reviewed By: Approved By:

Q. A. MANAGER Q.C. MANAGER G.M. PLANT

5.3.9. For opportunities with a final Opportunity Factor rating equal to or greater than the
100, management will decide whether to pursue the opportunity through an
“opportunity pursuit plan” or to abandon the opportunity altogether. The opportunity
pursuit plan must be documented, either in the Opportunity Register or in another
document which must be referenced on the form.

5.3.10. Opportunities with a factor less than the opportunity target rating may be
abandoned outright, unless otherwise directed by management.

5.3.11. Analysis of any opportunity will generally result in one of the following possible
determinations:

 Pursue the opportunity

 Explore the opportunity in greater detail before proceeding

 Accept the opportunity, but under limited and controlled conditions

 Decline the opportunity, typically based on a high expected cost or low

anticipated benefit

5.3.12. If an opportunity includes a negative aspect, management may elect to conduct a

risk assessment on the negative aspect, as defined above.
 Document No. QA-SOP-41
Revision No “1”
UDL Pharmaceuticals Issue Date: 01.12.2016
Revision Date: 01.12.2018
(A Division of First UDL Modaraba)
Standard Operating Procedures Quality Assurance Department
Subject / Title
BUSINESS RISK AND OPPORTUNITY ASSESSMENT & PAGE 01 of 02
MANAGEMENT
Prepared By: Reviewed By: Approved By:

Q. A. MANAGER Q.C. MANAGER G.M. PLANT

TABLE # 01: Occurrence

Occurrence

Criteria: Occurrence of Cause- PFMEA

Rank Likelihood of Failure (Incident (s) in total jobs done at time of risk
assessment)
>100 per thousand
10 Very High
> 1 in 10
50 per thousand
9 High
1 in 20
20 per thousand
8 High
1 in 50
10 per thousand
7 High
1 in 100
20 per thousand
6 Moderate
1 in 500
0.5 per thousand
5 Moderate
1 in 2000
0.1 per thousand
4 Moderate
1 in 10,000
0.01 per thousand
3 Low
1 in 100,000
<0.001 per thousand
2 Low
1 in 1,000,000
1 Very Low Failure is eliminated through prevent control
 Document No. QA-SOP-41
Revision No “1”
UDL Pharmaceuticals Issue Date: 01.12.2016
Revision Date: 01.12.2018
(A Division of First UDL Modaraba)
Standard Operating Procedures Quality Assurance Department
Subject / Title
BUSINESS RISK AND OPPORTUNITY ASSESSMENT & PAGE 01 of 02
MANAGEMENT
Prepared By: Reviewed By: Approved By:

Q. A. MANAGER Q.C. MANAGER G.M. PLANT

TABLE # 02: Severity

Severity
Ranking Severity Description
Catastrophe, without
10
warning Predicted to cause severe impact to quality and business
Catastrophe, with (Product out of specifications, Customer Sue , Legal Action)
9
warning
8 Very High Predicted to cause significant impact on quality and delivery
(Failure to meet specifications, Late delivery, Customer
7 High Complaint)
6 Moderate Predicted to cause Moderate impact on quality and delivery
5 Low (Quality within specifications and Target Dates Meet)

4 Very Low Predicted to have minor impact on quality of the product

and delivery (Quality within specifications and Target Dates
3 Minor Meet)
2 Very Minor Predicted to no impact on quality of the product (Quality
1 None within specifications)

UDL Pharmaceuticals
(A Division of First UDL Modaraba)
Standard Operating Procedures
Subject / Title
BUSINESS RISK AND OPPORTUNITY ASSESSMENT &
MANAGEMENT
Prepared By: Reviewed By:
Q. A. MANAGER Q.C. MANAGER
TABLE # 03: Detection:
Ranking Detection
10 Absolute Uncertainty
9 Very Remote
8 Remote
7 Very Low
6 Low
5 Moderate
4 Moderately High
3 High
2 Very High
1 Almost Certain
Document No. QA-SOP-41
Revision No “1”
Issue Date: 01.12.2016
Revision Date: 01.12.2018
Quality Assurance Department
PAGE 01 of 02
Approved By:
G.M. PLANT
Detection
Criteria: Likelihood of Detection by Process Control
Process Control will not and/or cannot detect a potential
cause/mechanism and subsequent failure mode, or there is
no process Control
Very remote chance the process Control will detect a
potential cause/mechanism and subsequent failure mode
Remote chance the Process Control will detect a potential
cause/mechanism and subsequent failure mode
Very Low chance the process Control will detect a potential
cause/mechanism and subsequent failure mode
Low chance the process Control will detect a potential
cause/mechanism and subsequent failure mode
Moderate chance the process Control will detect a potential
cause/mechanism and subsequent failure mode
Moderately high chance the process Control will detect a
potential cause/mechanism and subsequent failure mode.
High chance the process Control will detect a potential
cause/mechanism and subsequent failure mode.
Very high chance the process Control will detect a potential
cause/mechanism and subsequent failure mode.
Process Control will almost certainly detect a potential
cause/mechanism and subsequent failure mode
 Document No. QA-SOP-41
Revision No “1”
UDL Pharmaceuticals Issue Date: 01.12.2016
Revision Date: 01.12.2018
(A Division of First UDL Modaraba)
Standard Operating Procedures Quality Assurance Department
Subject / Title
BUSINESS RISK AND OPPORTUNITY ASSESSMENT & PAGE 01 of 02
MANAGEMENT
Prepared By: Reviewed By: Approved By:

Q. A. MANAGER Q.C. MANAGER G.M. PLANT

5 DOCUMENTS & RECORD

Cross Functional Team members (For Risk and Opportunity Assessment)
List of Interested Parties
Issues of Concern
Process Failure Mode & Effect Analysis