PlatformRisk management
Quality risk management software that works one step ahead
QMSdesk™ is quality risk management software that connects every module. Risks open from real signals, serious issues get an owner early, and your team's attention goes where the risk is highest.
RISK-014
Excipient supplier certificate expired
Workflow
Step 2 of 6: Assessed
- Severity, probability, detectability
- 4, 3, 2
- Owner
- Assigned from the supplier record
- If re-assessed as critical
- A CAPA is raised, once
What proactive means, exactly
Monday morning. A supplier certificate expired over the weekend, and the risk is already open. Here is what "proactive" means in QMSdesk. Every rule is written down, so you can always see why a risk opened.
Risks open on their own from real signals
Daily jobs open a risk when a supplier certificate expires, a document review runs more than 30 days late, or training for a GxP-critical role lapses.
Serious issues get owned early
A critical risk raises its CAPA automatically, once. A critical audit finding raises a nonconformance and a risk. A critical event prompts a risk assessment, which a named person makes.
Supplier risk follows performance
Two rejected SCAR responses raise the supplier to the Critical tier.
High-severity hazards stay visible
A maximum-severity risk never scores below High.
Scrutiny scales with risk
High-impact changes route to the Change Manager and the Quality Manager. High-criticality documents need two approvers. Supplier tier sets 6-, 12- or 24-month reviews. A closed CAPA's effectiveness is checked over the interval you set.
Risk stays current
When a CAPA closes, or proves ineffective, its risk returns for re-assessment by a person.
Controls are verified before risk is reduced
The person who implements a control never verifies it, and residual risk is scored only after verification.
What changes for your team
01
Issues surface while they're small
The signals your team would otherwise go looking for arrive on the risk register by themselves.
02
Your effort follows the risk
Low-risk work moves quickly. High-risk work gets more approvers and earlier effectiveness checks, by rule.
03
Scores you can defend
Every residual-risk number rests on controls an independent person has verified. A catastrophic hazard can't be scored away by a low probability.
Risk-based quality management, step by step
Whether you're running an ICH Q9 risk assessment on a process or assessing a device hazard under ISO 14971, each risk follows one lifecycle, and each decision is signed.
Step 1 of 6
Identified
The risk is raised by a person, or opened automatically from a signal.
Step 2 of 6
Assessed
It is scored and signed.
Step 3 of 6
Mitigation planned
Controls are chosen and linked to the SOP, change or training that carries them out.
Step 4 of 6
Mitigated
Controls are verified independently, and the residual risk is scored and signed.
Step 5 of 6
Monitoring
Review tasks return the risk to its owner when a review falls due.
Step 6 of 6
Accepted or closed
Acceptance as low as reasonably practicable (ALARP) is signed.
Quality risk management software highlights
Severity dominance
Score likelihood × impact on a 5×5 matrix, or use FMEA risk priority numbers (severity × probability × detectability). Either way, a maximum-severity risk never scores below High. Every organization scores on the same 5×5 matrix, and you set the thresholds.
ISO 14971 risk management software, control by control
Controls follow the ISO 14971 taxonomy: inherent safety, protective measures and information for safety. Implementation and verification are separate acts by separate people. A new hazard introduced by a control is raised as a risk in its own right.
A critical risk always has a CAPA
When an assessment turns a risk critical, QMSdesk raises one linked CAPA automatically. A second trigger returns the existing CAPA, so you never get duplicates.
Risk Command
The Risk Command view in the Command Center shows your risk matrix, top risks, overdue reviews and the risk trend.
Feature index
Everything in risk management
Register and scoring
- Risk register lifecycle, from Identified to ALARP acceptance or closure
- Signed assessment, signed residual risk and signed acceptance
- A 5×5 likelihood × impact matrix, or FMEA RPN
- Severity dominance: a maximum-severity risk never scores below High
- Risk thresholds you set on the 5×5 matrix
- Built-in risk templates and your own custom templates
Controls (ISO 14971 model)
- Control taxonomy following ISO 14971 §7.1
- Implementer and verifier always different people
- Residual risk scored only after controls are verified
- Risks arising from controls raised in their own right
Automation across modules
- Risk opened when a supplier certificate expires
- Risk opened when a document review is more than 30 days overdue
- Risk opened when training for a GxP-critical role is overdue
- One CAPA raised automatically for a critical risk
- Nonconformance and risk raised for a critical audit finding
- Risk assessment prompted for a critical event
- Supplier raised to the Critical tier after two rejected SCAR responses
- Risk returned for re-assessment when its CAPA closes or proves ineffective
- Review-due risks returned to their owner
Oversight
- Risk Command view in the Command Center
- Typed, attributed links between risks and any other record
- Global search across risks
- REST API access to risk records
One connected system
Connected across QMSdesk
CAPA receives the corrective action a critical risk requires.
Supplier quality, document control and training management open risks from real signals.
Audit management turns critical findings into risks.
Regulations
Regulations it's designed to support
- ISO 14971 and ICH Q9. QMSdesk's risk engine is built on ISO 14971 and ICH Q9 principles, including the ISO 14971 control taxonomy (§7.1) and residual risk after verification.
- ISO 13485 and FDA QMSR. The MDR (medical device) profile carries ISO 14971 alongside ISO 13485:2016, and QMSdesk is built to support organizations working to ISO 13485:2016.
- ICH Q10. Risk feeds your CAPA and change management systems.
- EU GMP Annex 22. QMSdesk puts no AI model in any regulated decision path.
Questions buyers ask
How does QMSdesk decide when to open a risk?
By rules you can read. A risk opens when a supplier certificate expires, a document review runs more than 30 days late, or training for a GxP-critical role lapses. A critical risk raises its CAPA automatically, and every automatically created record carries its source. QMSdesk puts no AI model in any regulated decision path.
What is severity dominance?
A rule that a maximum-severity risk never scores below High, whatever its probability. A rare but catastrophic hazard stays visible.
Does a critical risk raise a CAPA automatically?
Yes, exactly once. A critical event works differently: it prompts a risk assessment, which a person makes. An event's CAPA is raised by a signed CAPA decision.
Can we use QMSdesk as FMEA software?
Yes. Score with FMEA risk priority numbers or the 5×5 matrix. Severity dominance applies either way.
Is it built for ISO 14971?
It is built on ISO 14971 and ICH Q9 principles. Implementing and verifying a control are always separate, and residual risk is scored only after verification.
Your quality system, always one step ahead
Bring your riskiest open issue. We'll show you QMSdesk opening, scoring and owning it.