How risk is scored, and how much formality each score requires.
ICH Q9 is the international guideline on quality risk management. Two ideas from it are built into this platform as fixed rules: risk is judged on defined scales, and the formality of the response must match the risk. The AI proposes the inputs. These rules do the arithmetic and decide who has to look.
1. The score: three scales multiplied
Each item gets a severity (how bad if it goes wrong), an occurrence (how likely) and a detection (how likely we are to miss it), each from 1 to 4. Multiplied together they give the risk priority number, the RPN, from 1 to 64. The RPN falls into one of four risk levels:
| Risk level | RPN | Who has to look | Items now |
|---|---|---|---|
| Level 1 | 1 to 7 | Automated rule checks. No person needed if nothing else is unusual. | 4 |
| Level 2 | 8 to 15 | The AI reviews it and it is logged. A person only if something is unusual. | 4 |
| Level 3 | 16 to 23 | A person must look. If escalated, the QA head signs. | 3 |
| Level 4 | 24 or more | A person must look. If escalated, the QA head signs and then an executive signs. | 3 |
2. The formality: three more factors
Separately, uncertainty (how much is unknown), importance (how much it matters to the decision) and complexity are each scored from 0 to 2. Added together they give the formality grade, from A (least formal) to D (most formal): the more uncertain, important and complex, the more formal the response must be.
| Grade | The three factors add up to | Items now |
|---|---|---|
| A | 0 to 1 | 4 |
| B | 2 to 3 | 4 |
| C | 4 to 5 | 3 |
| D | 6 | 3 |
3. The rule that joins them: formality must match the risk
A higher risk level demands a more formal grade. The least formal grade each level may have is level 1: A, level 2: B, level 3: C, level 4: D. An item below that line is marked below the required formality, which always sends it to a person. The AI cannot override this.
formality matches the risk below the formality required. The number in each box is how many live assessments sit there.
4. What each result sets in motion
- Levels 1 and 2: the AI may clear the item on its own, if its confidence is at least 75%, its grade matches the risk, and the Assurance Layer passes it. Every clearance is logged and a person can challenge it.
- Level 3: a person must look. If they escalate it, the QA head signs.
- Level 4: a person must look. If they escalate it, the QA head signs first and an executive signs second.
- Whatever the level: low confidence, a grade below the required formality, an AI recommendation to review or escalate, or a failed Assurance check all send the item to a person. The AI can add reasons for a person to look. It can never remove one.
See the Assurance Layer for the checks, and how a record is handled for the whole path.