Integrating elements and building a Risk Based Strategy

The Contamination control Strategy elaboration is a staged approach starting with Gap assessment and includes of
course KPIs. The below model describes the entirety of the strategy elaboration, from the design to the monitoring Once the Gaps have been identified and categorized from Compliance and Business perspective, the action plan must be rolled out, and in parallel the strategy defined for a sustainable sterility assurance. This is achieved through the use of Risk assessments, standards implementation, etc.
The strategy will be documented in a so called “CCS document” as per Annex one requirement, that aims to be easy to navigate and provide all necessary information supporting the contamination control strategy. The CCS structure may vary depending on the process, or the complexity, but will always provide the elements as described in figure 1. The strategy for contamination control must be risk assessed to ensure its effectiveness. This will include criteria such as its added value on patient safety, its robustness from a business perspective, but must also include the complexity of the strategy, and the oversight from the Quality Organization. The CCS itself is subject to continuous improvement based on risks.

A Gap Assessment, yes! But let’s think different.

When performing a Gap assessment regarding compliance to Annex 1, several criteria may be used. The goal should not only be to respond to the question “Gap” or “no Gap”, it’s never as simple as that, but rather to provide at the same time an information regarding the Risk related to the GAP. That’s explained later in this article, but let’s talk a little bit about mathematics first.

Why thinking in ratios is better than considering differences?

When we compare two positive quantities, or values, we can look at their difference (subtract one from the other) or their ratio (how many times one fits into the other). The second approach gives a quicker and actionable information specifically when dealing with lots of Data.

How our minds reinforce this

Experiments in psychology show that people detect change in proportion to the relative difference, not the absolute one. The tiniest change you can notice in a stimulus is roughly a fixed fraction of its current level. In other words, human perception is tuned to ratios. That said, we can imagine that a Risk Assessment using Risk Priority Numbers can easily be compared to the maximum score possible, thus telling us how big the Risk is compared to the worst case situation of a 100% Risk. Interesting isn’t it? But that’s not all.

Why a logarithmic scale helps

By writing each value as its logarithm (log a, log b). The distance between two points on a log axis is simply log (a ÷ b), the logarithm of the ratio. This single step gives several benefits:
• Equal spacing for equal ratios. Doubling, tripling, or halving always occupies the same visual width, so tiny numbers are not squashed and huge numbers are not stretched.
• Multiplication becomes addition. Logarithms turn products into sums, which are easier to plot, fit with straight lines, and analyze statistically. Stable variability. Data whose scatter is naturally multiplicative (e.g., growth rates) shows a constant spread after logging, making standard tools such as least-squares more reliable.
• Unit-free comparison. The log. distance is unchanged if every measurement is rescaled, preserving objectivity.

What do we conclude out of it?

Ratios capture the true “relative size” of things, our brains naturally track change this way, and a logarithmic scale lays those ratios out in straight, even steps. That makes multiplication-based thinking, expressed through logs, the clearest and most efficient framework for comparing quantities at any scale.

Using a logarithmic calculation system, values are discriminated in the sense that lower values become less visible and higher values gain visibility.This enables the use of the full range of measurements and helps to better discriminate Risks for an accurate prioritization.

For the calculation, we can use a Log10 referential and divide the result of the calculation by the maximum achievable score, to obtain a result ranging from 0 to 100%.
The graph (Figure 2) beside is generated from random data to calculate a RPN (Risk Priority Numbers) using 4 risk factors (f1 to f4) ranked from 1 to 5 using the formula described, and shows this differentiation between logarithmic ratio (green) and usual linear models (red).
The way data are plotted on the chart enables a better discrimination and subsequently a far more efficient decision making process when it’s about setting priorities. Last but not least that doesn’t affect the comparative positioning of each item. A low Risks keeps low, and a high risk keeps high, but better separated. Having GAPs visualized in such a way permits the elaboration of a structured action plan. Let’s apply this
to Annex 1.

The Annex 1 Gap assessment

The risk scoring system used integrates five key factors: patient impact, business impact, compliance gap, inspection readiness, and likelihood of remediation failure. These are not weighed equally (gap severity carries the highest influence, followed by remediation effort, probability of failure, inspection preparedness, and patient safety impact.
Each factor is rated on a logarithmic scale (low, medium, high) and converted into weighted numerical values, allowing a Risk Priority Number (RPN) to be calculated for each compliance item.

Company strategy

Should it be for a launch of the facility or a routine re-assessment, criteria will have a different weight. The example below shows the Gap (including all of these aspect for each requirement) will be very precisely evaluated in alignment with the context of the company.
Values are indicative.
The intermediate value (Medium) corresponds to the half of the logarithmic scale between low and max values.

Gaps calculation

For each Gap, the calculation is made by multiplying the values for all of the 5 criteria, and dividing the log of the result by the log of the maximum values multiplied. It gives for each item of the standard a so called “success score”, not only based on Compliance (Gap/No Gap) but integrating all aspects in terms of risks. In parallel, the calculation is made regarding pure Quality and compliance risks (using patient and compliance criteria), and business risks (using Business and Remediation failure risk).Back to Annex 1, the compilation of all of these data provide a risk score representing all gaps for on given chapter (Indicative values):

When adding the Preparedness criteria (Inspection readiness), the areas of focus might be slightly different, and calculation (using ratio and logarithmic scale) enable an immediate visualization of areas of focus.

The outcome of this methodology is a multi-dimensional risk map, capturing both quality-related and business-related areas of focus. These are used to build a focus matrix, visually distinguishing critical issues that combine high compliance risk and high remediation difficulty. The most urgent priorities emerge where compliance risk and difficulty intersect. Each plot of the map represents a requirement from annex 1.

To translate risk scores into action, a prioritization system is applied. This assigns a four part code to each gap, derived from its overall success score and sub-scores in business urgency, preparedness, and failure risk. The resulting roadmap ensures that the most critical issues (those with high impact, difficult mitigation, and no solution) are addressed first.

These charts are being generated using Power BI capabilities based on calculation Data sets. enabling a possible periodic re-assessment using the tools, with updates sets of Data, after changes in the process, or regulatory updates for example.

This methodology goes beyond checklist compliance. It enables rational resource allocation, data-driven decision-making, and transparent communication. In doing so, it embodies the risk- and science-based mindset at the heart of Annex 1, where the aim is not only to meet standards, but to sustain a robust, justifiable state of control throughout the product lifecycle.

And what about KPIs?

In the evolving landscape of contamination control, the ability to measure, interpret, and respond to performance indicators is no longer a complementary feature it is foundational. Within the framework of the Contamination Control Strategy (CCS), Key Performance Indicators (KPIs) are not simply dashboard metrics; they are the analytical backbone that transforms the CCS from static documentation into an operational, verifiable system of assurance.

The proposed process for an effective oversight consists in a multi-layered, data-driven approach. Each component of Annex 1, ranging from premises and utilities to quality control and environmental monitoring, is mapped against five strategic pillars: basics, controls, validation, monitoring, and governance. These pillars form the structure of the CCS, and the KPIs provide the continuous signals that show whether each part is functioning as intended. What emerges is a system where every requirement of Annex 1 is mirrored by at least one measurable indicator, ensuring that completeness, traceability, and trending capability are embedded from the outset.

Metrics are normalized on a 0–100% scale, turning qualitative assessments such as the adequacy of cleaning or personnel training, into quantitative, auditable values. These indicators feed a digital scorecard, visualized through a Power BI dashboard, that not only shows current status but also highlights deviations, risks, and missing data. By incorporating multiple timeframes—quarterly for operational metrics, rolling 12-month windows for seasonal or low-frequency events, and biennial checkpoints for governance activities—the system ensures both granularity and long-term oversight.

Beyond static reporting, the dashboard allows for slicing data by CCS element, department, facility, or even specific process lines. It empowers leadership and quality teams to analyze trends, benchmark performance, and initiate timely actions. For regulators, the KPI structure provides immediate confidence: they are presented not with anecdotal narratives, but with a transparent, continuously updated demonstration of aseptic control.

This KPI-centric model embodies the Annex 1 emphasis on lifecycle quality management. By making contamination risk measurable, comparable, and actionable, the CCS is no longer just a risk strategy, it becomes an engine for sustained GMP performance and inspection readiness. In this context, KPIs do not just inform: they govern.