Technology Transfer Risk Assessment

This is a ready-to-use risk assessment for a technology transfer between a sending and a receiving site. It identifies what changes when a process moves, scores the risk of each change, and drives mitigation before the first engineering run. Replace every <<FILL: ...>> placeholder with your own specifics and route it through your normal document control, review, and approval. A worked filled specimen follows. Verify each cited reference against the current source before you rely on it.

Document control header

1. Purpose

This assessment identifies and scores the risks introduced when <<FILL: product / process>> moves from the sending site to the receiving site, so the transfer plan can mitigate the real gaps rather than a generic checklist. It covers facility, equipment, scale, and process-step risk, and sets the residual risk that must be formally accepted before PPQ.

2. Scope

3. Responsibilities

4. Method and scoring scale

Score each identified risk on severity (S), occurrence (O), and detectability (D), 1 to 5 each, and take the risk priority number (RPN = S x O x D). A risk scoring 4 or 5 on severity, or an RPN above <<FILL: threshold, e.g. 40>>, requires a named mitigation before the affected step proceeds to an engineering run.

5. Risk register by process step

Score every unit operation the process passes through, not only the ones that look risky at first glance; a step assumed identical at both sites is exactly where an untested assumption hides.

6. Facility-fit differences

A facility difference is not automatically a risk; state what it changes about the process or the product before scoring it in section 5.

7. Equipment differences

Where the receiving site uses a different working principle, not just a different make, treat it as a design change and reference the equivalence assessment, not a routine like-for-like transfer.

8. Scale effects

State the scale-up or scale-down model relied on (geometric similarity, power per volume, or another named model) and where it has not been demonstrated at this scale before; an unverified model is itself a risk, not a mitigation.

9. Mitigation actions

Every risk scoring above the threshold in section 4 gets a row here with a named owner; “monitor” is not a mitigation unless paired with a defined trigger and response.

10. Residual risk acceptance

11. References

ICH Q9(R1), Quality Risk Management. ICH Q10, Pharmaceutical Quality System. WHO Technical Report Series 961, Annex 7, WHO Guidelines on Transfer of Technology in Pharmaceutical Manufacturing.

Confirm the current version of each reference before issue.

12. Revision history

13. Approvals

Filled specimen

Extract from an example transfer of Acme Therapeutics’ ATX-101 lyophilized biologic vial-filling step from an internal site to a CDMO. Company, product, and numbers are illustrative.

Facility fit: receiving site fill suite is Grade A/B like the sending site, so no risk driver scored. Equipment: the receiving site lyophilizer has a larger, differently baffled chamber; scale-up model is heat-transfer-based and had not been demonstrated above 60 percent load before this transfer, so it was scored and mitigated with a dedicated engineering run mapping shelf temperature at full load.

Mitigation: for the lyophilization risk, owner Engineering (receiving site), due before engineering run 1, verified by thermocouple mapping across the full shelf showing uniformity within plus or minus 2 degrees C of setpoint at every mapped position. Residual risk after mitigation: RPN 12, accepted by QA to proceed to PPQ with the mapped profile locked into the recipe. The labeling risk, RPN 4, was accepted without further mitigation beyond the existing dual-verification step already in the receiving site’s labeling SOP, an example of a real difference that was scored honestly and still closed at Low without inventing a study it didn’t need.

The specimen shows the pattern an inspector looks for: a facility factor correctly scored as no risk once actually compared, an equipment change correctly treated as more than routine because the working principle differs, and a scale-up model risk that was tested, not assumed, before it was accepted.

Common inspection findings this risk assessment prevents

• A transfer risk assessment that lists generic categories with no process-step-level detail.
• Equipment differences noted but not scored, because the two units “do the same thing.”
• A scale-up model asserted with no data showing it holds at the new scale.
• Mitigations with no owner or no way to verify they worked.
• Residual risk accepted informally, with no named QA decision on record.

How to adapt this risk assessment

1. Set your document number, sites, and linked transfer plan number in the header.
2. Set your own severity/occurrence/detectability anchors and RPN threshold in section 4, and keep them consistent across every transfer at your site.
3. Walk every unit operation in section 5; do not skip steps assumed to be identical.
4. Fill sections 6 to 8 from an actual side-by-side comparison, not from memory.
5. Tie every mitigation in section 9 to the engineering run or verification activity that proves it worked.
6. Confirm every reference in section 11 against the current published version before issue.