Free guide · Risk-based laboratory quality
What could go wrong—and why does it matter?
Connect the laboratory task to the person who depends on it.
A risk-based approach starts with possible harm, then asks how the work, its safeguards and the available evidence fit together.
Start with the purpose
Quality has a consequence.
Laboratory quality activities help make results and services suitable for their intended use. Risk-based thinking asks why a particular failure would matter, who could be affected and how the laboratory can reduce that possibility. It helps focus attention without treating every process, test or clinical situation as interchangeable.
This is an introduction for scientists, quality leads, managers and assessors. The aim is to recognise and explain a concern, not to complete a formal risk assessment or choose operating limits. The examples below are fictional and are not local procedures.
The failure
An urgent-result notification is routed to an unattended inbox.
The possible harm
The intended recipient may not receive important information in time; a delay in appropriate care could harm the patient.
The missing connection
A separate check might detect the problem. Harm is possible, not inevitable. Understanding that connection is part of assessing risk.
Four ideas worth separating
Hazard
Something that has the potential to cause harm. In laboratory work, misleading or unavailable information can be part of that concern.
Hazardous situation
The circumstances in which someone is exposed to a hazard—for example, care proceeds without important laboratory information being available.
Harm
The adverse effect itself, such as injury or deterioration in health. A process failure and the resulting harm are different things.
Risk
Consider both the chance of harm and how serious it could be. Neither the frequency of process failures nor severity alone supplies the whole answer.
Patient safety is a central concern, but laboratory workers and service providers also belong in the picture.
Follow the work beyond the analyser
A technically sound measurement cannot compensate for the wrong patient identification or a result that never reaches the correct record. Consider pre-examination, examination and post-examination activities, including the handoffs between people and systems.
Defining the scope simply means saying which work you are considering: where it starts, where it ends and who is involved. If the fictional notification review ends at “result authorised”, the unanswered inbox may be missed. Including delivery and acknowledgement exposes the gap, without implying that the laboratory controls every later clinical decision.
Process mapping helps people discuss the real sequence, including exceptions and out-of-hours arrangements. Failure Mode and Effects Analysis (FMEA) examines potential ways a process could fail and their effects. Fault Tree Analysis (FTA) begins with a defined unwanted outcome and examines combinations of causes. It can be used prospectively as well as to analyse an event that has happened. These are tools for structuring thought, not substitutes for understanding the work.
An original conceptual illustration
Where does the safeguard act?
This fictional example shows possible connections, not measured probabilities or an inevitable chain of events.
1 · Opportunity for failure
Wrong destination
The notification is routed to an unattended inbox.
Question: could the routing design prevent that destination being used?
2 · Exposure to the problem
Information unavailable
The intended recipient does not receive the result when it is needed.
Question: could a missing acknowledgement be detected and escalated?
3 · Possible consequence
Care delayed
Delay could lead to harm, depending on the clinical circumstances and other safeguards.
Question: is there a workable response when the usual route fails?
Source note: original teaching illustration by Pathology Uncertainty, informed by the risk-management concepts discussed in the sources below. No patient data or publisher figure is reproduced.
Explain what the control changes
A control may reduce the chance of failure, detect a problem before it affects someone, or limit its consequences. Ask which job it does. Generating an alert is different from ensuring an appropriate person receives it and can respond.
Process design can remove an opportunity for error or make the safer action easier. Protective checks, usable information and training can support it. A reminder alone still depends on memory and attention. Two controls may also share a weakness: a notification and its backup are not independent if both rely on the same unavailable system.
Controls can have unintended effects. More alerts may create overload; another manual step may introduce transcription errors or delay. The appropriate response needs local assessment, not a generic instruction to add more checking.
Familiar quality activities contribute different evidence. IQC addresses aspects of analytical performance, while EQA offers external comparison with important qualifications. Neither can be assumed to detect every identification or communication failure.
What remains after the action?
Residual risk is the risk remaining after controls have been implemented. A completed action does not establish that this risk is acceptable. Evidence, uncertainty, relevant clinical context and the laboratory’s agreed responsibilities still matter.
Matrices and risk priority numbers can organise discussion. Their ratings depend on definitions and judgement; multiplying ordinal scores does not create a measured probability of patient harm. Similar totals may hide very different consequences. A low total should not conceal a severe concern.
Likewise, the percentage of results meeting a turnaround-time target measures performance against that target. It is not itself the probability of harm. Understand the clinical meaning of delays, the start and finish used for timing, and whether the data capture the failures of interest.
ISO 22367 does not provide a universal acceptable-risk threshold. This guide therefore offers no generic score, traffic-light rule or target for declaring a process safe.
Look for effectiveness, then review
A control needs evidence that it works for its intended purpose. Counts of alerts, training attendance or closed actions may be useful records, but do not automatically demonstrate reduced harm. In the fictional example, successful delivery and response address the concern more directly than the number of notifications generated.
Incidents, near misses, audits, staff observations and quality indicators provide complementary information. Changes in reporting can change apparent incident rates, and no reported harm is not proof of no risk. Be clear about the limits of the evidence.
Review at appropriate intervals and when relevant changes occur: software, staffing, workload, a new clinical use or an unexpected trend may alter the picture. Responsibilities and timing belong in local arrangements.
A small grounded reflection
Using the fictional inbox example, explain four things in one short paragraph: the possible harm, a safeguard, what might still go wrong, and what evidence would help you review it.
See one possible explanation
A missed urgent result could delay care. A maintained destination and escalation route may help it reach the right person, but depend on functioning systems and current contacts. Evidence of delivery and action would help us judge whether those safeguards work. That is a useful introduction to the concern, not a completed risk assessment.
Continue a little at a time
Five free emails. One clearer explanation.
Learn the same introductory ideas through short lessons and occasional reflections, on days 0, 2, 4, 7 and 10 after confirmed enrolment.
Explore the free risk course →Sources and reading
Original introductory teaching by Stephen MacDonald, informed by his Pathology in Practice series. The articles were written in the context of ISO 22367:2020; the publisher retains rights to the published text and figures.
- Introduction to risk management frameworks in clinical laboratories. February 2025; 26(1):29–31. Publisher web posting: 1 April 2025.
- Process Mapping, FMEA and FTA: Practical Approaches to Risk Assessment. April 2025; 26(2):27–30. This guide clarifies that FTA is not restricted to retrospective use and that an RPN is not a measured harm probability.
- Risk-based turnaround time management: a look at some important issues. August 2025; 26(5):29–33.
- Management of risk: an action plan for pulling everything together. December 2025. The detailed implementation programme is outside this introduction.
- ISO 22367:2026 — Medical laboratories — Application of risk management to medical laboratories. Second edition, published April 2026; replaces the withdrawn 2020 edition.
Reviewed 3 October 2026. Current-edition status and scope were checked against ISO’s public record. This introduction draws on the articles and the earlier standard; it is not a clause-by-clause review of the complete 2026 text, a substitute for the standard or a claim of compliance. Publisher articles may require free registration for full access.