18.4 FMEA, HACCP, CTQ & SWOT

18.4 FMEA, HACCP, CTQ & SWOT (CQA BoK V.H — Understand)

/practice/cqaPractice questions with detailed explanations

Auditors do not own every risk model, but they must understand common tools well enough to challenge empty templates, missing severity logic, and “green RPN” theater. BoK V.H sits at Understand: recognize purpose, structure, and appropriate use.

Risk strategies: avoidance, mitigation, tradeoffs

Before naming tools, fix the treatment vocabulary:

Audit lens: Was the strategy chosen consciously? Is residual risk documented? Did “acceptance” become silent neglect?

Scenario — tradeoff

A team could 100% inspect a feature (high cost, high detection) or redesign the fixture (higher upfront cost, lower occurrence long-term). FMEA-driven mitigation chooses fixture redesign; management accepts interim inspection until redesign is validated. The tradeoff is explicit—good risk thinking.

FMEA — Failure Mode and Effects Analysis

FMEA is a structured method to identify how something can fail, what happens, why, and how the failure is prevented or detected—then prioritize actions.

Core columns (conceptual)

DFMEA vs PFMEA

System/application FMEA variants exist; software FMEA may cover cyber and data-integrity failure modes.

Auditor evaluation points (Understand → challenge)

• Are failure modes from real process knowledge (not only brainstorming once five years ago)?
• Does severity reflect patient/user harm—not only scrap cost?
• Are detection scores honest about escapes (field data)?
• Do recommended actions actually implement and update the living FMEA?
• Is FMEA linked to control plans, inspection, and change control?
• After process/design change, was FMEA revisited?

Scenario — weak PFMEA

PFMEA lists “operator error” everywhere with medium severity and no poke-yoke. RPN is reduced by claiming “training” as detection. Auditors should challenge: training is often weak detection; severity may be understated for safety effects; causes should go deeper (fixture, lighting, software UI).

HACCP — Hazard Analysis and Critical Control Points

HACCP is a preventive system (classic in food safety, also adapted to other process-hazard contexts) that:

1. Conducts hazard analysis (biological, chemical, physical—and sometimes other hazard classes by industry)
2. Determines Critical Control Points (CCPs)
3. Sets critical limits
4. Establishes monitoring
5. Defines corrective actions when limits fail
6. Requires verification procedures
7. Keeps records

Relation to FMEA: Both are structured risk tools. HACCP is especially oriented to process hazards and CCPs with continuous monitoring; FMEA is broader failure-mode prioritization for design/process. Do not treat them as identical forms.

CTQ — Critical to Quality

CTQs are the measurable characteristics that must be achieved to satisfy customer or stakeholder requirements. They translate “voice of the customer” into specs and controls.

Flow (conceptual)

Customer need → CTQ characteristic → specification / target → process control → measurement → audit evidence

Why auditors care

• CTQs should drive inspection plans, SPC, and FMEA severity.
• If CTQs are undefined, teams may control convenient metrics while missing what customers value.
• Audit sampling should prefer CTQ-related records under risk-based approaches.

Scenario

A dashboard glows green on OEE while CTQ dimensional capability is poor and complaints rise. The organization optimized a non-CTQ metric—an auditor links findings to misaligned CTQ deployment.

SWOT — Strengths, Weaknesses, Opportunities, Threats

SWOT is a simple strategic matrix:

Quality / audit program uses

• Planning audit program focus for the year
• Supplier strategy sessions
• CAPA system health discussions with management
• Preparing for new standards or markets

Limits

• SWOT is qualitative and can be vague without evidence.
• It does not replace FMEA, HACCP, quantitative risk matrices, or formal enterprise risk management.
• “Threat: competitors” without linkage to quality risk is weak audit evidence.

Note: organizational risk management (IV.A.8)

BoK IV.A.8 addresses broader organizational risk management (program/business context). Domain V.H is the quality tools set—FMEA, HACCP, CTQ, SWOT, and treatment concepts. On the exam:

• Use V.H when the stem is about tool structure, failure modes, CCPs, CTQs, SWOT cells.
• Think IV.A.8 when the stem is enterprise risk frameworks, audit program risk, or business risk integration.

They connect (tools feed programs) but are not the same leaf of the BoK.

Putting tools together in an audit narrative

1. CTQs define what matters.
2. FMEA/HACCP analyze how it fails or which hazards matter.
3. Controls and sampling manage residual risk.
4. Change control updates tools when design/process changes.
5. SWOT may frame annual priorities at management review.

Integrated mini-case

A dairy plant’s HACCP identifies pasteurization as a CCP with critical time/temperature limits. PFMEA for filling highlights mislabel allergen risk (high severity). CTQs include pathogen absence and correct allergen labeling. SWOT notes a strength (strong lab) and a threat (new allergen regulations). An auditor samples CCP charts, label verification, and whether FMEA actions closed after a filler change—tool coherence is the story.

Audit application checklist (Understand-level)

1. Identify which tool the auditee claims to use—and whether the artifact matches that tool.
2. Check linkage: CTQ ↔ FMEA severity ↔ control plan ↔ monitoring.
3. For FMEA: challenge stale scores, weak detection, missing safety severity.
4. For HACCP: verify CCP monitoring, critical limits, corrections, and verification.
5. For SWOT: look for evidence-based inputs and resulting actions—not wallpaper.
6. Confirm risk treatment (avoid/mitigate/accept) is explicit for high residual risks.
7. After changes, confirm risk tools were updated (connects to V.F–G).

Common exam traps

• Swapping DFMEA (design) and PFMEA (process)
• Treating RPN as the only modern prioritization method without understanding S/O/D meaning
• Confusing HACCP CCPs with every process step
• Calling any customer wish a CTQ without measurability
• Using SWOT as if it were quantitative process control
• Mixing V.H tools with IV.A.8 organizational risk program detail
• Assuming mitigation always means “more inspection” (redesign/avoidance may be better)

Link forward

/practice/cqaPractice questions with detailed explanations