FMEA (failure mode and effects analysis) is a structured way to find what could go wrong in a laboratory process before it happens. The team lists each failure mode, scores its severity, occurrence and detectability, multiplies the scores into a risk priority number (RPN), and acts on the highest risks first.
Risk-based thinking is now built into ISO 15189:2022 and ISO/IEC 17025:2017, so assessors expect to see evidence that a lab has identified its risks and done something about them. FMEA is one of the most practical tools for this, especially for multi-step processes where errors can start outside the lab.
Where FMEA fits in laboratory standards
ISO 15189:2022 includes a dedicated risk management clause (5.6) and requires actions to address risks and opportunities for improvement (8.5). It points labs towards ISO 22367, which applies risk management to medical laboratories. ISO/IEC 17025:2017 requires testing and calibration labs to address risks and opportunities (8.5) and to identify risks to impartiality on an ongoing basis.
Neither standard mandates FMEA. They require a risk-based approach, and you choose the method. CLSI EP23 describes how medical labs can design quality control plans based on risk management, and FMEA-style thinking is common there. ISO 14971 covers risk management for medical device manufacturers and is useful context, but it is not a laboratory accreditation requirement.
FMEA step by step
- Assemble the team. Include people who do the work, not only managers. A blood culture FMEA needs a phlebotomist or nurse as well as microbiology staff.
- Map the process. Draw each step from request to report, including steps outside the lab such as collection and transport.
- List failure modes. For each step, ask how it could fail: wrong, late, missing, incomplete or contaminated.
- Describe effects and causes. What happens to the patient or client, and why could the failure occur?
- Record current controls. What already prevents or detects the failure?
- Score severity (S), occurrence (O) and detection (D). Use defined 1 to 10 scales agreed before scoring starts.
- Calculate RPN = S x O x D and rank the failure modes.
- Prioritise and act. Assign actions, owners and target dates, starting with the highest risks and any high-severity item.
- Re-score after actions to confirm the risk has fallen, and review the FMEA when the process changes.
Scoring scales
| Score | Severity (S) | Occurrence (O) | Detection (D) |
|---|---|---|---|
| 1-2 | No or negligible effect on the result or patient | Remote, almost never seen | Almost certain to be detected before release |
| 3-4 | Minor effect, easily corrected | Occasional | High chance of detection |
| 5-6 | Moderate effect, delayed or repeated test | Moderate, seen periodically | Moderate chance of detection |
| 7-8 | Serious effect on diagnosis or treatment | Frequent | Low chance of detection |
| 9-10 | Potential for serious patient harm | Very frequent or almost certain | Very unlikely to be detected |
Note that detection runs in reverse: a high D score means the failure is hard to detect. Define each scale in your procedure so different teams score consistently.
Worked example: FMEA of blood cultures in a Sharjah hospital lab
A hospital microbiology lab in Sharjah reviews its blood culture process after a run of contaminated cultures and a delayed critical call. A team of two microbiologists, a lab supervisor, an infection control nurse and a ward phlebotomist maps the process and agrees six failure modes.
| # | Step | Failure mode | Effect | Cause | Current control | S | O | D | RPN |
|---|---|---|---|---|---|---|---|---|---|
| 1 | Collection | Skin flora contaminates bottle | False positive, unnecessary antibiotics | Poor antisepsis, drying time skipped | Induction training | 7 | 6 | 6 | 252 |
| 2 | Collection | Bottles underfilled | Missed bacteraemia | Difficult venepuncture, fill marks ignored | None | 8 | 7 | 7 | 392 |
| 3 | Ordering | Only one set taken | Lower sensitivity, contaminants hard to judge | Order set allows single set | Clinician judgement | 8 | 5 | 6 | 240 |
| 4 | Labelling | Wrong patient label | Result reported for wrong patient | Labels printed and applied before collection | Two-identifier check at reception | 10 | 2 | 5 | 100 |
| 5 | Transport | Delayed loading into analyser | Delayed detection | Bottles held on ward overnight | Receipt time logged | 7 | 5 | 4 | 140 |
| 6 | Reporting | Positive Gram stain not communicated promptly | Delayed effective therapy | Night workload, clinician unreachable | Phone call policy | 9 | 4 | 5 | 180 |
The team then agrees actions and re-scores after three months of monitoring:
| # | Action | Revised S / O / D | Revised RPN |
|---|---|---|---|
| 1 | Standard antisepsis kits, observed drying time, monthly contamination rate feedback by ward | 7 / 3 / 4 | 84 |
| 2 | Check fill volume on receipt against the manufacturer's recommendation and feed back to wards | 8 / 4 / 3 | 96 |
| 3 | Order set defaults to two sets from separate sites | 8 / 2 / 4 | 64 |
| 4 | Label at the bedside immediately after collection; reception rejects unlabelled bottles | 10 / 1 / 4 | 40 |
| 5 | Loading time indicator monitored; out-of-hours loading arranged | 7 / 3 / 3 | 63 |
| 6 | Escalation ladder, read-back of critical results and documentation in the LIS | 9 / 2 / 3 | 54 |
Notice row 4. Wrong-patient labelling had the lowest starting RPN but the highest severity. The team acted on it anyway, because their procedure requires action on any severity of 9 or 10, whatever the RPN. Severity scores normally stay the same after actions, because controls reduce how often a failure occurs or improve how well it is caught, not how bad it would be. Any nonconformities found along the way are handled through the lab's CAPA process.
Limitations of the RPN
- Ordinal scores are multiplied. A severity of 8 is not twice as bad as 4, so the product is only a rough ranking.
- Different risks can share an RPN. S10 x O2 x D5 and S5 x O4 x D5 both give 100, yet the first could harm a patient.
- Scores are subjective. Without defined scales and a mixed team, scoring drifts towards optimism.
- Small changes swing the result. One point on any factor can move an item up or down the list.
To counter this, many labs add a severity rule like the one above. The AIAG and VDA FMEA Handbook (2019) moved from RPN to an Action Priority approach for the same reason.
FMEA vs a risk matrix
A risk matrix scores likelihood against severity, usually on a 3x3 or 5x5 grid, and colours the result low, medium or high. It is quicker and easier to explain, which makes it well suited to a lab-wide risk register or a single event. FMEA is more detailed and adds detectability, so it suits complex processes such as blood cultures, molecular testing or sample reception. Many labs use a risk matrix for their register and FMEA for high-risk processes.
Common mistakes
- Scoring alone at a desk instead of with the people who do the work.
- Starting the process map at the lab door and ignoring collection and transport.
- Treating the RPN as precise and ignoring high-severity items with low RPNs.
- Listing actions without owners or dates.
- Never re-scoring, so there is no proof the risk fell.
- Writing the FMEA for the assessor and then filing it away.
Key takeaway: FMEA helps a lab find and rank failure modes before they reach patients or clients. Use defined scales and a mixed team, act on high-severity risks regardless of RPN, and re-score to prove your actions worked.
Frequently Asked Questions
What is FMEA in a laboratory?
FMEA in a laboratory is a proactive risk assessment method. The team maps a process, lists how each step could fail, scores severity, occurrence and detection, and calculates a risk priority number. The highest risks are then reduced through preventive actions, and the process is re-scored to confirm improvement.
How do you calculate the RPN in FMEA?
The risk priority number is calculated as severity multiplied by occurrence multiplied by detection. On common 1 to 10 scales, the RPN ranges from 1 to 1,000. It is a ranking aid, not a precise measure, so high-severity failure modes should be reviewed even when their RPN is low.
Does ISO 15189:2022 require FMEA?
No. ISO 15189:2022 requires a laboratory to identify and manage risks to patients and to the quality of its examinations, but it does not prescribe a specific method. FMEA is a common choice, alongside risk matrices and the approaches described in ISO 22367 and CLSI EP23. Confirm expectations with your accreditation body.
What is the difference between FMEA and a risk matrix?
A risk matrix plots likelihood against severity to classify risks as low, medium or high, and suits a lab-wide risk register. FMEA breaks a process into steps, adds detectability and calculates an RPN for each failure mode, giving more detail for complex or high-risk processes.
Next steps
To apply risk-based thinking across your quality system, explore our Laboratory Quality Management System course, and for investigation skills, the Root Cause Analysis and CAPA course.
For related reading, see risk-based thinking in ISO 9001 and CAPA in laboratories: root cause to closure. If you would like guidance on where to start, speak to a counsellor.
Looking for structured certification?
Explore Innoryx courses or speak to a counsellor about the right program for you.