IQCP Risk Assessment: Five Components and How to Document Them
An IQCP risk assessment identifies and evaluates potential failures across the preanalytic, analytic and postanalytic phases, covering at minimum five components: specimen, test system, reagent, environment and testing personnel. It must use your lab's own data and show how each risk is detected or reduced.
The risk assessment is the evidence behind every QC decision in an IQCP. If it's thin, the QC plan has nothing to stand on.
Last reviewed Oct 2026 · By Sound Lab Consultants CLIA team · General information, not legal advice.
The five required components
The Developing an IQCP - A Step-By-Step Guide (CDC/CMS workbook) lists five components a risk assessment must cover at minimum. Here's how we break them down: - Specimen: patient identification, collection, container, labeling, transport time and temperature, stability, rejection criteria, interferences. CMS says the risk assessment should consider both general risks and risks specific to the specimen types you receive. - Test system: instrument function, calibration, internal controls, software, sample handling, known limitations. - Reagent: storage, shipping, lot changes, expiration, preparation, and handling of QC and calibration material. - Environment: CMS defines environmental conditions as conditions that may affect test system performance, including temperature, airflow, light intensity, humidity and altitude. - Testing personnel: training, competency, staffing, multiple operators, turnover.
How to evaluate each risk
CMS doesn't require a formal risk matrix (CMS IQCP Frequently Asked Questions (Aug 2016)), but you need to show how you judged how often a failure might happen and how much harm it could do. For each risk, record the control that prevents or detects it, and point to the record that proves it works.
Data that belongs in the assessment
CMS says much of the data already exists from routine operation: verification studies, QC records, corrective actions. There must be documented data showing test system stability that supports the QC type and frequency. Add PT results, maintenance logs, complaints and the manufacturer's instructions. The CAP says manufacturer risk information can supplement your assessment but can't be used alone (the CAP's public IQCP FAQ (updated Nov 2024)).
Multi-analyte systems and multiple devices
For one test system that runs many analytes, CMS says one risk assessment can cover the platform-wide risks plus any analyte-specific ones. Different makes or models need separate IQCPs. Identical devices in several locations can share one risk assessment if it covers each location's risks. See IQCP for new tests and multiple sites.
Where risk assessments commonly fall short
Westgard's outside review of a point-of-care IQCP reported that a sample POC IQCP built largely from manufacturer guidance didn't adequately address environment and personnel risks or multiple identical devices, and lacked historical lab data. The reviewers also found a manufacturer minimum requirement missing from its QC plan. Typical gaps worth checking in your own assessment: - Preanalytic risks such as the wrong patient entering the process or contamination during collection - Device handling, such as dropped devices or under- or over-filled cartridges - How staff recognize interferences and inconsistent results - QC and calibration material storage and handling
More in common IQCP mistakes.
IQCP Risk Assessment checklist
☐ List every potential failure by component and phase
☐ Include specimen-type-specific risks
☐ Record the environmental factors that can affect the system
☐ Record personnel risks: training, competency, staffing
☐ Cite manufacturer limitations and required QC
☐ Link each mitigation to evidence (QC, PT, maintenance, competency)
☐ Explain how frequency and impact were evaluated
☐ Cover each location and each device if more than one
☐ Laboratory director reviews before approving the QC plan
CDC resources on CLIA
CDC's overview of the CLIA program: CDC explains that CLIA applies to every U.S. site that tests human specimens to assess health or to diagnose, prevent, or treat disease. It also explains that CDC supports the program alongside CMS and FDA.
CDC on CLIA test complexity categories: CDC explains how FDA scores tests as moderate or high complexity using seven criteria. It also notes that lab-developed or modified tests default to high complexity, and that moderate and high complexity standards differ only in personnel requirements.
CDC's free CLIA educational materials: CDC offers brochures and booklets on waived testing, PPM, and IQCP.
Frequently asked questions
What are the five components of an IQCP risk assessment?
Specimen, test system, reagent, environment and testing personnel, evaluated across the preanalytic, analytic and postanalytic phases.
Is a risk matrix required for IQCP?
No. CMS doesn't require a risk acceptability matrix, but the lab must show how it evaluated the frequency and impact of errors.
Do I need new studies for the risk assessment?
Not necessarily. CMS says much of the data comes from routine operation, such as verification studies, QC records and corrective actions.
Can one risk assessment cover a multi-analyte analyzer?
Yes. CMS says one risk assessment can include platform-wide risks plus analyte-specific risks.
Can I rely on the manufacturer's risk assessment?
Only as a supplement. The CAP says the lab must still evaluate all five components itself.
Who decides if a risk is acceptable?
The laboratory director, according to the CAP's IQCP FAQ.
Official sources and further reading
Developing an IQCP - A Step-By-Step Guide (CDC/CMS workbook)
ASM's IQCP protocol templates for microbiology and molecular testing
Related IQCP guides
Talk to an IQCP consultant
Sound Lab Consultants helps labs nationwide build, review and maintain IQCPs from their own data and the official CMS and CDC guidance.
Sound Lab Consultants, PO Box 2135, Chandler, AZ 85244