What to Do After a Biological Risk Assessment

After a biological risk assessment, the step before approving work is to write down the evidence needed for each critical control. In June 2014, CDC transferred anthrax-derived material to lower-containment laboratories before confirming that it was inactive, creating a potential exposure incident. The practical question is whether the evidence supports the particular work about to begin.

A biological risk assessment evaluates potential harm from biological agents and the work involving them, to support decisions about protective controls.

A biological assessment connects hazards to the work

A useful assessment describes an activity closely enough for someone to choose appropriate safeguards. The organism matters. So does what a person will do with it. Reading a specimen label and handling material during a procedure present different questions. The assessment should connect the proposed work to possible exposure and the controls intended to prevent it.

The CDC and NIH biosafety manual makes protocol-driven assessment its core principle. Its guidance considers agent hazards alongside procedure hazards. It also calls for review of the assessment and selected safeguards with appropriate biosafety expertise before controls are implemented.

The output gives the person responsible for the work a basis for action. It can identify a containment requirement, a change to the procedure or a control that needs attention. That is useful work. An assessment that names the actual activity is more informative than a list of biological hazards detached from what staff will do.

After that assessment, the usual task is to put the selected controls into effect. CDC's biological risk assessment guidance includes implementing mitigation and evaluating control effectiveness. Evaluation belongs in the process itself. A completed form does not end the inquiry.

The wider risk assessment question is how the findings help someone decide. In biological work, the immediate decision may be permission to start a procedure or move material. Identify that decision before turning the findings into an action list. Different permissions can require different supporting evidence.

Keep the assessed protocol version with the approval record. That gives reviewers a concrete reference when the work changes. The risk assessment process needs a connection between the activity described and the activity authorized. Otherwise, people can complete every action while working from different versions of the procedure.

What evidence justifies starting the assessed work?

A control can be proposed, installed or demonstrated to work. Those are different states. If an assessment gives a lower residual rating because a control is effective, find the evidence supporting that statement. An intended improvement should not carry the same weight as a completed, checked improvement.

WHO's risk assessment guidance asks whether selected controls are effective and sustainable when evaluating the remaining risk. Its template also asks whether work should proceed and who approves it. That makes the authorization decision explicit rather than leaving it inside a rating.

The remaining question is how much evidence that authorization needs. Sufficient certainty means enough confidence to make this decision, given its consequences and the available options. It does not mean feeling comfortable with a completed assessment. The person approving work must be able to explain what supports the permission being given.

Start with the controls whose failure would change the decision. For each one, state what must be true and what evidence would support it. Use the institution's applicable requirements and qualified review to set that evidence requirement. A manager's preference for a quick start cannot substitute for a required technical demonstration.

The question of having enough information to decide becomes clearer when tied to one permission. More reading may add little if the missing fact is whether the specified control has passed its required check. Seek evidence for that fact rather than requesting another general review of biological hazards.

Also ask who can use the evidence. A result held by the person who performed a check may not reach the person authorizing work. Record where the evidence sits and who must review it before approval. This is a practical handoff, not a request for a longer report.

When the evidence is incomplete, identify the options that remain available. The decision may be to delay the affected activity, change its scope or obtain the missing verification. Refer those options to the responsible specialist. The answer should specify what is permitted now and which evidence is needed before that permission expands.

This is the checkpoint after evaluating risk: decide whether the basis for action is strong enough. A rating helps describe the assessment. The approval must describe the work that the evidence actually supports.

Which critical control still needs evidence before the assessed biological work can start? Start the Walk →

CDC transferred material before confirming inactivation

The June 2014 event shows why an evidence requirement must match the material and the activity. CDC was evaluating a method for rapid bacterial identification. Anthrax-derived extracts were prepared in a biosafety level 3 laboratory and then moved to laboratories operating at biosafety level 2.

The CDC investigation report says staff observed no growth on sterility plates after 24 hours. On June 13, growth was found on a plate containing an unfiltered anthrax extract. The transferred material had received longer chemical treatment than the material plated for the check; the report did not equate those samples.

Investigators identified the lack of an approved written study plan as the overriding contributing factor. They also found that material had been transferred without confirmation of inactivation. The report says a validated method should have been used to confirm sterility. It explicitly warns that waiting 48 hours instead of 24 might not have prevented the incident.

CDC's July 11 statement reported that no potentially exposed staff member had become ill with anthrax. It described exposure to viable bacteria as extremely unlikely. CDC nevertheless restricted transfers from its highest-containment laboratories while improvements were put in place.

This was a laboratory incident, not a documented sequence in which a completed biological risk assessment led to approval. The lesson drawn here concerns the decision to release material. Evidence of a check is only useful if that check establishes what the release decision requires.

For the reader, the useful question is not whether another institution's assessment resembles CDC's paperwork. It is whether the approval record names the decisive evidence. Ask what would stop the handoff if a required result were missing. Then check that the person receiving the material can see that result before accepting it.

That keeps assumptions in decision making connected to a real permission. A general statement that a procedure is safe is difficult to challenge. A statement identifying the required verification, its scope and its reviewer gives the team something specific to examine.

Write the evidence required before work starts

Take the assessment to the next authorization meeting. Select one activity that is waiting for approval. Write a short decision note stating the work to be permitted and the relevant protocol version. Use the existing institutional approval process; attach the note to the assessment rather than creating another parallel register.

For each critical control, name the evidence the approver needs. Point to its location and state whether it has been reviewed. If a required record is missing, record that gap plainly. Do not mark the control complete because someone has arranged a future inspection or expects a satisfactory result.

Ask the responsible biosafety professional to check whether the evidence covers the proposed activity. The same record may not support a different procedure. Record any limits on the permission, including work that remains outside its scope. This prevents an approval for a narrow activity from becoming assumed permission for something broader.

Then state the decision: approve the defined activity, revise it or defer it until the specified evidence is available. Give the remaining action to a named role and set the next review point. A decision record should let someone see both the permission and the grounds for it.

The Universal Decision-Making Method places sufficient certainty in the decision itself. Here, that means deciding whether the evidence is adequate for the particular biological work being authorized. It also means setting a reason to return to the decision when the basis for approval changes.

Record which changes require fresh review before the affected activity continues. A changed procedure or an unexpected control result should have a clear route back to the approver. The assessment can then support an active decision whose limits are understood, rather than a document that remains signed while the work around it changes.

---

Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.