Blast from the Past: Quality Control Based on Risk Management – A Concept Whose Time Has Arrived


By: Marcy Anderson


When the Centers for Medicare & Medicaid Services (CMS) Clinical Laboratory Improvement Amendments (CLIA) of 1988 was enacted into law, the current sophistication of laboratory equipment, methods, locations and environments where clinical laboratory testing is performed could never have been imagined. Clearly, a new approach to conducting the numerous routine quality control (QC) practices in 2014 should be different than those required in 1988. What has not changed is clinical laboratories’ desire to produce the highest quality results using the appropriate amount of QC, based on the risk of error. In its simplest form, risk management is not a new concept for laboratorians and is now being applied to QC. The Clinical and Laboratory Standards Institute (CLSI) created EP23-A™ — Laboratory Quality Control Based on Risk Management; Approved Guideline because stakeholders from government, industry and the healthcare professions strongly desired more current guidance to help laboratories perform the right QC based on risk. Key sources a laboratory may use to gather this information are from regulatory requirements, accrediting organizations, manufacturers, the laboratory environment and medical requirements to assess the risk for each step of the testing process. From this risk assessment, a QC plan can be created. The effectiveness of the laboratory QC plan must be monitored to detect trends, identify corrective actions and provide continuous quality improvement. The CMS CLIA program has adopted key concepts from EP23 to create their new QC option called individualized quality control plan (IQCP). 


The Clinical and Laboratory Standards Institute (CLSI) has been educating and training on EP23-A — Quality Control Based on Risk Management; Approved Guideline to help laboratories create and maintain a sound quality control (QC) plan by using well-established risk management principles. The need for this guideline grew out of concern from laboratories and industry implementing the Clinical Laboratory Improvement Amendments’ (CLIA) equivalent quality control (EQC) concepts. These concepts, also called options 1, 2 and 3, were rigid, focused solely on the analytical phase of testing, and limited in scope. The Centers for Medicare & Medicaid Services (CMS) was tasked with creating QC concepts that were flexible, focused on all stages of testing and broader in scope.

The CLSI guideline EP23 was created with the leadership of Chairholder James H. Nichols, PhD, DABCC, FACB, and through the consensus from individuals representing CMS, the U.S. Food and Drug Administration, the Centers for Disease Control and Prevention, industry and healthcare professions. It enables laboratories to perform “The Right QC” based on risk and guides laboratorians through the process of gathering the right information needed, performing a risk assessment, creating a quality control plan (QCP) and reviewing the plan for effectiveness.

Major concepts from the EP23 guideline have been adopted by the CMS CLIA program and placed into a new QC option based on risk management. This new option, called individualized quality control plan (IQCP), provides the ability to customize QC policies and procedures based on the test system used. Laboratories can either follow the existing CLIA QC regulations or use IQCP for each test system. This optional testing has a two-year phase-in education and transition period starting on Jan. 1, 2014, and ending on Jan. 1, 2016. After that time period, laboratories will no longer be able to use the current EQC as an acceptable CLIA QC compliance option. Risk management tools were first introduced in CLSI document EP18-A2 — Risk Management Techniques to Identify and Control Laboratory Error Sources; Approved Guideline, Second Edition, which significantly impacted manufacturers and clinical laboratory management by exposing the fact that conventional quality assurance and QC methods in and of themselves do not assure quality.

In applying the constructs of risk management, EP23 guides the user through each step of the testing process, following the logical path of workflow steps of pre-examination (pre-analytical), examination (analytical), and post-examination (post-analytical). EP23 describes the specific tools that may be used such as “process maps,” “fishbone diagrams,” “risk assessment charts” and, finally, the creation of the IQCP. Each step of the testing process is analyzed with the intent of identifying errors that may likely occur, deciding the potential impact of the error, and determining preventive measures. EP23 categorizes the testing processes into five main areas where errors can occur: samples, operator, reagents, laboratory environment and measuring system. These questions may be asked when looking at potential failures or risks that can occur:

• Is there already a control process in place to prevent this error? The control processes could be an internal control, external control, engineering control, operator training or another laboratoryimplemented monitor.

• If there is not a control process in place, what needs to be done? Additional monitoring? More comprehensive training or additional training? The control process needs to mitigate the risk of this error occurring. Consider information from as many sources as possible:

• Study the manufacturer’s package insert for information regarding procedures, interfering substances and other possible areas of concern.

• Consult the literature to see if others are reporting problems.

• Review your regulatory and accreditation requirements.

• Obtain information about your healthcare and testsite setting.

• Check with the physicians using the test results to understand how they are using the results and what kind of test performance they are relying on. Ultimately, risk assessment is about applying critical thinking to a particular situation. A point-of-care PT/INR (prothrombin time/international normalized ratio) example is provided in CLSI’s EP23 worksheet and its implementation guide workbook. These companion products showcase the steps taken to perform a risk assessment and create an IQCP. For any example, the testing device likely has specific requirements for applying the sample. The device’s package insert may state: “After sticking the finger with the lancet, wipe away the first drop of blood, and apply the second drop of blood to the test cartridge, within 30 seconds of the fingerstick.” The language is very specific regarding how to handle the sample. In thinking about risk assessment, one may ask:

• Is everyone following this procedure?

• Could someone be performing this step incorrectly?

• Can errors (wrong results) be occurring because someone is not obtaining the second drop of blood?

• What does a wrong result mean in this situation?



A wrong result may mean that a patient could be given the wrong dosage of anticoagulant drug. A wrong dosage of the drug could lead to a bleeding episode, or clotting — either of which might harm the patient. How can the laboratory ensure that everyone is handling the sample correctly? Perhaps more training may be needed with competency testing at six-month intervals. The training and competency testing are necessary to ensure that the samples are being handled properly, and that errors are not occurring at this step of the testing process. This would complete this risk assessment example. The next step would be to document the training and competency testing as part of the IQCP. With that, the building of an IQCP has begun. Proceed in this way through each step of the testing process, all the way through reporting of the test results.

Once each step of the testing process has been analyzed and includes the actions that ensure quality, the IQCP has been built for that test. Now that the QC actions have been determined to ensure the quality of the test, it becomes evident that “quality control” is a lot more than running two levels of liquids on each day of use. Instead, QC encompasses all of the actions performed to ensure that the right test result is delivered to the physician, every time.

The next major step is to routinely monitor the IQCP and any errors occurring for the test. If errors are still occurring, determine why and at which step in the process the error is occurring. Once an error is understood, additional monitoring actions can be put into place to control the error. The IQCP should be a living document. It should be reviewed regularly and updated as necessary to ensure the QC is effective for the test.

In summary, risk management is something that laboratories are already doing. CLSI’s EP23 formalizes this activity and provides insight on how to approach risk management in the most effective way. An IQCP is necessary to ensure the best quality result and can be different for each test system. Finally, once you have implemented your IQCP, monitor it for effectiveness and modify as needed to maintain risk at a clinically acceptable level. 



1. CLSI. Laboratory Quality Control Based on Risk Management; Approved Guideline. CLSI document EP23-A™. Wayne, PA: Clinical and Laboratory Standards Institute; 2011.

2. CLSI. Risk Management Techniques to Identify and Control Laboratory Error Sources; Approved Guideline—Second Edition. CLSI document EP18-A2. Wayne, PA: Clinical and Laboratory Standards Institute; 2009.

3. Centers for Medicare & Medicaid Services. Individualized quality control plan (IQCP). Plan_IQCP.html. Accessed November 20, 2013.

Recent Stories
Meet the Winners: Lona Small, KnowledgeLab 2020 3rd Place ICE Poster Winner

Top News Stories for the Week of June 29

Meet the Winners: Amanda Roth, 2nd Place KnowledgeLab Poster Track Winner