Walk into any pharma plant during a GMP inspection and you will see the same scene. An inspector opens a validation package. The risk assessment is there, beautifully formatted. Version-controlled cover page. Three neat chapters: risk identification, risk analysis, risk control. Every item scored for probability, severity, and detectability. RPN values calculated, sorted high to low. Control measures listed. A confident conclusion at the bottom: “All risks are acceptable after controls are applied.” On paper, it is a perfect document. Then the inspector asks one question: “The risk of audit trail being disabled — what RPN did you assign to that?” The answer: Probability 2, Severity 3, Detectability 2. RPN…