Risk Assessments and Self-audits should cover the whole of your GDP activities during the year. It is best to plan and ensure that you also conduct at least a couple of process audits.
Prior to conducting risk assessments, you should look for evidence and discuss with key people your assumptions, if it is a large risk assessment you might wish to have a workshop and capture everyone’s ideas, the likely hood of the risks and the consequences. Try not to get bogged down in discussions about what level the risk is to start with and focus more on capturing as many risks as possible. Often in an open workshop there may be varied opinions on what the risk level may take up too much time.
You may wish to carry out an audit to test some of the assumptions you have made and then you may wish to review the risk assessments. You may also decide to set a re-audit date and adjust your self -audit plan.