Local Risk Assessment

Table of Contents

• Preface
• Abbreviations and Acronyms
• Chapter 1 - Introduction
  • 1.1 Scope
  • 1.2 How to Use the Local Risk Assessment Guideline
• Chapter 2 - Risk Assessments
  • 2.1 Pathogen Risk Assessment
  • 2.2 Biosecurity Risk Assessment
  • 2.3 Overarching Risk Assessment
  • 2.4 Step-by-Step Approach to Conducting any Risk Assessment
  • 2.5 Acceptable Risk
• Chapter 3 - Local Risk Assessment
  • 3.1 Conducting a Local Risk Assessment
• Chapter 4 - Additional Considerations
  • 4.1 Roles and Responsibilities
  • 4.2 Risk Assessment Team
• Chapter 5 - Glossary
• Chapter 6 - References and Resources

Preface

In Canada, facilities where Risk Group 2, 3, and 4 human pathogens or toxins are handled and stored are regulated by the Public Health Agency of Canada (PHAC) under the Human Pathogens and Toxins Act (HPTA) and the Human Pathogens and Toxins Regulations (HPTR). The importation of animal pathogens, infected animals, animal products or by-products (e.g., tissue, serum), or other substances that may carry an animal pathogen or toxin or parts thereof are regulated by the PHAC or the Canadian Food Inspection Agency (CFIA) under the Health of Animals Act (HAA) and Health of Animals Regulations (HAR).

The following figure depicts the document hierarchy used by the PHAC to oversee biosafety and biosecurity operations. Each tier of the pyramid corresponds to a document type, with documents increasing in order of precedence moving upwards. Acts and regulations are the documents that convey the PHAC's legal authorities, and, therefore, are found at the top of the pyramid. Guidance material and technical pieces are found at the bottom of the pyramid, as they are intended to summarize recommendations and scientific information only.

Text Equivalent

Figure in the form of a pyramid depicting the document hierarchy used by the PHAC to oversee biosafety and biosecurity operations. Each of the five tiers of the pyramid corresponds to a document type, with documents increasing in order of precedence moving upwards.

At the top sits the Enabling Legislation, that is, the HPTA, HPTR, HAA, and HAR, that convey the PHAC’s legal authorities. Below the acts and regulations sit Instrument in Support of Legislation, which are the Pathogen Risk Assessments. The next tier down are the Biosafety Requirements, which include the Canadian Biosafety Standard, Biosafety Directives, and Biosafety Advisories. The second lowest tier are the Policy Documents, the Compliance and Enforcement Policy. Guidance material and technical pieces found at the bottom of the pyramid, under the Risk Communication Tools and Technical Documents heading are intended to summarize recommendations and scientific information only. These include the Canadian Biosafety Handbook, Canadian Biosafety Guidelines, and Pathogen Safety Data Sheets.

Local Risk Assessment was developed by the PHAC and the CFIA as part of a series of electronic publications that expand upon the biosafety and biosecurity concepts discussed in the current edition of the Canadian Biosafety Handbook (CBH), the companion document to the Canadian Biosafety Standard (CBS). It describes best practices for conducting a local risk assessment in an organization where human or animal pathogens, toxins, or other regulated infectious material are handled or stored. This guideline is intended to assist regulated parties in meeting the requirements specified in the CBS, but should not be interpreted as requirements. Regulated parties may choose alternate approaches to meet the requirements specified in the CBS.

This guideline is continuously evolving and subject to ongoing improvement. The PHAC and the CFIA welcome comments, clarifications, and suggestions for incorporation into future versions. Please send this information (with references, where applicable) to PHAC-pathogens.

Abbreviations and Acronyms

BSC

Biological safety cabinet

BSO

Biological safety officer

CBH

Canadian Biosafety Handbook

CBS

Canadian Biosafety Standard

CFIA

Canadian Food Inspection Agency

CL

Containment Level (i.e., CL1, CL2, CL3, CL4)

ERP

Emergency response plan

IBC

Institutional biosafety committee

LRA

Local risk assessment

PHAC

Public Health Agency of Canada

PPE

Personal protective equipment

RG

Risk Group (i.e., RG1, RG2, RG3, RG4)

SOP

Standard operating procedure

Chapter 1 - Introduction

The words in bold type are defined in the glossary found in Chapter 5.

The necessary procedures to manage biosafety and biosecurity are based on an assessment of the risks associated with potential hazards (e.g., pathogens, toxins, equipment, animals, and procedures) at each facility. Risk is a function of the probability of an undesirable event occurring and the consequences of that event should it occur. The risks associated with the handling and storing of pathogens and toxins can be minimized through the application of appropriate biosafety and biosecurity mitigation measures identified through the risk assessment process. These mitigation measures can range from the containment requirements for handling a particular pathogen to elements of the biosafety program, such as the training program and the medical surveillance program.

1.1 Scope

The Local Risk Assessment guideline describes best practices for conducting a local risk assessment (LRA) in an organization where human or animal pathogens, toxins, or other regulated infectious material are handled or stored. Information on pathogen risk assessment, biosecurity risk assessment, and overarching risk assessment has been included to illustrate that the principles and mechanisms used for conducting risk assessments are the same regardless of the type of risk assessment being conducted. Nevertheless, the risks associated with the pathogen (e.g., pathogenicity, route of infection) are always considered when determining biosafety and biosecurity risks. More information on risk assessment can be found in Chapters 4, 5, and 6 of the Canadian Biosafety Handbook (CBH); requirements related to risk assessments can be found in Matrix 4.1 of the Canadian Biosafety Standard (CBS).^{Footnote 3},^{Footnote 4}

1.2 How to Use the Local Risk Assessment Guideline

A detailed list of all abbreviations and acronyms used throughout this guideline is located at the beginning of this document. Each abbreviation or acronym is spelled out upon first use in the guideline, with the abbreviation immediately following in brackets. After its initial definition, the abbreviation is used exclusively throughout the remainder of the document. A comprehensive glossary of definitions for technical terms is located in Chapter 5 of this document. Terms defined in the glossary appear in bold type upon first use in the guideline. A list of references and other resources is provided in Chapter 6.

Chapter 2 - Risk Assessments

Biosafety and biosecurity risk assessments aim to identify potential hazards (e.g., pathogens, toxins, equipment, animals, and procedures) and to determine the associated risk with the goal of mitigating the identified risks. They also serve to determine whether existing mitigation measures are commensurate with the risk and can be used to determine how the requirements of the CBS are applied. The risk assessment process will determine the acceptable risk.

Risk assessments are an integral part of a biosafety program and are based on a combination of science, policy, and expert judgment. They are conducted for several reasons, including to:

• create awareness of biological hazards and risk;
• identify who may be at risk;
• prioritize risks and control methods;
• assess applicable CBS physical containment requirements and operational practice requirements;
• determine the overall risk management plan that an organization should develop;
• determine if existing mitigation measures are adequate or if additional measures are needed; and,
• determine training needs.

Various types of risk assessments are used to evaluate the risks associated with the handling and storing of infectious material and toxins, including the risks related to the pathogen, to the specific work activities or tasks, to biosecurity, and to the scientific program as a whole. The key concepts and approaches to risk assessment and risk management can be universally applied to each type of risk assessment. The relationship between the different risk assessments and mitigation strategies is presented in Figure 2-1.

Text Equivalent

Figure showing that biosecurity risk assessments, pathogen risk assessments, and local risk assessments (LRA) all contribute to the overarching risk assessment process. Medical surveillance, training programs, emergency response plans (ERP), and standard operating procedures (SOPs) for safe work practices are not discussed within this guideline, but they are included in the figure since their development is based on the overarching risk assessment.

Biosecurity risk assessments, pathogen risk assessments, and LRAs all contribute to the overarching risk assessment process. Although medical surveillance, training programs, emergency response plans (ERP), and standard operating procedures (SOPs) for safe work practices are not discussed within this guideline, their development is based on the overarching risk assessment.

2.1 Pathogen Risk Assessment

A pathogen risk assessment characterizes the risks associated with a pathogen based on the inherent characteristics of the pathogen that contribute to the risk it poses to humans and animals. It is used to determine how likely a pathogen is to cause negative health effects and the severity of those health effects. The pathogen risk assessment process will determine the pathogen's risk group and the appropriate containment level needed for the safe and secure handling of the pathogen. Examples of human pathogens belonging to Risk Group 2 (RG2), RG3, and RG4, as well as prohibited human pathogens, are provided in Schedules 2, 3, 4, and 5 of the Human Pathogens and Toxins Act (HPTA), respectively.^{Footnote 9}

For biological agents that have not been classified by the PHAC or the CFIA, regulated parties may conduct their own pathogen risk assessment to determine the human or animal risk group. The Pathogen Risk Assessment Template is available online, and once completed, may be submitted to the PHAC for validation. More information on pathogen risk assessment and risk groups can be found in Chapter 4 of the CBH.

2.2 Biosecurity Risk Assessment

A biosecurity risk assessment is used to identify, prioritize, and mitigate the biosecurity risks associated with biological and other related assets in a facility. It is an evaluation of the probability of the loss of a biological asset (e.g., pathogen, toxin, infectious material, equipment, animals, information) or of an intentional event, such as the theft, misuse, diversion, or unauthorized release of biological and related assets (e.g., personnel, equipment, non-infectious material, and animals), and the consequences of that event (e.g., community health impact resulting from unauthorized release of a pathogen, theft of proprietary information). The biosecurity risk assessment differs from biosafety risk assessments (i.e., overarching, pathogen and toxin, and LRAs), in that the individuals or groups that may have malicious interest in the asset (i.e., threats) also need to be considered.

In addition, a biosecurity risk assessment needs to consider the increased security requirements of assets with dual-use potential (i.e., assets that can be used for legitimate scientific applications, but also pose an increased biosecurity risk due to an inherent potential for development and use as a biological weapon). Assets with dual-use potential not only include security sensitive biological agents (SSBAs), but can also include assets related to their handling and storing (e.g., equipment, information). Information on SSBAs and the steps to conduct a biosecurity risk assessment are described in Chapter 6 of the CBH.

2.3 Overarching Risk Assessment

An overarching risk assessment is a broad assessment of the program intent and planned activities, at the organization or facility level, that informs the development of the biosafety program as a whole. It may encompass multiple containment zones within an institution or organization. It is conducted to identify the hazards in the organization or facility and to determine appropriate mitigation management strategies (CBS Matrix 4.1).

The overarching risk assessment is a systematic review of the type of biological material that is or will be handled and stored (e.g., risk group[s] of pathogens and toxins, primary specimens, and purified pathogen), the locations and facilities where it will be handled and stored (e.g., laboratories, animal rooms, and storage areas), the personnel handling the material (e.g., students, junior technicians, investigators, microbiologists, and post-doctoral fellows), the type of work planned (e.g., laboratory scale, large scale production, small animal or large animal, scientific research, teaching, or diagnostic activities), and the various equipment and procedures that will be used.

An overarching risk assessment informs the development of biosafety program risk mitigation strategies, which will include having appropriate physical containment (e.g., for Containment Level 2 [CL2], CL3, CL4, prion, large animal containment zone, small animal containment zone, or large scale production area), as well as the appropriate operational practices (e.g., policies, personnel management, Biosafety Manual, medical surveillance program, emergency response plan [ERP], facility maintenance, and training program). It helps identify the key biosafety issues at the program level and provides an opportunity to assign resources (e.g., people, time, funding) where they are needed. The overarching risk assessment may be supported by LRAs, described in Chapter 3, which are more focused assessments to examine specific elements of the program.

While personnel are kept informed through the training program, a risk communication plan may be included in the mitigation strategies to inform the public about the risks associated with the facility and its operation, and more importantly, on how the mitigated risks are acceptable. An effective risk communication plan is proactive, begins early in the facility planning stages, continues after operation begins and may include engagement with the public that should be maintained throughout the lifetime of the facility. Trust, transparency, and availability of information that is not of a sensitive nature are all integral elements of a successful risk communication plan.

2.4 Step-by-Step Approach to Conducting any Risk Assessment

There is a systematic approach to conducting risk assessments, regardless of the type. Risk assessments follow the plan-do-check-act framework, a quality management system used for the control and continual improvement of processes and products, to continually improve the risk assessment and to evaluate any incidents that have occurred since the implementation of the risk mitigation strategies. Additionally, it is essential that the mitigation strategies implemented have not introduced new hazards. The following methodology applies to all types of risk assessments relating to biological material:

Step 1: Identify and Characterize Hazards - Recognize hazards that may exist when handling or storing of pathogens and toxins. Questions that may be asked include the following:

• What is the organization's program intent?
• What work with pathogens and toxins will be performed?
• Are there security aspects related to the work or the pathogens and toxins?

The potential for the infectious material or toxins to cause harm to personnel, the community, and the environment is taken into account.

Step 2: Identify and Assess Risk - Consider the likelihood of exposure, release, or loss of the infectious material or toxin for each hazard, and the consequences should such an event occur. For example:

• How likely will an incident lead to infection or intoxication of personnel or the community, or to a release into the environment?
• What would be the consequence resulting from an incident?

Determine the risk and if it needs to be mitigated. This is only a rough approximation into risk categories, which can range from "very low" to "very high". Facilities can decide on the scale that best suits their situation. Examples include a scale of three (e.g., low, moderate, high), five (e.g., very low, low, moderate, high, very high), and a numerical scale (e.g., 1 to 10, 1 to 100) where lower numbers indicate a lower risk.

The risk assessment matrix presented in Figure 2-2 can be used to determine the risk based on the likelihood of an event occurring, and the consequences of the event. As an example, the risk associated with pipetting a pathogen that is transmissible via the airborne route is shown below. The likelihood of generating aerosols would be considered moderate to high, depending on factors such as the device used and operator competence. The consequence (exposure and subsequent infection) may be low to very high, depending on the severity of disease resulting from infection. If a competent technician were pipetting a strain of seasonal influenza virus, the risk could be assessed as low (blue star). If the same person were pipetting a strain of highly pathogenic influenza virus, the risk could shift to high (green star).

Step 3: Develop and Implement Risk Mitigation Strategies - What mitigation strategies can be developed and implemented to reduce the risk to acceptable levels? A single measure may be sufficient or a combination of measures may be needed. This step can also evaluate the existing mitigation strategies to determine if they are sufficient to reduce the risk to an acceptable level and if they are not, to determine the new, mitigated risk. The mitigation measures that can be implemented may be dependent on the resources available. If a risk cannot be sufficiently mitigated, substitution (e.g., with a lower risk pathogen or procedure) or termination of work should be considered.

Text Equivalent

Risk assessment matrix with likelihood on y-axis and consequence on x-axis ranging from very low to very high. It demonstrates that for a given likelihood value (e.g., moderate-high), the consequence shifts from very low to high when a more highly pathogenic organism is used, which changes the risk from low to high.

Risk can be evaluated by plotting the likelihood of an event occurring and the impact of that event, should it occur.

Step 4: Review and Continually Improve - Regular review of the risk assessment can help identify deficiencies and determine whether the implementation of additional mitigation measures would help prevent an incident from occurring or recurring. Any deficiencies, changes, or areas identified for improvement should lead to an update of the risk assessment and mitigation measures, if required.

There is no specific time frame for the review and update of risk assessments since it is an evolving process, but they should be reviewed following any changes or incidents that may have occurred. Organizations may establish their own review timelines using a risk-based approach.^{Footnote 13}

Some examples of situations that may trigger the review or update of a risk assessment include, but are not limited to:

• occurrence of biosafety incidents (e.g., laboratory acquired infections/intoxications [LAIs], accidents, incidents, and near misses);
• addition of a new biological hazard;
• initiation of a new project;
• addition of a new containment zone;
• initiation of research involving a potential for pathogen gain of function or dual-use;
• use of new equipment;
• renovation or modification of a facility or equipment, or new construction;
• change in model, type, or manufacturer of personal protective equipment (PPE);
• modification of staffing arrangements (e.g., addition of contractors, visitors, volunteers, students);
• modification of standard operating procedures (SOPs) or work practices that may impact containment or risk of exposure (e.g., decontamination and waste management, PPE requirements and usage, entry/exit procedures);
• modification of the program intent;
• modification of work flow or volume (e.g., increase in the number of specimens to be processed); or
• identification of actual or potential non-conformity with internal or external requirements (e.g., audit, new legislation or standards, accidents or exposures).

2.5 Acceptable Risk

Acceptable risk is the risk that an organization is willing to tolerate, and is based on the premise that zero risk is an unachievable goal. The acceptable risk is the risk tolerance threshold, which is determined by senior management. This threshold can be defined early in the risk assessment process and adjusted throughout.

If the risk is deemed acceptable, the activities can proceed without additional mitigation measures. If the risk is deemed too high, risk mitigation strategies must be developed and implemented, or the work terminated.

Text Equivalent

Bar graph showing five risks of levels varying from very low to very high. With the risk tolerance threshold set to medium, the two risks above the threshold (rated high and very high) are flagged for additional mitigation. All others are considered acceptable.

In Figure 2-3, the risk tolerance threshold was set to "medium". The risks that are "high" and "very high" exceed the risk tolerance threshold and require the implementation of additional mitigating measures.

Table 2-1: Overview of the four types of risk assessments required for a biosafety program

Step	Overarching Risk Assessment	Pathogen Risk Assessment	Local Risk Assessment	Biosecurity Risk Assessment
1. Hazard Identification/ Characterization	Consider the biological material that will be handled or stored. Determine the type of activities that will be conducted at the facility (i.e., diagnostic, large animal, small animals, large scale, or laboratory scale). Identify and characterize any hazards associated with the biosafety program as a whole.	Identify the pathogen or toxin. This may include historical information, physical characteristics, genome structure, taxonomy, and other identifying characteristics.	Consider the biological agent to be handled and its corresponding risk group. Identify and assess the activities performed (e.g., centrifugation, entry/exit from containment zone, moving pathogens between rooms). Break the activities down into steps to better identify and characterize activity-specific hazards.	Consider the biological and related assets that are handled and stored within the facility. Identify potential for misuse of assets (e.g., SSBAs).
2. Identify and Assess Risk	Identify who may be harmed/what may be damaged and how (e.g., personnel, animals, environment, facility). Assess the severity of the consequences in the event of an exposure, release, or loss. Assess the risk across the biosafety program as a whole (i.e., at the facility or organization level). For example, the competence of personnel, available facilities, possible emergencies, and accident records.	Evaluate the ability of the pathogen or toxin to cause adverse health effects (e.g., infection, intoxication, outbreak, or epidemic) in humans and animals, the likelihood of such effects following an exposure to the pathogen or toxins, and the severity of the effects. Determine the appropriate risk group.	Determine the likelihood of exposure, release, or loss for each activity or step. Determine the consequences in the event of an exposure, release, or loss. Assess the risk associated with each activity. If the risk is acceptable, the activity can proceed. If the risk is deemed unacceptable, proceed to Step 3 in order to develop strategies to control and mitigate risk.	Determine the likelihood of a biosecurity event (e.g., unauthorized access to the asset or its unauthorized removal from the facility). Determine the consequences resulting from such an event. Assess the risk associated with each potential event. If the risk is acceptable, the activity can proceed. If the risk is deemed unacceptable, proceed to Step 3 in order to develop strategies to control and mitigate risk to an acceptable level.
3. Develop and Implement Risk Mitigation Strategies	Develop and implement a risk management plan, including engineering (e.g., containment facilities, biological safety cabinets [BSCs], decontamination technologies) and administrative controls (e.g., local oversight, Biosafety Manual and SOPs, training program, ERP) to mitigate risk. Complete and implement risk communication plan.	Determine the appropriate containment level and any additional biosafety requirements (e.g., PPE, use of BSC).	Determine the appropriate engineering controls (e.g., BSC), administrative controls (e.g., SOPs), and PPE needed to mitigate risks. Some controls (e.g., containment zones, BSCs) will already be available as determined by the overarching risk assessment. Where appropriate, the mitigation control(s) are incorporated into SOPs.	Develop the appropriate mitigation controls (e.g., locked doors or freezers, access control system, inventory). Where appropriate, the mitigation control(s) are incorporated into SOPs.
4. Review and Continual Improvement	Review risk assessment on a regular basis and following changes or incidents, and update as needed.	Review risk assessment on a regular basis and following changes or incidents, and update as needed.	Review risk assessment on a regular basis and following changes or incidents, and update as needed.	Review risk assessment on a regular basis and following changes or incidents, and update as needed.

Chapter 3 - Local Risk Assessment

While an overarching risk assessment is a broad assessment at the organization level, LRAs are site-specific risk assessments of activities involving pathogens and toxins. They are used to:

• identify and characterize hazards associated with the infectious material or toxins in use and the activities being performed;
• assess the risks for each hazard, determine the likelihood of incidents occurring that have the potential for exposure, release, or loss of pathogens and toxins, and the consequences of those incidents; and
• develop and implement mitigation measures.

LRAs determine which risk mitigation strategies need to be incorporated into the facility design and program procedures, based on planned activities, to safely handle and store infectious material and toxins. For example, the mitigation measures implemented for the safe handling of a pathogen at CL2 may be very different if the work involves only a few millilitres of a diagnostic sample compared to the production of 20 litres of culture containing the same pathogen. Furthermore, mitigation measures could vary significantly if the pathogen is being used in animal studies versus being manipulated in a laboratory.

LRAs determine whether the existing physical containment and operational practices are sufficient to mitigate the identified risks to acceptable levels, or if additional measures are needed, sometimes exceeding the minimum requirements specified in the CBS. In addition, since the CBS requirements are risk-based, the LRA is used to determine the way that many of the requirements are implemented. For example, the CBS requires that the appropriate dedicated PPE specific to each containment zone be donned in accordance with entry procedures; however, the PPE used and how and where it is donned and doffed is determined by an LRA.

Through an LRA, it is possible that a regulated facility identifies exemptions to specific CBS requirements. In such a case, the exemption(s) must be approved by the Public Health Agency of Canada (PHAC) and/or the Canadian Food Inspection Agency (CFIA), and the facility would have to demonstrate that the intent of the requirement in question has been met through an alternative mechanism.

Email PHAC or CFIA should you need more information.

3.1 Conducting a Local Risk Assessment

The following sections follow the general risk assessment steps described in Section 2.4, but have been adapted specifically for the LRA. In addition, a template has been included as an example, with additional fields completed following each step.

3.1.1 Step 1: Identify and characterize the hazards related to the infectious material or toxin used, and the activities performed

The activities performed and the activity-specific hazards are identified and characterized. It is important to break down the activities into steps, which can possibly reduce the amount of work needed for each LRA. If a step is ever modified, only that step needs to be reassessed, not the entire procedure. For example, an activity could be "storing a stock culture of a pathogen". The steps involved in this activity might include pipetting, centrifugation, disposal of liquid waste, and movement of infectious material from the work area to a freezer. If a step is common to other activities or areas (e.g., centrifugation, pipetting), it may not need to be reassessed unless there is a modification to the step (e.g., use of a different type of centrifuge or pipetting device, or involving a pathogen with a different risk profile).

Consider the following:

• What is the quantity and concentration of infectious material or toxin handled or stored?
• What is the potential of aerosol generation by equipment or activities?
• What is the form or state of the infectious material or toxin (e.g., liquid, solid, powder)?
• Does the work involve animals?
• Are sharps or glassware used? Are sharps handled and disposed of properly?
• Who will be performing the activity? (e.g., experienced investigator, junior technician, or student).

While the pathogen's risk group and the containment level at which it must be handled or stored has been determined by the pathogen risk assessment, certain pathogen-specific characteristics may need to be taken into account in the LRA, such as:

• How the pathogen gains entry into hosts (i.e., ingestion, inhalation, inoculation, contact with skin or mucous membranes, or genitourinary);
• The host range; and
• The stability of the pathogen outside the host. That is, the environmental conditions in which it can survive and for how long.

Table 3-1: Example of STEP 1 of a Local Risk Assessment

Step 1: Hazard Identification	Step 2: Risk Identification and Assessment	Step 3: Develop and Implement Risk Mitigation	Step 4: Review Risk Assessment
Hazard
Cells infected with a virus are homogenized using a glass homogenizer.	N/A	N/A	N/A

3.1.2 Step 2: Assess Risk

Assess the potential risks associated with each activity-specific hazard. When assessing risk, consider the likelihood of exposure to or release or loss of the pathogen or toxin for each step and the severity of the consequences (e.g., infection, illness, outbreak) in the event of an exposure, release, or loss. Prioritize hazards that pose an unacceptable risk.

The LRA should consider all potential risks that could occur at each step or task in an activity. By assessing the potential risks of each task, the circumstances and the likelihood of an incident leading to exposure, release, or loss of infectious material or toxins will be identified.

Those performing the activity may also need to be taken into account. The likelihood of an incident occurring can depend on the individual performing the activity. For example, the likelihood of an incident occurring when a student is performing a laboratory activity for the first time is much higher than when an experienced technician is performing the same activity. More oversight and mitigation controls may be required for the student.

Table 3-2: Example of STEP 2 of a Local Risk Assessment

Step 1: Hazard Identification	Step 2: Risk Identification and Assessment			Step 3: Develop and Implement Risk Mitigation	Step 4: Review Risk Assessment
Hazard	Risk Scenarios	RiskFootnote a	Mitigation Required? (Y or N)
Cells infected with a virus are homogenized using a glass homogenizer.	Glass homogenizer breaks if too much force is used. The worker is cut and exposed to the virus through compromised skin, which may cause an infection.	Moderate to High	Y	N/A	N/A
Footnote a The risk can be determined using the assessment matrix provided in Figure 2-2. In the example, the likelihood of occurrence can vary from "low" to "high" based on operator experience, and other factors such as the condition of the homogenizer (e.g., new or old, brittle from frequent washing or exposure to alkali, cracked). Likewise, the consequence will vary from “low” to “high” depending on the communicability and severity of disease caused by the pathogen. The risk for an experienced operator using an undamaged homogenizer (“low” likelihood) with a highly virulent pathogen that is transmissible via contact with broken skin (“high” or “very high” consequence) would be “moderate” to “high” (i.e., the blue star in the figure). Return to footnote a referrer

Text Equivalent

Risk assessment matrix (from figure 2-2) is used to graphically represent that the risk for an experienced operator using an undamaged homogenizer (“low” likelihood) with a highly virulent pathogen that is transmissible via contact with broken skin (“high” or “very high” consequence) would be “moderate” to “high”.

3.1.3 Step 3: Develop and Implement Risk Mitigation Strategies

After the risks associated with each step or task have been assessed, mitigation strategies that address any unacceptable risk (i.e., over the risk tolerance threshold) can be implemented. It may be found that existing mitigation measures reduce the identified risks to acceptable levels and that no additional measures are needed. In the event that a risk is deemed acceptable or a decision is made not to implement risk mitigation strategies, a rationale for the decision should be clearly documented, including who was involved in the process and who approved the decision. If mitigation strategies cannot reduce the risk to acceptable levels, the activity may have to be modified or the work terminated.

It is best to implement controls to prevent the incident from occurring (i.e., at the source of the hazard) altogether. However, having a mechanism in place to contain infectious material or toxins or to prevent an exposure, release, or loss in the event of an incident (e.g., sealed secondary container, biological safety cabinet [BSC], PPE) will reduce the consequences of the incident, should it occur.^{Footnote 1} Various strategies exist to mitigate risk, including those described in the following sections.

3.1.3.1 Physical containment

Physical containment mitigates risks through specific physical barriers provided by engineering controls and facility design. The appropriate engineering controls should already be in place and are specified in Chapter 3 of the CBS. The use of certain controls (e.g., primary containment caging, BSCs) may be based on an LRA. Examples of engineering controls include but are not limited to:

• primary containment device (e.g., BSC);
• secondary containment (e.g., the containment barrier of the containment zone);
• ventilation (e.g., inward directional airflow, HEPA filtration of exhaust air); and
• decontamination technologies (e.g., autoclave, effluent decontamination system).

3.1.3.2 Substitution

Where feasible, substitution with a lower risk pathogen (e.g., attenuated strain vs. parental strain) or toxin, or lower risk equipment (e.g., plasticware vs. glassware), may reduce the dependence on engineering controls. In some cases, existing engineering controls may be sufficient if the pathogen, toxin, or equipment were substituted with a lower risk alternative.

3.1.3.3 Administrative controls

Administrative controls are operational practices and SOPs specific to the containment zone or procedure. Examples of such controls include but are not limited to:

• signage;
• SOPs;
• selection and use of PPE; and
• training.

In order to select the appropriate mitigation control measures, the advantages and disadvantages of each option should be compared. The favoured mitigation measure(s) should always be appropriate to the risk and incorporated into SOPs. Operational practice requirements for regulated facilities are specified in Chapter 4 of the CBS.

Table 3-3: Example of STEP 3 of a Local Risk Assessment

Step 1: Hazard Identification	Step 2: Risk Identification and Assessment			Step 3: Develop and Implement Risk Mitigation		Step 4: Review Risk Assessment
Hazard	Risk Scenarios	Risk	Mitigation Required? (Y or N)	Type(s) of Strategies	Description of Strategies
Cells infected with a virus are homogenized using a glass homogenizer.	Glass homogenizer breaks if too much force is used. The worker is cut and exposed to the virus through compromised skin, which may cause an infection.	Moderate to High	Y	Substitution	Use a non-breakable homogenizer made of plastic or stainless steel. Use a less pathogenic or non-pathogenic variant of the virus.	N/A
				Administrative Controls	Implement specific laboratory practices when homogenizing infected cells in a glass homogenizer (e.g., slow and gentle strokes, minimal and controlled force).
					Provide training to personnel performing the activity.
					Perform homogenization with uninfected cells first until the procedure is mastered.
				PPE	Use activity-specific PPE, such as puncture-resistant gloves.

3.1.4 Step 4: Review and Continually Improve the Risk Assessment

Any change within the facility or activity has the potential to increase the level of risk. Therefore, the LRA must be reviewed immediately after any incident, including near misses, or following any changes in procedures or equipment. The occurrence of an incident may be an indication that the LRA overlooked the likelihood of that incident occurring or possibly that the appropriate mitigation controls were not in place.

A review of LRAs serves to confirm or refute that the risk remains unchanged, that the implemented risk mitigation strategies are appropriate, and that no further controls are needed. Based on the outcome of the review, a new LRA may be needed, or the existing one updated.

Table 3-4: Example of STEP 4 of a Local Risk Assessment

Step 1: Hazard Identification	Step 2: Risk Identification and Assessment			Step 3: Develop and Implement Risk Mitigation		Step 4: Review Risk Assessment
Hazard	Risk Scenarios	Risk	Mitigation Required? (Y or N)	Type(s) of Strategies	Description of Strategies	Review Strategies
Cells infected with a virus are homogenized using a glass homogenizer.	Glass homogenizer breaks if too much force is used. The worker is cut and exposed to the virus through compromised skin, which may cause an infection.	Moderate to High	Y	Substitution	Use a non-breakable homogenizer made of plastic or stainless steel. Use a less pathogenic or non-pathogenic variant of the virus.	Determine if the protocol or equipment has changed. Determine if any incidents have occurred since implementation of the procedure. As appropriate, update LRA or initiate a new LRA. If no changes are needed, document the fact.
				Administrative Controls	Implement specific laboratory practices when homogenizing infected cells in a glass homogenizer (e.g., slow and gentle strokes, minimal and controlled force).
					Provide training to personnel performing the activity.
					Perform homogenization with uninfected cells first until the procedure is mastered.
				PPE	Use activity-specific PPE, such as puncture-resistant gloves.

Chapter 4 - Additional Considerations

4.1 Roles and Responsibilities

The roles and responsibilities of all individuals involved in conducting risk assessments should be clearly defined prior to the initiation of the risk assessment so they know what is expected of them. Roles can be delegated but senior management remains ultimately responsible for risk assessments and the implementation of appropriate mitigation strategies.

In order to appropriately address all of the elements related to developing a risk assessment, individuals with varying expertise and responsibilities (e.g., facility manager, principal investigator, senior microbiologist, biological safety officer [BSO], institutional biosafety committee [IBC] members, and laboratory worker) should be included in the risk assessment process.

The person or persons responsible for conducting the risk assessment should be identified early in the process so as to address any concerns, perceptions, roles, responsibilities, and accountabilities they may have. All parties and their potential contributions should be considered. Note that between organizations, roles and responsibilities will differ and there is no universal way to assign tasks nor is a risk assessment team always needed or available.

Senior management and a range of personnel could be involved in conducting an overarching risk assessment since it is a broad assessment that looks at the biosafety program as a whole. Conversely, it is usually only those more closely involved with laboratory activities, such as laboratory personnel, supervisors, scientists, and the BSO who will be involved with performing LRAs since the risks are best identified by the individuals most familiar with the equipment, and activities.

Senior management support and engagement with regards to risk assessment and mitigation will greatly support a culture of biosafety. If senior management demonstrates its dedication to biosafety, it sets the tone for the entire organization and motivates all personnel to follow the example.

4.2 Risk Assessment Team

A risk assessment team may include the BSO, IBC (if applicable), laboratory managers, laboratory personnel (or representative), and senior management. Tasks can be assigned according to the knowledge and experience of the persons on the team. Although the members involved in the risk assessment may evolve as it progresses towards risk mitigation, a core team should remain in place to sustain progress. In facilities regulated by the PHAC or the CFIA, the BSO must be involved with the risk assessment process, whether as part of the team or working independently since the BSO is required to assist in the development and maintenance of the Biosafety Manual and SOPs.

It is essential to assign tasks so that team members understand how or what they will contribute to the risk assessment. Any gaps in knowledge should be identified and training arranged to fill the gap, or personnel with suitable knowledge recruited from other areas of the organization.

Once the risk assessment team has been formed, discussion and agreement upon the process to be followed to conduct the risk assessment will immediately follow. The process should be tailored to the issue and its context while remaining transparent. Effective communication between persons will help to provide clarity in terms of the process followed, information used, and decisions made. The documentation process should be established as early as possible so that each step in the process is documented (i.e., the information gathered and decisions made at each stage).

Chapter 5 - Glossary

It is important to note that while some of the definitions provided in the glossary are universally accepted, many of them were developed specifically for the CBS and the CBH, and some have been modified to be applicable in the context of this guideline. A comprehensive list of terms and their definitions can be found in the glossary of the CBS and CBH.

Aerosol

A suspension of fine solid particles or liquid droplets in a gaseous medium (e.g., air) that can be created by any activity that imparts energy into a liquid/semi-liquid.

Animal pathogen

Any pathogen that causes disease in animals; including those derived from biotechnology. In the context of the Canadian Biosafety Standard, the Canadian Biosafety Handbook, and the Canadian Biosafety Guidelines, "animal pathogen" refers only to pathogens that cause disease in terrestrial animals; including those that infect avian and amphibian animals, but excluding those that cause disease in aquatic animals and invertebrates.

(Biological) assets

All of the pathogens, infectious material, and toxins in the possession of a facility. Other assets include materials, equipment, non-infectious material, animals, knowledge and information (e.g., protocols, research findings), and personnel in a facility.

Biological material

Pathogenic and non-pathogenic microorganisms, proteins, and nucleic acids, as well as any biological matter that may contain microorganisms, proteins, nucleic acids, or parts thereof. Examples include, but are not limited to, bacteria, viruses, fungi, prions, toxins, genetically modified organisms, nucleic acids, tissue samples, diagnostic specimens, live vaccines, and isolates of a pathogen (e.g., pure culture, suspension, purified spores).

Biological safety officer (BSO)

An individual designated for overseeing the facility's biosafety and biosecurity practices.

Biosafety

Containment principles, technologies, and practices that are implemented to prevent unintentional exposure to infectious material and toxins, or their accidental release.

Biosafety manual

A facility-specific manual that describes the core elements of a biosafety program (e.g., biosecurity plan, training, personal protective equipment).

Biosecurity

Security measures designed to prevent the loss, theft, misuse, diversion, or intentional release of pathogens, toxins, and other related assets (e.g., personnel, equipment, non-infectious material, and animals).

Biosecurity risk assessment

A risk assessment in which pathogens, toxins, infectious material, and other related assets (e.g., equipment, animals, information) in possession are identified and prioritized, the threats and risks associated with these materials are defined, and appropriate mitigation strategies are determined to protect these materials against potential theft, misuse, diversion, or intentional release.

Community

Encompasses both human (i.e., the public) and animal populations.

Containment

The combination of physical design parameters and operational practices that protect personnel, the immediate work environment, and the community from exposure to biological material. The term "biocontainment" is also used in this context.

Containment level (CL)

Minimum physical containment and operational practice requirements for handling infectious material or toxins safely in laboratory, large scale production, and animal work environments. There are four containment levels ranging from a basic laboratory (Containment Level 1 [CL1]) to the highest level of containment (Containment Level 4 [CL4]).

Containment Zone

A physical area that meets the requirements for a specified containment level. A containment zone can be a single room (e.g., Containment Level 2 [CL2] laboratory), a series of co-located rooms (e.g., several non-adjoining but lockable CL2 laboratory work areas), or it can be comprised of several adjoining rooms (e.g., Containment Level 3 [CL3] suite with dedicated laboratory areas and separate animal rooms, or animal cubicles). Dedicated support areas, including anterooms (with showers and "clean" and "dirty" change areas, where required), are considered to be part of the containment zone.

Decontamination

The process by which materials and surfaces are rendered safe to handle and reasonably free of microorganisms, toxins, or prions; this may be accomplished through disinfection, inactivation or sterilization.

Emergency response plan (ERP)

A document outlining the actions to be taken and the parties responsible in emergency situations such as a spill, exposure, release of infectious material or toxins, animal escape, personnel injury or illness, power failure, fire, explosion, or other emergency situations (e.g., flood, earthquake, hurricane).

Exposure

Contact with, or close proximity to, infectious material or toxins that may result in infection or intoxication, respectively. Routes of exposure include inhalation, ingestion, inoculation, and absorption.

Facility (plural: facilities)

Structures or buildings, or defined areas within structures or buildings, where infectious material or toxins are handled or stored. This could include individual research and diagnostic laboratories, large scale production areas, or animal housing zones. A facility could also be a suite or building containing more than one of these areas.

Handling or storing

"Handling or storing" pathogens, toxins, or infectious material includes possessing, handling, using, producing, storing, permitting access to, transferring, importing, exporting, releasing, disposing of, or abandoning such material. This includes all controlled activities involving human pathogens and toxins specified in Section 7(1) of the Human Pathogens and Toxins Act.

Hazard

Any source (thing or situation) with the potential for damage, harm, or adverse health effects.

Incident

An event or occurrence with the potential of causing injury, harm, infection, intoxication, disease, or damage. Incidents can involve infectious material, infected animals, or toxins, including a spill, exposure, release of infectious material or toxins, animal escape, personnel injury or illness, missing infectious material or toxins, unauthorized entry into the containment zone, power failure, fire, explosion, flood, or other crisis situations (e.g., earthquake, hurricane). Incidents include accidents and near misses.

Infectious material

Biological material that is pathogenic in nature (i.e., contains human and/or animal pathogens) and poses a risk to human and/or animal health.

Laboratory (plural: laboratories)

An area within a facility or the facility itself where biological material is handled or stored for scientific or medical purposes.

Large scale

Activities generally involving volumes of toxins or the in vitro culture of infectious material on a scale of 10 litres or greater. This could be a single vessel with a volume of 10 litres or greater, or based on the processes and pathogen used, could be multiple vessels with a total volume of 10 litres or greater. It is determined in consultation with the Public Health Agency of Canada and/or the Canadian Food Inspection Agency on a case-by-case basis, whether or not particular activities conducted in a containment zone are required to follow the increased or unique requirements for large scale production areas.

Local risk assessment (LRA)

Site-specific risk assessment used to identify hazards based on the infectious material or toxins in use and the activities being performed. This analysis provides risk mitigation and risk management strategies to be incorporated into the physical containment design and operational practices of the facility.

Medical surveillance program

A program designed to prevent and detect personnel illness related to exposure to infectious material or toxins. The focus of the program is primarily preventative, but provides a response mechanism through which a potential infection or intoxication can be identified and treated before serious injury or disease occurs.

Operational practice requirements

Administrative controls and procedures followed in a containment zone to protect personnel, the environment, and ultimately the community, from infectious material or toxins, as outlined in Chapter 4 of the Canadian Biosafety Standard.

Overarching risk assessment

A broad risk assessment that supports the biosafety program as a whole and may encompass multiple containment zones within an institution or organization. Mitigation and management strategies reflect the type of biosafety program needed to protect personnel from exposure and to prevent the release of pathogens and toxins.

Pathogen

A microorganism, nucleic acid, or protein capable of causing disease or infection in humans or animals. Examples of human pathogens are listed in Schedules 2 to 4 and in Part 2 of Schedule 5 of the Human Pathogens and Toxins Act, but these are not exhaustive lists. Examples of animal pathogens can be found on the Canadian Food Inspection Agency website.

Pathogen risk assessment

The determination of the risk group and appropriate physical containment and operational practice requirements needed to safely handle the infectious material or toxins in question.

Personal protective equipment (PPE)

Equipment and/or clothing worn by personnel to provide a barrier against infectious material or toxins, thereby minimizing the risk of exposure. PPE may include, but is not limited to, lab coats, gowns, full-body suits, gloves, protective footwear, safety glasses, safety goggles, masks, and respirators.

Prion

Small proteinaceous infectious particle generally considered to be responsible for causing a group of neurodegenerative diseases in humans and animals known as transmissible spongiform encephalopathies.

Release

The discharge of infectious material or toxins from a containment system.

Risk

The probability of an undesirable event (e.g., accident, incident, breach of containment) occurring and the consequences of that event.

Risk group (RG)

The classification of biological material based on its inherent characteristics, including pathogenicity, virulence, risk of spread, and availability of effective prophylactic or therapeutic treatments, that describes the risk of health of individuals and the public as well as the health of animals and the animal population.

Risk management plan

A plan that provides the foundation and organizational arrangements for designing, implementing, monitoring, reviewing, and continually improving risk management throughout the organization.

Senior management

The ultimate authority responsible for delegating appropriate biosafety authority. Senior management is responsible for ensuring that adequate resources are available to support the biosafety program, to meet legal requirements, and that biosafety concerns are appropriately prioritized and addressed.

Standard operating procedure (SOP)

A document that standardizes safe work practices and procedures for activities with infectious material and toxins in a containment zone, as determined by a local risk assessment.

(Microbial) Toxin

A poisonous substance that is produced or derived from a microorganism and can lead to adverse health effects in humans or animals. Regulated human toxins are listed in Schedule 1 and Part 1 of Schedule 5 in the Human Pathogens and Toxins Act.

Chapter 6 - References and Resources