White Papers

Return to listings page

November 1, 2009

White Paper: Expert Evaluation of Failure Mode and Effect Analysis An expert review and evaluation of RxFMEA®, our proprietary modification and extension of the basic FMEA methodology. The objective of RxFMEA® is the comprehensive management of risks in the pharmaceutical industry. RxFMEA® identifies specific weaknesses

An adaptation of failure modes and effects analysis for pharmaceutical risk management

Benjamin A. Berman --November 2003


This paper provides the results of my review of RxFMEA™, a proprietary business process of ParagonRx, LLC for which a patent application is pending. The scope of this review is the reasonableness and validity of RxFMEA™ in (1) applying the generic Failure Modes and Effects (FMEA) process, and (2) extending the generic FMEA process to compensate for some of the limitations of FMEA and address the special requirements of managing the risks in post-production (distribution and use) processes. As such, this review is limited to the risk management methodology of RxFMEA™, and it does not assess the technical evaluations based on medical and pharmaceutical industry knowledge and judgment that have been incorporated in RxFMEA™ or the specific application of RxFMEA™ to any pharmaceutical product.[1]


In performing this review, I examined a broad range of materials describing the RxFMEA™ process and its application to risk management of proprietary pharmaceutical products. I also interviewed personnel of ParagonRx, LLC about team composition, team meetings, failure modes/effects evaluations, and probabilistic hazard analyses in RxFMEA™. Further, I evaluated several RxFMEA™ work products from its initial application to a pharmaceutical product. I then evaluated RxFMEA™ with respect to the accepted definitions of FMEA and the advantages, limitations, and critical factors in FMEA applications.[2]

Summary of FMEA Methodology

FMEA is a systematic method of identifying risks and mitigating their consequences. It is based on identifying the discrete components or sub-processes in a system, attempting to comprehensively list all of the ways that each part of the system can fail (failure modes), then assessing the effects that each failure has on the safety or quality of the system (failure effects). Further, the consequences of each failure effect are evaluated as to their risk. This risk evaluation is represented in a hazard score that combines estimates of the severity of each failure effect with estimates of the probability that it will occur.

The FMEA process continues until every significant risk that has been identified in the analysis (that is, every failure effect that has a hazard score greater than a selected threshold level) has been controlled or mitigated to an acceptable risk level. The interventions needed to control the risks are specifically incorporated in FMEA documentation and an explicit accounting is made of the effectiveness of each intervention in reducing the hazard score.

FMEA is a widely accepted risk management methodology that has been in successful long-term use in several industries. With its identification of risks from the evaluation of the components of the overall system and the ways that each component can fail, FMEA is a “bottom-up” method that is capable of identifying failure effects before they have their adverse consequences. When advantageous, FMEA may be combined with a “top-down” evaluation that proceeds from the anticipated failures of the overall system and then attempts to identify the underlying causes of each system failure. Top-down analysis can be integrated within the FMEA method and documentation.

The FMEA methodology typically uses a multi-disciplinary team to most comprehensively identify the failure modes, effects, and consequences. It uses standard worksheet forms to document the team’s baseline assumptions, data, and logic. Specifically, the worksheets document each failure mode, the intermediate steps in the FMEA process (failure effects, initial hazard score, interventions, and post-intervention hazard reduction), and the final demonstration that the risk of each failure has been controlled to an acceptable level. Industry standards have been defined for FMEA, and I refer the reader to my companion paper for more information about these standards, the FMEA process, and its applications in health care and other industries.

Advantages of FMEA

FMEA is a structured process that promotes the disciplined elicitation of ideas about the kinds of failures that may occur, careful analysis of specific risk/hazard areas, proper documentation of sources and assumptions, and identification of interventions to mitigate the adverse consequences of failures. As such, it is an effective method for achieving the ultimate goal of managing risks to an acceptable level.

Further, by proceeding from the failure an individual component of a system to the effects on the entire system, FMEA helps organizations identify unforeseen, undesired outcomes. Its best applications are prospective, facilitating the control or mitigation of adverse outcomes before they occur.

Also, FMEA explicitly considers the detectability of failures and thus promotes consideration of failures that can remain latent; that is, failures that may lie dormant and undetected with no immediate effect, yet (if they remain undetected) result in adverse effects when combined with subsequent failures or events.

Limitations of FMEA

The basic approach of FMEA is to consider single failures and a typical FMEA application handles multiple (simultaneous/sequential) failures with difficulty if these failures are capable of interacting. I will evaluate this more as I discuss the independence of multiple interventions, below.

Further, as FMEA has typically been applied to managing risks in the design and manufacturing processes, human performance (such as monitoring and checking by practitioners and users in the field; for example, pilots and mechanics) is often relied upon to mitigate the adverse effects of hardware and software component or system failures. However, typically little consideration is given to imperfect human performance. This is often an unrealistic expectation, because human performance is highly variable across different persons and, for the same person, across different tasks and challenges.

Also, as FMEA typically has been applied in design/process applications, there is no inherent feedback to the FMEA process from the actual failure modes and outcomes experienced in field use. However, this feedback is not excluded by the FMEA process and the continuing refinement of an FMEA through feedback has been explicitly recognized as an important aspect of system safety analysis in some applications.

Critical Factors in FMEA Applications

While FMEA provides a comprehensive analysis, it is difficult to prospectively identify all possible failures and adverse outcomes from a complex component or functional element of a system. Because even the best FMEA effort may leave some failure modes and effects undiscovered, after completing an FMEA it is essential to avoid concluding that all risks have been compensated for or controlled. This suggests that FMEA analysts and users of the results should maintain an open and creative attitude about identifying new failure modes or reassessing their effects and consequences. The possibility of new or undiscovered failure modes also suggests that it is essential to obtain, analyze, and react to feedback from field use and operations. An FMEA should be viewed as a living document that will be revisited and revised on a continuing basis.

Further, the proper scope must be chosen for the FMEA to obtain the best results in identifying and controlling risks. Many FMEAs are limited to design issues and do not necessarily consider manufacturing variations or errors. Still others consider both design and manufacturing failures but exclude consideration of how products may fail and processes may be misused in the field, by practitioners, operators, or consumers. Even non-use of a product may have adverse effects from the loss of the product’s benefits to the user, which may only be partially recovered by the users turning to alternative products; these adverse effects will only be identified if the scope of analysis is restricted to use of the product. It is likely that failures generating critical risks will be missed if the scope of analysis is excessively narrow.

It is also critical to recognize that the interventions selected in an FMEA to mitigate an identified risk can also introduce their own failure modes and effects having critical risks. Interventions should be designed to “first, do no harm” that is, they should introduce no new uncorrected failure modes. This suggests that FMEA should be performed on each intervention, as well, to identify failures and provide the opportunity to control their inherent risks.

Also, an important part of interpreting the results of an FMEA is understanding how the probabilities of the adverse consequences of failures were evaluated in the analysis. Ideally the actual, historic failure rates of the individual components of a system will be available from existing field data. The probability that an entire function, process, or product will fail can then be estimated by combining the failure rates of the individual component sub-assemblies or sub-systems. Similarly, when considering interventions to control or mitigate an identified risk, the probability that the intervention will successfully address the risk needs to be calculated or estimated from the reliability of each part of the intervention. However, these data are only likely to be available when a product has been in long-term production and use. It is not uncommon for field data to be inadequate to provide actual failure rates for these analyses, and many FMEAs (especially those being performed prospectively to prevent failures before they can occur) use engineering judgments to estimate the probabilities that adverse consequences will ensue from failures and the reliability with which these risks will be mitigated by interventions. The sources of probability analysis will suggest the confidence that should be placed in the results of a prospective analysis, and when probabilities are estimated there will be a stronger need to obtain feedback from actual field operations to the FMEA.

Failure and reliability rates are particularly difficult to estimate when human performance is involved. It is probably best to assume that human performance in systems often may be much less reliable than what is demanded of hardware and software systems, and accordingly to plan additional compensations when humans may be responsible for detecting primary failure modes or for intervening to mitigate failure effects.

When considering the effectiveness of interventions in mitigating risks, a significant implication of probability analysis is the assumption that the individual interventions are independent events. Normally, the probability of two events both occurring is the probability of one event multiplied by the probability of the other event. As a result, it becomes very unlikely that all of several interventions for mitigating a risk will fail simultaneously. However, this probability analysis assumes that the events are independent, while in reality many events may interact; for example, a pilot who knows that a mechanic is supposed to be checking a component may grow to rely on the mechanic and over time may be less likely to perform a re-check that is supposed to be an independent safety and quality assurance intervention. Whenever the assumption of independent events is violated and the likelihood of one event becomes a function of another event, the redundancy of the interventions will be reduced or eliminated, and it is impossible to conclude that the desired reliability will result from multiple interventions. Therefore, interventions must be designed and implemented so as to provide and preserve the independence of the events.

Summary Evaluation of FMEA

In my opinion, FMEA is a sound methodology for basic, structured risk management, and quality improvement analysis. An ideal approach to risk management is to use FMEA as the backbone for the analysis and also to extend the analysis, as required, to (1) integrate top-down evaluations of the underlying causes of system failures, (2) evaluate the probabilities that failures will occur, adverse consequences will ensue, and interventions will control or mitigate the consequences, and (3) open the system to further analysis and change through continued feedback from actual product/process use. I believe that the thoughtful application of FMEA can help to identify when these extensions are required. Further, FMEA is an effective vehicle for integrating an extended analysis and documenting the results.

I suggest that the limited reliability of humans in complex systems argues for multiple interventions when relying on humans to detect failures or actively intervene to mitigate the consequences. Although a single human intervention may not provide adequate reliability to control risk, a set of multiple interventions that are redundant (that is, compensate for the same risk) and mutually independent can provide an effective countermeasure to the adverse consequences from system failures.

I conclude that FMEA, as extended with appropriate top-down, probabilistic, and feedback methods, is an excellent framework for risk management and quality improvement in the post-design/post-manufacture (field distribution, application, or user) environment, including the human performance aspects of this environment.

Application of FMEA to Post-Production Pharmaceutical Processes

Pharmaceutical design and manufacturing processes generate products with health benefits for the end-user patients. These products may also have adverse side-effects that generate health risks for some of the end-users. Of these risks, some can be controlled by modifying the design of the pharmaceutical and exercising quality control in the manufacturing process; however, some risks may remain as the product is released for distribution and use. These residual risks can potentially be controlled or mitigated during the distribution and use of the product. For example, a medication may have the side effect of liver toxicity for some users. To mitigate this risk, patients may receive a blood test prior to taking the medication that identifies and screens out the users at risk for this side-effect, or they may receive blood tests during while taking the medication to monitor their liver status. Further, as the product is distributed and used, additional adverse consequences may result from human error and other failure modes in these processes. For example, physicians may prescribe an incorrect dosage of the product. These risks also may be mitigated by interventions during the distribution and use process; in this case, dosages prescribed by physicians may be cross-checked by pharmacists or automatically by dispensing systems within the pharmacy. These examples demonstrate that pharmaceutical distribution and use processes have unique challenges from the active participation of multiple parties, some of whom are trained health care providers (physicians, nurses, pharmacists) while some are untrained, end-user consumers (patients and care-givers). Because there are many potential failures (and possible opportunities to compensate for failures) in this post-production environment, a pharmaceutical risk management program that does not include product distribution and use within the scope of its analysis will omit significant risk factors. Based on the evaluation of FMEA that I have summarized in this paper, I would consider an FMEA scoped to include distribution and use processes to be generally applicable as the backbone of the pharmaceutical risk management program.

Further, because of the extensive participation of humans in these processes, it is particularly important to evaluate the possibility of critical failures being generated from these human activities. Similarly, to ensure the reliable performance of human-based interventions that are proposed to mitigate these risks, I would look for these interventions to be multiple, redundant, and independent. Also, the probabilities of the distribution and use failures and the successful interventions in these processes should be based on actual field data, or these probabilities should be estimated conservatively. If data about the reliability of human performance in the distribution and use processes and human interventions in these processes cannot be determined prospectively, feedback from the field becomes an essential part of the pharmaceutical risk management program.

Description of RxFMEA™

RxFMEA™ is a proprietary modification and extension of the basic FMEA methodology and that of Healthcare FMEA (HFMEA™), an adaptation of FMEA that was developed by the U.S. Veteran’s Administration. My review of the process suggests that the objective of RxFMEA™ is the comprehensive management of risks in the pharmaceutical industry. Because of the active involvement of trained personnel and untrained consumers in the distribution and use of pharmaceuticals, RxFMEA™ extends the basic FMEA and HFMEA™ processes in the following ways:

  • The scope of the analysis is defined to include the entire process of medication administration and use, including the diagnosis, prescribing, dispensing, consumption, and monitoring of the pharmaceutical product in actual field use. In this scope, the residual risks from the product design and manufacturing processes are considered to be “intrinsic” risks. These are incorporated in the analysis for mitigation along with the risks generated during the medication administration and use processes.
  • The hazard scoring (assessment of the combined severity and likelihood of each adverse outcome) has been modified to be consistent with an industry standard, from the Council of International Organizations of Medical Science. Under the matrix of severity and likelihood adopted by RxFMEA™, death or permanent disability resulting from a patient’s adverse reaction to a pharmaceutical product is classified as a risk that always requires control or mitigation regardless of its probability of occurrence. Consequences of less severe, but still serious, severity (for example, requiring blood transfusion or hospitalization, or resulting in temporary disability) require mitigation until they occur with a frequency no greater than 1 in 10,000.
  • The actions proposed to control or mitigate risks are designed in systems of multiple interventions to provide redundancy in the event of the failure of one or more of the interventions.
  • To maximize the effectiveness of the interventions in controlling risk, those that rely upon human action or monitoring (usually involving aspects of communication, training, and procedures) are designed to be consistent with known characteristics of adult learning, including the development of tools and materials to assist with learning and performance. Interventions involving medical professionals (for example, physicians) use peer-involvement to motivate adoption and adherence to the protocols of the intervention.
  • The program includes pre-implementation field-testing and post-implementation data collection and analysis to assess the effectiveness of interventions.

RxFMEA™ in Application - Preliminary Findings

In its initial application to an actual pharmaceutical product, RxFMEA™ used an interdisciplinary team of physicians, pharmacists, safety professionals, epidemiologists, biostatisticians, marketing personnel, and regulatory affairs specialists to cooperatively define the scope of the analysis, identify the product distribution/use processes and their subcomponents, identify the failures that each subcomponent can experience, identify the consequences of these failures, evaluate the risks of these consequences, and propose multiple interventions to mitigate the risks. The team met together more than 10 times to accomplish the analysis. The first iteration of the analysis is apparently complete, with interventions proposed for mitigating all of the identified risks to acceptable levels.

As of the time of writing this paper, these interventions have not yet been implemented in field use. Once implementation has occurred, RxFMEA™ is designed to obtain feedback on the effectiveness of the interventions by monitoring data on adverse outcomes as well as direct measures of compliance by physicians, pharmacists, and patients with the individual interventions. These feedback programs will be supplemented with additional market research about the performance and acceptability of the specific interventions. It is anticipated that feedback may suggest changes in the interventions, and as specific failure rate and intervention reliability data replace the original estimates, these data will have to be explicitly incorporated into the RxFMEA™ worksheets and analysis.

Assessment of RxFMEA™

I evaluated RxFMEA™ with respect to cross-industry standards for FMEA and the specific limitations and critical factors for FMEA that I have discussed in this paper. Because there is no actual experience with an RxFMEA™ process that has been implemented in the field, my conclusions must be regarded as preliminary.

Based on my review of descriptive RxFMEA™ materials and its work products, and my interviews with personnel involved in the process, it is my assessment that the RxFMEA™ team process and worksheets are consistent with standard FMEA methodology. Further, the initial application of RxFMEA™ to risk management of a pharmaceutical product appears to have followed standard FMEA procedures. It is significant to note that, based on interviews, the process resulted in many insights that had not previously been obtained; therefore, RxFMEA™ was successful at the most basic level.

The scoping of the risk management problem in RxFMEA™ effectively includes failures and risks through the entire design, production, administration, and use cycle of a pharmaceutical product. Further, top-down analysis that RxFMEA™ included as an extension of the FMEA raised the issue of non-use of a pharmaceutical product as an additional kind of failure, because it deprives the patient of the benefits of the medication (assuming that no equivalent substitute medication is readily available). Recognition of this possibility suggests that the scoping of RxFMEA™ could be further broadened to explicitly consider the adverse effects of non-use of a pharmaceutical in the analysis.

The hazard scoring system implemented in RxFMEA™ is an important feature of the uniqueness of the process. There is no cross-industry standard for acceptable levels of risk; in fact, based on the various hazard scoring systems that are used in FMEAs, which incorporate different evaluations of the seriousness of risks, it is apparent that there exists a wide range of tolerance of risk. Risk tolerance may vary as a function of several factors, including the public’s aversion to mass losses yet acceptance of individual losses, and the tradeoff between the risks and the benefits of using a product. RxFMEA™ scores hazards in a way that is specifically consistent with the pharmaceutical industry’s accustomed risk/benefit tradeoffs, which is appropriate

The probability that a failure will occur or that an adverse consequence will ensue from the failure is an important component of risk assessment in FMEA. At present, RxFMEA™ assesses risk qualitatively. Assuming an approximate 50 percent reliability rate for each intervention, the RxFMEA™ intervention systems that I inspected were based on four redundant interventions to mitigate each risk. Collectively, a four-element system of independent interventions with 50 percent individual reliability could provide as much as 94 percent reliability for the entire system of interventions. These reliability estimates appear to be appropriate for human interventions and demonstrate the importance of compensating for the limited reliability of a single human intervention with multiple, redundant interventions.

As I have discussed, the independence of interventions is a necessary condition for redundancy in a system of multiple interventions. Independence of interventions has been recognized and designed into the RxFMEA™ program. In some cases, during initial application of the RxFMEA™ process, analysts noted possible dependencies between interventions that collapsed the intervention system from four independent elements to three. I suggest that the RxFMEA™ process functioned properly in helping to identify these dependency issues. Going forward, it will be essential to respond to these findings by reassessing the intervention systems to provide adequate reliability.

Overall, a great deal of effort and attention is required to maintain independence in a system of interventions. Otherwise, subtle dependencies may adversely affect the reliability of the system. This can happen when one intervention is triggered from within another, and thus a failure of one intervention may result in the failure of one or more others. This problem can be corrected by “de-anchoring” the triggers that initiate the interventions from within each other. For example, a pharmaceutical company may provide physician and patient information packages as two interventions to mitigate the risks of a product’s potential side effects. If the company provides the materials intended for the patients to the physicians’ offices for distribution to the patients, both interventions may fail if a single party, the physician, does not perform as intended. The independence of the patient information material can be maintained, though, by distributing the materials directly to the end-users. Another potential dependency that is subtle, but potentially disruptive, is the human tendency to relax our discipline when we are aware that others are also responsible. For example, physicians and pharmacists may both be asked to track patient compliance with laboratory testing requirements, as two interventions that are apparently independent. However, if physicians are aware that the pharmacists are being asked to track the patients’ tests, then the physicians may be less likely to perform the redundant tracking of the same information. Based on the examples of RxFMEA™ interventions that I reviewed for this evaluation, I do not believe that these subtle dependencies are problematic to the methodology; I would caution RxFMEA™ analysts and users to maintain awareness about these concerns, though, to ensure that independence of the multiple interventions is not compromised.

I have suggested that, in an ideal FMEA process, the interventions chosen to mitigate risks would also be evaluated as to their own failure modes and effects. I further suggested that by analyzing an intervention comprehensively, some of its failures might be avoided and the reliability of the intervention improved. My review of RxFMEA™ indicates that it devotes a great deal of attention to the failure modes and effects of interventions; this realistic consideration of human reliability is one of RxFMEA’s significant contributions. For example, considering an intervention involving a pharmacist’s cross-check of a medication dosage prescribed by a physician, failure modes for the cross-check such as pharmacists not performing the check, or performing it incorrectly, will be considered. I note, however, that this process can continue at an even deeper level; in the example, the reasons why pharmacists sometimes do not perform the dosage check could be explored and appropriate interventions provided to improve the reliability of the dosage check. This level of analysis apparently has not been attempted in RxFMEA™, but this is a possible extension. Further, interventions can have subtle failure modes that can cause the reliability of the intervention to be estimated inaccurately, without very careful analysis. For example, in an inspection or monitoring process, especially one involving significant human attention and effort, a fault that is theoretically detectable will not always be detected. By applying FMEA to the inspection and monitoring intervention, identifying and correcting as best as possible for the reasons why the monitoring fails, it may be possible to increase the detection rate.

The provision for feedback from field data to the FMEA is an excellent design feature of RxFMEA™. The strength of the feedback function appears to be a reasonable and proper compensation for any uncertainties that may exist about the effectiveness of interventions until they can be field-tested. Also, feedback—and response to the information obtained from the field—are the key to the openness that is required to keep the analysis comprehensive and up-to-date. In these regards, RxFMEA™ has been pathbreaking in its incorporation of outcomes and intervention reliability monitoring.

I will close this evaluation of RxFMEA™ with a parallel from the aviation industries. For many years, only three- and four-engine airplanes were used by airlines for transoceanic operations. Longstanding concerns about engine reliability, which were valid in the piston-engine era, caused twin-engine aircraft (which were the most commonly used designs in overland service) to be prohibited from long distance overwater flights because two engines were not considered to provide adequate redundancy. However, engines became much more reliable with the advent of the turbojet. After the airlines accumulated many years of operating experience with the jets, some began to consider that twin-engine overwater operations might be appropriate.

The industry and its regulators responded with the extended-range twin-engine operations (ETOPS) program. Under ETOPS, airlines were authorized to operate in a manner previously thought to be too risky. However, the airlines obtained this authorization by committing to a program of extremely careful monitoring of a large number of measurable parameters (for example, engine temperatures and oil consumption), risk-mitigating operational procedures (for example, developing facilities at alternate airports to permit more successful flight diversions), and a high criterion for performance (the airline’s record of premature engine shut-downs must be extremely good to maintain ETOPS approval). The ETOPS program could not have been implemented, as designed, without the advent of new technologies for data measurement and in-flight data transmission. Further, ETOPS also required substantial financial support and human effort, commitment to a long-term program of continued feedback monitoring, and maintenance of the discipline to respond positively to adverse findings revealed by the data. The ETOPS program has been so successful that its monitoring and risk-mitigating operational procedures are being adopted for flight operations with the three- and four-engine aircraft that are not formally required to have these safety measures. I think that RxFMEA™, with its careful analysis of failures, establishment of systems of multiple, redundant, independent interventions, and strong feedback of information from product distribution and use in the field, has a similar potential to add to the benefits and safety of pharmaceutical products while it allows the industry to explore new methods of managing risks.

Conclusion-Expert Opinion

In my opinion, RxFMEA™ retains the validity of the standard FMEA methodology as it extends and augments that methodology. The extensions that define the uniqueness of RxFMEA are appropriate responses to the challenges of the pharmaceutical industry’s distribution and use environment. Perhaps the most significant advances of RxFMEA™, from an analytical standpoint, are (1) its realistic treatment of the human generation of failures and capabilities of reliably mitigating their effects, (2) its consequent incorporation of multiple, independent, redundant interventions to compensate for risks when human performance is involved, and (3) its recognition that post-implementation monitoring of adverse outcomes and the performance of interventions, and openness to the changes that may be suggested by these feedback data, are required to ensure that risks have been managed adequately.

In its initial application, RxFMEA™ identified specific weaknesses in the distribution and use processes for a pharmaceutical product, some of which generated potential risks to patients. It guided the development of interventions to mitigate these risks, and it documented the assessments and decisions that were executed in obtaining these results. Judging by these preliminary indications, I would judge RxFMEA™ to be a success.

The ultimate judgment on a pharmaceutical risk management program that is designed and executed with the assistance of RxFMEA™ will be its relative effectiveness when compared to the alternatives for managing the risks of the product. These include withdrawal of the product from the market and imposition of active distribution controls that limit its use. The metrics for comparing the effectiveness of these risk management programs should include their performance in both mitigating the risks and allowing patients to obtain the benefits of the medication. Although many of the interventions used by RxFMEA™ that rely on human performance may have limited reliability and value in risk mitigation when considered individually, a program of multiple, independent, and redundant interventions derived from the RxFMEA™ process may be more effective than active controls, which have inherent negative effects of limiting or preventing users from benefiting from the product. The proof of the effectiveness of an RxFMEA™-based program will be in the data obtained from actual field experience, as the product is distributed by physicians and pharmacists and used by patients and caregivers, and as these persons respond to the interventions.


About the Author

The opinions that I express in this paper are based on a thorough review that I conducted of industry standards and procedures for risk management, FMEA techniques, and FMEA applications in aviation and other industries. My opinion paper, Effective Risk Management and Quality Improvement by Application of FMEA and Complementary Techniques, was based on that review.

In addition to my work in cross-industry risk management process evaluation, I have a 25-year background in transportation management and analysis, airline flight operations, safety investigation management, safety research, and airline accident investigation. I have ten years of experience on the staff of the U.S. National Transportation Safety Board (NTSB), concluding my service there as the Chief of the Major Investigations Division. In that position, I managed the overall investigative effort for U.S. air carrier accidents from the field investigation to the public board meeting and final accident report. I also managed the U.S. Government’s participation in foreign aviation accidents. My previous NTSB experience included management of flight operations, air traffic control, and meteorological aspects of air carrier accident investigations; on-scene and follow-up investigations of flight operations for several major accident investigations including the USAir flight 427 Boeing 737 accident near Pittsburgh and ValuJet flight 592 DC-9 accident in the Everglades; and management of research programs on flight crew human factors and regional air safety issues, both of which were adopted and published by the NTSB. I am a pilot for a major U.S. air carrier, qualified in the Boeing 737 and two other transport category aircraft types. I have consulted with the National Aeronautics and Space Administration (NASA), the World Bank, the European Bank for Reconstruction and Development, the U.S. President’s Aviation Safety Commission, and several airlines, financial institutions, airport authorities, and other private entities on safety and analytical matters. I received the A.B. degree summa cum laude in Economics from Harvard College and am a member of the Phi Beta Kappa Society.


[1] I acknowledge and thank ParagonRx, LCC for its support of my review of risk-management methodologies and the writing of this paper. All opinions expressed herein are my own and do not necessarily represent the opinions, policies, and products of ParagonRx, LLC.

[2] My general evaluation of the FMEA methodology is documented in a companion paper, Effective Risk Management and Quality Improvement by Application of FMEA and Complementary Techniques, to which I refer the reader for more information about the definition of FMEA, standards for FMEA application, cross-industry use of the method, and its general advantages and limitations.



To speak to a ParagonRx team member about our publications
call 888.459.8080 or email