# How to Document a Biosafety Risk Assessment: What to Include By the end of this article you will be able to write a complete, inspectable biosafety risk assessment document for your microbiology laboratory. You will know which sections the document must contain, how to score and record risk in a defensible way, what a filled-in documentation example looks like, how to attach the document to your training program, and when the document must be revised. The walkthrough uses a semi-quantitative scoring method you can apply with a spreadsheet or a short script, and it ends with a reusable documentation template you can adapt the same day. Have on hand before you start: - Your laboratory's agent inventory, including Risk Group classifications where they exist - The standard operating procedures (SOPs) for each activity involving biological material - Your current [biosafety manual](/knowledge/diagnostics/emerging-tech/biosafety-manual-development-a-template-for-diagnostic-laboratories), facility floor plan, and equipment list (class II biological safety cabinet, autoclave, centrifuge with sealed rotors, and so on) - Incident and exposure logs from the past review cycle - The [biosafety level](/knowledge/diagnostics/emerging-tech/biosafety-levels-1-4-a-comparative-framework-for-diagnostic-laboratory-design) assigned to each room where work is performed - A reviewer or biosafety officer who can countersign the final document ## What a Biosafety Risk Assessment Actually Is A biosafety risk assessment is a structured judgment about three questions. What biological agent is in play. What does the procedure do to it, such as vortexing, centrifuging, sonicating, or plating, that could release it. What measures, in order, reduce the residual risk to a level the laboratory accepts. Modern frameworks separate the agent from the activity. The WHO Laboratory Biosafety Manual fourth edition (LBM4) requires risk assessments tailored to specific pathogens, specific activities, and specific operational settings rather than a one-time decision per organism [1]. The reason is practical. The same agent can demand different containment depending on what you do with it. A structured review of ten national and international biosafety reference documents, including WHO LBM4, the CDC-NIH publication known as BMBL in its sixth edition, and the CDC Biological Risk Assessment guidance, found that linking a Risk Group directly to a Biosafety Level fails to capture how much exposure varies across procedures, and that exposure generated by the procedure should serve as the primary determinant of containment [2]. Three terms recur throughout this article and must be defined now. **Risk Group (RG)** is a classification of an organism by its intrinsic hazard, typically RG1 through RG4, based on pathogenicity, transmissibility, available treatment, and endemicity. **Biosafety Level (BSL)** is the set of containment practices, equipment, and facility features a laboratory applies to a specific activity, typically BSL-1 through BSL-4. **Residual risk** is the risk that remains after controls are applied, which is what the document ultimately certifies as acceptable or unacceptable. A biosafety risk assessment is the reasoning that connects these three. The documentation is the written record of that reasoning, and it is the part most often done poorly. ## Why Documentation Fails in Real Laboratories Two failure patterns show up repeatedly. The first is inconsistent, redundant documentation. A study of laboratory documentation practices for genetically modified organisms found that individual researchers, rather than the institution, carry the burden of lab internal documentation and compliance with [biosafety regulations](/knowledge/diagnostics/emerging-tech/biosafety-regulations-and-guidelines-a-global-overview-for-diagnostic-laboratories), producing inconsistent documentation regimes and a significant time and labor burden, which motivated the development of standardized, semi-automatic digital tools [3]. The lesson generalizes. If every bench scientist formats their risk assessment differently, no one can compare risks across the laboratory and no reviewer can verify completeness. The second is stale documentation. A case study of a hospital laboratory that updated its risk assessments and rewrote its biosafety manual against current international standards reported significantly improved identification and management of biosafety threats, along with better operational standardization [4]. The document you write once and never revisit is not a risk assessment. It is shelf decoration. Good documentation solves both problems with a fixed format, a defined review cycle, and one owner per document. ## The Documentation Format: Nine Required Sections The following sections constitute a complete biosafety risk assessment documentation format. Every section has a purpose an inspector, an accreditator, or a successor can verify. Skip one and the chain of reasoning breaks. ### Section 1. Header and Metadata Record the document identifier, version number, date of assessment, date of scheduled review, the assessor's name and role, the biosafety officer or reviewer who countersigns, and the scope. The scope statement is critical. It names the rooms, the agents, and the activities covered, and it explicitly excludes everything else. ### Section 2. Agent Identification and Hazard Characterization List each agent with its Risk Group classification, the basis for that classification, and relevant hazard traits such as route of infection, infectious dose where established, environmental stability, and availability of prophylaxis or treatment. For agents without an established classification, record the evidence you used to assign a provisional hazard tier. ### Section 3. Procedure and Activity Inventory Enumerate the specific activities, not just the agent. "Handling N. gonorrhoeae" is too vague. The activity inventory reads like this: receipt and accessioning of swabs, inoculation of chromogenic agar, colony picking on an open bench, slide preparation for Gram stain, AST disk placement. Each activity carries its own aerosol, splash, and contact potential. This is the core insight of procedure-specific risk frameworks, in which exposure generated by the procedure, rather than agent taxonomy, drives the containment decision [2]. ### Section 4. Exposure Characterization For each activity, describe the routes by which personnel, the environment, or other samples could be exposed. Routes include inhalation of aerosols, percutaneous injury, mucocutaneous splash, ingestion via hand-to-mouth transfer, and environmental release through waste or spill. A study of occupational exposure among healthcare workers found that most participants had experienced skin injury while performing professional duties, and that the study explicitly examined the documentation used for recording occupational injuries as part of its assessment [5]. That finding is a benchmark for your own records. If your incident documentation cannot tell you which procedures most often injure hands, your exposure characterization has no feedback loop. ### Section 5. Risk Evaluation and Scoring Assign a score or a qualitative tier to each activity-agent pair. The next major section walks through a worked calculation. Record the scoring scheme itself inside the document so a reviewer can reproduce your numbers. ### Section 6. Control Measures in Hierarchy Order List controls in the classic hierarchy. Elimination or substitution (use killed material for training, inactivated controls for assay validation). Engineering controls (BSC, sealed rotors, sharps containers). Administrative controls (SOPs, restricted access, one-handed needle recapping bans). Personal protective equipment (gloves, gown, eye protection, respirator where indicated). Each control must map to a named hazard from Section 4. A control that does not address a listed exposure is decoration. ### Section 7. Residual Risk Statement and Acceptance Decision State the risk remaining after controls, classify it as acceptable or unacceptable, and record who accepted it and when. If any activity remains unacceptable, the document must state the interim restriction, for example suspension of that assay until a BSC repair is completed. ### Section 8. Training and Competency Linkage Name the training required before personnel perform each activity, the competency assessment method, and the records repository. Training is not an afterthought. An improved training program developed for a BSL-4 facility in China built its system around fourteen modularized theoretical topics that staff with different backgrounds could combine according to their knowledge level, paired with a standardized practical assessment usable before, during, and after training [6]. The modular structure maps directly onto documentation. Each risk assessment section can reference the specific training module that covers its hazards. ### Section 9. Signatures, Review Dates, and Revision History Record the assessor, the countersigning biosafety officer, the approval date, the next scheduled review date, and every amendment with its date and rationale. ## How to Document a Biosafety Risk Assessment: A Numbered Walkthrough This walkthrough produces a finished document for one realistic scenario. Follow it in order. ### Step 1. Define the scope in one sentence Example scope: "This assessment covers handling of suspected Mycobacterium tuberculosis complex specimens in Room 114, including decontamination, digestion, and smear preparation, from accessioning through fixation. Molecular testing on extracted, inactivated nucleic acid is excluded and covered by document RA-2026-03." A narrow scope keeps the activity inventory manageable. Assessors who write "all BSL-3 work" as their scope produce documents too vague to verify. ### Step 2. Inventory activities and assign exposure descriptors For each activity, record the physical manipulation that could generate exposure. A practical descriptor set: ```text Activity ID: ACT-03 Activity: Digestion and decontamination of sputum (NaOH/NALC method) Agent(s): Mycobacterium tuberculosis complex (RG-3) Manipulations: Vortex mixing (sealed tube), timed centrifugation, decanting supernatant, resuspension of pellet Aerosol potential: High (decanting, resuspension) Splash potential: Moderate (tube transfer) Sharps potential: Low Sample volume: 2-5 mL per specimen Daily frequency: Up to 40 specimens ``` ### Step 3. Score the risk with a semi-quantitative formula ![Calculation of the semi-quantitative risk score R = H x A x LF for sputum digestion, giving 27 before controls and 9 after controls.](/article-images/illustrations/biosafety-risk-assessment-documentation-risk-score-calc.webp) Semi-quantitative scoring beats purely narrative judgment because it is reproducible. A three-dimensional risk matrix model developed for primary-level pathogen microorganism laboratories defines three core dimensions: pathogen hazard (H), laboratory activity type (A), and annual operation frequency (F), which maps to the likelihood of event occurrence, combined in the formula R = H × A × L[F] [7]. You must define your own scale values and anchor them to your institution's guidance. The following illustrative scale shows how the mechanics work. ```text H (agent hazard): 1 = RG1, 2 = RG2, 3 = RG3, 4 = RG4 or equivalent A (activity type): 1 = closed system / inactivated material 2 = open handling of low-volume material 3 = aerosol-generating manipulation 4 = large-volume or high-titer aerosol generation L[F] (frequency factor): 1 = monthly or less, 2 = weekly, 3 = daily, 4 = many times daily R = H x A x L[F] ``` Worked calculation for ACT-03, assuming the laboratory's own anchors assign H = 3, A = 3, and L[F] = 3 for a high-throughput daily digestion bench: ```text R = H x A x L[F] R = 3 x 3 x 3 R = 27 ``` Expected output in a simple Python implementation your biosafety officer can run: ```python def risk_score(h: int, a: int, lf: int) -> int: """Semi-quantitative biosafety risk score, R = H x A x L[F].""" for name, value in (("H", h), ("A", a), ("L[F]", lf)): if not 1 <= value <= 4: raise ValueError(f"{name}={value} outside 1-4 scale") return h * a * lf print(risk_score(3, 3, 3)) ``` Output: ```text 27 ``` Record the raw score, the scale definition, and the score for every activity. The model behind this formula was validated with real laboratory activity data from 16 district Centers for Disease Prevention and Control in Beijing covering 130 tests, of which 88 percent involved Category III pathogens, and it identified one laboratory activity posing an unacceptable level of risk, demonstrating that the approach can surface specific problem activities rather than blanket judgments [7]. ### Step 4. Assign or confirm containment from the procedure, not just the agent Use the exposure characterization to check whether your current BSL assignment matches the procedure. Procedure-specific risk frameworks integrate agent Risk Group classification, procedural exposure characterization, and modulating factors such as staff experience and equipment condition into a BSL assignment matrix, with structured templates available for the assessment [2]. If your scoring in Step 3 shows ACT-03 at the top of your acceptance band but your facility performs decanting on an open bench, the containment or the procedure must change. ### Step 5. Write controls against each exposure route Continue the example: ```text Exposure route Control Aerosol, decanting Perform inside Class II BSC, discard pipettes into disinfectant within the cabinet Aerosol, centrifugation Sealed rotor, load/unload in BSC, 10 min aerosol-settle before opening per SOP Splash Fluid-resistant gown, face shield during tube transfers Sharps No needles in the workflow, blunt cannula for aliquoting Environmental release Validated autoclave cycle for all waste, monthly spore-strip verification ``` ### Step 6. State residual risk and record the acceptance decision Example statement: "With all listed controls in place and verified functional, residual risk for ACT-03 is assessed as acceptable under current BSL-3 practices. Risk score post-controls, using the activity-type downgrade from aerosol-generating to contained handling (A = 1), equals R = 3 × 1 × 3 = 9." The document records both the pre-control and post-control scores. The delta is the documented value of your control program. ### Step 7. Link the document to training records For each activity, list the required training and the competency check. Tie each module to the hazard it addresses, following the modular logic used in high-containment training programs, which pair flexible theoretical modules with standardized practical assessments administered before, during, and after training [6]. Competency methods can include direct observation, simulation, and written assessment. Clinical simulation in biosafety education has been shown to improve understanding of personal protective equipment use, risk perception, and integration of theory with practice among nursing students, which supports simulation as a documented competency method for PPE-dependent procedures [8]. ### Step 8. Assemble, countersign, and register the document Save the document in your controlled document system with the version number, route it to the biosafety officer for countersignature, and enter it in the laboratory's assessment register. If you work with genetically modified organisms, digital tools exist specifically for this purpose. GMOCU, a free Python-based tool, unifies laboratory documentation on genetic parts and genetically modified organisms, automates biological risk evaluations, maintains a shared inventory for team-wide navigation, and exports data into customizable formats suitable for official biosafety documents [3]. ### Step 9. Schedule and trigger reviews Set the next review date, typically annually, and list unscheduled triggers. Review triggers should include: a new agent or a change in agent classification, a new or modified procedure, new equipment, an incident or exposure, renovation or relocation, staffing changes that affect competency coverage, and changes in external guidance. A hospital laboratory case study found that expanding the scope of risk assessments and updating the biosafety manual against current international standards significantly improved threat identification and response efficiency [4], which is the documented payoff of keeping reviews current rather than ceremonial. ## Summary Table: Documentation Elements, Purpose, and Verification | Section | Purpose | How a reviewer verifies it | |--|--|--| | Header and metadata | Traceability and version control | Version history, signatures, dates present | | Agent identification | Establish intrinsic hazard | RG assignment matches an acknowledged source | | Activity inventory | Capture real exposures | Every SOP involving the agent appears | | Exposure characterization | Link hazard to route | Each activity lists route and direction of exposure | | Risk scoring | Reproducible judgment | Scale defined, math reproducible by reviewer | | Control measures | Reduce risk in hierarchy order | Each control maps to a listed exposure | | Residual risk | Certify acceptability | Acceptance decision signed and dated | | Training linkage | Prove competence | Module IDs match training records | | Revision history | Preserve institutional memory | Every change dated and justified | ## Choosing Between Documentation Formats ![Comparison of paper narrative, spreadsheet register and digital platform formats across scale, updating, risk sorting and export.](/article-images/illustrations/biosafety-risk-assessment-documentation-format-choice.webp) **Paper or narrative document.** Acceptable for small, stable laboratories. Fails at scale because updating one agent means reprinting everything. **Spreadsheet register.** The workhorse format for most clinical microbiology laboratories. One row per activity-agent pair, with columns matching the nine sections. Enables sorting by risk score to prioritize interventions. **Digital, semi-automatic platforms.** For laboratories managing many constructed organisms or high activity volume, dedicated software reduces the documentation burden and inconsistency that arise when individual researchers maintain their own records, and can export directly into official biosafety document formats [3]. The tradeoff is onboarding effort and the need to keep the tool itself validated. Whichever format you choose, the nine sections do not change. The format changes. The reasoning chain does not. ## What a Completed Entry Looks Like The following is a condensed documentation example for one activity-agent pair, in the format described above. ```yaml document_id: RA-2026-07 version: "1.2" date_of_assessment: 2026-10-14 next_review: 2027-10-14 assessor: J. Okafor, Lead Medical Technologist, Microbiology countersigned_by: M. Alvarez, Biological Safety Officer scope: > Processing of respiratory specimens for M. tuberculosis complex in Room 114, BSL-3, from accessioning through smear fixation. activities: - id: ACT-03 name: Digestion-decontamination of sputum agent: Mycobacterium tuberculosis complex risk_group: 3 hazard_traits: >- Slow-growing, airborne person-to-person transmission, treatable but prolonged therapy, low infectious dose via aerosol route manipulations: [sealed-tube vortex, sealed-rotor centrifugation, BSC-internal decanting, resuspension] exposure_routes: [inhalation, mucocutaneous splash, percutaneous] scoring: scheme: "R = H x A x L[F], 1-4 scale per institutional SOP BSL-08" H: 3 A: 3 LF: 3 R_pre_control: 27 R_post_control: 9 controls: engineering: [Class II BSC, sealed rotor and buckets] administrative: [SOP MB-114 rev 4, two-person rule after hours] ppe: [N95 respirator, fluid-resistant gown, gloves, face shield] residual_risk: acceptable accepted_by: M. Alvarez, Biological Safety Officer accepted_on: 2026-10-14 training_required: [MOD-TB-01 didactic, MOD-TB-02 observed competency, annual respirator fit test] incident_linkage: "Exposure log, Room 114, rolling 12 months" ``` This single entry is one row of the larger register. A full assessment repeats the structure for each activity in scope. ## Common Mistakes and Limitations **Assessing the agent and forgetting the procedure.** A Risk Group classification alone cannot determine containment. Frameworks that equate Risk Group with Biosafety Level fail to capture how exposure varies across procedures, which is why activity-level characterization is now central to the major reference frameworks [2]. **Defining a scale nobody anchored.** If two assessors scoring the same activity get different numbers, the scale is not defined tightly enough. Write the anchor descriptions for every point on every axis, inside the assessment document itself. **Recording controls without verifying them.** "BSC used for all open manipulations" is a claim until you attach the certification date of the cabinet and the airflow verification record. Link each engineering control to its maintenance record. **Treating the assessment as a one-time event.** Documentation that is not revisited decays into fiction. The Beijing validation study shows the value of feeding actual annual activity data into the model, since workload intensity varied significantly across laboratories and only two reported a daily workload of five or more tests per BSL-2 room, a fact invisible without activity data [7]. **Letting training records drift from the assessment.** If the assessment requires fit testing annually and the records show it happened fourteen months ago, the document and reality have diverged. Reconciliation of training records against the assessment belongs in every review cycle. Simulation-based methods are one documented way to keep competency current for PPE-dependent work. **Poor incident linkage.** The value of exposure characterization grows with feedback. Occupational exposure studies explicitly examine the documentation used for recording workplace injuries [5], and laboratories should do the same. If your exposure log cannot be joined to your activity inventory, add an activity ID field to the log. **Ignoring external movement of material.** If you ship isolates or specimens, the documentation accompanying those shipments carries its own obligations under international instruments such as the [Cartagena Protocol on Biosafety](/knowledge/diagnostics/emerging-tech/understanding-the-cartagena-protocol-on-biosafety-implications-for-diagnostic-laboratories), which includes provisions on risk assessment, risk management, and documentation accompanying shipments [9]. For living modified organisms in particular, the Protocol's documentation requirements are distinct from your internal assessment and must be tracked separately [10]. **Overstating certainty for emerging agents.** For newly recognized or imported pathogens, evidence supporting containment decisions can be incomplete. Reviews of henipavirus biosafety evidence found that the adequacy of evidence supporting risk-based containment decisions remained unclear in places, underscoring the need to document the evidence base, and its gaps, alongside your conclusions [1]. Similarly, the Andes virus outbreak linked to a cruise ship in 2026, with 13 cases including three deaths and sustained person-to-person transmission, prompted European health authorities to identify diagnostic capability gaps and rapidly deploy support, illustrating that risk assessments for emerging agents must document what is unknown as carefully as what is known [11]. One limitation applies to every document of this kind. A risk assessment reflects the judgment of its assessors at a point in time. Individual situations, unusual specimens, and atypical exposures require real-time consultation with the biosafety officer rather than reliance on the written document alone. ## Frequently Asked Questions ### What is a biosafety risk assessment documentation template? It is a pre-structured form containing the required sections of the assessment, such as agent identification, activity inventory, exposure characterization, scoring, controls, residual risk, and signatures, so that every assessment a laboratory produces follows the same format. ### How is a biosafety risk assessment documentation format different from the assessment itself? The assessment is the reasoning about hazard, exposure, and controls. The documentation format is the fixed structure that records that reasoning so others can verify, reproduce, and update it. ### How often must a biosafety risk assessment document be reviewed? At minimum on the schedule your institution sets, commonly annually, and immediately upon defined triggers such as a new agent, a modified procedure, new equipment, an incident, or a change in external guidance. ### Who signs a biosafety risk assessment? The person who performed the assessment signs as assessor, and a biosafety officer or designated responsible official countersigns the residual risk acceptance decision. ### What is the difference between a Risk Group and a Biosafety Level? Risk Group classifies the intrinsic hazard of the organism. Biosafety Level defines the containment practices, equipment, and facility applied to a specific activity with that organism, and modern frameworks derive the level from the procedure and its exposures, not from the agent alone. ### Can I score a biosafety risk assessment numerically? Yes. Semi-quantitative formulas such as R = H × A × L[F], combining agent hazard, activity type, and frequency of operation, provide reproducible scores that support risk ranking and targeted control measures. ### What role does microbiology biosafety training play in the documentation? The assessment must name the training modules and competency assessments required for each documented activity, and the training records must map back to the assessment so reviewers can confirm that everyone performing a task was trained for its specific hazards. ### Should small laboratories use digital documentation tools? Digital tools become worthwhile when documentation volume or staff turnover makes manual formats inconsistent, since dedicated platforms can unify records, automate risk evaluation steps, and export documents in official formats. ## Sources 1. [Hendra and Nipah viruses: Biosafety evidence for risk-based containment, inactivation practices, and one health preparedness.](https://pubmed.ncbi.nlm.nih.gov/42381667/) 2. [An 8-step procedure-specific risk framework enables reproducible biosafety level assignment beyond agent-based classification.](https://pubmed.ncbi.nlm.nih.gov/42539660/) 3. [GMOCU: Digital Documentation, Management, and Biological Risk Assessment of Genetic Parts.](https://pubmed.ncbi.nlm.nih.gov/38263723/) 4. [Enhancing laboratory biosafety management: a comprehensive strategy from theory to practice.](https://pubmed.ncbi.nlm.nih.gov/39371211/) 5. [ASSESSMENT OF INFECTIOUS DISEASE RISK FACTORS, INCLUDING COVID-19, AMONG HEALTHCARE WORKERS IN EAST KAZAKHSTAN REGION.](https://pubmed.ncbi.nlm.nih.gov/41072544/) 6. [Networking for training Level 3/4 biosafety laboratory staff.](https://pubmed.ncbi.nlm.nih.gov/32501432/) 7. [A semi-quantitative risk assessment of pathogenic microorganism laboratories in Beijing's CDCs based on a three-dimensional risk matrix model.](https://pubmed.ncbi.nlm.nih.gov/42395648/) 8. [Nursing students' perceptions of the use of clinical simulation in biosafety education.](https://pubmed.ncbi.nlm.nih.gov/42742997/) 9. [Conservation biology, genetically modified organisms, and the biosafety protocol.](https://pubmed.ncbi.nlm.nih.gov/17181797/) 10. [The Cartagena Protocol on Biosafety: interaction between the Convention on Biological Diversity and the World Organisation for Animal Health.](https://pubmed.ncbi.nlm.nih.gov/16110874/) 11. [Andes virus reaches Europe: a narrative review on clinical challenges, diagnostic gaps and public health preparedness, 2026.](https://pubmed.ncbi.nlm.nih.gov/42921680/)