Quality Risk Management in Pharma (ICH Q9 R1) Explained

In short: Quality risk management (QRM) is a structured way to find, assess, control, communicate and review risks to product quality across the product lifecycle. This article is for QA, QC and production staff and pharmacy students. The key idea in ICH Q9(R1) is that the effort and formality you apply should match the level of risk, and that subjectivity must be managed.

What is quality risk management?

ICH Q9 describes quality risk management as a systematic process for assessing, controlling, communicating and reviewing risks to the quality of a drug product over its whole lifecycle. The current version is ICH Q9(R1), which reached Step 4 (final adoption) on 18 January 2023.

Two basic principles

1. Risk evaluation should rest on scientific knowledge and must link back to protecting the patient.
2. The effort, formality and documentation of the QRM process should be proportionate to the level of risk.

What ICH Q9(R1) changed

The 2023 revision left the core process in place but tightened four areas where industry practice was weak:

• Subjectivity: Risk scoring can vary with who is in the room. Subjectivity cannot be removed completely, but it should be managed and reduced, for example by using clear scoring definitions, good data and a well-chosen team.
• Formality: Formality is not a yes/no choice. Use more formality when uncertainty, importance to product quality or complexity is higher, and less when the issue is simple and well understood.
• Risk-based decision-making: Decisions that matter should be backed by a documented risk rationale, not only by opinion.
• Product availability risks: Patient protection includes making sure medicines stay available. Quality or manufacturing problems that could cause shortages should be treated as risks within QRM, for example in supplier, site and equipment changes.

Roles and responsibilities

QRM is usually, but not always, done by a cross-functional team. Depending on the topic, this may include quality, engineering, production, regulatory affairs, statistics, clinical and others, plus at least one person who knows the QRM process itself.

Decision makers are responsible for coordinating QRM across functions, making sure the process is defined, used and reviewed, and making sure resources are available.

The QRM process

To start a QRM exercise, a team typically does the following:

1. Define the problem or risk question and list the assumptions.
2. Gather background data on the hazard, harm or impact on health.
3. Appoint a leader and arrange resources.
4. Set a timeline, deliverables and the level at which the decision will be made.

Risk assessment

Risk assessment covers hazard identification and the analysis and evaluation of the risks linked to those hazards. It works best when the risk question is clearly worded. Three questions guide it:

1. What might go wrong?
2. How likely is it?
3. How severe would the consequences be?

Risk identification

A systematic use of information (past data, theory, expert opinion, stakeholder concerns) to list hazards. It answers “what might go wrong?” and the possible consequences.

Risk analysis

Estimating the risk by linking likelihood and severity, either qualitatively or quantitatively. Some tools also include detectability.

Risk evaluation

Comparing the analysed risk with agreed risk criteria, and considering how strong the evidence is behind all three questions above.

Data quality and uncertainty

The output is only as good as the data behind it. State your assumptions and sources of uncertainty openly. Uncertainty comes from gaps in process knowledge and from variability, including how likely a problem is to be detected.

Expressing the result

Risk can be given as a number (a probability) or as a qualitative rating such as high, medium or low. If you use ratings, define each one clearly in your procedure. A risk score can be used to rank risks. Many tools combine severity and probability into a relative risk value.

Risk control

Risk control means deciding how to reduce or accept risk. The effort should match how significant the risk is. Useful questions are:

• Is the risk above the acceptable level?
• What can be done to reduce or remove it?
• What is the right balance between benefit, risk and resources?
• Could the control create new risks?

Risk reduction

Actions taken when risk is above the acceptable level. These can lower severity, lower probability, or improve detection. Because a control can introduce new risks, re-check the assessment after you implement it.

Risk acceptance

A decision to accept the remaining (residual) risk. It should be a conscious, documented decision where appropriate, not a passive default. Some risks cannot be eliminated entirely, and the acceptable level must be set case by case.

Risk communication

Information about risk should be shared between decision makers and other interested parties, such as regulators, industry and patients, and within the company. Communication can occur at any stage, and the results of QRM should be communicated and documented. Not every risk acceptance needs to be communicated.

Risk review

QRM is ongoing. Results should be reviewed as new knowledge arrives and when events could affect the earlier decision, such as product reviews, audits, inspections, change control, failure investigations or recalls. The review frequency should depend on the level of risk, and a review may reopen earlier risk acceptance decisions.

Risk management tools

ICH Q9 accepts both informal, experience-based approaches and recognised tools. Commonly used tools include:

• Basic facilitation methods (flowcharts, check sheets)
• Failure Mode and Effects Analysis (FMEA)
• Failure Mode, Effects and Criticality Analysis (FMECA)
• Fault Tree Analysis (FTA)
• Hazard Analysis and Critical Control Points (HACCP)
• Hazard Operability Analysis (HAZOP)
• Preliminary Hazard Analysis (PHA)
• Risk ranking and filtering
• Supporting statistical tools

These are described in Annex I of ICH Q9(R1) and can be adapted or combined.

See also

• Change management system as per ICH Q10: QRM is used to evaluate every proposed change.
• SOP for Risk Management (example template)
• SOP on Change Control (example template)

Frequently asked questions

What is the difference between ICH Q9 and ICH Q9(R1)?

Q9(R1) keeps the original framework and adds clarity on subjectivity, formality, risk-based decisions and product availability.

Is FMEA mandatory?

No. ICH Q9 does not require a specific tool. Choose one that suits the question and justify the choice.

How do I reduce subjectivity in a risk assessment?

Use defined scales, relevant data, a cross-functional team and a documented rationale for every score.

Who approves risk acceptance?

This is set by your own quality system. Decision makers with the right authority and knowledge should decide.

References

1. ICH Q9(R1) Quality Risk Management, Step 4, 18 January 2023. International Council for Harmonisation. https://database.ich.org
2. Download the example SOP for quality risk management (PDF)