Quality risk management pharma teams should implement as a structured, science- and knowledge-based cycle: assess risk, control it, communicate decisions and review whether those decisions remain appropriate. Under ICH Q9(R1), the level of effort, formality and documentation should be commensurate with the level of risk. The purpose is not to generate a risk register or mandate FMEA for every issue; it is to make transparent, evidence-based decisions that protect patients and support appropriate product availability.
This article addresses the ICH Q9(R1) Quality Risk Management Step 4 final guideline. It is an ICH guideline, rather than a statement of country-specific legal adoption. Organisations should therefore assess applicable local GMP and marketing-authorisation requirements alongside it. The implementation methods and examples below are GuideGxP advice, not additional ICH requirements.
What ICH Q9(R1) requires from a QRM process
ICH Q9(R1) presents two overarching principles. First, evaluation of risk to quality should be based on scientific knowledge and, ultimately, linked to the protection of the patient. Second, the level of effort, formality and documentation of the quality risk management process should be commensurate with the level of risk.
The guideline describes a process with four connected activities: risk assessment, risk control, risk communication and risk review. The process can be applied prospectively, when planning a change or development activity; retrospectively, when investigating an event; and repeatedly, as new information changes knowledge of the risk.
Risk assessment: define the decision before scoring
Risk assessment comprises risk identification, risk analysis and risk evaluation. Start with a decision-focused risk question. For example: what could cause a critical process parameter to drift beyond its justified operating range, what would that mean for product quality, and what controls are needed before implementation?
Identification should draw on relevant knowledge: process and product understanding, prior deviations, complaints, stability information, validation evidence, supplier knowledge and technical expertise. Analysis considers the likelihood of harm and the severity of that harm; detectability may be useful where the selected method supports it. Evaluation compares the analysed risk with defined criteria to establish whether it is acceptable, requires further reduction or needs escalation.
GuideGxP advice: define the hazard, affected quality attribute or GMP objective, patient or product-availability consequence, assumptions, evidence sources and decision owner in plain language before selecting a scoring method. This prevents a numerically neat assessment from answering the wrong question.
Risk control, communication and review
Risk control includes deciding whether risk reduction is needed, implementing controls, and assessing residual risk. Controls may reduce the likelihood of occurrence, improve detection, reduce consequences where possible, or remove the source of risk. The benefit of risk reduction should be considered against the resources used; risk control is not a promise to eliminate every risk.
Risk communication means sharing risk information and decisions among decision-makers and relevant stakeholders. It may include dialogue with functions, sites, suppliers, customers or regulators where appropriate. Risk review checks whether the output remains current in light of events, changes, inspections, complaints, recalls, new knowledge or planned activities.
For lifecycle activities, connect QRM outputs to the governing system rather than filing them in isolation. A risk assessment supporting validation planning, for instance, should be traceable to the scope, acceptance approach and ongoing review described in a Validation Master Plan under Annex 15.
Decision formality should fit the risk, uncertainty and decision impact
Appropriate formality is often misunderstood as a choice between a fully facilitated workshop and no record. ICH Q9(R1) instead calls for a commensurate level of effort, formality and documentation. A simple, well-reasoned record can be more useful than an elaborate tool applied without relevant expertise.
ICH Q9(R1) also addresses risk-based decision-making, subjectivity and uncertainty. Subjectivity can enter through framing, selection of information, scoring and interpretation of results. Uncertainty may arise from incomplete knowledge, ambiguous data, model limitations or a changing operating context. Neither should be concealed by a risk score. They should be recognised, reduced where feasible and reflected in the decision, controls or follow-up.
| Decision context | Indicative formality | Useful evidence and record | GuideGxP implementation advice |
|---|---|---|---|
| Routine, well-understood decision with established controls and low potential impact | Focused assessment | Known data, rationale, accountable approver and linkage to the relevant quality record | Use a concise documented rationale; avoid creating a stand-alone multi-page analysis without added value. |
| Change or event with plausible quality impact, cross-functional dependencies or material uncertainty | Structured cross-functional assessment | Defined risk question, evidence sources, assumptions, identified controls, residual-risk conclusion and review trigger | Use a suitable tool and include knowledgeable process, quality and technical participants. |
| Potentially high patient impact, significant product-availability consequence, novel situation or limited knowledge | High formality and governance | Robust scientific justification, alternatives considered, uncertainty assessment, documented acceptance rationale, escalation and effectiveness checks | Engage appropriate senior quality and technical governance early; explicitly define interim safeguards and reassessment points. |
This matrix is GuideGxP implementation advice. It is not a mandatory ICH categorisation, and an organisation should tailor its procedure, authorities and records to its own pharmaceutical quality system.
FMEA is useful, but it is not the universal answer
ICH Q9(R1) describes a range of risk-management methods and notes that no one tool or set of tools is applicable to every situation. Failure Mode Effects Analysis (FMEA) is therefore an option, not an ICH requirement. It can be particularly useful when a team needs to examine how a process, system or equipment function could fail, the effects of those failures and the controls that address them.
FMEA can support structured thinking, but a risk priority number must not become the decision itself. Scores are often based partly on expert judgement. Multiplying them can suggest precision that the evidence does not support, and identical totals can represent very different risk profiles. A severe potential patient consequence should not be obscured by arithmetic or averaged away by a combined score.
GuideGxP advice: use FMEA where failure modes and their effects can be meaningfully described. Define scoring scales before the workshop; capture the basis for important ratings; challenge inconsistent scoring; and record the narrative decision alongside any numerical output. Select another method, or a simple documented assessment, when it better fits the question. The appropriateness of the process matters more than the familiarity of the template.
Making uncertainty and subjectivity visible
- Separate observed evidence from assumptions and expert judgement.
- State important data gaps, variability and limits of transferability from prior knowledge.
- Use relevant subject-matter expertise, including independent challenge where the decision is consequential.
- Do not treat a risk ranking as a substitute for considering severity, context and uncertainty.
- Where uncertainty remains material, define additional data, temporary controls, monitoring or a review date.
Product availability belongs in the discussion when quality decisions may affect supply. This does not dilute patient protection: it helps decision-makers understand the consequences of available options and make balanced, knowledge-based choices within the pharmaceutical quality system.
Common QRM failure modes and how to correct them
Template-led assessments
A pre-populated form can turn a genuine assessment into a compliance ritual. Correct this by establishing the decision question, evidence and risk owner first, then using only the tool elements needed to support the decision.
Controls assumed rather than verified
Listing an SOP, alarm or qualification report does not demonstrate that a control is effective for the stated risk. Identify the control’s intended function, ownership, operating condition and evidence of effectiveness. Set a review trigger when the control or its context changes.
Risk acceptance without a defensible rationale
“Low” is a conclusion, not an explanation. The record should show why the residual risk is acceptable, who has authority to make that decision and how uncertainty was handled.
One-off assessments with no lifecycle link
Risk knowledge changes. Link outputs to change control, deviation and CAPA systems, validation, annual or periodic review arrangements, monitoring and management review as applicable. This makes risk review operational rather than ceremonial.
Inspection-ready QRM checklist
- Is the risk question specific, decision-oriented and within a defined scope?
- Are patient protection and relevant product-availability implications considered?
- Are evidence sources, assumptions, limitations and uncertainty documented?
- Is the chosen method proportionate and suitable, rather than automatically an FMEA?
- Were appropriate quality, technical and operational experts involved?
- Are the risk criteria and any scoring scales understood and applied consistently?
- Are existing and proposed controls clearly identified, with control owners?
- Does the conclusion explain residual-risk acceptance, reduction or escalation?
- Are decisions, approvals and risk communication traceable to the relevant quality-system record?
- Are effectiveness measures, review triggers and reassessment responsibilities defined?
Frequently asked questions
Is FMEA required by ICH Q9(R1)?
No. ICH Q9(R1) describes tools and acknowledges that no one tool or set of tools applies to every situation. FMEA is one possible method.
Does a low score mean a risk is acceptable?
Not by itself. Acceptance should reflect the risk context, scientific knowledge, uncertainty, applicable criteria and a documented decision rationale.
How much documentation is enough?
Enough to show a proportionate, science- and knowledge-based process, the decision made, its rationale, controls and any necessary review. ICH Q9(R1) says documentation should be commensurate with risk.
When should a QRM assessment be reviewed?
Review it when new information, changes, events or monitoring indicate that the original risk understanding or control strategy may no longer be appropriate.
Primary source
Stay practical: The Pragmatic GMP
Subscribe to The Pragmatic GMP for evidence-led GMP analysis, practical checklists and regulatory updates.
