Quality Risk Management for Pharmaceutical Water Systems: Hazards, Critical Control Points and Control Strategy

During an inspection, the hard question is not “do you have a risk assessment for the water system?”. That one always has an answer: there is a file, it is signed, it is filed. The hard question is the follow-up: “show me a decision this risk assessment changed.”

Very often no answer comes. The document was written once, during qualification, after the loop layout had already been frozen and after someone else had already written the sampling plan. Alert levels came from the supplier's default. Sampling points are the ones you can reach without a platform ladder. The risk assessment exists, but it has never decided anything: it describes the system, it does not govern it.

This article works the other way round. Not “how to fill in a matrix”, but how to build an assessment that produces design constraints, acceptance criteria, sampling points and review triggers, and that stays alive across the system life cycle. It is part of the Pharmaceutical Water & WFI Systems cluster.

Terminology: what we mean by critical control point

First, an honest note on vocabulary, because it is a recurring source of confusion. “Critical control point” is not a defined GMP term for pharmaceutical water systems. It does not appear as a definition in EudraLex Volume 4 Annex 1, nor in Annex 15. It originates in food safety (HACCP), and in the pharmaceutical field it is referenced mainly as a method — ICH Q9(R1) lists HACCP among the quality risk management tools in Annex I, without mandating it and without defining a threshold of “criticality”.

In this article the term is used in a process control strategy sense: the point at which a control, if exercised, prevents or intercepts the loss of a water quality attribute, and at which loss of control is not recovered downstream. It is a working label, not a requirement. If your quality system uses the term, it must define it in a procedure and apply it consistently, and it must never be presented to an inspector as a regulatory obligation. Otherwise, use the vocabulary the legislation actually uses — risk-based controls on utilities (Annex 1, 6.1-6.5) and contamination control strategy, of which water quality is explicitly an element (Annex 1, 2.5(v)). A document that uses regulatory terms that do not exist invites the inspector to ask where they are written.

The regulatory frame: what is actually being asked of you

None of these texts gives you the numbers. They tell you that you must set them, justify them and review them.

• ICH Q9(R1), Step 4 on 18 January 2023. QRM is a process — risk assessment, risk control, risk communication, risk review — not a form. The R1 revision made four themes explicit that weigh heavily on a water system: the subjectivity of the assessment and how to contain it; formality as a spectrum, with rigour commensurate with the uncertainty, importance and complexity of the issue; risk-based decision-making; and risk to product availability. Q9(R1) also states that resource constraints do not justify a lower level of formality.
• ICH Q10, Step 4 on 4 June 2008: residual risk and its trend are an input to management review, not a project annex.
• Annex 1 (C(2022) 5938 final, in operation since 25 August 2023): water quality is an element of the CCS (2.5(v)); utilities are to be controlled on a risk basis, and utilities in direct contact with the product carry the highest risk (6.1-6.5); the plant is to be designed, installed, commissioned, qualified, monitored and maintained to prevent microbiological contamination, minimising particulates, microbial proliferation and endotoxin/pyrogen, with pipework sloped for drainage and dead legs avoided (6.7); qualification must take seasonal variation into account (6.8); flow must remain turbulent to limit microbial adhesion and biofilm, with flow rate established at qualification and monitored routinely (6.9); sanitisation follows a predetermined schedule and is also a remedial action (6.12); alert levels are based on initial qualification data and are periodically reassessed (6.13); alert excursions are documented, reviewed and investigated, distinguishing an isolated event from an adverse trend (6.14); WFI systems include continuous monitoring such as TOC and conductivity (6.15).
• EMA Q&A EMA/INS/GMP/443117/2017 (effective 1 August 2017), on WFI produced by non-distillation methods. Two statements feed straight into the risk assessment: reverse osmosis typically operates at ambient temperature and therefore constitutes an ideal environment for biofilm formation; and on limits, “Increasing of such limits is not good practice and may mask a failing system”. The document expects extensive testing, daily testing of all critical points in the initial phase and roughly a year of data to capture seasonal variation, and asks for at least an annual assessment of monitoring effectiveness.
• WHO TRS 1033, Annex 3 (2021): alert and action levels are established from reported historical data and, for bulk purified water, determined by system knowledge and data trending.
• PIC/S Aide-Memoire PI 009-4 “Inspection of Utilities”, rev. 4, effective 1 January 2021: the document PIC/S inspectors use to prepare for looking at utilities.

The EMA Guideline on the quality of water for pharmaceutical use (EMA/CHMP/CVMP/QWP/496873/2018, in force since 1 February 2021) defines the minimum water grade by use and route of administration, but sets no alert/action limits, no sanitisation frequencies and no periodic review rules. That gap is precisely what the risk assessment has to fill with a documented justification.

Scope and boundaries: the part almost nobody writes

A risk assessment without declared boundaries falls apart at the first challenge. Four things belong in writing before you list any hazard. Upstream: the potable water supply contract, the delivery point, the break tank or raw storage — for sites exporting to the United States, 21 CFR 211.48 requires potable water supplied under continuous positive pressure in a plumbing system free of defects, the only water criterion in Part 211 and an upstream integrity requirement that often falls outside scope. Downstream: the point of use valve, the user's flexible hose, the sampling point, the transfer into the process; the hose is almost always the most challenged and the least documented item. Adjacent systems: pure steam, CIP, laboratory water, condensate — state whether they are in scope or covered by a separate assessment, and cite that assessment. Supporting processes: sampling, laboratory, maintenance, calibration, automation and SCADA, change control; these are processes, not pipes, but they are where many real failure modes originate.

Write down what you have deliberately excluded, and why. A boundary that is not written is a boundary that will be argued during an inspection.

The real hazards of a water system

Biofilm. This is the structural hazard, not an accident. Adhered cells produce a matrix that protects them from sanitisation and from flow, and they release planktonic cells intermittently: low, stable counts for weeks, then a spike with no apparent cause, then low values again. In a system with established biofilm that spike is not analytical noise, it is a release event. Hence the two controls Annex 1 names explicitly — turbulent flow (6.9) and drainable geometry without dead legs (6.7) — and the EMA Q&A warning about ambient-temperature RO systems. The subject is developed in the article on microbiological and endotoxin control in PW and WFI.

Endotoxin. A hazard independent of microbial count: endotoxins survive cell death and are not removed by thermal sanitisation, which can in fact release them by lysing cells. A system can therefore show counts in control and a rising endotoxin load. Treat them as a separate attribute, with their own failure modes and their own detection: Annex 1 clause 6.7 requires endotoxin and pyrogen to be minimised, not only microbial proliferation.

Chemical hazards. Ionic breakthrough from exhausted or degraded membranes and resins, organic carry-over measured as TOC, residues of sanitising and regenerating agents, corrosion products and rouging, leachables from polymers and gaskets, disinfectants present in the feed water. Many of these have no dedicated alarm: they surface as a conductivity or TOC trend, which is exactly why Annex 1 clause 6.15 requires continuous monitoring of those two attributes on WFI systems.

Stagnation. It multiplies every microbiological hazard, and it is not only about geometric dead legs: it covers rarely used points of use, spare branches left for future expansion, instruments on side taps, samplers and drain valves. A branch that fully complies with geometric criteria but is opened once a month behaves like a dead leg.

Source water variability. It changes with the season, with the utility's abstraction source, with rainfall, with works on the network, with the operator's disinfection regime: microbial load, organic matter, temperature, hardness, residual chlorine or chloramine all move. Annex 1 clause 6.8 requires qualification to take seasonal variation into account, and the EMA Q&A expects roughly a year of data precisely to capture it. A system qualified in a single season carries a knowledge gap that the risk assessment must declare, not hide.

Typical failure modes in generation, storage and distribution

A list of hazards is not enough: a risk assessment works on the ways the system fails. The table collects failure modes that recur across plants. It is not exhaustive and it does not replace analysis of your own installation: it is a starting point for the working session.

From hazard to control point: four criteria

The question “is this a critical point?” produces endless debate without criteria. Four criteria, applied in order, settle most of it.

1. Direct impact. Loss of control alters a quality attribute of the water delivered to the process. If the effect is only on efficiency, consumption or consumable life, it is a process control point, not a quality one.
2. Controllability. A control can actually be exercised there: an adjustable parameter, a barrier, a cycle, a procedure. If none exists, it is not a control point but a design constraint, to be resolved in design or accepted as declared residual risk.
3. Timely verifiability. A verification exists that returns evidence in time to prevent use of the water. A control verified only by an analysis whose result arrives after consumption is weak on detection, however accurate the method.
4. No downstream recovery. Loss of control is not corrected by a later step. This is the criterion that separates a critical point from a mere monitoring point, and it is the one teams forget most often.

Applied together they cut the list of critical points from several dozen down to a handful of decisive ones. That is the objective: a control strategy in which everything is critical discriminates nothing.

FMEA applied to a water system

FMEA is one of the tools listed in Annex I of ICH Q9(R1), alongside FMECA, FTA, HACCP, HAZOP, preliminary hazard analysis, risk ranking and filtering, and the supporting statistical methods. None is mandatory: the guideline asks that the tool suit the problem and that formality be commensurate with uncertainty, importance and complexity. On a water system FMEA works well, because the system is made of components with identifiable failure modes; it works badly when used as an arithmetic exercise.

• Choose the granularity before you start. Run the FMEA at the level at which you can take a decision: analysing every valve produces hundreds of rows and no decision, while analysing “the loop” as a single item produces no specific control. The functional sub-system with its interface points is usually the right level.
• Document existing controls before scoring. Assess the system “bare” and you get a risk profile that does not exist; fail to list the controls and you cannot demonstrate why the risk is low.
• Be honest about detectability. It does not measure the quality of the analytical method, but the ability to intercept the failure in time to prevent use: an excellent method whose result arrives after consumption has low detectability. This is where subjectivity does the most damage, and it is exactly the theme ICH Q9(R1) made explicit.
• Do not turn RPN into an authorisation threshold. The product of three ordinal scales is neither additive nor linear, and very different combinations give the same number. Use it to rank priorities, then apply an explicit rule: every failure mode with maximum severity is assessed on its own, whatever the score.
• Cross-functional team and a facilitator. An FMEA written by a single function reflects only the hazards that function knows; a water system touches engineering, production, microbiology, QA, maintenance and automation.
• Separate design from operational FMEA. The design FMEA is run while decisions are still open and generates requirements; the operational one is run on the existing system and generates controls, monitoring and actions.

The template below can be adopted as it stands. The scoring columns are deliberately blank: you assign the values, using the scale your site has defined and justified.

You then need a scale. The table below is an example of structure, not a standard and not a regulatory reference. No severity, occurrence and detectability scale is prescribed by ICH Q9(R1) or by EudraLex: every site must define its own, justify it, approve it in a procedure and apply it consistently across assessments, otherwise the scores are not comparable. The scoring column is left blank on purpose.

Define the operational meaning of each level with examples from your own plant, otherwise two assessors will give the same failure different numbers. And fix the decision rule in a procedure — which combination requires action, which only monitoring, who may accept — before seeing the results: setting the threshold after seeing the scores is the most common way of making an FMEA say what had already been decided.

Worked example: Site Delta

Site Delta is a fictional site, used here as a teaching example. Nothing reported constitutes an acceptance criterion or a reference value.

Site Delta manufactures sterile injectables: a PW loop that also feeds a membrane WFI generator, and a WFI loop. The risk assessment had existed for years and had only been updated with formal revisions. Reopening it, with a cross-functional team and a facilitator from outside the area, produced four outcomes, none of them exotic.

A forgotten point of use. A room used twice a month was served by a branch with a manual valve, and no failure mode covered it because the previous analysis had stopped at the header. The no-downstream-recovery criterion made it a critical point. Outcome: flush before use, inclusion in the rotating sampling plan, and a technical evaluation of removing the branch.

An incomplete integrity test. The WFI tank vent filter was tested after use, but the procedure did not require testing before installation, which Annex 1 clause 6.11 requires alongside condensate prevention. The FMEA had given the filter high detectability without checking what the procedure actually required. Outcome: procedure revised, filter heating verified, and a methodological lesson — detectability is verified against the current document, not against the team's belief.

A single-season qualification. The PQ had been run entirely in winter and the gap was not declared. Outcome: the gap was recorded as residual risk with a deadline, extended monitoring was set up to cover the annual cycle, and alert levels were kept provisional until the programme closes.

A flow rate recorded but not alarmed. A slow drop in WFI loop return flow would only have been visible at the monthly review, whereas clause 6.9 requires flow rate to be established at qualification and monitored routinely precisely because turbulent flow is a control against microbial adhesion. Outcome: alarm configured under change control, audit trail check on threshold changes, detectability recalculated.

None of the four outcomes required significant investment, and all four were invisible in the previous document: that document had been built to exist, not to decide.

From assessment to control strategy

The control strategy is not a document: it is the set of controls that keep the system inside its validated state, spread across several layers. The risk assessment establishes which layer holds each hazard, and flags the hazards resting on a layer that is too weak.

• Elimination. The most robust control is not having the hazard: remove a branch, delete a spare leg, move an instrument in line. It costs during design and costs nothing afterwards.
• Design controls. Drainable geometry, no dead legs, slope for drainage, materials and finish, sizing for turbulent flow, thermal regime or ozonation (Annex 1, 6.7 and 6.9). These are the only controls that do not depend on daily human behaviour.
• Operational controls. Continuous recirculation, temperature regime, predetermined sanitisation schedule and sanitisation as a remedial action (6.12), management of points of use and hoses.
• Monitoring controls. Regular and ongoing chemical and microbiological monitoring (6.13), continuous TOC and conductivity monitoring on WFI systems (6.15), a sampling plan built on the critical points identified.
• Procedural and quality system controls. Deviations, trending, investigations, change control, periodic review, training. The last layer and the most fragile, because it depends entirely on execution.

The practical rule: a hazard controlled only at the detection layer is not a controlled hazard. If the only defence against contamination of a point of use is periodic sampling, you do not have a control: you have a hope with a record attached. The risk assessment must make these cases visible and force a decision — strengthen the layer above, or accept the residual risk explicitly. For sterile products all of this feeds the contamination control strategy, of which water quality is an element (Annex 1, 2.5(v)): an assessment that neither feeds the CCS nor receives its constraints is a parallel document, and it shows during an inspection.

Residual risk: who accepts it, and on what evidence

ICH Q9(R1) treats risk acceptance as an informed decision, not a closing formality. Three honest categories are enough: risk reduced to an acceptable level and monitored, with controls in operation and the trend under observation; risk accepted with justification and a deadline, where the ideal control cannot be applied now, with a compensating measure and a review date; and unacceptable risk, which is not residual risk at all but an open action with an owner and a date.

Two rules avoid most of the trouble. Acceptance belongs to a role, not to a project: a risk accepted “by the project team” has no owner once the project closes. And a residual risk that depends on a control not yet installed is not a residual risk, it is an open action disguised as a conclusion.

How the risk assessment ties URS, design, qualification, monitoring and periodic review together

This is where a living risk assessment differs from an annex. Risk assessment is not a project phase: it is the thread running through every phase, and each phase must both receive something from it and return something to it. If the flow is one-way, the document dies on first delivery.

Two connections deserve detail. The first is with the water system URS: every requirement born of a hazard should be traceable back to that hazard, so that in design review everyone knows which requirement is negotiable and which is not. A requirement with no origin is cut at the first cost discussion, because nobody knows what it protects. The science- and risk-based approach of ASTM E2500-25 rests on exactly that traceability, and the upstream choice of the water grade required for the intended use is the first risk-based decision of the project: over-specifying quality is not caution, it is moving the risk onto maintaining a more complex system.

The second is with monitoring. The sampling plan is where the assessment becomes verifiable every week: if the points sampled are not the ones identified as critical, you have two documents describing two different systems. Annex 1 clause 6.13 closes the loop on the criteria side — alert levels come from initial qualification data and are periodically reassessed on the basis of requalification, routine monitoring and investigations. They are not a configuration parameter: they are an output of the life cycle.

Periodic review: when, not just how often

A fixed frequency is the worst way to manage review, because it guarantees the document is updated at the wrong moment. ICH Q9(R1) frames risk review as a continuing process, with re-evaluation triggered by planned events (product review, inspections, audits, change control) and unplanned ones (investigations, recalls), at a frequency based on the level of risk. Translated onto a water system, these are the triggers to put in the procedure.

• Changes under change control affecting geometry, materials, thermal regime, sanitisation cycles, instrumentation or alarm logic.
• Addition or removal of a point of use, and any significant change in the demand profile.
• A new product or process requiring a different water grade or a different use of an existing point.
• Deviations, OOS and OOT, with the isolated event versus adverse trend distinction required by clause 6.14.
• Source water changes: a new abstraction source, a change in disinfection regime, an abnormal seasonal event, works on the network.
• Outcomes of periodic requalification and of the alert level review.
• Retrofit, replacement of major components, obsolescence of the control system.
• Assessment of monitoring effectiveness: the EMA Q&A on non-distillation methods asks for at least one a year.
• Publication or entry into force of an applicable regulatory text.

One trap deserves naming. When a system starts producing repeated excursions, the quickest reaction is to revise the limits upwards: the excursions disappear and the trend looks “in control” again. EMA Q&A EMA/INS/GMP/443117/2017 addresses this without hedging: “Increasing of such limits is not good practice and may mask a failing system”. Raising an alert level is legitimate only as the conclusion of an analysis showing that the previous level was inadequate against data from a system in a state of control, never as a remedy for a system that is failing. The same logic applies to the levels cited in the informational chapter USP <1231>, which remain non-binding action levels and do not replace in-house specifications built on your own data. Risk review is also the natural trigger for periodic review and retrofit decisions: the point at which you decide whether a residual risk accepted three years ago is still acceptable, or has become the way of not addressing a structural problem.

Common mistakes and inspection red flags

• Writing the risk assessment after the design freeze: it can then only justify decisions already made.
• Assessing the system “bare”, without listing the existing controls.
• Assigning high detectability to a control whose result arrives after the water has been used.
• Using an RPN threshold as automatic authorisation, or setting the acceptability threshold after seeing the scores.
• Not defining the scale in a procedure, and ending up with scores that cannot be compared across successive assessments.
• Stopping the analysis at the header, leaving out branches, hoses and low-frequency points of use.
• Treating endotoxin as an automatic consequence of microbiological control.
• Qualifying in a single season and not declaring the gap.
• Presenting “critical control point” as a regulatory term without having defined it in a procedure.

In an inspection, these are the signals that open the discussion.

• A single signature date and no revision after years of operation with documented deviations.
• Monitoring plan points that do not match the critical points of the assessment.
• Alert levels not traceable to qualification data or to historical data analysis, or raised with reduced excursions recorded as the justification.
• Repeated excursions closed individually as isolated events, with no trend evaluation.
• Plant modifications visible in the field but absent from the updated P&ID and from the risk assessment.
• Residual risks “accepted” with no owner, no technical justification and no review date.
• A severity, occurrence and detectability scale not defined in any approved procedure.
• Loop flow rate recorded but with neither criterion nor alarm, while being cited as a control against biofilm.
• The water system risk assessment not referenced by the site contamination control strategy.

If these topics are useful to you, The Pragmatic GMP collects operational analysis on qualification, utilities and water systems. No promotion, only material you can use at work.

Key takeaways

• A risk assessment that has not changed a decision is not a risk assessment: it is a description of the system.
• “Critical control point” is not a defined GMP term for water systems: use it as a control strategy label and define it in a procedure.
• The regulations ask for the method, not the numbers: ICH Q9(R1) for the process, Annex 1 for risk-based controls on utilities, WHO TRS 1033 Annex 3 for deriving alert and action levels from historical data.
• Biofilm, endotoxin, stagnation and seasonal source water variability are the structural hazards: treat them as distinct entries, with their own failure modes and detection.
• Four criteria identify a critical point: direct impact, controllability, timely verifiability, no downstream recovery. The fourth is the one that gets forgotten.
• No severity, occurrence and detectability scale is prescribed: the site defines it, justifies it and approves it before use; RPN ranks priorities, it does not authorise.
• A hazard controlled only by detection is not controlled: build the control strategy from elimination downwards.
• Residual risk is accepted by a role, with justification and a deadline. If it depends on a control not yet installed, it is an open action.
• Review must be triggered by events, not only by the calendar, and raising limits to make excursions disappear masks a failing system.

Regulatory and technical references

• ICH Q9(R1) Quality Risk Management, Step 4 on 18 January 2023; ICH Q10 Pharmaceutical Quality System, Step 4 on 4 June 2008 — ich.org
• EudraLex Volume 4, Annex 1, C(2022) 5938 final, in operation since 25 August 2023 (clauses 2.5(v), 6.1-6.5, 6.7, 6.8, 6.9, 6.11, 6.12, 6.13, 6.14, 6.15); Annex 15, in operation since 1 October 2015 — an EU-PIC/S revision concept paper was published on 9 February 2026 with consultation closing on 9 April 2026, but Annex 15 has not been revised — EudraLex Volume 4
• EMA Guideline on the quality of water for pharmaceutical use EMA/CHMP/CVMP/QWP/496873/2018, in force since 1 February 2021 — ema.europa.eu; EMA Q&A EMA/INS/GMP/443117/2017, effective 1 August 2017
• WHO TRS 1033, Annex 3 (2021) — who.int; PIC/S Aide-Memoire PI 009-4 Inspection of Utilities, rev. 4, effective 1 January 2021 — picscheme.org
• USP <1231> Water for Pharmaceutical Purposes, informational chapter (the action levels quoted are non-binding); USP <643> and <645>
• 21 CFR 211.48 Plumbing — eCFR Part 211; FDA Guide to Inspections of High Purity Water Systems (July 1993), non-binding — fda.gov
• ASTM E2500-25 (approved 1 April 2025); ISPE Baseline Guide Vol. 4 Water and Steam Systems, 3rd edition, September 2019; PDA Technical Report No. 69 (2015) — industry guides, not regulations