Risk Management (ICH Q9) Workflow

⚖️

Quality Risk Management - A Systematic Process for a Scientific Judgment

ICH Q9(R1) establishes quality risk management as a systematic process for the assessment, control, communication, and review of risks to product quality across the product lifecycle. Rather than a single tool or a one-time exercise, it is a framework applied wherever a decision needs to be made under uncertainty, from facility design through process validation, supplier qualification, and change control. The rigor and formality applied should be proportionate to the level of risk involved, meaning not every risk question warrants a full formal assessment, but every significant decision should be able to show that risk was genuinely considered.

ICH Q9(R1) · ICH Q10 · EU GMP Annex 20 / Part III

ICH Q9(R1)

ICH Q10

EU GMP Annex 20 / Part III

FMEA

Failure Mode and Effects Analysis systematically identifies potential failure modes and scores them by severity, occurrence, and detectability to prioritize risk reduction.

Best for: Process and equipment risk

Output: Ranked risk priority number

HACCP

Hazard Analysis and Critical Control Points identifies critical control points in a process where a hazard can be prevented, eliminated, or reduced to an acceptable level.

Best for: Contamination and process hazards

Output: Critical control point list

Fault Tree Analysis

Top-down logical diagram tracing how combinations of contributing events could lead to a specific undesired top-level failure.

Best for: Complex, multi-factor risk

Output: Logical failure pathway map

Risk Ranking and Filtering

Preliminary hazard analysis comparing and prioritizing multiple risks against a common set of qualitative or semi-quantitative factors.

Best for: Early-stage prioritization

Output: Relative risk ranking

Phase 1

Initiation and Planning

1Define the risk question and scope

Risk question framed clearly and specifically, with the boundaries of the assessment defined before any analysis work begins.

ICH Q9(R1)

↓

2Assemble a cross-functional team

Team assembled with the subject matter expertise relevant to the specific risk question, spanning quality, manufacturing, engineering, or other functions as needed.

ICH Q9(R1)

↓

3Select the appropriate risk management tool

Tool selected based on the nature and complexity of the risk question, whether FMEA, HACCP, fault tree analysis, or a simpler ranking approach.

ICH Q9(R1) Annex II

↓

4Gather relevant data and information

Historical data, prior investigation findings, scientific literature, and subject matter expert input gathered to inform an evidence-based assessment.

ICH Q9(R1)

Phase 2

Identification and Analysis

5Identify potential hazards and failure modes

Systematic identification of what could go wrong, drawing on the team's collective expertise and any relevant historical data or precedent.

ICH Q9(R1)

↓

6Analyze severity, probability, and detectability

Each identified risk analyzed against these three dimensions, forming the basis for a consistent, comparable risk score across the assessment.

ICH Q9(R1)

↓

7Apply the selected tool to score and rank risks

Formal scoring methodology applied consistently across all identified risks, producing a ranked output that supports prioritization.

ICH Q9(R1)

↓

Does the risk level exceed the pre-defined acceptance threshold?

YES → Proceed to risk control NO → Document and accept, proceed to review

Phase 3

Evaluation and Control

8Evaluate against acceptance criteria

Ranked risks compared against pre-defined acceptance criteria established before the assessment began, avoiding criteria set retrospectively to fit the results.

ICH Q9(R1)

↓

9Implement risk reduction measures

Controls implemented to reduce severity, occurrence, or improve detectability for risks exceeding the acceptance threshold, prioritized by risk ranking.

ICH Q9(R1)

↓

10Reassess residual risk after controls

Risk re-scored after mitigation measures are in place, confirming the residual risk now falls within the acceptable range, or documenting the rationale if it does not.

ICH Q9(R1)

Phase 4

Communication and Review

11Communicate outcome to stakeholders

Risk assessment outcome and rationale communicated clearly to decision-makers and affected functions, in a form appropriate to the audience.

ICH Q9(R1)

↓

12Integrate outcome into quality system documents

Assessment conclusions reflected in relevant documents such as the CCS, validation protocols, specifications, or SOPs, ensuring the risk work translates into practice.

EU GMP Annex 1 2022

↓

13Schedule periodic risk review

Review scheduled at a defined interval, or triggered by new information, a process change, or an event that could affect the original risk conclusions.

ICH Q9(R1)

Risk Level Classification

High Risk

Risk level requiring mandatory reduction measures before the process, system, or decision can proceed, with documented residual risk reassessment.

Mandatory mitigation required

Medium Risk

Risk level warranting consideration of reduction measures, with a documented rationale if the decision is made to accept the risk as-is.

Mitigation considered, rationale documented

Low Risk

Risk level generally acceptable without further mitigation, though still documented and subject to periodic review.

Acceptable, documented

High-Risk Escalation Response Steps

Step 1 - Confirm the risk score is well-supported Verify the severity, occurrence, and detectability scores are grounded in genuine data or sound scientific rationale before proceeding.

Step 2 - Notify quality and relevant leadership Communicate high-risk findings promptly to quality leadership and any function with authority over the affected process or system.

Step 3 - Identify feasible risk reduction options Generate a range of potential mitigation measures, evaluating feasibility, cost, and expected risk reduction for each.

Step 4 - Implement and verify controls Implement selected controls and verify their effectiveness through data before considering the risk reduced.

Step 5 - Document any residual risk acceptance decision Where risk cannot be reduced further, document a formal acceptance decision with clear rationale and appropriate sign-off authority.

Data and Documentation Requirements

Evidence-based scoring Severity, occurrence, and detectability scores supported by data, prior investigation history, or clearly stated scientific rationale rather than unsupported opinion.

Pre-defined acceptance criteria Risk acceptance thresholds established before the assessment is scored, preventing criteria from being adjusted to reach a predetermined conclusion.

Traceable assumptions Key assumptions underlying the assessment documented explicitly, supporting later review if underlying conditions change.

Version-controlled living document Risk assessment maintained as a version-controlled document, updated at defined review points or when triggering events occur.

Common GMP Applications for Quality Risk Management

Facility and Equipment Design Risk assessment informing HVAC design, material flow, and equipment selection decisions during facility planning.

Process Validation Strategy Risk-based approach to identifying critical process parameters and determining the extent of validation required.

Supplier and Material Qualification Risk-based prioritization of supplier audit frequency and incoming material testing rigor based on criticality.

Change Control Impact Assessment Risk assessment determining the scope of qualification or validation work required to support a proposed change.

Contamination Control Strategy Risk assessment forming the analytical backbone of the CCS, prioritizing controls across the facility's contamination sources.

Cleaning Validation Approach Risk-based determination of worst-case product and equipment combinations for cleaning validation studies.

Data Integrity Vulnerability Assessment Risk assessment identifying systems and processes most vulnerable to data integrity gaps, prioritizing remediation effort.

Product Lifecycle Risk Review Periodic risk reassessment across the product lifecycle as manufacturing experience, complaint data, and process knowledge accumulate.

Never do this

Set risk acceptance criteria after scoring to reach a predetermined conclusion. Apply a single risk tool to every risk question regardless of fit. Treat a low initial risk score as a reason to skip documentation entirely. Leave a documented high-risk finding without a formal, sign-off-level acceptance or mitigation decision.

Risk assessment vs risk management

Risk assessment is the identification, analysis, and evaluation step. Risk management is the complete cycle, including control, communication, and review, that ensures the assessment's conclusions are acted upon and periodically revisited rather than filed away.

Qualitative vs quantitative

A qualitative assessment uses descriptive risk categories and is often sufficient for lower-complexity questions. A quantitative or semi-quantitative approach, using numeric scoring, provides more rigorous comparability across a larger or more complex set of risks, at the cost of greater time investment.

Key regulations

ICH Q9(R1) - quality risk management principles, process, and tools. ICH Q10 - integration of risk management into the pharmaceutical quality system. EU GMP Annex 20 / Part III - quality risk management as applied within EU GMP.