Quality Risk Management:

An introduction to
ICH Q9(R1) and an
overview of the
Guideline:

• Part I: Principles and Key

Concepts

• Part II: Structure of the

Guideline
1
 Legal Notice
This presentation is protected by copyright and may, with the exception of the ICH logo,
be used, reproduced, incorporated into other works, adapted, modified, translated or
distributed under a public license provided that ICH's copyright in the presentation is
acknowledged at all times. In case of any adaption, modification or translation of the
presentation, reasonable steps must be taken to clearly label, demarcate or otherwise
identify that changes were made to or based on the original presentation. Any
impression that the adaption, modification or translation of the original presentation is
endorsed or sponsored by the ICH must be avoided.
The presentation is provided "as is" without warranty of any kind. In no event shall the
ICH or the authors of the original presentation be liable for any claim, damages or other
liability arising from the use of the presentation.
The above-mentioned permissions do not apply to content supplied by third parties.
Therefore, for documents where the copyright vests in a third party, permission for
reproduction must be obtained from this copyright holder.​

2
 This training presentation is in
2 parts
• Part I – Principles & Key Concepts
o This provides introductory information about Quality Risk Management
(QRM) and the ICH Q9(R1) Guideline
o It explains certain risk and QRM-related concepts
o It explains the role of ICH Q9(R1) in facilitating the manufacture and
regulation of medicines, and the protection of patients
o It emphasizes a number of important aspects that Senior Management
should take into account and prioritize when implementing the ICH Q9(R1)
guidance.

• Part II – Structure of the ICH Q9(R1) Guideline

o This provides a detailed overview of how the guideline is structured, and it
highlights the key points in each section
o It clarifies the connection between the core content of the guideline and its
two Annexes
o It highlights several important factors that Senior Management should
consider and give priority to when implementing the ICH Q9(R1)
guidance. 3
Part I: Principles and Key
Concepts

4
 Consider these
definitions…

Quality The degree to which a set of inherent

properties of a product, system or
process fulfills requirements
Risk The combination of the probability of
occurrence of harm and the severity of
that harm
A systematic process for the
QRM assessment, control, communication
and review of risks to the quality of the
drug (medicinal) product across the
product lifecycle

5
 6

ICH Q9(R1) is a guideline that

provides guidance on a relatively
complex subject area; the
management of risk
Managing Risk is inherently an expression of uncertainty, and
risk is uncertainty, by its very nature, presents challenges
challenging
for a variety when trying to deal with it
of reasons:
Risk is probabilistic in nature, and estimating
probabilities of occurrence with a high degree of
accuracy can be difficult

Risk assessment relies on the identification of hazards

and an understanding of their associated risks, and
different stakeholders can view hazards and risks
differently
 The Desired State, in an ICH Q9(R1)
context, may be characterised by the
following:
Risks to patients are effectively managed, based on science,
knowledge and relevant controls
• Such risks may relate to the product, the process and the facility.
• The level of oversight required to manage risk is commensurate with the level of risk that
is presented to the patient. This is done through an effective Pharmaceutical Quality
System (PQS).
• Barriers to continual improvement are reduced or removed, leading to enhanced product
quality and manufacturing efficiency.
• Proactive activities are undertaken to address risk, and there is reduced reliance on
reactive measures.
• Potential quality issues during development, manufacturing and distribution are identified
and addressed.
• Both industry and competent authorities focus on areas of higher risk and have a good
understanding of residual risks.
• ICH Q9(R1) provides an approach for the management of risk that can be implemented
by industry and regulators alike
• There is transparency in how risks are managed, with a common understanding of risk
among stakeholders, and the language of risk is standardised.

7
 Risk,
Quality Risk Management
and
Related Concepts

8
 The Concept of Risk

ICH Q9(R1) defines risk as:

A combination of the probability of occurrence of harm and the
severity of that harm

Risks can relate to the • e.g., equipment, utilities, facilities,

manufacturing facility… interfaces, the environment, IT systems

Risks can relate to the • e.g., process operations, controls,

manufacturing quality parameters
processes…

Risks can relate to the • e.g., quality attributes, the product

medicinal (drug) packaging, product stability
product…

Risks can relate to the • e.g., Quality systems, controls,

organisation… documentation, regulatory compliance
9
 Risk may be perceived differently
by individuals and organizations

• Regardless of how risk is defined and classified, it is important to

acknowledge that different stakeholders may perceive hazards and
risks differently.
• They may interpret potential harms differently, assign different probabilities to
each harm's occurrence, and attribute varying degrees of severity to each
harm.
• Subjectivity in QRM can lead to biased risk assessment outcomes, and these
can give way to sub-optimal risk controls, poor risk-based decisions, and
ineffective QRM outcomes generally – if not addressed.

See the ICH website for training materials on

Subjectivity in Quality Risk Management
Link

10
 Risk is a combination of the
probability of occurrence of harm
and the severity of that harm​
Assessing risk is all about understanding
the scenarios that potentially lead to harm:​

Probability of occurrence of
• Analysing the chain of events Event
is useful to understanding the elements
of severity and probability of harm.​

Harm
Event
Probability of occurrence of harm:​
• This relates to the probability of harm
occurring​
• It covers the likelihood of the entire event Event
chain leading to harm​
• It is part of answering the question ”What
is the likelihood (probability) it will go
Harm
wrong?”​

Severity of harm:​ Severity of

• A measure of the possible consequences Harm
of a hazard (definition from ICH Q9R1)​
Note: This diagram
• A way to measure the size of harm (or illustrates the concepts of
how much is would hurt)​ Severity and Probability of
• It is part of answering the question “What Harm. It is not meant to be
are the consequences?” ​ prescriptive of any 11
methodology, format or
 Severity and Probability are
important in most considerations
of risk

But these are not simple concepts…

• Which consequence is more severe?
o 300 lives lost in single, fiery plane crash.
o 300 lives lost on US roads over a weekend.
o 300 lives potentially lost from cancer within the next 20 years

• In relation to probability, what does a “30% chance of rain

tomorrow” mean?
o 30% of the days like tomorrow will have at least a trace of rain.
o 30% of the area will have rain tomorrow.
o 30% of the time tomorrow, it will rain.

Making judgements about severity and probability is influenced

by many factors, including how people perceive the hazard
or the risk in question. 12
 Severity and Probability cont’d

People judge the severity of an event by more than just the numbers
they may have been given.
• Severity can be difficult to quantify, because factors relating to how people
perceive hazards and risks can play a significant role.
• Risk perception and human heuristics can introduce bias that can lead to
counter-intuitive judgements about severity. For example:
o The severity ratings people may assign to a scenario such as ‘300 lives lost’
depends on factors such as whether the hazard or the risk in question is
one that is voluntarily taken on, or not so.
o Riding a motorcycle at high speed could be considered to be a hazard that
motorcyclists voluntarily assume.
• Other risk perception factors that can influence severity judgements relate to
the degree of control that is in place for the hazard or risk scenario. An
example here is an airline crash - the passengers generally have little control
over such a risk scenario.
13
 Severity and Probability cont’d

How catastrophic a hazard or a risk is perceived to be is also an

influencing factor in how people make judgements about severity.
• A fire in a high-rise apartment building that kills 100 people within the space of an
hour can be perceived as more severe than a hazard which kills people in more
mundane and common scenarios, such as road traffic accidents, which occur all
the time and which often result in greater numbers of deaths.
And going back to probability estimation, there are many risk perception
and other factors that are known to interfere with people’s judgements.
• For example, the ease at which people can recall past instances of an event can
influence the probability of occurrence they assign to such events.
• Also, individuals often adopt various rules of thumb (heuristics) when estimating
probabilities, and in doing so, they may overlook the principles of probability. For
instance, when discussing a 30% chance of rain, it is crucial to recognize that it
also implies a 70% chance of no rain. However, this complementary information is
sometimes disregarded when describing the practical implications of a 30%
chance of rain.
14
 Severity and Probability cont’d

Key takeaway message:

It is important to devote time to understand the basic foundations of risk

estimation and risk perception, before making important risk-based
decisions.

See the ICH website for training materials on

Subjectivity in Quality Risk Management.

Those materials address risk perception issues,

including those related to human heuristics and
biases.

Link

15
 ‘Detectability’ can also be an
important consideration when
assessing risk
ICH Q9(R1) states the following:

• Quality risk management supports a scientific and practical approach to

decision-making.

• It provides documented, transparent and reproducible methods to

accomplish steps of the quality risk management process based on
current knowledge about assessing the probability, severity and
sometimes detectability of the hazards, and their associated risks.

• While detectability may not be a discrete factor in some quality risk

management methods, detection controls are important as they can
reduce the probability of occurrence of harm.

16
 Exploring probability of occurrence
of Harm - considering effect of
mitigation
Sometimes it is useful to split Probability of occurrence of Harm into separate elements,
because this can be helpful in answering the risk question.
An example of this could be singling out the effect of applied risk controls, as shown below:

Probability of Harm
Risk controls for Hazards and Failure Modes can
Probability of effect of mitigation
have different characteristics and effects.
Typically, they are intended to reduce the
Gross probability of Harm occurring

preventing harm (PMitigation)

Occurrence of Harm via:

without mitigation (POccurrence)

• Prevention
• Correction
• Detection

In addition, controls can mitigate the Severity of

Harm – e.g. loss of data, or product supply
issues – by establishing back-up systems for
critical data, or by qualifying an additional
supplier for a critical starting material.

17
 ICH Q9(R1) outlines two
fundamental principles that serve
as the foundation for QRM

The evaluation of The level of effort,

the risk to quality formality, and
should be based documentation of
on scientific the quality risk
knowledge and management
ultimately link to process should be
commensurate
the protection of
with the level of
the patient risk

18
Product Availability is also an
important consideration in QRM
activities

ICH Q9(R1) clarifies in the first

principle that ‘Risk to quality
includes situations where
product availability may be
impacted, leading to potential
patient harm’.
For more information, see the ICH
website for training material on
Product Availability Risks.
Link

19
 The ICH Q9(R1) QRM Process

ICH Q9(R1) outlines a Quality

Risk Management Process
• It comprises of four main elements
– Risk Assessment, Rick Control,
Risk Review and Risk
Communication.
• These process steps do not
necessarily occur in a strictly
sequential manner. For example,
Risk Communication, as illustrated
in the diagram, can take place at
any stage throughout the process.

20
The role of Knowledge and
Knowledge Management
in the QRM Process

21
 The importance of Knowledge and
Knowledge Management

Knowledge and Knowledge Management are of fundamental importance

when working to assess and manage risk, and ICH Q9(R1) makes
multiple references to knowledge and knowledge management; it states
the following:
Introduction:
QRM is part of building knowledge and understanding risk scenarios.
Knowledge is used to make informed risk-based decisions, trigger re-
evaluations and stimulate continual improvements.
Section 4.1 Responsibilities:
• Decision makers should… assure that a QRM process is defined, deployed
and reviewed and that adequate resources and knowledge are available.

22
 References to Knowledge and
Knowledge Management in ICH
Q9(R1), cont’d

Section 5.1 Formality in QRM

• The term “uncertainty” in quality risk management means lack of
knowledge about risks. The level of uncertainty that is associated with the
area being risk assessed informs how much formality may be required to
manage potential risks.
• Systematic approaches for acquiring, analysing, storing and disseminating
scientific information are essential for generating knowledge, which in turn
informs all quality risk management activities.
• Uncertainty may be reduced via effective knowledge management, which
enables accumulated and new information (both internal and external) to
be used to support risk-based decisions throughout the product lifecycle.

23
 References to Knowledge and
Knowledge Management in ICH
Q9(R1), cont’d

Section 5.2 Risk-based Decision Making

• As all decision making relies on the use of knowledge, see ICH Q10 for
guidance in relation to Knowledge Management.
• The above approaches to risk-based decision-making are beneficial,
because they address uncertainty through the use of knowledge,
facilitating informed decisions by regulators and the pharmaceutical
industry in a multitude of areas.
Section 5.3 Managing and Minimising Subjectivity:
• While subjectivity cannot be completely eliminated from quality risk
management activities, it may be controlled by addressing bias and
assumptions, the proper use of quality risk management tools and
maximising the use of relevant data and sources of knowledge (see ICH
Q10, Section 1.6.1).

24
 References to Knowledge and
Knowledge Management in ICH
Q9(R1), cont’d

Chapter 6 - In relation to Product Availability Risks

• The pharmaceutical quality system uses quality risk management and
knowledge management to provide an early warning system that supports
effective oversight and response to evolving quality/manufacturing risks
from the pharmaceutical company or its external partners.
• Approval and oversight of outsourced activities and material suppliers is
informed by risk assessments, effective knowledge management, and an
effective monitoring strategy for supply chain partner performance.
Chapter 7 – Definitions: Risk-based Decision Making
• An approach to, or a process of, making decisions that considers
knowledge about risks relevant to the decision and whether risks are at an
acceptable level.

25
Reflecting on the ICH Q9(R1)
guidance

26
 ICH Q9(R1) is an important source
of guidance for the manufacture
and regulation of medicines

• The guideline provides guidance on…

o What QRM is, its key principles and its main process elements
o The application of QRM across all stages of the product lifecycle, from
development through to product discontinuation
o Some of the methods and tools that may be used during quality risk
management activities
o The potential applications of QRM by the industry and regulators

27
 ICH Q9(R1), cont’d

• It facilitates…
o The effective management of product quality and product availability
risks that affect patients
o Risk-based decision-making by providing a structured process for
identifying hazards and managing risks, that uses science and
knowledge
o Timely, effective and consistent decisions in relation to hazards, risks
risk controls and risk acceptance
o Proactive and patient-focused actions on quality and availability risks,
that are realistic and appropriate
o Communication and dialog about hazards and risks between
stakeholders - this also helps build trust and understanding
o Manufacturing and regulatory flexibility

28
 ICH Q9(R1), cont’d

• It helps…
o Create an awareness of the need to manage risk
o Manage critical-to-quality aspects, through systems, organisations,
processes & products
o Optimize the use of resources and set priorities that focus on patient
protection
o Provides assurance that risks are effectively managed
o Define acceptable quality levels – it recognizes that it is not necessary
to address every single detail via specifications (product quality)
o Achieve compliance with external and internal requirements
o Prevent overly restrictive and unnecessary requirements that are not
science or risk-based

29
 ICH Q9(R1), cont’d

• It presents…
o Opportunities for industry and regulators
- For example, the use the same guidance by industry and
regulators when identifying hazards and when managing risks has
the potential to lead to more consistent approaches to risk-based
decision making by both parties
- Also, where warranted, the use of common QRM guidance can
help bring about the revision or withdrawal of some guidance that
is not risk-based.

30
 What ICH Q9(R1) is not…

The preceding slides address the role of ICH Q9(R1) and what its
use can lead to.
But it is important to also recognise that:
• ICH Q9(R1) is not a means to justify pre-determined outcomes/decisions
• It is not a means to justify poor practices, poor product quality or ineffective
processes
• The ICH Q9(R1) guideline states that “Quality risk management should not be
used in a manner where decisions are made that justify a practice that would
otherwise, in accordance with regulations and/or guidance, be deemed
unacceptable.”

31
 When implementing ICH Q9(R1),
there are several valuable aspects
that Senior
Management should take into
consideration…

32
 Useful things to focus on…

• Ensure the organisation applies the guidance in ICH

Q9(R1) in an appropriate and holistic manner:

1 o This requires effective education and training.

o The training material on QRM and ICH Q9(R1) on the
ICH website should be used as part of this work.
• Drive the integration of Quality Risk Management
2 within existing Quality System elements and activities:
o This requires a thoughtful and coordinated approach to
implementing the ICH Q9(R1) guidance.
• Promote a culture of risk-awareness:
o In this regard, it can be useful to establish and support
3 ‘QRM leaders’ across the organisation who can drive
that awareness.
33
 Implementing the guidance in ICH
Q9(R1)…
• Continue to embed QRM practices and behaviors into the product
quality-related aspects of business, technology and regulation
needs input from many different groups...
o Adapting the pharmaceutical quality system to reflect QRM in all areas
where risk-based decision-making is needed requires effective planning
and effort.
o The various training materials on the ICH website on QRM and ICH Q9(R1)
are useful in this regard.
• Some of the concepts that are addressed in the ICH Q9(R1)
Guideline are complex and multi-faceted…
o Examples include Subjectivity in QRM, Formality in QRM and Risk-based
Decision-making.

See the ICH website for training materials

on each of these topics.
Link 34
 It is important to
recognise that ICH Q9(R1)
is not intended to be a
stand-alone guideline
used in isolation

35
 ICH Q9(R1) supports several other
ICH Quality guidelines, as well as
other guidance and legislation

Many other ICH Quality Guidelines refer to risk, QRM

and risk-based approaches. Examples include:

• ICH Q12, for which risk-based change management is a

fundamental concern when working to achieve effective lifecycle
management and regulatory flexibility
• ICH Q7, which highlights the importance of QRM when
manufacturing active substances.
• ICH Q8(R2), which envisages the application of QRM principles
when designing and developing pharmaceutical control strategies,
• ICH Q10, which positions QRM as a key enabler of the
Pharmaceutical Quality System.

36
Part II: Structure of the
Guideline

37
 Table of contents of ICH Q9(R1)

The Guideline has eight main sections and two annexes:

1. Introduction
2. Scope
3. Principles of Quality Risk Management
4. General Quality Risk Management Process
5. Risk Management Methodology (this section links directly with Annex I:
Quality Risk Management Methods and Tools)
6. Integration of QRM process into Industry and Regulatory operations (this
section links directly with Annex II: Potential Applications for Quality Risk
Management )
7. Definitions
8. References
Annex I - Quality Risk Management Methods and Tools
Annex II - Potential Applications for Quality Risk Management

38
 Section 1 provides an Introduction
to the guideline

This section sets the scene, making a number of high-level

statements about Risk, Risk Management and Quality Risk
Management. It refers to several concepts and points that
are important in any consideration of QRM, including:

o Harm, severity of consequences and probability of occurrence

o Stakeholder issues, risk perception and subjectivity
o Patient protection, product quality and availability
o Risk-based decision-making, QRM effectiveness and Pharmaceutical
Quality System (PQS) effectiveness
o Root cause analysis, including considerations relating to human factors
o Proactive QRM and Continual Improvement

39
 Section 1, cont’d

• Other concepts and points addressed in the Introduction section

are…
o Product lifecycle considerations
o Building knowledge and understanding risk scenarios
o Using knowledge to make risk-informed decisions
o The extent and level of direct regulatory oversight
o Considerations in relation to digitalization and emerging technologies
o Formality in quality risk management
o Obligations to comply with regulatory requirements

40
 Section 2 shows the Scope of the
guideline

Scope of the guideline:

• “This guideline provides principles and examples of tools for quality risk
management that can be applied to different aspects of pharmaceutical
quality. These aspects include development, manufacturing, distribution,
and the inspection and submission/review processes throughout the
lifecycle of drug substances, drug (medicinal) products, biological and
biotechnological products (including the use of raw materials, solvents,
excipients, packaging and labeling materials in drug (medicinal) products,
biological and biotechnological products).”
The scope is quite comprehensive:
• It covers development, manufacturing and distribution activities
• It includes drug substances and drug (medicinal) products, biological and
biotechnological products
• It extends to regulator activities (inspection and submission review)
41
 Section 3 deals with the Principles
of Quality Risk Management

It refers to two primary principles:

The evaluation of The level of effort,

the risk to quality formality, and
should be based documentation of
on scientific the quality risk
knowledge and management
process should be
ultimately link to
commensurate
the protection of with the level of
the patient risk

42
 Section 4.1 of the Guideline
addresses Responsibilities in
relation to QRM activities
• The guideline states that Quality risk management activities
are usually, but not always, undertaken by interdisciplinary
teams.
• It refers to interdisciplinary teams from areas appropriate to the risk
being considered e.g.
o Quality Unit
o Product Development
o Business development
o Engineering
o Regulatory Affairs
o Production operations
o Sales and Marketing
o Supply Chain
o Legal
o Statistics
o Individuals knowledgeable of the QRM processes
43
 Section 4.1 Responsibilities cont’d

The guideline refers to decision makers and their responsibilities.

(Decision makers are considered to be person(s) with the competence
and authority to make decisions.)
Section 4.1 states that decision makers should:
 Take responsibility for coordinating quality risk management across various
functions and departments of their organization;
 Assure that a quality risk management process is defined, deployed and
reviewed and that adequate resources and knowledge are available; and
 Assure that subjectivity in quality risk management activities is managed and
minimised, to facilitate scientifically robust risk-based decision-making.

It is noteworthy that the aspect of subjectivity is encompassed within

these responsibilities in the context of risk-based decision-making
in QRM activities.
44
 Section 4.2 addresses the
initiation and planning of a QRM
Process
• First, define the specific question that needs to be
addressed/answered (e.g. a problem and/or a risk question)
o Include pertinent assumptions identifying the potential for risk
• Then, assemble background information and/or data on the potential
hazards or human health impacts relevant to the risk assessment
o Identify a leader and the necessary resources
o Specify a timeline, deliverables and an appropriate level of decision
making for the QRM process

45
 Section 4.3 focuses on Risk
Assessment and outlines the
different steps involved in it
• Hazard Identification:
What might go wrong? 3 fundamental
questions
• Risk Analysis:
What is the likelihood (probability) it will go wrong?
• What are the consequences (severity)?
Note: In some QRM tools, the ability to detect the harm (detectability) also
factors into the estimation of risk.
Risk Evaluation comes next: it compares the analyzed risk against given risk
criteria. Risk evaluations consider the strength of evidence for all three of the
fundamental questions.
Robust decision-making is crucial at each stage.

Note: It is incorrect to use the terms ‘Risk Analysis’, ‘Risk

Assessment’ and ‘Risk Evaluation’ interchangeably; they have
distinct meanings and refer to different aspects of the QRM process.
46
 In relation to “What might go
wrong?”

• The systematic use of information and knowledge relevant to

the risk question or problem is important when identifying
hazards
• Such information and knowledge may include:
o historical data
o theoretical analysis
o informed opinions
o the concerns of stakeholders

For further information, see the ICH website

for training materials on Hazard Identification
Link

47
 When considering the question
“What is the likelihood it will go
wrong?”
This relates to the probability of occurrence of the identified
hazards or their root causes.
• Likelihood may be expressed using qualitative, semi-quantitative or
quantitative scales or rating systems. It is crucial to minimize subjectivity
and uncertainty to the greatest extent possible in these assessments.
• It is important to consider the factors that can influence people’s
judgements about probability of occurrence estimates.
• Some Risk Assessment approaches and tools consider detectability and
detection controls when deciding on the probability of occurrence of harm,
identified hazards or their root causes

For further information, see the the ICH website for

training material on Subjectivity in QRM
Link

48
 When considering the question
“What are the consequences
(severity)?”
It is important to consider the consequences of the hazard on:
o Product quality
For further information, see the
o Product availability ICH website for training material on
o Patient safety Product Availability Risks
Link
In relation to product availability:
• Proactive risk-based measures are necessary to prevent and mitigate drug
shortage situations and effectively manage the complexities of the supply
chain
• Implementing QRM allows for the early identification and implementation of
preventive measures to ensure product availability.
• The level of formality in performing risk-based drug shortage prevention and
mitigation activities may vary based on the associated risk level of product
availability loss.

49
 When considering the question
“What are the consequences
(severity)?” cont’d
Also in relation to product availability:
• Manufacturing process variability and state of control can impact product
availability. Quality risk management helps identify and address the
causes of deviations and other issues, ensuring a state of control and
predictable outputs.
• Robust manufacturing facilities and equipment, including modern
technology and proper maintenance, contribute to reliable supply and
help mitigate risks to product availability.
• Oversight of outsourced activities and suppliers through risk
assessments, effective knowledge management, and monitoring
strategies ensures quality system governance and minimizes variability
in the supply chain.
• Identifying alternative supply chain entities may be necessary in cases of
substantial quality or safety issues with materials or services.

50
 Risk Assessments should be data-
driven

It is important to maintain and use robust data-sets when

assessing risks
• Start with the more extensive data-set and reduce it, if necessary. The
data must be reliable.
• Trend and extrapolate data --> analyze for trends (e.g. control charts)
and/or use statistics (e.g. extrapolation)
• Compare different datasets (note: this requires compatible data-sets).
• Statistical approaches may be used.

51
 Risk Assessment, cont’d

This involves understanding the risk and its magnitude (or level)
• Compare the analyzed risk against given risk criteria
• Is the risk at an acceptable level, or is risk reduction required?
• Establishing a high level of confidence in the strength of evidence is
crucial when addressing the three key questions in the risk assessment
process.
o What might go wrong?
o What is the likelihood (probability) it will go wrong?
o What are the consequences (severity)?

52
 Section 4.4 of the Guideline focuses
on Risk Control

Risk Control involves addressing the following questions:

• Is the risk above an acceptable level?
• What can be done to reduce or eliminate risks?
• What is the appropriate balance among benefits, risks and resources?
• Are new hazards and risks introduced as a result of the existing risks
being controlled?

The primary focus should be on prioritizing patient safety and relying on

sound scientific principles and robust data to control risks.
It is important that the effectiveness of each risk control be considered
during risk control activities, including when using proposed risk controls to
re-assess the level of risk.
The amount of effort used for risk control should be proportional to the
significance of the risk
53
 Risk Control is primarily about
Risk Reduction
Risk Reduction can be achieved through:
• The avoidance of quality risks
• Actions and controls that reduce the probability of occurrence of hazards
and harms
• Actions and controls that reduce the severity of the effects of hazards and
harms
• Actions and controls that increase the detectability of hazards and risks

Note: It is beneficial to analyse each type of action mentioned above

independently. This helps in assessing the extent to which prevention is
achieved through risk control activities versus relying on detection to
manage risks.

54
 Risk Acceptance is an important
part of Risk Control activities
Risk Acceptance is a decision to accept risk.
• ICH Q9(R1) indicates that, for some types of harms, even the best QRM
practices might not entirely eliminate risk.
• In these circumstances, it might be agreed that an appropriate QRM
strategy has been applied and that quality risk is reduced to a specified
(acceptable) level.
• This (specified) acceptable level will depend on many parameters and
should be decided on a case-by-case basis.
• This is essentially the acceptance of what is called Residual Risk, and
such decision making about residual risks should have the involvement
and the support of senior management.

See slide 57 for more information about

residual risks.

55
 Who may be involved in Risk
Acceptance decisions?

• Decision Maker(s):
o Person(s) with the competence and authority to make appropriate and
timely quality risk management decisions.
• Stakeholders may sometimes be decision makers in this regard:
o In this context, a stakeholder is any individual, group or organization that
may be affected by a risk.
o The primary stakeholders for QRM activities are usually patients, healthcare
professionals, regulatory authorities, and industry.
o Other stakeholders may include patient associations, the general public,
and others.

56
 Residual Risk is an important
consideration during Risk Control
activities
Residual Risk is important to consider when making decisions
about the need for, and the adequacy of, risk controls
• Residual risk can relate to:
o Hazards that have been risk-assessed and where those
risks have been accepted
o Hazards which have been identified but not risk-assessed
o Hazards that have not been correctly risk-assessed, or where there is
significant subjectivity and/or uncertainty as to what their risk levels are
o Hazards that have not yet been identified

It is important that residual risks be considered in all risk

acceptance decisions and that efforts are made to identify and
risk-assess all reasonable hazards

57
 Risk Control can give rise to
new hazards and risks

Sometimes, risk control actions can result in new

hazards and, thus, new risks, being introduced.

The significance of existing hazards and their

associated risks can also sometimes be increased.

It is important that this be considered during risk

control activities, and that appropriate risk control
actions are taken.

58
 Risk Acceptance – key
considerations

Example
Risk acceptance is a decision to • There will always be process variability, but
accept risk. For some types of what would the accepted variation be in
harms, even the best quality risk
order to meet the specifications and
management practices might not
ensure robustness in manufacturing and
entirely eliminate risk. In these
release?
circumstances, it might be
agreed that an appropriate • When the level of variability is such that
quality risk management strategy there is high certainty that
has been applied and that quality limits/specifications will be met, the risk
risk is reduced to a specified presented by the level of variability would
(acceptable) level. This be acceptable.
(specified) acceptable level will • However in situations where the variability
depend on many parameters and
brings one close to the
should be decided on a case-by-
limits/specifications, the risk of exceeding
case basis.
those limits/specifications is higher, and it
may be unacceptable, because there is no
Ref. ICH Q9(R1)
longer assurance of robustness in
manufacturing and release. 59
 Section 4.5 of the Guideline
addresses Risk
Communication
This is the sharing of information about risk and quality risk
management
• It occurs between the decision makers and others, and the parties can
communicate at any stage of the QRM process.
• ICH Q9(R1) indicates that the output/result of the QRM process should be
appropriately communicated and documented. Communications might include
those among interested parties; e.g., regulators and industry, industry and the
patient, within a company, industry or regulatory authority, etc.
• The information that might be communicated may relate to the existence,
nature, form, probability, severity, acceptability, control, treatment, detectability
or other aspects of risks to quality.
• It is worth noting that not all risk acceptance decisions necessitate
communication for each individual risk.
• Also, communications between the industry and regulatory authorities
concerning QRM decisions might be conducted through existing channels,
as specified in regulations and guidance. 60
 Risk Communication, cont’d

The purpose of risk communication is to share information about

risks that may impact patient safety, product quality and
availability

• Effective risk communication during the quality risk management process can
help achieve stakeholder agreement for how risks are to be managed

• The ultimate aim of risk communication is to enhance internal decision-

making by facilitating the transparent sharing of risk information among
relevant parties.

61
 Section 4.6 provides guidance in
relation to Risk Review
The Guideline indicates that QRM activities should be ‘an ongoing
part of the pharmaceutical quality system’.
It states that such activities ‘should include the review and monitoring of events,
and the output/results of the QRM process.’
This is so that new knowledge and experience can be taken into account.
‘Once a quality risk management process has been initiated, that process
should continue to be utilized for events that might impact the original
QRM decisions, whether such events are planned (e.g., results of product
review, inspections, audits, change control) or unplanned, (e.g., root
cause from failure investigations, recall).’ Ref. ICH Q9(1)
The frequency of any review should be based upon the level of risk.
Risk review might include reconsideration of risk acceptance decisions.

For further information, see the ICH website for

training materials on Risk Review.
Link 62
 63

Section 5 of the ICH Q9(R1)

Guideline provides guidance on
QRM methodologies

When discussing QRM methodologies, the Guideline refers to

empirical and/or internal procedures, as well as recognized tools.
Such methodologies can support science-based decisions

While a variety of methods are listed, the list is not exhaustive, and
other methodologies may also be used
No single methodology is considered appropriate for all cases, and
specific risks do not always require the same methodology to be used
Note: The selection of particular risk management tools is dependent
upon specific facts and circumstances
 Section 5 refers to the following
tools…

Basic risk
Failure Mode,
management
Failure Mode Effects Effects and
facilitation methods
Analysis (FMEA) Criticality Analysis
(flowcharts, check
(FMECA)
sheets, etc.)

Hazard Analysis and

Fault Tree Analysis Hazard Operability
Critical Control
(FTA) Analysis (HAZOP)
Points (HACCP)

Preliminary Hazard Risk ranking and Supporting statistical

Analysis (PHA) filtering tools

Information and guidance on each tool is

provided in Annex I of the
Guideline.
The Annex also lists their potential areas of 64

use.
 The methodologies outlined in
Section 5 are useful to consider.
This is because:
The methodologies provide documented, transparent and
reproducible methods for identifying hazards and/or assessing
and managing risks.
• They can help achieve scientific and practical decision-making.
• Some of the methodologies can be used together, in combination, such as
FTA and FMEA.
o This can be value-adding, especially where one methodology or tool is
stronger in an area, such as root cause analysis, than another.

65
 The various QRM methodologies
can differ in their degree of rigor
and formality

The Guideline states that it is neither always appropriate nor always

necessary to use highly formal quality risk management methods
and tools.
• The use of less formal methods and tools can also be considered acceptable.
• Guidance on what constitutes formality in quality risk management is provided
in section 5.1 of the Guideline.
• The use of the different methodologies and tools should be commensurate
with the degree of complexity, importance and uncertainty that is associated
with the area being risk assessed or the QRM activity.

66
 Section 5 also provides guidance
in relation to the following topics:

These topics are:

• Formality in Quality Risk Management
• Subjectivity in Quality Risk Management
• Risk-based Decision-making
The guidance on those topics is located within three sub-sections of ICH
Q9(R1), in Section 5.
Training materials were developed on each of these topics after the guideline
was revised, and they were published on the ICH website.

See the ICH website for training materials on

the above topics.
Link
67
 Section 5 is closely linked with
Annex I of the
Guideline
Annex I provides a general overview of, and references for, some
of the primary tools and methodologies that might be used in
QRM activities by industry and regulators.
• It also lists the potential areas of use for each tool or methodology.
• References for the various tools and methodologies are included in the
Annex as an aid to gain more knowledge and detail about each.
• The Guideline indicates that its list of tools and methodologies is not
exhaustive.
• It explains that no one tool (or set of tools) is applicable to every situation
in which a quality risk management procedure is used.

68
 Section 6 of the Guideline
addresses the integration of QRM
into Industry and Regulatory
Operations
The guideline indicates that QRM:
• Should be integrated into existing operations and documented
appropriately.
• Is a process that supports science-based and practical decisions
when integrated into quality systems.

Note: The potential applications of QRM can be found in Annex II of

the guideline. The first section of that Annex specifically addresses
the integration of QRM into the quality system.

69
 Section 6, cont’d

Why is the integration of QRM into Industry and Regulatory Operations

important?
The guideline indicates that:
• Effective QRM can facilitate better and more informed decisions, can provide
regulators with greater assurance of a company’s ability to deal with potential
risks, and might affect the extent and level of direct regulatory oversight.
• It indicates that QRM can facilitate the better use of resources by all parties.
• Thus, the integration of QRM into the pharmaceutical quality system is
important; it can help assure the effectiveness of the pharmaceutical quality
system, a better use of resources, and it has the potential to lead to
regulatory flexibility.

70
 Section 6 of the Guideline also
addresses Product Availability
Risks
Sub-section 6.1 of the guideline addresses the role of Quality Risk
Management in addressing Product Availability Risks that arise
from Quality/Manufacturing issues.
The original version of ICH Q9 referred to product availability issues within
its definition of harm. This topic was further elaborated in the 2023 revision
of ICH Q9, with a focus on quality/manufacturing factors that may give rise to
such risks. The factors addressed in the guideline are:
• Manufacturing Process Variability and State of Control
• Manufacturing Facilities and Equipment
• Oversight of Outsourced Activities and Suppliers
Note: A myriad of other factors that are unrelated to quality and manufacturing
can also affect product availability, such as natural disasters, economic
conditions, etc. ICH Q9(R1) does not address those issues.

71
 Section 6.1, Product Availability
Risks, cont’d
• Given the complexities and high number of actors involved in global
supply chains, the guideline emphasizes the need to manage
quality/manufacturing risks to product availability, including those
related to outsourced activities and suppliers.
• It also refers to the usefulness of risk-based drug shortage prevention
and mitigation activities
• These can help to proactively manage supply chain complexities and
ensure the availability of needed drug (medicinal) products .

For further information, see the ICH website for

training materials on Product Availability Risks.
Link

72
 Section 6 is closely linked with
Annex II of the Guideline

• Annex II provides examples of the potential uses of quality risk

management by industry and regulators. They relate to:
o Integrated Quality Management (See Annex II.1)
o Regulatory Operations (See Annex II.2)
o Development (See Annex II.3)
o Facilities, Equipment and Utilities (See Annex II.4)
o Materials Management (See Annex II.5)
o Production (See Annex II.6)
o Laboratory Control and Stability Studies (See Annex II.7)
o Packaging and Labelling (See Annex II.8)
o Supply Chain Control (See Annex II.9)

Note: These examples are not intended to create any new

expectations beyond the requirements laid out in current regulations.
73
 For more information…

• See also:
o The other presentations in the ICH Q9 Briefing Pack
o The ICH Q8/Q9/Q10 Training Materials
o The ICH Q7 Q&A
o The ICH Q12 Training Materials

These and other training materials are available

on the ICH website
ICH Official web site : ICH

74
 Acknowledgment and Contact

• Acknowledgement to ICH Q9(R1) Implementation Working

Group (IWG)
• For any questions, please contact the ICH Secretariat:
admin@ich.org

75