Quality Risk Management under ICH Q9(R1): Assessing Risks with Sound Justification

A clear risk question determines the scope of investigation

At goods receipt, a damaged seal was documented on container 3 of RM-427. The question “Is this bad?” is too vague to work with. What needs to be clarified is, for example, which protective function might be affected, what this means for the intended use, and what information is still needed for a decision. The uncertainty about how the damage occurred must be distinguished from the uncertainty about its possible consequences.

ICH Q9(R1) starts with a defined problem or risk question. Risk is the combination of the probability of occurrence of harm and its severity; risk assessment is based on scientific knowledge, including an awareness of its limits. ^[1]

For RM-427, the scope is initially limited to the documented seal finding and the possible impact on the material. Investigating the unclear handover is a separate, procedural line of inquiry. An improved instruction can strengthen this process but does not retroactively answer the question of the material’s quality.

Quality risk management supports operational decisions

EU GMP Chapter 1, sections 1.12–1.13, describe quality risk management as a systematic process that can be applied both proactively and retrospectively. It comprises assessment, control, communication, and review. A matrix completed after the fact does not, on its own, reflect this process. ^[3]

In deviation management, the risk question helps determine the depth of investigation and the next steps. Before a planned change, by contrast, it supports a forward-looking assessment. In both cases, the decision, the information it was based on, and the responsible persons must remain identifiable.

Risk assessment separates hazard, analysis, and evaluation

ICH Q9(R1), section 4.3, distinguishes between the identification of potential hazards, the analysis of the risk, and its evaluation against defined criteria. Analysis covers the probability of occurrence and the severity of harm; some tools also take detectability into account. A numerical model is therefore not required for every question. ^[1]

If information on the protective function is missing, the possible impact has not yet been sufficiently narrowed down. This gap becomes an investigation task; it is not treated as a low probability of occurrence. Likewise, the absence of earlier reports supports only as much as the scope and quality of the available records can actually support.

For qualitative ratings, terms such as “low” or “high” are defined within the organization so that different participants can apply them consistently and traceably. The justification records what the assessment is based on and which change in assumptions would alter the result.

Formality follows risk, uncertainty, and complexity

According to ICH Q9(R1), section 5.1, formality is a continuum. Uncertainty, the importance of the decision, and complexity influence the appropriate degree of structure, involvement, and documentation. A lack of resources is not a justification for lower formality. ^[1]

The chosen approach is defined and justified in the quality system.

A routine decision with clear rules can build on existing knowledge and a suitable instruction. A new combination of unknown damage and unclear use calls for a different approach. Less formality can mean documenting the assessment within the existing case instead of creating a separate report. Technical rigor and a traceable basis are still required.

Section 5.2 also covers rule-based decisions for which no new case-by-case risk assessment is needed. This requires an established understanding of the risks that supports suitable instructions or limits. For a known inspection scenario, such a rule can determine the next step. If the observed condition does not match, or the information the rule assumes is missing, the first question is whether the rule covers this case at all. The unknown seal finding does not become a routine case merely because a form exists.

Assumptions and assessment criteria are made visible

ICH Q9(R1), section 5.3, explicitly addresses subjectivity: differing perceptions, unclear questions, and unsuitable scales can skew assessments. Relevant data, transparent assumptions, and appropriate use of tools help limit these effects. ^[1]

For RM-427, one person might regard the damaged seal as a mere sign of transport handling, while another suspects that its protective function is impaired. Instead of averaging the two assessments, the team names the underlying difference in assumptions: What function does the seal actually serve? Only once this question is answered can the assessments be compared.

The team also records whether a statement is observed, supported by evidence, or still assumed. The data integrity of the information used is essential for this. A form that is formally complete does not make an unclear or wrongly assigned finding reliable.

An expert cross-check deliberately considers alternative explanations and how far the evidence reaches. If a disagreement arises, the point of contention and the way it will be resolved are documented. A delivery deadline is not evidence of a lower quality risk.

The meaning of the scale itself is also checked. Does a level stand for the severity of potential harm or for the frequency of reports received? If different things are mixed, results that look the same can conceal very different situations. The terms and the limits of the data are therefore clarified before the team assigns a rating. Agreeing on the result is no substitute for this shared understanding.

Risk control links controls to a justified objective

Risk control covers measures to reduce risk and the possible acceptance of residual risk. ICH Q9(R1), section 4.4, also calls for attention to new risks that controls may introduce. The assessment does not replace any binding quality or marketing authorization requirement. ^[1]

For the procedural side of RM-427, the objective could be to describe a damaged seal unambiguously and pass the finding on to the responsible reviewer. A clarified instruction addresses this gap. The CAPA links the action to a later effectiveness check. Its implementation does not automatically demonstrate that the affected material can be used.

The planned improvement is also checked to see whether the new wording might, for example, assign responsibilities inconsistently or cause information to be lost at handover. Change control introduces the new instruction in a controlled way. The V3 snapshot is preserved for the earlier execution.

Communication and review keep the assessment current

Risk communication runs alongside the work; it is not just a message at the end. According to ICH Q9(R1), sections 4.5–4.6, knowledge should be shared and assessments reviewed in light of new information. When and why an assessment is reviewed again also depends on the risk. ^[1]

For RM-427, the record shows who needs an updated material assessment and which decision remains open until then. An additional investigation can support, qualify, or refute the original assumption. The responsible person carries the resulting conclusion forward into the next steps; the earlier basis remains visible.

A specific trigger for review would be a further documented finding on another container or new knowledge about the seal’s protective function. The first question is then which assumption in the previous assessment is affected. Scope, controls, and, where applicable, other uses are then reconsidered. The review trigger and the conclusion drawn from it remain linked.

ICH Q10, sections 1.6.1–1.6.2, link knowledge management and quality risk management within the pharmaceutical quality system. Feedback from practice, CAPA, and changes broadens the basis for decisions. ^[4] Whether this has consequences for the batch assessment by the Qualified Person is assessed in the respective release procedure.

A reliable supply of medicinal products is also part of considering quality- and manufacturing-related risks. ICH Q9(R1), section 6.1, addresses this relationship. The aim is to safeguard supply proactively; supply pressure does not justify a practice that would otherwise be unacceptable. ^[1]

Tools are selected according to the question

An FMEA, a process map, or a structured expert assessment can support the work. ICH Q9(R1), Annex I, describes various tools and emphasizes that no single tool fits every situation. An elaborate diagram is not automatically a better basis. ^[1]

For identifying possible causes and cross-checking them, the article on root cause analysis shows specific 5-Why, Ishikawa, and FMEA examples. In quality risk management, what counts is which question a tool answers and how the result feeds into the decision. A cause hypothesis and a risk estimate are different work products.

If a scoring model is used, it needs a defined scope and traceable criteria. Two identical total scores can conceal different combinations of severity of harm and probability of occurrence. The decision therefore also considers the underlying estimates and uncertainties. A number must not take the place of an expert justification or the review of binding requirements.

420+ preserves the link between finding, assessment, and follow-up work

In the operational twin, the material reference, the executed task, and the associated evidence remain connected. For RM-427, the later assessment can thus refer back to the original finding and the instruction used at the time. New information is handled in the process context.

An audit trail makes documented changes traceable. Roles, independent second-person review, deadlines, and escalation are configurable defaults. The responsible persons decide which assessment holds up technically and whether further evidence is needed.

The benefit lies in linking open questions and follow-up tasks to what they concern. Work on the unclear instruction remains distinguishable from the material decision. This allows one action to continue while information still needs to be obtained for another decision.

Frequently asked questions about ICH Q9(R1)

Does ICH Q9 prescribe a risk matrix?

No. The method and formality must fit the question, the risk, and the available knowledge; the guideline names various tools.

Does less formality mean less documentation?

A separate report may not be needed if the assessment is appropriately documented within the existing quality system; the basis and the decision must still be traceable.

Is missing data an indication of low risk?

Missing data is, first and foremost, a source of uncertainty and may call for further clarification; it does not demonstrate a low probability of occurrence.

Can a risk assessment release a batch?

It supports the expert decision but replaces neither quality evidence nor the legally required material or QP decision.