Quality Risk Management Guidelines

Q. I have heard that the International Council for Harmonization’s (ICH’s) Q9 Quality Risk Management is being revised. Do you know what the industry can expect to see with the new version of the risk management guidelines?


A. You have heard correctly. The guideline was first published in 2005 and, at the time of publication, it offered an overview of general quality risk management (QRM) principles including an example of a risk management lifecycle approach.


Risk Management Program


In addition, the guideline provided a list of risk tools and quality system areas critical to establishing and maintaining an effective risk management program. As stated on the ICH website, “This Guideline provides principles and examples of tools for quality risk management that can be applied to different aspects of pharmaceutical quality.


These aspects include development, manufacturing, distribution, and the inspection and submission/review processes throughout the lifecycle of drug substances, drug (medicinal) products, biological and biotechnological products (including the use of raw materials, solvents, excipients, packaging and labeling materials in drug (medicinal) products, biological and biotechnological products)”.


Risk Management Guidelines


Over the past 15 years, the industry has tried to implement risk management guidelines and principles as a part of their quality management systems. The introduction to ICH Q9 states,


“Although there are some examples of the use of QRM in the Pharma industry today, they are limited and do not represent the full contributions that risk management has to offer”.


This statement still holds true today as citations for incomplete corrective action and preventive action (CAPA)/investigations typically ranks in the top five inspectional observations for the pharmaceutical and biopharmaceutical industries.




To date, QRM implementation has used simple investigational tools to solve simple problems. In addition, the industry seems to struggle with providing data or metrics to demonstrate that information from investigation results have been used to effect continuous improvement.


Speakers at the PDA conference also talked about some of the challenges the industry has faced in trying to implement QRM. These reasons include using QRM to justify actions instead of assessing risk and substituting risk-assessment tools for the QRM process. Other problems that seem to prevent effective implementation of QRM is using it to confirm a hypothesis or rationalize non-compliance situations.




Understanding the original purpose of ICH Q9 is crucial in understanding what the industry might see in terms of its revision. Current thinking, as discussed at the PDA conference, is that the EWG will focus on clarifying certain aspects of the document’s concepts in an addendum to the document. Basically, the document itself will probably not be revised but instead will be enhanced by creating a partnering document that will focus more on ‘how to do’ and less on ‘what to do’ with respect to QRM.


The ICH Steering Committee approved the Q9 revised concept paper in 2019, and the EWG is expected to begin working on the revision at the ICH spring meeting. A development integrated addendum according to ICH parlance means only specific sections of the guideline will be targeted for revision but a complete revision is off the table.


QRM System


It is unclear whether the ICH Q9 revision will become more of a QRM tutorial or whether it will clarify what needs to be achieved in order for a QRM system to be considered robust and effective. To accomplish the vision of making appropriate and acceptable risk-based decisions, QRM needs to be iterative and not a once-and-done exercise within the quality management system. An effective QRM system should implement a risk review program to facilitate continuous improvement efforts.


At a recent PDA conference, attendees were given an opportunity to tell EWG representatives what they felt needed to be added or clarified in ICH Q9. They were asked to answer the following question: If you could recommend changes to ICH Q9, Quality Risk Management, what would you recommend? The information will be provided to the EWG representatives for consideration when they begin work enhancing the document and will be posted on the PDA Letter website.


Some of the recommendations were as follows:


  • Ensure that QRM is recognized by FDA as a required quality system. Currently, the European Medicines Agency (EMA) is more likely to inspect for QRM. There should be consensus regarding more alignment between Europe and the United States on QRM.
  • Include a standardized CAPA.
  • Remove the perception that QRM is not enforced and not part of the quality system.
  • Include language that drives a holistic systems approach.
  • Provide examples or a case study featuring a QRM tool.
  • Expand clarity on the training and documentation needed for applying QRM.
  • Clarify difference between risk evaluation and risk control.
  • Define roles, particularly decision-maker roles.
  • Provide more guidance on risk acceptance.
  • Provide additional examples such as how to apply QRM to legacy products.
  • Include examples of communication flow.
  • Clarify levels of maturity for QRM in enterprise risk management.
  • Offer strategies for demonstrating QRM compliance to regulators.
  • Recommend how to prioritize compliance versus patient safety concerns.


Continuous Improvement


Bottom line, ICH Q9 is scheduled to be revised, but the risk management guidelines to be revised have yet to be identified. There is no timeline available for completion of the revision. Industry has provided feedback to representatives of the EWG on some of their thoughts on what needs to be clarified so that implementation of an effective QRM program can be achieved, and the industry can drive toward continuous improvement realizing what Janet Woodcock, director of FDA’s Center for Drug Evaluation and Research, described as:


“A maximally efficient, agile, flexible, pharmaceutical manufacturing sector that reliably produces high quality drug products without extensive regulatory oversight”.


Article Details


regulatory compliance


Pharmaceutical Technology
Vol. 44, No. 2
Pages: 58, 57


About RCA’s Pharmaceutical Consulting Services 


Regulatory Compliance Associates (RCA) has helped thousands of pharmaceutical companies meet regulatory, compliance, quality assurance, and remediation challenges. With more than 20 years of experience with FDA, Health Canada, EU and global regulatory agencies worldwide, Regulatory Compliance Associates® offers leading pharmaceutical consultants. We’re one of the few pharma consulting companies that can help you navigate the challenges associated with industry regulations.


Our pharmaceutical consulting firm includes over 500 seasoned FDA, Health Canada & EU compliance consultants and regulatory affairs experts who understand industry complexities. It’s a pharma consultancy founded by regulatory compliance executives from the pharmaceutical industry. Every pharmaceutical industry consultant on the Regulatory Compliance Associates team knows the unique inner workings of the regulatory process. 


Client Solutions


Whether you’re in the product planning, development or pharmaceutical lifecycle management stage or need a remediation strategy for a compliance crisis, Regulatory Compliance Associates will guide you through every pharmaceutical consulting step of the regulatory process and create a customized approach depending on your product and your pharma company’s individual needs. Our regulatory compliance clients include:


  • Companies new to FDA, Health Canada or EU regulations and regulatory compliance
  • Start-up organizations with novel submissions to 510(k) submissions from multi-national corporations
  • Investment firms seeking private equity due diligence for pre-acquisition and post-deal research
  • Law firms seeking pharmaceutical consulting firm expertise in the remediation of warning letters, consent decrees, 483’s or import bans


Regulatory Affairs


Regulatory affairs is Regulatory Compliance Associates backbone. We exceed other pharma consulting companies with industry experts experienced in complexities of the pharmaceutical and biopharmaceutical industries. Our pharma consulting expertise spans all facets and levels of Regulatory Affairs, from Regulatory Support for New Products to Life Cycle Management, to other services like Outsourced Regulatory Affairs, Submissions, Training, and more.


As your partner, we can negotiate the potential assessment minefield of regulatory compliance services with insight, hindsight, and the clear advantage of our breadth and depth of knowledge and regulatory compliance consulting. We offer the following pharma consulting regulatory affairs services for pharmaceutical companies.


  • New Product Support
  • Product Lifecycle
  • Other Regulatory Services
  • Combination Products


Compliance Assurance


The regulations process surrounding pharmaceutical companies can be tricky for even the most experienced industry veteran to understand. Just one misstep could mean significant and lasting consequences for your business. At Regulatory Compliance Associates, we offer the pharma consulting experience and pharma consultants necessary to guide you through the quality compliance process.


  • Assessments
  • Audits
  • Regulatory Agency Response
  • Preparation and Training
  • Inspection Readiness
  • Data Integrity


Quality Assurance


Regulatory Compliance Associates Quality consulting includes assessments, strategy, implementations, staff augmentations, and identification of quality metrics to ensure continuous improvement. Our pharma consultants understand the strategic thinking needed to align your business needs and goals. Regulatory Compliance Associates quality assurance services include quality experts with experience spanning major corporations and start-ups. Our pharmaceutical consulting firm knows firsthand how to achieve, maintain, and improve quality, and we excel in transferring pharma consulting knowledge to your organization.


  • 21 CFR Part 11
  • Data Integrity
  • Manufacturing Support
  • Facility Support
  • Quality Metrics


Remediation Services 


Regulatory Compliance Associates has a proven remediation services approach to managing FDA Warning Letters, Consent Decrees, Remediation and other serious regulatory situations. Our pharma consultants know how to partner with executive, legal, and communication teams. Each RCA pharma consulting Expert will develop a response that will be accepted by the regulatory agency and be realistic to execute.


Regulatory Compliance Associates pharma regulatory consultants will develop a comprehensive proof book of documented evidence demonstrating the corrective action taken to remediate non-compliant issues. In addition, each Regulatory Compliance Associates pharma consulting Expert understands compliance enforcement. We’ll prepare a comprehensive pharma consulting strategy to assist in your remediation efforts, drive continuous improvement, and maintain regulatory compliance with the regulations.


  • Regulatory Action
  • Regulatory Compliance
  • Regulatory Enforcement
  • Warning Letter
  • 483 Observation
  • Oversight Services
  • Risk Management Plan


About Regulatory Compliance Associates


pharmaceutical consultantsRegulatory Compliance Associates® (RCA) provides pharmaceutical consulting to the following industries for resolution of life science challenges:



We understand the complexities of running a life science business and possess areas of expertise that include every facet of R&D, operations, regulatory affairs, quality, and manufacturing. We are used to working on the front lines and thriving in the scrutiny of FDA, Health Canada, MHRA and globally-regulated companies.


As your partners, we can negotiate the potential minefield of regulatory compliance and regulatory due diligence with insight, hindsight, and the clear advantage of our unique expertise and experience.


  • Founded in 2000
  • Headquartered in Wisconsin (USA)
  • Expertise backed by over 500 industry subject matter experts
  • Acquired by Sotera Health in 2021


About Sotera Health


The name Sotera Health was inspired by Soteria, the Greek goddess of safety, and reflects the Company’s unwavering commitment to its mission, Safeguarding Global Health®.


Sotera Health Company, along with its three best-in-class businesses – Sterigenics®Nordion® and Nelson Labs®, is a leading global provider of mission-critical end-to-end sterilization solutions and lab testing and advisory services for the healthcare industry. With a combined tenure across our businesses of nearly 200 years and our industry-recognized scientific and technological expertise, we help to ensure the safety of over 190 million patients and healthcare practitioners around the world every year.


We are a trusted partner to 5,800+ customers in over 50 countries, including 40 of the top 50 medical device companies and 9 of the top 10 pharmaceutical companies.


Commitment to Quality


Our Certificate of Registration demonstrates that our Quality Management System meets the requirements of ISO 9001:2015, an internationally recognized standard of quality.


To begin the Regulatory Compliance Associates scoping process today, please enter your information in the blue form below and click the submit button at the bottom of the webpage. 


Our website uses cookies to give you the best possible experience.

By continuing to use this site, you agree to the use of cookies.
Privacy Policy