FDA Seeks Comments on ICH Q9(R1) Quality Risk Management


By Mark Durivage, Quality Systems Compliance LLC

On June 16, 2022, the FDA’s Center for Drug Evaluation and Research (CDER) released for public comment Q9(R1) Quality risk management guidelines for industry. The International Council for Harmonization (ICH) of Technical Requirements for Pharmaceuticals for Human Use has undertaken the review of Q9 Quality Risk Management to ensure that safe, effective and high quality medicines are developed, registered and maintained from the the most resource-efficient way. way around the world. The FDA, a founding member of the ICH, plays a major role in the development of each of the ICH guidelines, which the FDA then adopts and publishes as guidance for industry.

The objective of these guidelines is to enhance the application of effective quality risk management principles by industry and regulators and to provide a systematic approach to quality risk management for improved, informed and timely. The FDA recognizes that quality risk management is a valuable part of an effective pharmaceutical quality management system to ensure that drugs are safe and effective.

Q9(R1) Quality risk management provides quality risk management principles and tools that can be applied throughout the life cycle of drug substances, pharmaceutical products, and biological and biotechnology products, including development, manufacturing, distribution, inspection and regulatory submission. and review processes.

Q9(R1) Stage 1 of Quality Risk Management, Signing of Draft Consensus Technical Document, was completed in October 2021. It was signed in November 2021, as a Technical Document stage 2 which will be published by the regulatory members of the ICH for public comment. . This document has been drawn up on the basis of a design document approved in November 2020 and a Business plan approved in October 2020. ICH expects finalization as a Step 4 document for implementation by local regional regulatory systems in September 2022.

Principles of quality risk management

ISO/IEC Guide 51 defines risk as the combination of the probability of occurrence of harm (harm to health, including harm that may result from loss of quality or availability of a product) and severity (a measure of possible consequences of a hazard [potential source of harm]) of this damage.

Quality risk management is based on two fundamental principles. First, quality risk assessment should be science-based and ultimately linked to patient protection. Second, the quality risk management process (effort, formality and documentation) must be commensurate with the level of risk.

Quality risk management is a systematic process of assessing, controlling, reviewing and communicating risks to the quality of a pharmaceutical product throughout its life cycle. Q9(R1) Quality risk management provides a quality risk management model as shown in Figure 1. When risks are deemed unacceptable due to patient risk and legal or regulatory requirements, the risk should be reassessed. Other risk models can be used but should generally include the same elements provided in the model shown in Figure 1.

Quality risk management activities are best performed by an interdisciplinary team representative of the relevant business activities, which may include quality, regulatory affairs, operations, production, sales, marketing, research and development, engineering, maintenance, supply chain, warehousing, distribution, customer service, clinical affairs and post-market surveillance. Interdisciplinary teams can help minimize subjectivity when identifying hazards and probabilities of occurrence and estimating the effectiveness of risk reduction.

The Quality Risk Management Process Owner is responsible for coordinating Quality Risk Management activities across the organization, ensuring that the Quality Risk Management process is established, implemented and maintained, to ensure the adequacy of resources (training and experience) and to ensure that subjectivity is controlled to facilitate sound risk-based decision-making based on science and data.

Figure 1: Overview of a typical quality risk management process.

The quality risk management process should be designed to coordinate, facilitate and improve risk-based decision making. An effective quality risk management process should use these basic steps:

  1. define the problem
  2. form an interdisciplinary team
  3. identify a leader
  4. gather background information
  5. develop a schedule
  6. establish deliverables.

Quality risk assessments begin with a well-defined description of the problem or risk question to identify the hazards and analyze and assess the risks associated with exposure to the identified hazards. Here are three useful questions that can be used by the interdisciplinary team to define risks:

  • What could go wrong (hazard identification)?
  • What is the probability that it will go wrong (risk analysis)?
  • What are the consequences of severity (risk assessment)?

The effectiveness of risk assessments relies on the quality of the data used to formulate the risk assumptions. Documenting the rationale for assumptions will help current and future team members in the decision-making process. Knowledge gaps related to pharmaceutical sciences, including processing, impede the ability of the interdisciplinary team to correctly identify sources of harm, the likelihood of occurrence, and the ability to detect the problem. Depending on the risk management tools and methods used, risk assessments can provide a quantitative or qualitative estimate of risk. Quantitative risk is expressed as a numerical probability while qualitative risk is described, for example, as high, medium or low.

The risk control phase consists of reducing the risk to an acceptable level while deciding to reduce and/or accept the identified risks. Useful questions that can be used by the interdisciplinary team to monitor risk include:

  • Is the risk above an acceptable level?
  • What can be done to reduce or eliminate the risks?
  • What is the right balance between benefits, risks and resources?
  • Are new risks introduced following the control of identified risks?

Risk reduction focuses on mitigating or avoiding risk when the risk exceeds a pre-established limit. Risk reduction activities may include reducing the severity of harm, decreasing the frequency of occurrence, and increasing the ability to detect hazards associated with harm. The decision to accept residual risks should be supported by documented justification, recognizing that risks may not be fully eliminated.

Sharing risk and risk management information between decision makers and other interested parties is the basis of an effective risk communication process. Risk communications may include internal company stakeholders, regulators, industry and industry and the patient and may include information relating to the existence, nature, form, likelihood, severity, acceptability, control, treatment and detectability of risks.

Risk management should be an ongoing process and contain a mechanism for reviewing and monitoring events, including the results of product reviews, inspections, audits, change control, complaints, adverse events, reminders, actions in the field, new knowledge and experience.

There are several widely recognized tools and techniques that can be used for risk management, including:

  • Basic methods of facilitating risk management
  • Failure Mode Effects Analysis (FMEA)
  • Failure Mode, Effects and Criticality Analysis (FMECA)
  • Fault Tree Analysis (FTA)
  • Hazard Analysis and Critical Control Points (HACCP)
  • Hazard Operability Analysis (HAZOP)
  • Preliminary Hazard Analysis (PHA)
  • Classification and filtering of risks
  • Statistical tools

The choice of risk management tools depends on specific facts, circumstances and the level of experience of the interdisciplinary team. Annex I of the guide: Methods and tools for quality risk management provides an overview, references and potential areas of use for tools and techniques that could be used by industry and regulators for the process risk management.

Quality risk management can be used as part of an integrated quality management system, including regulatory operations, development, facilities, equipment and utilities, materials management, production, inspection, laboratory control, stability studies, packaging, labeling, supply chain control, storage, and distribution. Q9(R1) Quality risk management Annex II: Quality risk management as part of integrated quality management identifies potential uses of quality risk management principles and tools by industry and regulators.


Q9(R1) The quality risk management is well written and provides a good basis for establishing an effective risk management program. Additional information on proposed changes to ICH Q9(R1) Quality Risk Management can be found at WG presentations/trainings.

Please submit written comments to Records Management Staff, Food and Drug Administration, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852 or electronic comments at https://www.regulations.gov. Please indicate the file number FDA-2022-D-0705 with all comments. For questions regarding this draft document, contact Rick Friedman, [email protected]

About the Author:

Mark Allen Durivage has worked as a practitioner, educator, consultant and author. He is a Senior Consultant at Quality Systems Compliance LLC, ASQ Fellow and SRE Fellow. Durivage primarily works with companies in FDA-regulated industries (medical devices, human tissues, animal tissues and pharmaceuticals) focusing on the implementation, integration, updates and training of the management system of the quality. Additionally, it assists companies by providing internal and external audit support as well as FDA 483 response and remediation services and warning letters. He earned a BAS in Computer Aided Machining from Siena Heights University and a Masters in Quality Management from Eastern Michigan University. It holds several certifications, including CRE, CQE, CQA, CSSBB, RAC (Global) and CTBS. He has written several books available through ASQ Quality Press, published articles in Quality progressand frequently contributes to Life Sciences Connection. You can reach him at [email protected] for any questions or comments.


Comments are closed.