Key Points of Quality Risk Management

Historical Context and Evolution

ICH Q9 “Quality Risk Management Guideline” was first issued on November 9, 2005, and came into effect in January 2006. This represents a significant milestone in pharmaceutical manufacturing history. In the high-risk pharmaceutical industry, there were no standards or guidelines for risk management throughout the entire 20th century, despite the critical nature of the products being manufactured.

In contrast, the food industry had established the risk management methodology known as HACCP (Hazard Analysis and Critical Control Points) since the 1970s. Similarly, the medical device industry had the international standard ISO 14971 available since the late 1990s (first edition published in 1998, with subsequent revisions in 2007 and 2019).

It is often said in Japan that “kusuri” (medicine) read backwards becomes “risuku” (risk). However, despite this recognition, pharmaceutical manufacturing in the 20th century relied heavily on human experience and intuition without any formal guidelines.

Important Update: In January 2023, ICH Q9 was significantly revised and published as ICH Q9(R1). This revision, which came into effect in July 2023, addresses four key areas for improvement that had been identified in the application of quality risk management: high levels of subjectivity in risk assessments, inadequate management of supply and product availability risks, lack of understanding regarding formality in QRM work, and lack of clarity in risk-based decision-making. The revised guideline provides enhanced guidance on these critical areas while maintaining the fundamental principles established in the original 2006 version.

The fundamental principle of quality risk management is to implement scientific risk management rather than relying solely on personnel experience and intuition.

Understanding “Quality” Risk Management

In quality risk management, the focus is on managing the “health hazards” to patients that arise from defects in the “quality” of pharmaceutical products. This represents an important distinction from risk management in other industries.

Risk management for medical devices is direct in nature—when a device fails, it directly impacts patients or users. In contrast, risk management in pharmaceutical manufacturing is indirect—a failure event affects the quality of the pharmaceutical product, and when a defective pharmaceutical product is administered to a patient, it may cause some form of health hazard. This is precisely why the term “quality risk management” rather than simply “risk management” is used.

To illustrate this distinction more clearly: medical device risk management is direct, whereas pharmaceutical risk management is indirect, affecting patients through the quality of the product as an intermediary.

The process involves identifying the impact that defects in manufacturing facilities and equipment (such as failures, operational errors, etc.) have on pharmaceutical product quality.

It is important to note that ICH Q9(R1) covers the entire pharmaceutical lifecycle, including development, manufacturing, distribution, inspection, and regulatory submission/review. This means that not only pharmaceutical companies but also regulatory authorities have an obligation to comply with these guidelines. Furthermore, the scope of application includes not only pharmaceutical manufacturing but also pharmaceutical development.

Integration with Pharmaceutical Quality Systems

Quality risk management forms an integral relationship with the pharmaceutical quality system and must be based on a lifecycle model (PDCA cycle). It is crucial to understand that quality risk management is not a single process within the pharmaceutical quality system, nor should it be treated as such.

Organizations should not establish a dedicated specialized department solely for implementing quality risk management. Furthermore, it is not appropriate to create a single SOP for implementing quality risk management in isolation.

Instead, the concept of quality risk management must be integrated into all existing SOPs across all existing departments that are subject to regulation. This holistic approach ensures that risk management principles permeate all aspects of pharmaceutical operations.

Objectives and Risk-Based Approach

The objective of quality risk management in pharmaceutical manufacturing is to appropriately manage “risks that cause defects in pharmaceutical product quality” and prevent health hazards to patients. Examples of such risks include:

• Structural equipment failures
• Human errors
• Software bugs
• Data integrity deficiencies

However, it is essential to note that one must be careful not to unnecessarily increase compliance costs, which would ultimately result in increased patient burden. The adoption of a risk-based approach is fundamental to achieving this balance.

ICH Q9(R1) Enhancement: The revised guideline introduces the concept of formality in quality risk management, describing it as a spectrum rather than a binary state. The level of formality should be determined based on factors such as importance, complexity, and uncertainty. The guideline emphasizes that risk-based decision-making should be integrated throughout QRM activities, with clear criteria for determining appropriate levels of formality for different situations.

Regulatory Requirements and Organizational Structure

In the revised Japanese GMP regulations (effective from 2021), a quality risk management supervisor must be appointed (Revised GMP Ministerial Ordinance, Article 3-4, Paragraph 2). This requirement reflects the increasing emphasis on formalized risk management structures in pharmaceutical manufacturing organizations.

Application to Structural Equipment

For quality risk management related to structural equipment, FMEA (Failure Mode and Effects Analysis) is primarily used to address failure events such as equipment failures and operational errors (human errors).

FMEA should be implemented at the time of equipment introduction. During qualification (OQ – Operational Qualification), FMEA should be used to verify risk control measures and confirm that risks have been sufficiently reduced.

For automated equipment and computerized systems, CSV (Computer System Validation) must be implemented to reduce quality risks. The integration of quality risk management principles into CSV activities ensures that automated systems are appropriately controlled and monitored throughout their lifecycle.

Comparative Analysis: Pharmaceutical vs. Medical Device Risk Management

To provide a clearer understanding for professionals who may work across different sectors, the following table summarizes the key differences between pharmaceutical quality risk management and medical device risk management:

Aspect	Pharmaceutical QRM (ICH Q9(R1))	Medical Device RM (ISO 14971:2019)
Nature of Risk	Indirect – through product quality defects	Direct – device failure impacts users/patients
Primary Standard	ICH Q9(R1) (2023)	ISO 14971:2019
Risk Definition	Combination of probability and severity of harm through quality defects	Combination of probability and severity of harm
Scope	Entire product lifecycle (development through distribution)	Entire device lifecycle (conception through disposal)
First Established	2005-2006 (Revised 2023)	1998 (Latest revision 2019)
Key Focus Areas	Manufacturing quality, supply chain, data integrity	Device safety, biocompatibility, usability, cybersecurity
Benefit-Risk Analysis	Considered but less emphasized (enhanced in R1)	Strongly emphasized since 2019 revision
Post-Market Activities	Monitoring through PQS and regulatory reporting	Extensive post-production monitoring requirements
Regulatory Integration	Integrated with GMP and pharmaceutical quality system	Integrated with QMS (ISO 13485)

Note on Recent Updates: Both standards have been significantly updated in recent years. ICH Q9 was revised to Q9(R1) in January 2023, addressing subjectivity and formality in risk management. ISO 14971 was revised in 2019, adding enhanced focus on benefit-risk analysis and stronger requirements for production and post-production information. The 2021 European addendum (ISO 14971:2019+A11:2021) further harmonized the standard with EU Medical Device Regulations (MDR 2017/745 and IVDR 2017/746).

Modern Context and Continuous Improvement

Quality risk management continues to evolve as pharmaceutical manufacturing becomes increasingly complex, with new technologies such as continuous manufacturing, advanced process analytics, and artificial intelligence-based quality control systems. The principles established in ICH Q9(R1) provide a robust framework for managing these emerging challenges while maintaining patient safety as the paramount concern.

The revised guideline explicitly recognizes that quality risk management applies to digitalization and emerging technologies, including considerations for data and systems security. This forward-looking approach ensures that the framework remains relevant as the pharmaceutical industry continues to innovate and transform.

Organizations implementing quality risk management should focus on building a culture where risk-based thinking is embedded in daily operations, decisions are made based on scientific principles and objective evidence, and continuous improvement is pursued through systematic review and refinement of risk management processes. The integration of formal and informal risk management approaches, as described in ICH Q9(R1), allows organizations to apply appropriate levels of rigor based on the specific context and importance of each decision.

Document Version: Updated January 2026 to reflect ICH Q9(R1) (2023), ISO 14971:2019+A11:2021, and current Japanese GMP requirements (2021 revision)