Public Comment Period for Revised Guideline on Quality Risk Management

Background and Timeline

On February 28, 2022, Japan initiated a public comment period for the proposed revision to the Guideline on Quality Risk Management, with a deadline of April 1, 2022. This revision was prompted by the update to ICH Q9 in November 2021. ICH Q9(R1) reached Step 2 on November 18, 2021, and was released for public consultation at that time.

Subsequently, ICH Q9(R1) was adopted at Step 4 on January 18, 2023, and officially implemented as the final guideline. In Japan, the Ministry of Health, Labour and Welfare issued the revised guideline on August 31, 2023 (with a minor correction on October 4, 2023), which came into effect immediately. In the United States, the FDA published the final guidance in May 2023. The European Medicines Agency (EMA) finalized adoption on January 26, 2023, with the guideline coming into effect on July 26, 2023.

Challenges with ICH Q9 and Need for Practical Guidance

While the ICH Q9 “Guideline on Quality Risk Management” is relatively easy to read, its content is abstract and lacks specificity. The author has consistently believed that more concrete guidelines, including practical examples, are necessary for actual implementation. Indeed, those who attempt to develop Standard Operating Procedures (SOPs) in accordance with the Quality Risk Management guideline will quickly recognize the significant challenges involved.

Although ICH Q9 “Guideline on Quality Risk Management” is categorized under Quality guidelines, it is important to note that its scope includes the drug development stage. During the development phase, quality risk management is positioned as “part of knowledge accumulation.” This framework enables the determination of appropriate risk controls during technology transfer, facilitating informed decision-making throughout the product lifecycle.

Key Updates in Q9(R1)

New Terminology

Q9(R1) introduced several new terms: “continual improvement,” “pharmaceutical quality system,” “state of control,” and “uncertainty.”

The terms “continual improvement,” “pharmaceutical quality system,” and “state of control” appear to have been aligned with ICH Q10. The term “uncertainty” reflects the definition of risk found in ISO 9001. In ICH Q9, the definition of risk is aligned with ISO/IEC Guide 51 as “the combination of the probability of occurrence of harm and the severity of that harm.” It is noteworthy that the guideline also references the definition of risk from ISO 9001, though this makes the concept more abstract and potentially less accessible to the general public.

Expanded Scope: Product Availability

While the scope of application remains unchanged in this revision, “lack of stable supply of pharmaceuticals” has been added as a risk category. In other words, risks to quality now include situations where there is an impact on the stable supply of products that could potentially result in harm to patients. This represents a significant expansion in recognizing that quality risks extend beyond direct product quality issues to encompass supply chain reliability.

Supply Chain Risk Management

Furthermore, risks in the “supply chain” have been newly added to the guideline. While stable product supply can be achieved even with diverse manufacturing and supply chains, increasing complexity in supply chains can create interdependencies that lead to systematic quality and manufacturing risks affecting supply chain robustness.

When implementing quality risk management, appropriate subject matter experts should be involved, including personnel from quality departments, business development, engineering, regulatory affairs, manufacturing, sales and marketing, supply chain, legal, statistics, and clinical functions. This cross-functional approach ensures comprehensive risk assessment and management.

Managing Subjectivity in Risk Assessment

The guideline emphasizes as a point of consideration that subjectivity may be introduced into quality risk management. For example, this can occur when opinions differ regarding risk assessment methodologies. The “probability of occurrence” and “severity” included in the definition of risk are often subjective rather than objective measures. Therefore, conducting scientifically rigorous, evidence-based assessments is critically important.

For instance, consider a scenario where experts are gathered in a meeting room to discuss risk assessment. However, if the evaluation remains subjective, repeating the risk assessment at a different time, in a different location, with different people may not yield the same results. Consequently, there is a danger that patients or clinical trial subjects may ultimately bear the consequences of inconsistent risk assessments. To address this concern, the guideline emphasizes the need to reliably utilize available knowledge and promotes the use of objective data and scientific evidence in risk assessments.

New Section on Managing Subjectivity (5.3)

ICH Q9(R1) includes a dedicated new section, “5.3 Managing and Minimizing Subjectivity,” which addresses this critical issue. The section acknowledges that subjectivity can affect all stages of the quality risk management process, particularly hazard identification and the assessment of probability and severity of harm. It can also impact the evaluation of risk reduction measures and the effectiveness of decisions made from quality risk management activities. Subjectivity may arise from differences in risk assessment methods and how different stakeholders perceive hazards, harms, and risks, potentially introducing bias. To minimize subjectivity, it is essential to clarify risk assessment methods, use objective data where available, involve appropriate cross-functional expertise, and consider the perspectives of different stakeholders.

Fundamental Process Updates

From Risk Identification to Hazard Identification

In Chapter 4, “General Risk Management Process,” the previous term “risk identification” has been corrected to “hazard identification.” The author has consistently explained in seminars and training sessions that it is impossible to identify risks from the outset and that hazards must be identified first. Therefore, this correction is a welcome change that aligns with proper risk management methodology and eliminates the need for such explanations in training sessions.

This distinction is critical because hazards are sources of potential harm, while risks represent the combination of the probability and severity of harm occurring from those hazards. By first identifying hazards, organizations can then systematically assess the associated risks and implement appropriate controls.

Enhanced Risk Management Methodology

New Sections in Chapter 5

Chapter 5, “Risk Management Methodology,” has been substantially enhanced with the addition of two new sections:

5.1 Formality in Quality Risk Management
This section states that “formality in quality risk management is not a binary concept, i.e., formal versus informal.” Rather, formality in quality risk management should be understood as a continuous concept with a range from low to high levels. The section also emphasizes that “limited resources should not be used as justification for reducing the level of formality in the quality risk management process.” This is an important principle that ensures resource constraints do not compromise the rigor of risk management activities.

The concept of formality encompasses multiple dimensions, including the depth of analysis, the level of documentation, the use of structured tools and methodologies, the involvement of cross-functional teams, and the formality of decision-making processes. Organizations should determine the appropriate level of formality based on factors such as the complexity of the issue, the potential impact on patient safety and product quality, the degree of uncertainty, regulatory expectations, and the availability of prior knowledge and experience.

5.2 Risk-Based Decision-Making
This new section clarifies the concept of risk-based decision-making, which is inherent in all quality risk management activities. The guideline states that risk-based decision-making provides an essential foundation for decision makers in an organization. It emphasizes that effective risk-based decision-making begins with determining the appropriate level of effort, formality, and documentation that should be applied during the quality risk management process. Decision makers must consider not only the assessment of risk but also the broader context, including regulatory requirements, organizational capabilities, and the potential impact on patients and product quality.

Integration into Industry and Regulatory Operations

Chapter 6, “Integration of Quality Risk Management into Industry and Regulatory Operations,” has also been substantially enhanced.

Product Availability Risks (6.1)

A significant addition is section 6.1, “The Role of Quality Risk Management in Addressing Product Availability Risks Arising from Quality/Manufacturing Issues.” This section recognizes that quality risk management plays a crucial role in addressing product availability risks arising from quality and manufacturing issues. The process aims to ensure stable product supply by assessing risks related to product quality and developing strategies to reduce these risks.

Managing supply chain throughout the product lifecycle to address product availability risks due to quality and manufacturing issues includes maintaining current knowledge about quality and manufacturing hazards and prioritizing efforts to address such risks. Understanding quality and manufacturing hazards is critical for maintaining supply predictability. When risks are well understood and managed, higher reliability in stable supply can be achieved.

Risk management from the perspectives of “manufacturing process variation and state of control,” “manufacturing facilities and equipment,” and “supplier relationships and management” is recommended to ensure robust supply chain management.

Appendices

Appendix I Updates

In Appendix I, the title has been revised from “Risk Management Methods and Techniques” to “Quality Risk Management Methods and Techniques,” providing clearer alignment with the document’s focus. However, regarding content, while there are some additions, the substance remains largely unchanged. The appendix continues to provide examples of quality risk management tools and techniques, including Failure Mode and Effects Analysis (FMEA), Failure Mode, Effects and Criticality Analysis (FMECA), Fault Tree Analysis (FTA), Hazard Analysis and Critical Control Points (HACCP), and Preliminary Hazard Analysis (PHA), among others.

Appendix II: Supply Chain Management

Appendix II now includes a new section, “II.9 Quality Risk Management as Part of Supply Chain Control.” This addition addresses critical aspects of supply chain management:

• Manufacturing process variation and state of control
• Manufacturing facilities and equipment
• Supplier oversight, relationships, and management

These additions reflect the increasing complexity of pharmaceutical supply chains and the recognition that robust supply chain management is essential for ensuring product quality and availability. Organizations must implement comprehensive quality risk management strategies that encompass all elements of the supply chain, from raw material suppliers through manufacturing and distribution to the patient.

Supporting Training Materials

To facilitate implementation of ICH Q9(R1), comprehensive training materials covering six topics have been developed and made available on the ICH website. These training materials, released in October 2023, provide detailed guidance on:

1. Formality in Quality Risk Management
2. Risk-Based Decision-Making
3. Managing and Minimizing Subjectivity
4. Hazard Identification
5. Risk Review
6. Product Availability

These materials are designed to support both industry and regulatory authorities in effectively implementing the revised guideline and represent a significant enhancement to the original ICH Q9 framework.

Alignment with Other ICH Guidelines

ICH Q9(R1) has been carefully aligned with other relevant ICH Quality guidelines, particularly ICH Q10 (Pharmaceutical Quality System), ICH Q11 (Development and Manufacture of Drug Substances), and ICH Q12 (Technical and Regulatory Considerations for Pharmaceutical Product Lifecycle Management). This alignment ensures that quality risk management principles are consistently applied across various aspects of pharmaceutical quality throughout the product lifecycle.

The integration of quality risk management with these complementary guidelines creates a more cohesive regulatory framework that supports both planned processes (such as product review, inspection, audits, and change management) and unplanned processes (such as root cause analysis and recalls) within pharmaceutical quality management systems.

Implications for Implementation

The revisions to ICH Q9 represent a significant maturation of quality risk management approaches in the pharmaceutical industry. By addressing key areas where the original guideline was found to be insufficient—subjectivity in risk assessments, lack of clarity on formality, ambiguity in risk-based decision-making, and limited guidance on product availability risks—ICH Q9(R1) provides a more robust foundation for effective quality risk management.

Organizations implementing ICH Q9(R1) should focus on:

1. Developing clear methodologies that minimize subjectivity and enhance objectivity in risk assessments
2. Establishing appropriate levels of formality for different types of quality risk management activities
3. Enhancing risk-based decision-making capabilities throughout the organization
4. Integrating supply chain considerations into quality risk management processes
5. Ensuring cross-functional collaboration with appropriate subject matter experts
6. Leveraging the official ICH training materials to build organizational capability
7. Regularly reviewing and updating quality risk management practices to maintain effectiveness

The enhanced guideline, supported by comprehensive training materials, provides the pharmaceutical industry and regulatory authorities with clearer direction for implementing effective, scientifically sound quality risk management practices that ultimately serve to protect patients and ensure the quality and availability of pharmaceutical products.

Conclusion

ICH Q9(R1) represents a significant evolution in quality risk management guidance for the pharmaceutical industry. While maintaining the fundamental principles and framework of the original guideline, the revision addresses critical gaps in understanding and implementation that have emerged over nearly two decades of application. By providing greater clarity on formality, risk-based decision-making, managing subjectivity, and addressing product availability risks, the revised guideline better equips both industry and regulatory authorities to implement effective quality risk management throughout the pharmaceutical product lifecycle. As organizations implement these updates, they should leverage the comprehensive training materials and focus on building robust, scientifically sound quality risk management capabilities that prioritize patient safety and product quality while ensuring reliable product availability.