Quality Risk Management: Understanding ICH Q9 and the Revised GMP Regulations
Background and Regulatory Changes
Since the enforcement of the GMP Enforcement Notice on August 30, 2013, over a decade has passed, and in 2021, Japan’s GMP regulations underwent a major revision. This revision was published on April 28, 2021 (Ministry of Health, Labour and Welfare Ordinance No. 90) and became effective on August 1, 2021. The primary objective was to achieve international harmonization (alignment with global regulations) through integration with the Pharmaceutical Inspection Co-operation Scheme (PIC/S) GMP Guidelines and the ICH Quality Guidelines (Q8, Q9, and Q10).
A key component of this revision was the incorporation of appropriate quality risk management practices in accordance with ICH Q9 principles. Previously, ICH Q9 “Guideline on Quality Risk Management” had been issued as a Director’s Notice (issued on September 1, 2006, as Yakushoku Shinsa-hatsu No. 0901004 and Yakushoku Kanma-hatsu No. 0901005). However, the revised GMP regulations now require the establishment and implementation of procedures based on ICH Q9 principles to ensure the proper utilization of quality risk management.
It is important to note that ICH Q9 was subsequently revised, and ICH Q9(R1) reached Step 4 of the ICH Process on January 18, 2023. This revision addresses three key areas: managing subjectivity in quality risk management, defining the appropriate level of formality required, and clarifying risk-based decision-making processes. The revised guideline emphasizes the integration of uncertainty, significance, and complexity into quality risk management frameworks.
Current State of Implementation in Japanese Pharmaceutical Companies
A critical question remains: How many pharmaceutical companies in Japan truly understand and properly implement quality risk management? Despite the regulatory requirements, there appears to be significant misunderstanding about the fundamental nature of quality risk management and its proper integration into pharmaceutical quality systems.
Common Misunderstandings
Misunderstanding 1: Quality Risk Management as a Subset of the Improvement Process
Some conceptual diagrams, including those that have appeared in regulatory materials, have depicted quality risk management as if it were merely a component of a PDCA (Plan-Do-Check-Act) improvement process. This representation is fundamentally incorrect.
Quality risk management is not a tool within the improvement cycle; rather, it has its own PDCA cycle and must be implemented in parallel with quality control and quality assurance activities. Quality risk management operates as an enabling methodology that supports and enhances the entire pharmaceutical quality system (PQS), as defined in ICH Q10.
The relationship between quality risk management and the quality management system should be understood as follows:
- Quality risk management is one of the “enablers” (facilitating tools) in the pharmaceutical quality system, alongside knowledge management
- It should be integrated into all processes and decision-making activities throughout the product lifecycle
- It operates with its own continuous improvement cycle while supporting the broader quality management system
Misunderstanding 2: Creating Separate Risk Management Departments and Procedures
Another common misconception is the belief that quality risk management requires establishing a specialized department or creating dedicated Standard Operating Procedures (SOPs) specifically for risk management. This approach fundamentally misunderstands the nature of quality risk management.
Quality risk management is not an activity performed by a specific department following a particular procedure. Instead, risk management concepts must be integrated into all existing processes and procedures across the organization. Every department, in executing its current procedures, should incorporate risk-based thinking and decision-making.
The correct approach involves:
- Embedding risk management principles into existing SOPs across all functional areas
- Training all personnel to apply risk-based thinking in their daily activities
- Ensuring that risk assessment and control are considered at every decision point
- Integrating quality risk management into processes such as change control, deviation management, CAPA (Corrective Action and Preventive Action), supplier qualification, and product quality review
There is no need to establish a dedicated risk management department, nor should organizations create standalone quality risk management SOPs separate from their operational procedures.
Understanding the PDCA Cycle in Quality Management
Regarding the PDCA cycle itself, it is important to clarify the correct positioning of management review within this framework. In ISO 9001 quality management systems, management review is positioned within Clause 9 (Performance Evaluation), which corresponds to the “Check” phase of the PDCA cycle, not the “Act” phase as sometimes misunderstood.
The correct PDCA structure in ISO 9001:2015 is:
| PDCA Phase | ISO 9001:2015 Clauses | Content |
| Plan | Clauses 4-7 | Context, Leadership, Planning, Support |
| Do | Clause 8 | Operations, Product and Service Realization |
| Check | Clause 9 | Performance Evaluation (Monitoring, Measurement, Analysis, Internal Audit, Management Review) |
| Act | Clause 10 | Improvement (Nonconformity, Corrective Action, Continual Improvement) |
Management review serves as a comprehensive evaluation mechanism to assess the performance, suitability, adequacy, and effectiveness of the quality management system based on data and information gathered during operations. The outputs from management review (decisions on changes, resource allocation, and improvement opportunities) then feed into the “Act” phase, where corrective actions, preventive actions, and CAPA processes are implemented.
International Standards and Regulatory Framework
FDA’s Quality Systems Approach
In September 2006, the U.S. Food and Drug Administration (FDA) published the guidance document “Quality Systems Approach to Pharmaceutical CGMP Regulations.” This guidance was developed as part of the Pharmaceutical CGMPs for the 21st Century Initiative, which was announced in August 2002. The guidance references the international quality management standard ISO 9001 and provides a comprehensive quality systems model to help manufacturers meet current Good Manufacturing Practice (cGMP) requirements.
The FDA guidance presents a six-system inspection model that addresses:
- Quality System
- Production System
- Facilities and Equipment System
- Laboratory Control System
- Materials System
- Packaging and Labeling System
This guidance emphasizes that quality should be built into products and that testing alone cannot ensure product quality. It promotes the integration of quality risk management, knowledge management, and continuous improvement into pharmaceutical manufacturing operations.
ICH Q10: Pharmaceutical Quality System
ICH Q10 “Pharmaceutical Quality System,” which reached Step 4 in June 2008 and was implemented by the FDA in April 2009 and the European Commission in July 2008, provides a comprehensive model for an effective pharmaceutical quality system. ICH Q10:
- Encompasses the requirements of GMP regulations
- Complements ICH Q8 (Pharmaceutical Development) and ICH Q9 (Quality Risk Management)
- Applies throughout the product lifecycle from pharmaceutical development through commercial manufacturing and product discontinuation
- Emphasizes the achievement of product realization objectives and continual improvement
- Defines enabling approaches including quality risk management and knowledge management
The pharmaceutical quality system described in ICH Q10 aims to:
- Achieve product realization by meeting product and process requirements
- Establish and maintain a state of control through monitoring and control systems
- Facilitate continual improvement through innovation and pharmaceutical development
- Strengthen the link between pharmaceutical development and manufacturing activities
The Path Forward: International Harmonization
As globalization in the pharmaceutical industry becomes increasingly unavoidable, Japanese regulatory requirements must align with international standards, FDA regulations, PIC/S guidelines, and other global frameworks. It is essential to:
- Understand the true requirements of international standards such as ISO 9001, ICH Q8, Q9, and Q10
- Properly interpret and implement FDA guidance documents and PIC/S GMP Guidelines
- Construct appropriate processes that integrate quality risk management throughout the product lifecycle
- Move beyond superficial compliance to achieve genuine integration of quality risk management principles
- Foster a quality culture that embraces risk-based decision-making at all organizational levels
- Ensure that quality risk management is not merely a regulatory checkbox but a fundamental way of thinking and operating
Practical Implementation Considerations
For effective implementation of quality risk management, pharmaceutical companies should:
- Integrate Risk Management Systemically: Embed risk management into all existing processes rather than creating separate procedures
- Provide Comprehensive Training: Ensure all personnel understand risk-based thinking and can apply it in their roles
- Apply Appropriate Tools: Use risk management tools (FMEA, FMECA, FTA, HACCP, etc.) appropriate to the complexity and significance of the risk
- Maintain Proportionality: The level of effort, formality, and documentation should be commensurate with the level of risk
- Document Decisions: Record the rationale for risk-based decisions to demonstrate systematic thinking
- Review and Update: Regularly review risk assessments and update them based on new knowledge and experience
- Link to Quality Culture: Foster an organizational culture that values proactive risk identification and management
Conclusion
The proper understanding and implementation of quality risk management, aligned with ICH Q9(R1), FDA guidance, PIC/S requirements, and international standards, is essential for Japanese pharmaceutical companies operating in the global marketplace. Quality risk management is not an isolated activity or department function but rather a fundamental approach that should permeate all aspects of pharmaceutical operations. By correctly integrating quality risk management principles into existing processes and fostering a risk-aware culture, companies can achieve both regulatory compliance and genuine improvements in product quality and patient safety.
English Translation
Quality Risk Management: Understanding ICH Q9 and the Revised GMP Regulations
Background and Regulatory Changes
Since the enforcement of the GMP Enforcement Notice on August 30, 2013, over a decade has passed, and in 2021, Japan’s GMP regulations underwent a major revision. This revision was published on April 28, 2021 (Ministry of Health, Labour and Welfare Ordinance No. 90) and became effective on August 1, 2021. The primary objective was to achieve international harmonization (alignment with global regulations) through integration with the Pharmaceutical Inspection Co-operation Scheme (PIC/S) GMP Guidelines and the ICH Quality Guidelines (Q8, Q9, and Q10).
A key component of this revision was the incorporation of appropriate quality risk management practices in accordance with ICH Q9 principles. Previously, ICH Q9 “Guideline on Quality Risk Management” had been issued as a Director’s Notice (issued on September 1, 2006, as Yakushoku Shinsa-hatsu No. 0901004 and Yakushoku Kanma-hatsu No. 0901005). However, the revised GMP regulations now require the establishment and implementation of procedures based on ICH Q9 principles to ensure the proper utilization of quality risk management.
It is important to note that ICH Q9 was subsequently revised, and ICH Q9(R1) reached Step 4 of the ICH Process on January 18, 2023. This revision addresses three key areas: managing subjectivity in quality risk management, defining the appropriate level of formality required, and clarifying risk-based decision-making processes. The revised guideline emphasizes the integration of uncertainty, significance, and complexity into quality risk management frameworks.
Current State of Implementation in Japanese Pharmaceutical Companies
A critical question remains: How many pharmaceutical companies in Japan truly understand and properly implement quality risk management? Despite the regulatory requirements, there appears to be significant misunderstanding about the fundamental nature of quality risk management and its proper integration into pharmaceutical quality systems.
Common Misunderstandings
Misunderstanding 1: Quality Risk Management as a Subset of the Improvement Process
Some conceptual diagrams, including those that have appeared in regulatory materials, have depicted quality risk management as if it were merely a component of a PDCA (Plan-Do-Check-Act) improvement process. This representation is fundamentally incorrect.
Quality risk management is not a tool within the improvement cycle; rather, it has its own PDCA cycle and must be implemented in parallel with quality control and quality assurance activities. Quality risk management operates as an enabling methodology that supports and enhances the entire pharmaceutical quality system (PQS), as defined in ICH Q10.
The relationship between quality risk management and the quality management system should be understood as follows:
- Quality risk management is one of the “enablers” (facilitating tools) in the pharmaceutical quality system, alongside knowledge management
- It should be integrated into all processes and decision-making activities throughout the product lifecycle
- It operates with its own continuous improvement cycle while supporting the broader quality management system
Misunderstanding 2: Creating Separate Risk Management Departments and Procedures
Another common misconception is the belief that quality risk management requires establishing a specialized department or creating dedicated Standard Operating Procedures (SOPs) specifically for risk management. This approach fundamentally misunderstands the nature of quality risk management.
Quality risk management is not an activity performed by a specific department following a particular procedure. Instead, risk management concepts must be integrated into all existing processes and procedures across the organization. Every department, in executing its current procedures, should incorporate risk-based thinking and decision-making.
The correct approach involves:
- Embedding risk management principles into existing SOPs across all functional areas
- Training all personnel to apply risk-based thinking in their daily activities
- Ensuring that risk assessment and control are considered at every decision point
- Integrating quality risk management into processes such as change control, deviation management, CAPA (Corrective Action and Preventive Action), supplier qualification, and product quality review
There is no need to establish a dedicated risk management department, nor should organizations create standalone quality risk management SOPs separate from their operational procedures.
Understanding the PDCA Cycle in Quality Management
Regarding the PDCA cycle itself, it is important to clarify the correct positioning of management review within this framework. In ISO 9001 quality management systems, management review is positioned within Clause 9 (Performance Evaluation), which corresponds to the “Check” phase of the PDCA cycle, not the “Act” phase as sometimes misunderstood.
The correct PDCA structure in ISO 9001:2015 is:
| PDCA Phase | ISO 9001:2015 Clauses | Content |
| Plan | Clauses 4-7 | Context, Leadership, Planning, Support |
| Do | Clause 8 | Operations, Product and Service Realization |
| Check | Clause 9 | Performance Evaluation (Monitoring, Measurement, Analysis, Internal Audit, Management Review) |
| Act | Clause 10 | Improvement (Nonconformity, Corrective Action, Continual Improvement) |
Management review serves as a comprehensive evaluation mechanism to assess the performance, suitability, adequacy, and effectiveness of the quality management system based on data and information gathered during operations. The outputs from management review (decisions on changes, resource allocation, and improvement opportunities) then feed into the “Act” phase, where corrective actions, preventive actions, and CAPA processes are implemented.
International Standards and Regulatory Framework
FDA’s Quality Systems Approach
In September 2006, the U.S. Food and Drug Administration (FDA) published the guidance document “Quality Systems Approach to Pharmaceutical CGMP Regulations.” This guidance was developed as part of the Pharmaceutical CGMPs for the 21st Century Initiative, which was announced in August 2002. The guidance references the international quality management standard ISO 9001 and provides a comprehensive quality systems model to help manufacturers meet current Good Manufacturing Practice (cGMP) requirements.
The FDA guidance presents a six-system inspection model that addresses:
- Quality System
- Production System
- Facilities and Equipment System
- Laboratory Control System
- Materials System
- Packaging and Labeling System
This guidance emphasizes that quality should be built into products and that testing alone cannot ensure product quality. It promotes the integration of quality risk management, knowledge management, and continuous improvement into pharmaceutical manufacturing operations.
ICH Q10: Pharmaceutical Quality System
ICH Q10 “Pharmaceutical Quality System,” which reached Step 4 in June 2008 and was implemented by the FDA in April 2009 and the European Commission in July 2008, provides a comprehensive model for an effective pharmaceutical quality system. ICH Q10:
- Encompasses the requirements of GMP regulations
- Complements ICH Q8 (Pharmaceutical Development) and ICH Q9 (Quality Risk Management)
- Applies throughout the product lifecycle from pharmaceutical development through commercial manufacturing and product discontinuation
- Emphasizes the achievement of product realization objectives and continual improvement
- Defines enabling approaches including quality risk management and knowledge management
The pharmaceutical quality system described in ICH Q10 aims to:
- Achieve product realization by meeting product and process requirements
- Establish and maintain a state of control through monitoring and control systems
- Facilitate continual improvement through innovation and pharmaceutical development
- Strengthen the link between pharmaceutical development and manufacturing activities
The Path Forward: International Harmonization
As globalization in the pharmaceutical industry becomes increasingly unavoidable, Japanese regulatory requirements must align with international standards, FDA regulations, PIC/S guidelines, and other global frameworks. It is essential to:
- Understand the true requirements of international standards such as ISO 9001, ICH Q8, Q9, and Q10
- Properly interpret and implement FDA guidance documents and PIC/S GMP Guidelines
- Construct appropriate processes that integrate quality risk management throughout the product lifecycle
- Move beyond superficial compliance to achieve genuine integration of quality risk management principles
- Foster a quality culture that embraces risk-based decision-making at all organizational levels
- Ensure that quality risk management is not merely a regulatory checkbox but a fundamental way of thinking and operating
Practical Implementation Considerations
For effective implementation of quality risk management, pharmaceutical companies should:
- Integrate Risk Management Systemically: Embed risk management into all existing processes rather than creating separate procedures
- Provide Comprehensive Training: Ensure all personnel understand risk-based thinking and can apply it in their roles
- Apply Appropriate Tools: Use risk management tools (FMEA, FMECA, FTA, HACCP, etc.) appropriate to the complexity and significance of the risk
- Maintain Proportionality: The level of effort, formality, and documentation should be commensurate with the level of risk
- Document Decisions: Record the rationale for risk-based decisions to demonstrate systematic thinking
- Review and Update: Regularly review risk assessments and update them based on new knowledge and experience
- Link to Quality Culture: Foster an organizational culture that values proactive risk identification and management
Conclusion
The proper understanding and implementation of quality risk management, aligned with ICH Q9(R1), FDA guidance, PIC/S requirements, and international standards, is essential for Japanese pharmaceutical companies operating in the global marketplace. Quality risk management is not an isolated activity or department function but rather a fundamental approach that should permeate all aspects of pharmaceutical operations. By correctly integrating quality risk management principles into existing processes and fostering a risk-aware culture, companies can achieve both regulatory compliance and genuine improvements in product quality and patient safety.
Comment