1. Quality Risk Management ICH Q9 Content
Disclaimer: This presentation includes the authors views on quality risk management theory and practice. The presentation does not represent official guidance or policy of authorities or industry.

2. Purpose of this part
To guide through the content of the ICH Q9 document
Provide some considerations, possible interpretations and where appropriate examples

3. ICH Q9: Quality Risk Management (QRM)
Document is available on the ICH Webpage

4. Table of contents 1. Introduction 2. Scope
3. Principles of Quality Risk Management
4. General Quality Risk Management Process
5. Risk Management Methodology Annex I: Risk Management Methods and Tools
6. Integration of QRM process into Industry and Regulatory operations Annex II: Potential Applications for QRM
7. Definitions
8. References

5. Quality Risk Management
1. Introduction
Risk Management
Quality Risk Management
Quality Systems
Harm
Severity
Stakeholder
Product Life Cycle
GMP Compliance

6. 2. Scope
This guideline provides principles & examples of tools of quality risk management that can be applied to different aspects of pharmaceutical quality.
These aspects include development, manufacturing, distribution, and the inspection and submission/review processes throughout the lifecycle of drug substances, drug (medicinal) products, biological and biotechnological products
ICH Q9

7. 2. Scope Drug substances, Drug (medicinal) products,
CONSIDERATIONS
2. Scope
Drug substances,
Drug (medicinal) products,
Biological and biotechnological products Including the selection and use of
Raw materials
Solvents
Excipients
Packaging and labelling materials
Components

8. 3. Principles of Quality Risk Management
Two primary principles:
The evaluation of the risk to quality should be based on scientific knowledge and ultimately link to the protection of the patient
The level of effort, formality and documentation of the quality risk management process should be commensurate with the level of risk
ICH Q9

9. 4. General Quality Risk Management Process
Systematic processes designed to coordinate, facilitate and improve science-based decision making with respect to risk to quality
ICH Q9

10. 4. A General Quality Risk Management Process
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate
Quality Risk Management Process
Output / Result of the M g e l
Team approach
ICH Q9

11. 4. General Quality Risk Management Process
Decision makers: Person(s) with competence and authority to make a decision
Ensuring that ongoing Quality Risk Management processes operate
Coordinating quality risk management process across various functions and departments
Supporting the team approach
Management responsibility
ICH Q9

12. 4. General Quality Risk Management Process
CONSIDERATIONS
4. General Quality Risk Management Process
Team approach
Usually, but not always, undertaken by interdisciplinary teams from areas appropriate to the risk being considered e.g.
Quality unit
Development
Engineering / Statistics
Regulatory affairs
Production operations
Business, Sales and Marketing
Legal
Medical / Clinical
&… Individuals knowledgeable of the QRM processes

13. 4. General Quality Risk Management Process
When to initiate and plan a QRM Process
First define the question which should be answered (e.g. a problem and/or risk question)
including pertinent assumptions identifying the potential for risk
Then assemble background information and/ or data on the potential hazard, harm or human health impact relevant to the risk
Identify a leader and necessary resources
Specify a timeline, deliverables and appropriate level of decision making for the QRM process
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l
ICH Q9

14. When to apply Quality Risk Management?
CONSIDERATIONS
When to apply Quality Risk Management?
Should risks
be assessed?
Are there clear rules
for decision making?
e.g. regulations
Yes
“no RM“
Risk assessment not required
(No flexibility)
Follow procedures
(e.g. Standard Operating Procedures)
Document results,
decisions and actions
1. What might go wrong?
2. What is the likelihood (probability)
it will go wrong?
3. What are the consequences (severity)?
No or
justification needed
Can you answer
the risk assessment
questions?
Yes
“informal RM“
Initiate Risk assessment
(risk identification, analysis & evaluation)
Run risk control
(select appropriate measures)
Agree on a team
(small project)
Select a Risk Management tool
(if appropriate e.g. see ICH Q9 Annex I) No
“formal RM“
Carry out the
quality risk management process
Document the steps
Based on K. Connelly, AstraZeneca, 2005

15. 4. General Quality Risk Management Process
3 fundamental questions
Risk Assessment
Risk Identification What might go wrong?
Risk Analysis What is the likelihood (probability) it will go wrong?
Risk Evaluation What are the consequences (severity)?
Note: People often use terms “Risk analysis”, “Risk assessment” and “Risk management” interchangeably which is incorrect!
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l
ICH Q9

16. 4. General Quality Risk Management Process
Risk Assessment: Risk Identification
“What might go wrong?”
A systematic use of information to identify hazards referring to the risk question or problem
historical data
theoretical analysis
informed opinions
concerns of stakeholders
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l
ICH Q9

17. 4. General Quality Risk Management Process
Risk Assessment: Risk Analysis
“What is the likelihood it will go wrong?”
The estimation of the risk associated with the identified hazards.
A qualitative or quantitative process of linking the likelihood of occurrence and severity of harm
Consider detectability if applicable (used in some tools)
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l
ICH Q9

18. 4. General Quality Risk Management Process
CONSIDERATIONS
4. General Quality Risk Management Process
Risk Assessment: Risk Analysis
Often data driven Keep in mind: Statistical approach may or may not be used
Maintain a robust data set!
Start with the more extensive data set and reduce it
Trend and use statistics (e.g. extrapolation)
Comparing between different sets requires compatible data
Data must be reliable
Data must be accessible
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l

19. 4. General Quality Risk Management Process
Risk Assessment: Risk Evaluation
“What is the risk?”
Compare the identified and analysed risk against given risk criteria
Consider the strength of evidence for all three of the fundamental questions
What might go wrong?
What is the likelihood (probability) it will go wrong?
What are the consequences (severity)?
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l

20. 4. General Quality Risk Management Process
CONSIDERATIONS
4. General Quality Risk Management Process
Risk Assessment: Risk Evaluation
A picture of the life cycle
= Risk Priority Number
Probability x
Detectability x
Severity
Frequency of “occurences” driven by the number of trials
Degree of belief
Data refers to
Can you find it?
Impact
past
today
future
time

21. 4. General Quality Risk Management Process
Risk Control: Decision-making activity
Is the risk above an acceptable level?
What can be done to reduce or eliminate risks?
What is the appropriate balance between benefits, risks and resources?
Are new risks introduced as a result of the identified risks being controlled?
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l
ICH Q9

22. 4. General Quality Risk Management Process
CONSIDERATIONS
4. General Quality Risk Management Process
Risk Control: Residual Risk
The residual risk consists of e.g.
Hazards that have been assessed and risks that have been accepted
Hazards which have been identified but the risks have not been correctly assessed
Hazards that have not yet been identified
Hazards which are not yet linked to the patient risk
Is the risk reduced to an acceptable level?
Fulfil all legal and internal obligations
Consider current scientific knowledge & techniques
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l

23. 4. General Quality Risk Management Process
Risk Control: Risk Reduction
Mitigation or avoidance of quality risk
Elimination of risks, where appropriate
Focus actions on severity and/or probability of harm; don’t forget detectability
It might be appropriate to revisit the risk assessment during the life cycle for new risks or increased significance of existing risks
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l
ICH Q9

24. 4. General Quality Risk Management Process
Risk Control: Risk Acceptance
Decision to
Accept the residual risk
Passively accept non specified residual risks
May require support by (senior) management
Applies to both industry and competent authorities
Will always be made on a case-by-case basis
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l

25. 4. General Quality Risk Management Process
CONSIDERATIONS
4. General Quality Risk Management Process
Risk Control: Risk Acceptance
Discuss the appropriate balance between benefits, risks, and resources
Focus on the patients’ interests and good science/data
Risk acceptance is not
Inappropriately interpreting data and information
Hiding risks from management / competent authorities
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l

26. What is an “acceptable risk”?
Risk Control: Risk Acceptance Who has to accept risk?
Decision Maker(s)
Person(s) with the competence and authority to make appropriate and timely quality risk management decisions
Stakeholder
Any individual, group or organization that can …be affected by a risk
Decision makers might also be stakeholders
The primary stakeholders are the patient, healthcare professional, regulatory authority, and industry
The secondary stakeholders are patient associations, public opinions, politicians
(ICH Q9, definition)

27. 4. General Quality Risk Management Process
EXAMPLE
4. General Quality Risk Management Process
A Risk Acceptance process 1/3
Finish baseline for
risk acceptance decision
risk identification, risk analysis,
risks evaluation, risks reduction
Risk reduction step
finished
Yes
Stakeholders
involved as appropiate?
Revisit
risk assessment step
All identified
risks assessed? No
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l

28. 4. General Quality Risk Management Process
EXAMPLE
4. General Quality Risk Management Process
Evaluate measures
on severity, probability, detectability
Check needed resources
e.g. employee, money
Measures / Actions
appropriate? No
Yes
Revisit
risk reduction step
Other hazards
caused?
Is a risk
reducible?
Measures/
actions needed?
A Risk Acceptance process 2/3
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l

29. 4. General Quality Risk Management Process
EXAMPLE
4. General Quality Risk Management Process
A Risk Acceptance process 3/3
Accept the
residual risk?
Ready for communication
Accept risk
Sign off documentation
Is a risk
reducible?
Yes
Advantage
outweighs risk? No
Risk not acceptable
Revisit
risk assessment step
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l

30. 4. General Quality Risk Management Process
Risk Communication
Bi-directional sharing of information about risk and risk management between the decision makers and others
Communicate at any stage of the QRM process
Communicate and document the output/result of the QRM process appropriately
Communication need not be carried out for each and every individual risk acceptance
Use existing channels as specified in regulations, guidance and SOP’s
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l
According to ICH Q9

31. 4. General Quality Risk Management Process
CONSIDERATIONS
4. General Quality Risk Management Process
Risk Communication
Exchange or sharing of information, as appropriate
Sometimes formal sometimes informal
Improve ways of thinking and communicating
Increase transparency
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l

32. Quality risk management
CONSIDERATIONS
Quality risk management
Communication facilitates trust and understanding
Regulators operation - Reviews
- Inspections
Industry operation - Submissions
- Manufacturing

33. 4. General Quality Risk Management Process
Risk review: Review Events
Review the output / results of the QRM process
Take into account new knowledge and experience
Utilise for planned or unplanned events
Implement a mechanism to review or monitor events
Reconsideration of risk acceptance decisions, as appropriate
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l
ICH Q9

34. 5. Risk Management Methodology
One method “all inclusive”?
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l
Cartoon: © Zurich Insurance Inc.

35. Expectations on methods and tools
CONSIDERATIONS
Expectations on methods and tools
Supports science-based decisions
A great variety are listed but other existing or new ones might also be used
No single tool is appropriate for all cases
Specific risks do not always require the same tool
Using a tool the level of detail of an investigation will vary according to the risk from case to case
Different companies, consultancies and competent authorities may promote use of different tools based on their culture and experiences

36. Contributing items to manage quality risks
CONSIDERATIONS
Contributing items to manage quality risks
System Risk (facility & people)
e.g. interfaces, operators risk, environment, components such as equipment, IT, design elements
System Risk (organisation)
e.g. Quality systems, controls, measurements, documentation, regulatory compliance
Process Risk
e.g. process operations and quality parameters
Product Risk (safety & efficacy)
e.g. quality attributes: measured data according to specifications

37. 5. Risk Management Methodology
Supports a scientific and practical approach to decision-making
Accomplishing steps of the QRM process
Provides documented, transparent and reproducible methods
Assessing current knowledge
Assessing probability, severity and sometimes detectability
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l
ICH Q9

38. 5. Risk Management Methodology
Adapt the tools for use in specific areas
Combined use of tools may provide flexibility
The degree of rigor and formality of QRM
Should be commensurate with the complexity and / or criticality of the issue to be addressed and reflect available knowledge
Informal ways
empirical methods and / or internal procedures
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l
ICH Q9

39. Annex I: Risk Management Methods and Tools
Provides a general overview of and references for some of the primary tools
Might be used in QRM by industry and regulators
This is not an exhaustive list
No one tool or set of tools is applicable to every situation in which a QRM procedure is used
For each of the tools
Short description & reference
Strength and weaknesses
Purely illustrative examples
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l
ICH Q9

40. Overview: Some tools and their key words
CONSIDERATIONS
Overview: Some tools and their key words
Failure Mode Effects Analysis (FMEA)
Break down large complex processes into manageable steps
Failure Mode, Effects and Criticality Analysis (FMECA)
FMEA & links severity, probability & detectability to criticality
Fault Tree Analysis (FTA)
Tree of failure modes combinations with logical operators
Hazard Analysis and Critical Control Points (HACCP)
Systematic, proactive, and preventive method on criticality
Hazard Operability Analysis (HAZOP)
Brainstorming technique
Preliminary Hazard Analysis (PHA)
Possibilities that the risk event happens
Risk ranking and filtering
Compare and prioritize risks with factors for each risk
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l

41. 5. Risk Management Methodology
Supporting statistical tools
Acceptance Control Charts (see ISO 7966)
Control Charts (for example)
Control Charts with Arithmetic Average and Warning Limits (see ISO 7873)
Cumulative Sum Charts; “CuSum” (see ISO 7871)
Shewhart Control Charts (see ISO 8258)
Weighted Moving Average
Design of Experiments (DOE)
Pareto Charts
Process Capability Analysis
Histograms
Use others that you are familiar with….
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate Quality
Risk Management Process
Output / Result of the Quality M g e l
ICH Q9

42. 5. Risk Management Methodology
CONSIDERATIONS
5. Risk Management Methodology
Q9 does not provide “drivers licences”

43. 6. Integration into Industry and Regulatory Operations
Foundation for “science-based” decisions
Does not obviate industry’s obligation to comply with regulatory requirements
May affect the extent and level of direct regulatory oversight
Degree of rigor and formality commensurate with the complexity and/or criticality of the issue
Implement QRM principles when updating existing guidelines
ICH Q9

44. Annex II: Potential Applications for QRM
This Annex is intended to identify potential uses of quality risk management principles and tools by industry and regulators.
However, the selection of particular risk management tools is completely dependent upon specific facts and circumstances.
These examples are provided for illustrative purposes and only suggest potential uses of quality risk management.
This Annex is not intended to create any new expectations beyond the current regulatory requirements.
ICH Q9 Introduction to Annex II

45. Annex II: Potential Applications for QRM
Quality risk management as part of
Integrated quality management
Documentation
Training and education
Quality defects
Auditing / Inspection
Periodic review
Change management / change control
Continual improvement
Competent authorities
Industry

46. Competent authorities Competent authorities
Annex II: Potential opportunities for conducting quality risk management
Quality risk management as part of
Regulatory operations
Inspection and assessment activities
Competent authorities
Industry operations
Development
Facilities, equipment and utilities
Materials management
Production
Laboratory control and stability testing
Packaging and labelling
Industry
Competent authorities

47. Quality Risk Management
PROCESS
ASSESSMENT
CONTROL
COMMUNICATION
IDENTIFICATION
ANALYSIS
EVALUATION
REDUCTION
ACCEPTANCE
REVIEW EVENTS
ACCEPT (RESIDUAL RISK)
INTERDISCIPLINARY
TEAMS
WHAT`?
PROBABILITY
SEVERITY
CRITERIA
Failure Mode, Effects & Criticality Analysis
TOOLS
INFORMAL
HACCP
HAZOP
FMEA
FMECA
FTA
PHA
Hazard Analysis & Critical Control Points
Preliminary Hazard Analysis
Fault Tree Analysis
Failure Mode Effect Analysis
Hazard Operatibility Analysis
QUALITY Mgt.
INDUSTRY
REGULATORY
DOCUMENTATION
TRAINING
AUDITING
CHANGE CONTROL
MATERIALS
PRODUCTION QU
INSPECTION
ASSESSMENT
APPLICATION
ICH Q9
Quality Risk Management
RISK
PROBABILITY OF HARM
SEVERITY
CAUSE OF DAMAGE
CAUSE OF HARM
HAZARD
PRINCIPLES
PATIENT PROTECTION
EFFORT
Peter Gough, Stephan Roenninger, ICH Q9 : Quality Risk Management - an update Regulatory Affairs Journal, 16, 2005, 91-93
Bill Paulson, ICH Q9 Provides Implementation Framework for Quality Risk Management Gold Sheet, 39, May 2005
QUALITY SYSTEM
© J. Arce, F. Hoffmann-La Roche

48. Use the right “risk” expression please!
Risk Review R i s k C o m u n c a t
Risk Assessment
Risk Evaluation
unacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
Initiate
Quality Risk Management Process
Output / Result of the M g e l
Use the right “risk” expression please!