Quality Risk Management

Every product or process has associated risks. Zero risk reduction is not a realistic goal nevertheless protection of patient by managing this risk in the quality system and manufacturing process is being given prime importance in the pharmaceutical industry.

It is important that product quality should be maintained throughout the product lifecycle.
In the earlier days risk was assessed in the following ways:

  • Trends review
  • Check lists
  • Flow charts
  • Observations compilation
  • Changes review

Now the risk management approach initiated by regulatory agencies with recognized management tools along with support of statistical tools are implemented across the industry.

Risk Management is a systematic process for the assessment, control, communication and review of risks.

A Risk Management Program starts with identifying the possible risks associated with a product or with the process used to develop, manufacture, and distribute the product.

An effective quality risk management process ensures the high quality of drug product to the patient. In addition quality risk management improves decision making if a quality problem arises.

It should include systematic processes designated to co-ordinate, facilitate and improve science-based decision-making with respect to risk.

Approaches to Quality Risk Management

The industry widely uses two approaches to risk management:

Proactive: This approach identifies the threat exposure areas to mitigate the potential for loss, before the loss occurs.

Reactive: This approach investigates the threat exposure areas to identify the root cause for loss and its control, after the loss occurs.

Area of Scope for Quality Risk Management in the Industry

There are a number of areas of opportunity that where the potential risk could be managed, these include:







Renowned methods for managing of risks in the industry:

Qualitative: Qualitative analysis is the action of using subjective information in determining a conclusion of a given unit without proper statistical outcome. Qualitative analysis is used for subjective decisions based on the non-quantifiable information, generally it is used during root cause analysis to come up with possible solutions.

Quantitative: Quantitative analysis is structured statistical analysis to estimate the risk how much involved in the process/facility/system. Quantitative analysis is a statistical analysis and is a combination of Severity, Probability and Delectability.
Risk Priority Number (RPN) can be established during quantitative risk analysis and it is evolved by multiplication of identified values of Severity (S), Probability §, and Delectability (D).

The RPN rating scale can be established in three levels i.e. Low, Medium and High to estimate the identified risks are at which level.

The image below provides an overview of a typical QRM process:

Refer to ICH Q9 for further understanding of each element which is involved in the structured QRM process.

Basic Risk Management Tools

The Pharmaceutical industry and regulators can assess and manage the risks by using recognized management tools. Below is the non-exhaustive list of some of the tools.

  • Failure Mode Effects Analysis [FMEA]
  • Failure Mode, Effects and Criticality Analysis [FMECA]
  • Fault Tree Analysis [FTA]
  • Hazard Analysis and Critical Control Points [HACCP]
  • Hazard Operability Analysis [HAZOP]
  • Preliminary Hazard Analysis [PHA]

Failure Mode Effective Analysis

FMEA is an effective tool for an evaluation of potential failure modes it methodically breaks down the analysis of complex processes into manageable steps. FMEA can be used to prioritize risks and monitor the effectiveness of risk control activities.
An overview of some of the most critical steps are as follows:

  • Identify an area where risk exists.
  • Describe the system and function.
  • Create a block or process flow diagram indicating relationships within the process
  • Create a worksheet containing information about the system
  • What is important is that you have a process to analyze potential failure modes (i.e. problems that could happen) AND the potential effects of that failure on your process.

Let’s elaborate on each specific step:

Step 1: Selecting the High Risk Process/Area

You can identify the high risk processes with the following criteria but not limited to:

  • Lengthy process with more stages
  • High risk of failures in the process
  • Top failed product in the history
  • Process that is heavily dependent on human intervention
  • Process executed in the oldest facility
  • Process/facility with rapid changes

Step 2: Forming the Assessment Team

The assessment team should have the following capabilities

  • Subject matter expert
  • Cross functional
  • To cover all levels
  • Solid understanding to the process being assessed
  • Well experienced on the process being assessed
  • Well qualified with strong analytical skills

Step 3: Diagram the Process

The assessment team should have the following capabilities

  • Subject matter expert
  • Cross functional
  • To cover all levels
  • Solid understanding to the process being assessed
  • Well experienced on the process being assessed
  • Well qualified with strong analytical skills

Step 4: Identify the Potential Failure Modes

Process can have multiple failure modes and each failure mode can have multiple effects.

Address the following questions during failure modes identification.

  • What could fail with this step? (Failure modes)
  • Why would this failure occur? (Causes)
  • What could happen if failure occurs? (Effects)

Step 5: Assess the Failure Modes and Causes

  • Risk mitigation requires an understanding of the Severity, probability and detestability of the exposure.
  • Use clear scale for rating of risk consistently.
  • Keep the scales simple and ensure they are appropriate to the exposure and organizations risk tolerance.
  • Causes identification should be transparent to mitigate the risk effectively.

Step 6: Assessment of Critical Failure Modes

The highest RPN’s should be focused on first and should be considered as critical.

Ask the following questions during assessment

  • What might cause the failure to occur?
  • When might the failure occur?
  • Where might the failure occur?
  • Why might the failure occur?

Step 7: Redesign the process

Considerations for the re-designation of the process.

  • If identified the critical failure mode.
  • If inadequate controls are exists.
  • If existing process not robust.

Direct the re-designated process prior to its wide spread implementation.

Frame work for Failure Mode Effect Analysis

  • Assesses the steps of the process and identify where the problems may occur.
  • Identify consequences of each failure mode should it occur.
  • Scores the exposures quantifiably.
  • The highest RPN’s should be focused on first.
  • Assists with better understanding of the process.
  • Brain storming is the critical to the process.

Concerns regarding QRM implementation

  • Hiding risks
  • Writing half the truth (e.g. in an investigation report)
  • A means of removing industry’s obligation to comply with regulatory requirements
  • Both Companies & Inspectors have to think and not simply follow black and white rules


The use of a risk-based approach provides a consistent method for decision making which was easily associated with resource allocation and ensuring patient safety. Ultimately, applying risk management to pharmaceutical industry should reduce the number of threats or minimize their impact through the consistent use of the tools/methods and periodic review. The output of the risk management supports to the organization to meets the defined goals