What Is Quality Risk Management?

Quality risk management is the systematic process of assessing, controlling, communicating and reviewing risks to the quality of a product across its lifecycle. In pharmaceuticals it is governed by ICH Q9(R1), and its stated purpose is protecting the patient. The level of effort should always be proportionate to the risk.

Ifosfamide is a chemotherapy agent used in curative regimens for testicular cancer and sarcoma. It entered severe shortage after manufacturing quality problems surfaced at a key supplier, one line item among the 227 active US drug shortages recorded in the second quarter of 2026.

A quality failure had become a treatment failure. That link is the reason the International Council for Harmonisation rewrote its quality risk management guideline in 2023, adding product availability risk to a document that had previously stopped at the factory gate.

Quality Risk Management: Key Takeaways
Quality risk management is the systematic assessment, control, communication and review of risks to product quality across the lifecycle. Its purpose is patient protection, and ICH Q9(R1) is the governing guideline.
ICH Q9(R1) reached Step 4 on 18 January 2023 and the FDA issued it as guidance for industry that May. It exists because the original Q9 was being applied badly, not because the concept changed.
The revision names four specific failures: high subjectivity in risk assessments, confusion over formality, unclear risk-based decision making, and product availability risks arising from quality problems.
Formality is a spectrum, not a switch. Effort, formality and documentation should be proportionate to risk, so a low-risk decision can be recorded in a line and a high-risk one needs a full cross-functional analysis.
Subjectivity is the fixable part. Anchored scales, defined terms, diverse assessment teams and separating hazard from harm from risk remove most of the variation between two people scoring the same event.
Quality failures are supply failures. Manufacturing issues accounted for 15% of 2025 US drug shortages, and 59% were reported with no stated cause at all, which is its own governance finding.
Pick the technique by the question. FMEA finds process failure points, HACCP fixes control points, HAZOP tests deviations from design intent, and a fishbone diagram investigates a deviation you already have.

ICH Q9(R1) reached Step 4 on 18 January 2023, and the FDA published it as guidance for industry the following May. The concept did not change. What changed was an admission that the industry had been applying it poorly for fifteen years.

What Quality Risk Management Actually Covers

Strip the guideline back and quality risk management rests on just two principles. Risk evaluation should be based on scientific knowledge and tied ultimately to patient protection, and the effort spent on it should match the level of risk being managed.

Those two sentences carry more weight than most quality manuals. The first rules out scoring by opinion where data exists. The second rules out running a full analysis on a trivial change, which is how QRM programs become paperwork machines nobody respects.

Element	What it means in practice	Where teams get it wrong
Risk assessment	Identify hazards, analyze the link between hazard and harm, evaluate against criteria.	Jumping straight to scoring without stating the hazard or the harm it could cause.
Risk control	Reduce risk to an acceptable level, or accept it explicitly, then verify it worked.	Listing controls that already exist and calling that a reduction in risk.
Risk communication	Share the output with those who need it, including regulators where required.	A report that reaches quality assurance and never reaches production or supply.
Risk review	Revisit the assessment when new knowledge, events or changes arrive.	Annual review by calendar only, so a deviation never triggers a rescore.
Formality	Scale the work to the risk at hand, so a small change can close in one line.	One heavy template for everything, which pushes teams to avoid the process.

Table 1. The four activities of quality risk management plus the principle that governs how hard to work at each.

The vocabulary matters more than it looks. A hazard is the potential source of harm, harm is the damage to health, and risk combines the probability of that harm with its severity, a distinction Q9(R1) sharpened deliberately because collapsing the three is what produces meaningless scores.

The 2023 Revision and the Four Gaps It Names

Regulators rarely say plainly that a guideline is being applied badly. The Q9 revision did, in unusually blunt language, and the four problems it lists are a fair description of what most quality risk management files look like when an inspector opens one.

Figure 1. The revision reads as a defect list. Every gap on it describes a habit the guideline cannot legislate away.

Product availability is the addition that surprised most people. Including shortage risk inside a quality guideline says that a plant which stops shipping a sole-source oncology drug has created a patient safety problem of its own, whatever the batch record shows.

The other three are questions of method. Subjectivity, formality and risk-based decision making all describe one underlying failure, which is a serious process applied by teams who never agreed what its terms mean, as the ICH briefing pack sets out at length.

Subjectivity Is the Gap You Can Close Yourself

Ask two experienced people to score the same deviation and you will often get two different answers. That gap is not a personal failing, it is a design failure in the scale, and it is the first thing the revision tells you to attack.

Bias enters through entirely predictable doors. Recent events feel more likely than they are, familiar processes feel safer than they are, and the most senior voice in the room quietly sets the anchor that everyone else quietly adjusts from without noticing.

Four controls remove most of the variation between assessors, and not one of them requires software, a consultant or a new template. They work because they change what the form asks for before anyone is allowed to reach a score:

• Anchor every scale band to something observable. “Likely” means nothing; “has occurred more than twice in the last 24 months” can be checked against records.
• Separate hazard, harm and risk in the form itself, so the assessor has to name what could go wrong and who it hurts before scoring anything.
• Build assessment teams across functions. A production supervisor, a microbiologist and a supply planner will surface different failure modes than three QA colleagues will.
• Score independently first, then reconcile. Collecting scores before discussion stops the anchoring effect that a group conversation reliably produces.

Scale design carries most of the weight here. Our comparison of 5×5 and 4×4 scoring scales covers the arithmetic trap in multiplying ordinal bands, and the same discipline applies whether the register is a quality register or an enterprise one.

How Much Formality Does a Decision Deserve?

Formality was the most practical addition to the guideline. Q9(R1) treats it as a spectrum running from informal to fully formal, and tells you to place each decision on that spectrum according to its risk, its uncertainty and its importance.

Figure 2. Three tiers, one rule. The heavier the consequence, the more structure and evidence the decision has to carry.

Getting this wrong in either direction is costly. Treating every change as formal buries the team in templates nobody reads, and treating a sterile process change as informal is the kind of judgment that appears later in a warning letter.

Decision	Suggested formality	What the record should show
Swapping a validated cleaning agent for an identical grade	Informal	A short justification in the change record, referencing the existing validation.
Adding a second supplier for a non-critical excipient	Semi-formal	A structured review, scored register entry, named owner and an approval.
Changing a sterile filling line parameter	Formal	Full FMEA or HAZOP, cross-functional team, documented acceptance and verification.
Investigating a confirmed out-of-specification result	Formal	Root cause analysis, hazard-to-harm reasoning, CAPA with effectiveness checks.
Reordering the same component from a qualified vendor	Informal	Nothing beyond the routine purchasing record. Assessing it wastes the team’s attention.

Table 2. Five real decisions placed on the formality spectrum, with the evidence each should leave behind.

Running the Quality Risk Management Process

With formality settled, the process itself is unglamorous and surprisingly short. Q9 describes four activities and nothing more elaborate than that, and the discipline lies in finishing each one. Most programs redraw the diagram on a new slide and call that progress.

Stage	What the team does	The output that proves it happened
Assess	Identify hazards, analyze how each could cause harm, evaluate against defined criteria.	A scored assessment naming hazard, harm, probability, severity and detectability.
Control	Decide to reduce or accept, select controls, then verify the residual position.	Funded actions with owners and dates, plus a residual score supported by evidence.
Communicate	Share findings with everyone whose decisions change because of them.	A dated distribution record covering production, supply and regulatory affairs.
Review	Reassess when knowledge, events or changes arrive, not only on the calendar.	Trigger-linked reviews with score movements and the reason for each change.

Table 3. The four stages, with the evidence each one has to leave behind.

Communication is the stage that quietly fails. An assessment that concludes a single-source excipient is a patient risk changes nothing if procurement never sees it, which is the mechanism behind a surprising share of supply chain risk that quality teams had already identified.

Review deserves an event trigger as well as a date. A confirmed deviation, a supplier change, a new inspection finding or a market complaint should all reopen the file, in the same way that any risk assessment program defines what forces a reassessment.

Choosing a Technique That Fits the Question

Q9 lists the techniques without ranking them, which frustrates teams looking for a single recommendation. The honest guidance is that each tool answers a different question, so the choice follows directly from what you need to learn about that particular process.

Figure 3. Four techniques, four questions. Most misuse starts when a team reaches for the familiar tool and the question calls for another.

FMEA is the default in pharmaceutical quality and the most frequently misapplied. It examines how a process step can fail and whether detection would catch it, which makes it strong for process design and weak for investigating an event that has already happened.

Sector variants follow the same logic with different vocabulary. Our guides to the HACCP matrix for food safety and ISO 14971 for medical devices show how the underlying method adapts, and the wider catalogue of assessment techniques sits behind all of them.

Sector-specific assessments increasingly arrive with their own regulatory expectations. Nitrosamine work is the clearest current example, and our nitrosamine risk assessment checklist walks through an evaluation that regulators now expect every marketing authorization holder to hold on file and keep current.

When a Quality Failure Becomes a Supply Failure

The product availability clause turns an internal quality metric into a public health one. A batch rejected for good reason still removes doses from patients, and the guideline now expects somebody to weigh that consequence openly before the batch is written off.

Figure 4. Manufacturing issues account for 15%. The 59% reported with no cause is the more uncomfortable number.

Read that top bar as a governance finding in its own right. When most shortages carry no stated cause, the sector cannot learn anything from them, and neither regulators nor purchasers can tell an ordinary capacity decision apart from a quality failure.

For a quality team the practical response is to treat single-source dependencies as quality risks, not procurement ones. That means the assessment names the patient impact of a supply interruption, and the supply chain heat map carries the same scale as the quality register.

The FDA publishes its current shortage list openly, and checking whether your own products appear on it is a five-minute exercise that most quality functions never run. The agency’s shortage database and its shortage program pages are both public and free to use.

One Deviation Carried Through the Process

Abstract descriptions of the four stages leave the hardest part of the work unexplained. Here is a single event carried end to end: a temperature excursion on a cold-chain shipment of a biologic, discovered on receipt at the distributor’s own warehouse.

Stage	What was done	The number or evidence it produced
Assess	Hazard named as loss of temperature control; harm as reduced potency and possible loss of efficacy.	Excursion of 4 hours above 8C. Severity 4, probability 3, giving an initial score of 12 of 25.
Analyze	Stability data reviewed against the specific excursion profile rather than the label range.	Cumulative thermal exposure still inside the validated window, so product quality was not compromised.
Control	Root cause traced to an unqualified courier handoff at a regional hub during a heatwave.	Courier requalified, route restricted, temperature logger alarm threshold reduced to 6C.
Communicate	Findings shared with supply, regulatory affairs and the receiving distributor, not only QA.	Dated distribution record plus a contract amendment restricting uncontrolled sub-contracting.
Review	Reassessed after two subsequent shipments on the same lane were monitored end to end.	Residual score reduced to 6, evidenced by two clean shipments and the logger data behind them.

Table 4. One temperature excursion, four stages, and the evidence at each step.

Three things in that example are what an inspector will look for first. The harm was named before anything at all was scored, the stability data outranked the label assumption, and the residual score moved only after real evidence arrived on file.

Notice also what the assessment deliberately did not do. It did not reject the batch on the excursion alone, because the science supported release, and being able to defend that decision is what risk-based decision making is supposed to mean.

Common Quality Risk Management Questions Practitioners Ask

What is quality risk management in pharma?

Quality risk management is the systematic assessment, control, communication and review of risks to product quality across the lifecycle, with patient protection as the objective. ICH Q9(R1) is the governing guideline, adopted at Step 4 in January 2023 and issued by the FDA as guidance that May.

What changed in ICH Q9(R1)?

The revision targets four weaknesses: high subjectivity in risk assessments, poor understanding of formality, unclear risk-based decision making, and product availability risks caused by quality problems. It also adds guidance on digital tools and sharpens the distinction between hazard, harm and risk.

What are the two principles of quality risk management?

Risk evaluation should rest on scientific knowledge and connect ultimately to patient protection, and the level of effort, formality and documentation should be proportionate to the level of risk. Everything else in the guideline follows from those two short statements.

What tools are used in quality risk management?

FMEA, HACCP, HAZOP, fault tree analysis, fishbone diagrams and simple risk ranking are the common ones. Q9 lists techniques without ranking them, because each answers a different question. Choose by what you need to learn rather than by which method the site already uses.

How does quality risk management differ from ISO 31000?

ISO 31000 is a generic risk management framework for any organization and any risk type. Quality risk management is narrower and regulated, focused on product quality and patient safety under ICH Q9(R1). The process steps overlap heavily; the obligations and the consequences do not.

What does formality mean in quality risk management?

Formality describes how much structure and evidence a decision receives. Q9(R1) treats it as a spectrum from informal to formal, set by risk, uncertainty and importance. A routine reorder needs almost none; a sterile process change needs a full documented analysis.

Who is responsible for quality risk management?

Senior management owns the system and the resources, quality assurance owns the method and the standard, and process owners run assessments for their own operations. Regulators expect the decisions to be traceable to named people rather than to a committee.

How often should a quality risk assessment be reviewed?

At least annually, and immediately whenever new knowledge arrives. Confirmed deviations, supplier changes, inspection findings, complaints and process changes should all reopen the assessment. Reviewing by calendar alone is the single most common weakness that inspectors report in this area.

Where Quality Risk Files Fall Apart

The failures below turn up in programs that follow the guideline on paper and still produce assessments that nobody trusts. Each one is a behavior that no procedure can reach, which is why issuing a new template never fixes any of them.

Failure	How it shows up	The correction
Scoring before naming the harm	A number appears with no statement of who could be hurt and how.	Make hazard and harm mandatory fields that must be completed before any score.
Detectability as a fudge factor	A high severity is quietly offset by an optimistic detection score.	Base detection on measured escape rates, or drop the multiplier and report severity separately.
Formality by template	Every change gets the same heavy form, so teams route around the process.	Publish the formality tiers and let low-risk decisions close in a single line.
Assessment as a one-off	The file is created for an inspection and never touched again.	Define event triggers, not just an annual date, and log every trigger-linked review.
Quality risk stops at the gate	Supply interruption treated as a commercial matter outside the QRM scope.	Add product availability to the harm definitions, as Q9(R1) now expects.
Homogeneous assessment teams	Three colleagues from one function produce a confident, narrow answer.	Require cross-functional membership and record who took part in each assessment.
Controls listed, not verified	Existing controls are credited with reducing risk without any test.	Attach a test date and result to each control, or mark the residual score unverified.

Table 5. Seven recurring failures in quality risk files, each with the correction that costs least.

The second and seventh travel together most often. An unverified control paired with a generous detectability score can move a risk from red to green on paper without anything changing on the floor, which is the precise pattern inherent and residual scoring exists to prevent.

Independent challenge is what closes that gap in practice. Whoever reviews the assessment should not have been the person who wrote it, and a control self-assessment cycle plus a defined set of quality indicators gives that reviewer something factual to test against.

Where the Guideline Pushes Practice Next

Objectivity is becoming a measurable standard. Q9(R1) frames subjectivity as a defect to be reduced, not an unavoidable feature of expert judgment, so expect inspectors to probe how scale bands were anchored and who else was in the room that day.

Digital methods arrive with the same caution attached. The revision addresses risk management for digitalization and emerging technologies, which means an algorithm that ranks deviations will itself need justification, much as the NIST Cybersecurity Framework expects for any automated control.

Quality risk is also being pulled into enterprise governance. It now sits under the same oversight as every other exposure the board carries, and mapping the QRM register onto ISO 31000 terms, as our ISO 31000 guide sets out, makes board reporting possible without a translation layer.

Start with Table 2 before you touch a template. Place your last ten quality decisions on the formality spectrum, and if all ten received identical treatment, the design of the process is the problem and the people running it are not.

If you are a quality or risk lead whose assessments are thorough but rarely change a decision, we help teams anchor scales, set formality tiers and build files that survive an inspection. See how we work, or write to us with the last assessment your team argued about.