Umit Kartoglu is president and CEO, Extensio et Progressio,
Collonge-Bellerive, Switzerland.

Umit Kartoglu

Risk management matrix chart with pen and organizer book | Image Credit: ©wirojsid - stock.adobe.com

Submitted: January 20, 2024
Accepted: April 10, 2024

While the concept of risk has been a subject of study across various fields for centuries and has been implemented in diverse industries for decades, its formal integration into the pharmaceutical sector is relatively recent. While the concepts of risk and risk assessment had already been present in aspects of the good manufacturing practice (GMP) guidelines and regulations in various parts of the world, the more holistic management of risk, via quality risk management (QRM), was only formally introduced to the pharmaceutical industry in 2005 by the International Council for Harmonisation (ICH), through the publication of its harmonized tripartite guideline on 

This guideline outlined QRM principles and concepts, and it provided examples of QRM tools, offering applications of QRM to different facets of pharmaceutical quality, such as process development, manufacturing, distribution, as well as inspection and submission/review processes throughout the lifecycle of drug substances, drug (medicinal) products, and biological and biotechnological products. This coverage extended to the utilization of raw materials, solvents, excipients, and packaging and labeling materials in medicinal products, biological, and biotechnological products.

When ICH Q9 was introduced, there were limited instances of QRM being utilized in the pharmaceutical industry, and these instances were somewhat restricted and did not encompass the comprehensive benefits that QRM could offer. The ICH Q9 guideline introduced a systematic approach to QRM, and it aimed to facilitate more effective and consistent risk-based decision-making by both regulators and the industry, concerning the quality of drug substances and drug products throughout the product lifecycle.

While there were initial industry concerns that the implementation of ICH Q9 could result in heightened expectations and regulatory demands, going beyond the existing requirements, this proved to be generally unfounded. However, in the years subsequent to the release of ICH Q9, the principles and concepts of QRM became integrated into GMP requirements. ICH Q9 aimed to instill discipline in the management of risk by the industry and its regulators by emphasizing two crucial principles (1):

The evaluation of the risk to quality should be based on scientific knowledge and ultimately link to the protection of the patient

The level of effort, formality, and documentation of the QRM process should be commensurate with the level of risk.

At this point, it is useful to consider the interrelationship between risk and knowledge, and between quality risk management and knowledge management (KM), and ICH Q10 

, published in 2008, becomes important here. ICH Q10 positioned QRM and KM as two key enablers of an effective pharmaceutical quality system, and it presented a comprehensive quality system model that supports product development and manufacture across the product lifecycle (2). ICH Q10 was more than just a model for a PQS; it also offered a vision of potential opportunities for the industry when an effective PQS was demonstrated. These included opportunities afforded using more risk-based approaches by regulators with respect to inspections and product assessments, facilitating more innovative approaches to process validation and real-time release, as well as optimizing science and risk-based post-approval change processes to maximize the benefits derived from innovation and continual improvement.

All of these opportunities, which are often referred to as “regulatory flexibility”, can be linked back to ICH Q9 which, in 2005, stated: “Effective quality risk management can facilitate better and more informed decisions, can provide regulators with greater assurance of a company’s ability to deal with potential risks and can beneficially affect the extent and level of direct regulatory oversight” (1).

In this paper, the authors reflect upon the past 15 years of experience in the application of QRM and KM within the pharmaceutical GMP environment and consider how impactful those two enablers have actually been. This paper focuses on the following aspects:

ICH Q10 positioned QRM and KM as enablers of the PQS, where they would provide the means for science and risk-based decisions related to product quality.

ICH Q10 set out three main objectives of its PQS model—achieving product realization, establishing a state of control, and facilitating continual improvement.

Evolution of QRM and KM in the GMPs and official guidance documents. Since its publication, ICH Q9 has become a guideline of foundational relevance in pharmaceutical manufacturing, and it led to many updates to the GMP guidelines and requirements in various regions to incorporate QRM principles and concepts into the manufacture of medicines. In the European Union (EU), for example, the first chapter of the EU GMP Guide, Quality Management, was revised in 2008 to explicitly incorporate the QRM principles of ICH Q9, and many other updates were made to the EU GMPs in the years that followed, which embedded QRM and risk-based approaches into virtually all aspects of GMP (3). The publication in 2018 of comprehensive GMP guidance for the manufacture of advanced therapy medicinal products (ATMPs), and the revisions made to Annex 1 of the EU GMP guide in relation to the manufacture of sterile medicinal products, which became effective in August 2023, illustrate the extent to which QRM is relied upon to support the manufacture of high-quality medicines (4,5).

And it was not just the industry that was expected to apply QRM principles and concepts; regulators also developed and adopted risk-based approaches, methodologies, and tools for their own work, such as, for example, in GMP inspection planning. An example of this is the publication in 2012 by the Pharmaceutical Inspection Co-operation Scheme (PIC/S) of its risk-based planning tool for GMP inspections, which was directly based on the QRM guidance in ICH Q9, and which was subsequently adopted by the European Medicines Agency (EMA) and the EU GMP regulatory framework for planning GMP inspections in the EU (6).

The COVID-19 pandemic further illustrated the importance of QRM, when it became necessary to develop more flexible regulatory approaches and expectations to support the continued manufacture and release of medicines and active substances at a time of unparalleled supply chain disruption and manufacturing challenges. The regulatory flexibilities developed by the EU regulatory network in response to the COVID-19 pandemic were firmly rooted in the application of QRM, as illustrated by the “Questions and Answers on Regulatory Expectations for Medicinal Products for Human Use During the COVID-19 Pandemic” document, published by the European Commission, the Heads of Medicines Agencies and EMA on April 10, 2020, and updated on April 17, and May 29, 2020 (7). In parallel with these initiatives by regulators, industry, and industry-led organizations (e.g., the Parenteral Drug Association [PDA] and the International Society for Pharmaceutical Engineering [ISPE]) have produced a wealth of technical reports and guidelines heavily focused on QRM (8,9).

It is clear from the above points that QRM became heavily integrated into medicines manufacturing and in the associated regulatory framework since the publication of ICH Q9 in 2005. But it has been a somewhat different story in relation to KM. While, as noted above, ICH Q10 positioned KM as a key enabler to an effective PQS, alongside QRM, the incorporation of KM-related concepts and initiatives in the regulatory framework for medicines manufacturing has significantly lagged behind that of QRM. This is illustrated by the fact that significantly fewer GMP revisions and guidelines focused on KM. Apart from the 2011 World Health Organization (WHO) guidelines on the transfer of technology in pharmaceutical manufacturing, and the 2013 WHO guideline on QRM, which did highlight the importance of KM, there have been relatively few GMP guideline revisions or new guidelines published that gave any significant attention to KM (10,11). In the EU, the 2013 revision of Chapter 1 of the EU GMP guide to incorporate some of the concepts of ICH Q10 did refer to KM, as did the 2015 revision of EU GMP Annex 15 (Qualification and Validation) and the 2018 revision of EU GMP Annex 17 (Real Time Release Testing and Parametric Release) (3,12,13), but the degree of attention devoted to KM in those, and other, publications was relatively light, especially when compared to the attention that QRM was given in those and in other publications.

Fortunately, the revision of ICH Q9 in 2023 should serve to reset things, because it strongly emphasizes the role that knowledge and KM have in the management of risk. It states in its Introduction section that, that “QRM is part of building knowledge and understanding risk scenarios,so that appropriate risk control can be decided upon for use during the commercial manufacturing phase” (14). And in this context, it states that “knowledge is used to make informed risk-based decisions, trigger re-evaluations and stimulate continual improvements.” The section in the revised guideline on formality in QRM states that uncertainty may be reduced “via effective knowledge management, which enables accumulated and new information (both internal and external) to be used to support risk-based decisions throughout the product lifecycle.” The section on risk-based decision-making refers to how “all decision making relies on the use of knowledge”, and the approaches to risk-based decision-making that are outlined in the guideline are beneficial, “because they address uncertainty through the use of knowledge, facilitating informed decisions by regulators and the pharmaceutical industry in a multitude of areas” (14).

The guideline makes several other references to KM also, such as in Chapter 6 in relation to product availability risks, where it states that the pharmaceutical quality system “uses quality risk management and knowledge management to provide an early warning system that supports effective oversight and response to evolving quality/manufacturing risks from the pharmaceutical company or its external partners” (14).

QRM has been somewhat of a difficult subject area to get right, let alone develop high levels of competency in. Risk assessment primarily relies on probability estimation, demanding reliable data and keen insights. But estimating probabilities can be challenging. Not alone might there be a deficit of data to base reliable estimates on, research indicates that cognitive biases can significantly disrupt our judgments regarding probabilities (15–19), even in the context of there being reliable data available. There is also the issue of stakeholder perception; as ICH Q9 states, “achieving a shared understanding of the application of risk management among diverse stakeholders is difficult because each stakeholder might perceive different potential harms, place a different probability on each harm occurring and attribute different severities to each harm” (1). Even within a single site, people may perceive harms and hazards quite differently (20). This discrepancy may not only influence how risks are assessed, it can also influence which risks receive priority in the management process and which do not.

On top of these issues, subjectivity in risk assessment outputs can also arise through use of the tools and methods employed today, including their risk scoring methods, and very often, those tools and methods have few, if any, meaningful design elements that serve to control subjectivity (21).

Knowledge management has proven even more difficult to get right. The formal recognition via ICH Q10 in 2008 of KM as a crucial enabler of an effective PQS, alongside QRM, was an important development, but the role of KM in medicines manufacturing was probably not developed sufficiently in the years that followed, especially in regulatory guidance (as illustrated previously in this paper), and this has led to the situation today where KM remains somewhat of an elusive and under-developed concept in the GMP environment (2).

While intuitively easy to grasp, when one starts working on how actually to do KM within complex organizations, the problem becomes quite challenging. For many of us, the topic of KM can be quite nebulous. What exactly is KM? What are its tools? How is its effectiveness measured?How can we demonstrate its added value? Where should it reside within the PQSs of pharmaceutical companies?

Despite these issues, there have been some important academic and industry initiatives undertaken in KM over the past 10 years or so that have refocussed attention on KM, and progress has been made. Examples include the research work published by the Pharmaceutical Regulatory Science Team (PRST) at the Technological University, Dublin, Ireland, as well as ISPE’s 

 (22–24). It is also of note that, both ICH Q10 from 2008 and the 2019 ICH Q12 guideline on lifecycle management outlined expectations for organizations to proactively handle product and process knowledge, emphasizing the potential for more streamlined and effective regulatory oversight, as seen in the potential regulatory flexibilities relating to post-approval change management that are discussed in ICH Q12 (25).

But overall, unlike the situation with QRM, there is still a scarcity of resource and regulatory guidance specifically addressing the role of KM within the pharmaceutical sector, and this is an area that does need renewed focus. One of the key challenges with KM has probably been how to measure its effectiveness, and how to demonstrate that investing in KM adds value. Perhaps a smart way to demonstrate the effectiveness of KM activities is by measuring how much risk reduction a site’s QRM activities ultimately deliver (26). This is because, as knowledge increases, uncertainty should decrease, and risk should also decrease. Thus, an effective use of knowledge in QRM activities should drive risk down.

The relationship between knowledge and risk has been explored in research work on KM performed by Dr. Marty Lipa and his colleagues at the PRST. That work resulted in the development of the Risk-Knowledge Infinity (RKI) cycle shown in 

 (23), which serves as a useful construct for linking risk and knowledge through QRM and KM activities.

The key concepts behind the RKI Cycle are:

Knowledge is both an input to and an output from QRM.

Knowledge has an inverse relationship with risk.

The concept of flow; knowledge flows effortlessly and on demand to inform risk assessment, and risk assessment informs new knowledge.

The cycle is continuous and perpetual; knowledge is always evolving and should be continually applied to inform QRM activities.

Figure 1. The risk-knowledge infinity cycle by Lipa and O’Donnell, 2020 (23). (Figure courtesy of the authors)

The relationship between knowledge and risk is foundational to effective decision-making and QRM. As knowledge grows, it provides a basis for reducing uncertainty and implementing strategies to mitigate risks, contributing to more informed and successful outcomes. ISO 31000, on Risk Management, supports this way of thinking—it defines risk as “the effect on uncertainty on objectives”, where uncertainty relates to a deficiency in one’s knowledge of an event, its consequence, or likelihood (27).

Risk reduction is one way to assess the effectiveness of a KM program. The ISPE 

Good Practice Guide on Knowledge Management in the Pharmaceutical Industry

 suggests additional useful approaches to measure KM effectiveness (24).

Regardless of the challenges in measuring the effectiveness of KM activities, it is important to recognize that KM is a multifaceted discipline that encompasses both explicit and tacit knowledge, requiring a balanced approach that integrates technology with people-centric strategies to foster a culture of continuous learning and innovation. As underlined by Kane and Lipa, the “true North” in KM revolves around people, processes, technology, and governance, supported by a quality culture (28). When all these aspects work correctly, KM may be referred to as effective, leading to decreases in uncertainty and therefore in risk.

Is it always possible to objectively measure or quantify risk with a high degree of certainty? Risk values are derived through the process of risk analysis. However, the probabilistic nature of risk results in there being some degree subjectivity, and uncertainty, in its assessment, and sometimes to a significant extent (21). Even if all staff members agree on the hazard and understand the processes within which that hazard may reside, they may still interpret information about that hazard differently, leading to varied risk assessment conclusions. Even experts cannot guarantee complete precision in their judgments. The necessity for judgment introduces subjectivity and inherent bias into the risk assessment process. This underscores the preference for conducting risk assessments with a team of interdisciplinary experts to mitigate subjectivity.

In addition, risk represents the potential for future loss based on exposure to a hazard, and thus, risk estimates and risk assessments inherently involve foreseeing future outcomes. As the actual occurrence of the risk event and its consequences remain unknown beforehand, there arises a necessity for probabilistic judgments to supplement information about an unpredictable future, and such judgements can be affected by factors that introduce subjectivity, such as those relating to the various human heuristics that exist. Consequently, QRM is appropriately regarded as a type of decision analysis, a method for making decisions amidst a degree of uncertainty. While most risk definitions do not explicitly refer to time-based considerations, risk is widely considered to inherently encompass the future. Risk analysis does not delineate a present issue or a future certainty; instead, it outlines the potential for future harm. As Robert N. Charette points out, “risk assessment is not about future decisions, but about the future of decisions that we must take now” (29).

Unmitigated, recurring, and new high risks in the industry

The pharmaceutical industry, like any complex industry, faces challenges in mitigating and preventing all high risks from being realized, despite the implementation of QRM practices within GMP and other areas. Several factors contribute to the persistence of unmitigated and recurring high risks (e.g., ineffective control strategies, poor approaches to qualification and validation [where important GMP controls do not get sufficiently validated], a lack of understanding of hazards, highly subjective risk assessments [that sometimes lead to a false sense of security in the outcomes of risk assessment activities, which are often that all risks are under adequate control]). The increasing complexity of supply chains is also a factor, leading to an increased likelihood of things going wrong.

A relatively simple indication of unmitigated risks in the pharmaceutical industry is the presence of quality defects in batches of medicines that are placed on the market. Over the years, the Health Products Regulatory Authority (HPRA) in Ireland has reported increasing trends in critical, major, and other quality defects in medicines. Since 2002, the total number of reported quality defects increased eight-fold (

), while recalls showed a less steep two-fold increase.

Figure 2. Trends in critical, major, and other quality defects reported to the Health Products Regulatory Authority (HPRA) 2002-2021. (Figure courtesy of the authors)

While quality defect reporting rates, especially by the industry, did increase during that timeframe, it is probable that various other factors, such as the effects of globalization on the production and distribution of active substances and medicines, along with growing complexities in both products and their manufacturing processes, played a role in the observed increases.

Some examples of quality defect issues investigated by the HPRA in recent years, and which led to recall actions, include the following:

July 2023: Recall of a saline solution for infusion product to hospital level—due to the potential for cross-contamination with midazolam

June 2023: Recall of a lisdexamphetamine 30 mg capsule product to patient level—at least one pack contained 70 mg lisdexamphetamine capsules

February 2023: Recall of a levothyroxine product to patient level—due to the potential for over-concentration (x10) of the active substance

August 2022: Recall to patient level of three compounded parenteral nutrition medicinal products due to incorrect product compositions—in one case, the patient required hospitalization

April 2021: Recall of two liothyronine/levothyroxine products to patient level—due to potential for under-concentration of both actives in the tablets

May 2020: Recall of an Investigational Medicinal Product from a clinical trial in children—due to a product mix-up in different arms of the trial.

These issues all related to batches of medicines that were manufactured in licensed manufacturing plants working under GMP (which places a heavy emphasis on QRM), where the manufacturing processes were to have been validated and the equipment and facilities qualified in accordance with risk-based principles, and where the staff had been trained. This begs the question: Why are validated manufacturing processes, run using qualified facilities and equipment, producing defective batches of medicinal products? Is it that the hazard identification part of those site’s risk assessments had not been effective? Is it that the links between risk assessment and validation/qualification protocols had been inadequate? Or were other factors at play?

The stagnation of QRM and three challenge areas

Despite manufacturing processes and supply chains becoming steadily more complex, some companies have continued to conduct risk assessments and perform QRM activities using generally the same tools and the same approaches as what they were using 10–15 years ago. This has led to a lack of progress in getting to evidence-based risk reduction via QRM activities and can be characterized by the following:

a continued high reliance on qualitative and semi-quantitative risk assessment tools, where the outputs of those tools are essentially treated as quantitative expressions of risk and risk reduction

a high degree of subjectivity in risk estimates and risk assessment outputs

a lack of progress in developing reliable ways to measure residual risk in a process with respect to a) producing defective batches, b) running into quality issues that lead to drug shortages, and c) serious GMP non-compliances.

There are indications from regulatory inspection activities and quality defect investigations that current risk assessment and QRM activities are still not sufficiently robust or effective, leading to highly subjective risk estimates and risk assessment outcomes, where the risks presented by hazards are not effectively managed and where the outcomes of risk assessment work often do not withstand regulatory scrutiny. For example, GMP deficiencies continue to occur in areas directly related to the management of risk (e.g., deviations, validation, change control, supplier oversight, product quality reviews [PQRs]). The following are some examples:

classifying recurring defects with a starting material as minor, despite the rejection of those lots due to critical defects

PQRs that conclude a process is in control despite high rates of batch failures, recurring deviations, and very low process capabilities

inappropriate actions taken after repeated line clearance failures

rating suppliers as low risk despite recurring quality problems.

In addition to these issues, there are also recurring issues with risk assessments (e.g., concluding that certain failure modes are highly detectable when no detection controls are in place; assigning low probabilities to failure modes when no preventative controls are in place and when there are no data support those ratings).

In the authors’ experience, there has probably been some stagnation in the development of fit-for-use risk assessment and QRM tools and methods. For example, the validation or qualification requirements for the GMP controls that either maintain risks at low levels or that reduce risks to acceptable levels are often not well addressed in many currently used risk assessments and QRM tools/methods, and the linkages between risk assessments and validation/qualification protocols can be unclear. In addition, there is still a high reliance placed on qualitative and semi-quantitative risk assessment tools and approaches, where risk levels and risk priority numbers (RPNs) are calculated by multiplying ordinal-scale likelihood, severity, and detectability values assigned to hazards and failure modes, and where the decisions made about hazards and risks place a lot of importance on the magnitude of the risk and RPN numbers that are calculated, without realizing that such numbers, when derived from ordinal number scales, may have a relatively high level of subjectivity associated with them.

RPNs are calculated by multiplying ordinal-scale factors (likelihood, severity, and detectability) and are simply a tool for the relative prioritization of risk-control actions, rather than a precise quantification of risk magnitude. Failures to understand the purpose of RPNs have resulted in ineffective risk treatment, contributing to unmitigated and persistently recurring risks in the industry.

Looking at the current state of QRM within the GMP environment from a higher, more macro level, it is important to recognize that ICH Q9 is a high level, non-prescriptive guideline on QRM; it addresses ‘what’ needs to be done, not so much ‘how’ to do it. For example, ICH Q9 does not tell one how to perform risk assessments, when to select one risk assessment tool over another, how to deal with risk perception and subjectivity issues, or how best to design risk review activities. Despite this, perhaps the guideline has been treated as the “gold standard” for the pharmaceutical industry, when it was never intended to be that, and perhaps too little use may have been made of the literature and the learnings from other disciplines. Such learning opportunities for pharma might relate to probability estimation, expert opinion elucidation and calibration, risk perception, bias and human heuristics, decision analysis, accident theory, and experimental psychology.

In contrast to ICH Q9, the WHO guidelines on QRM are somewhat more prescriptive (11). The WHO guidelines give elaborative explanations on QRM application for pharmaceuticals, and they deliberate at length on QRM considerations for medicines regulatory authorities. In principle, there is generally not an expectation for guidelines to explain ‘how’ things should be done; supplementary training materials and supporting documents often address the ‘how’. A good example of this is WHO’s 2010 

Model Guidance for the Storage and Transport of Time- and Temperature-sensitive Pharmaceutical Products (TTSPPs)

. This was based upon existing regulations and best practice guidance from a wide range of international sources (30). Naturally, the model guidance in setting out the principal requirements for TTSPPs, simply addressed ‘what’ needed to be done. Following the release of this model guidance, WHO published a total of 16 technical supplements to amplify the recommendations from the model guidance (31). These technical supplements provided ‘how-to’ guidance for a set of topics (e.g., selecting sites for storage facilities, temperature mapping of storage areas, and qualification of shipping containers).

This brings us to three major ‘how-to’ challenges that the authors believe would be useful to address with the application of QRM and KM in the pharmaceutical industry at this time. Working on these has the potential to help with the stagnation and lack of development issues discussed above, and they represent tangible steps that might help the industry further evolve.

Challenge area one: controlling subjectivity and reducing uncertainty. Subjectivity in QRM activities and its outputs arises as a result of many different factors. For example, different individuals and teams involved in the QRM process may perceive, interpret, and prioritize hazards and risks differently, whereby the effects of biases and human heuristics can impact upon the probability of occurrence and severity estimates that are made during risk assessment. The risk rating scales that a risk assessment tool uses may also be inherently subjective, in terms of how they are interpreted and used.

Uncertainty is an inherent aspect of QRM, given the probabilistic nature of risk, as mentioned previously, and the fact that QRM activities are often focused on future events. Its control requires a comprehensive understanding of the factors that may contribute uncertainty to the outputs of QRM activities, such as a lack of knowledge about hazards, their likely occurrence rates, the potential effects of a hazard, the detectability of the hazard or its consequences, and the likely effectiveness of risk control activities. Because uncertainty often arises from a lack of usable information, or from the inability to predict outcomes accurately, KM plays a crucial role in reducing uncertainty within an organization.

In relation to KM, the accumulation of explicit and tacit knowledge, having a centralized repository for information and knowledge, capturing lessons learned from past experiences, doing expertise mapping, collaborating, and knowledge-sharing, sharing information in real-time, having continuous learning and adaptation programs, integrating KM with QRM with a framework such as the RKI Cycle shown above, or other effective means, should all be considered.

Controlling subjectivity and reducing uncertainty have the potential to deliver many benefits. This should lead to QRM outputs that are based more on data and science, rather than on guesswork and ununiformed opinions; risk assessments and risk control activities would focus more on current and new GXP controls, rather than on subjective risk ratings that are not well supported by any controls. It should lead to more reliable estimates of risk, and practical ways to estimate (or measure) risk reduction and residual risk. It should also result in more harmonized approaches by GxP inspectors when reviewing risk assessment and QRM activities on site.

Challenge area two: demonstrating PQS effectiveness. Being able to demonstrate the effectiveness of one’s PQS has the potential to deliver many potential benefits. This beneficial outcome is clearly illustrated by ICH Q10, which sets out a number of potential opportunities to enhance science and risk-based regulatory approaches, when a pharmaceutical company demonstrates the effectiveness of its PQS, in conjunction with its application of the guidance in ICH Q8/9/10. Examples of such opportunities include an increased use of risk-based approaches for regulatory inspections, being able to use innovative approaches to process validation, and optimized science and risk-based post-approval change processes that will maximize the benefits derived from innovation and continual improvement, as reflected in ICH Q12. For patients, an effective PQS should not only lead to better quality medicines, it should also lead to fewer medicines shortages.

There are many areas within a PQS that can be worked on to enable a company to demonstrate the effectiveness of its PQS. For example, in relation to change management, what if a company could show that its change management process leads to measured risk reductions 80% of the time, or to continual improvements 90% of the time. In relation to PQR activities, a company could reposition its PQR process to serve as an advanced risk review activity, where PQRs become a formal tool for measuring residual risk levels within a process. These are just two examples, but perhaps they could serve as indicators of what a truly effective PQS might look like. QRM and KM can help achieve this, but only if applied correctly.

An effective PQS involves many things: trained and competent people, the robust implementation of the company’s policies and procedures, adopting a risk-based approach in all key activities where risk is present, maintaining robust learning programs that lead to knowledge increases, knowledge transfer and the application of learnings, effective CAPAs, a high focus on continuous improvement that is fostered through a culture of feedback, innovation, and regular reviews of processes. A PQS also involves effective monitoring processes, a value-adding internal audit program that drives continuous improvement, and a strong supplier management program that provides for an early warning system with regard to emerging risks. Compliance with regulatory standards, supported by good documentation and record-keeping, is foundational to an effective PQS. Having a management review program that drives enhancements, transparent communications, and a culture of accountability and responsibility is also important.

A key element of an effective PQS is how a company manages changes. In this regard, the PIC/S recommendation paper of 2021 on how to evaluate and demonstrate the effectiveness of a PQS in relation to risk-based change management offers useful guidance and a practical solution to pharmaceutical companies in this area (32). Another important aspect of an effective PQS relates to the controls that are in place for the prevention and management of medicines shortages; there are many useful resources available for companies to use and leverage, including the 2014 PDA and ISPE reports/guidances on this topic that provide solutions to addressing the global problems of drug shortages caused by manufacturing, quality and/or GMP compliance issues (33,34).

Challenge area three: getting to grips with risk-based decision-making. A culture that proactively supports decision-making based on facts, science, considered thinking, experience, expertise, knowledge, risk, and benefits is paramount for effective risk-based decision-making. Having systems in place that collect and convert data, information, and learnings into ready-to-use knowledge is also important. The following are some useful things to think about:

How does the PQS enable the capture and maintenance of new knowledge? What aspects of the PQS make this happen? Can the company demonstrate that the PQS is actually doing this?

Are there standardized repositories in place for GXP and non-GXP technical product and process knowledge?

Does the company have an ability to quickly connect and apply the experience and expertise present within the organization (tacit knowledge/know-how)?

Are there lessons learned processes in place, including for near misses (and not just in relation to deviations and technology transfer activities)? And do such processes also capture learnings about good practices and what went well in projects?

Effective risk-based decision-making when addressing complex problems or topics involves a methodical approach. Understanding the context and goals of the decision, identifying potential hazards (both internal and external) that are relevant to the decision, and assessing their associated risks, are critical, as are establishing criteria and tolerance levels, along with gathering and analyzing relevant data. All of this supports a decision-making framework that incorporates identified hazards and risk mitigation strategies, and which uses an appropriate level of formality in QRM activities, and where the impact on organizational objectives is properly assessed.

Effective risk-based decision-making should lead to increased protection for patients via consistently high quality and available medicines, with lower chances of quality defects and non-compliances occurring. Because better decisions would lead to more efficient operations and, subsequently, lower costs, consequently, they should increase returns on investments for companies.

In addition, where a company can show its regulators that it has effective processes in place for capturing and leveraging prior and new knowledge in its decision-making processes, this may give regulators increased confidence to support requests for regulatory flexibility for the site, and this may also assist with the implementation of ICH Q12 in relation to post-approval changes.

Investing in risk-based decision-making processes is also useful for regulators to consider, because it can lead to better and more informed regulatory decisions in a myriad of areas, from inspection planning, to recall decision-making, through to the ongoing development of their oversight strategies, etc.

The revised version of ICH Q9, January 2023

A decision was made by ICH in 2019 to revise the ICH Q9 guideline; this was to address the fact that the benefits of QRM, as envisaged by ICH Q9, had not been fully realized. Four areas of improvement were identified with the application of QRM (14) at that time:

high levels of subjectivity in risk assessments and in QRM outputs

failing to adequately manage supply and product availability risks

a lack of understanding as to what constitutes formality in QRM work

a lack of clarity in relation to risk-based decision-making.

As the discussions on a possible revision advanced, it was decided that, in addition to addressing the above four areas, it would also be also useful to make a terminology change in the guideline, from “risk identification” to “hazard identification”. The purpose of this was to address the fact that, while risk identification was documented as a step in the risk assessment part of the QRM process schematic that the Q9 guideline contained, the actual description for risk assessment in the guideline more correctly referred to the identification of hazards, not the identification of risks. The terminology change was essentially made to correct that discrepancy.

It was also decided that a major part of the revision work should be to develop official ICH training materials that would support the revisions made to the guideline, and when doing this, it would also be useful to develop training materials on an element of the QRM process that was considered to be in need of additional clarity, the Risk Review element.

Preparatory work for the revision got underway in May 2020; by November of that year a Concept Paper and a Business Plan had been developed and published to direct the revision work, and in December 2020, the first revisions started to be made to the guideline text (35, 36). The ICH Q9(R1) Expert Working Group that was responsible for the revision made steady progress, and by October 2021, it had a draft ready for an extensive public consultation, which ran from December 2021 through to July 2022.

More than 770 comments were received by ICH on the draft revised guideline, and each of those was considered by the Expert Working Group, and several useful updates were made to the text as a result. By December 2022, the final version of the revised guideline was ready, and in January 2023, the revised text was agreed within the ICH process and published.

The development of official ICH training materials to support the revised guideline ran in parallel to the revision work, and those materials were finalized and published by ICH in October 2023. The materials, which also contain a number of case studies, address all of the aforementioned revision topics as well as risk review, and they were designed to elucidate the fundamental aspects of the new guidance that was added into the guideline (37).

 summarizes the changes introduced in ICH Q9(R1) (38).

Table I. Summary of changes introduced in ICH Q9(R1).

A number of other changes were also introduced into the guideline; the most prominent of these was a paragraph added to the Introduction section in Chapter 1 in relation to digitalization and emerging technologies, which indicated that, while such technologies can lead to risk reduction when they are fit-for-use, their validation requirements should not be overlooked. A sentence was also added into Chapter 1 in relation to the proper application of QRM, which stated that “quality risk management should not be used in a manner where decisions are made that justify a practice that would otherwise, in accordance with regulations and/or guidance, be deemed unacceptable.”

Articles

This paper reflects upon the past 15 years of experience in the application of QRM and KM within the pharmaceutical GMP environment. 