Two principles govern quality risk management: the evaluation of risk is grounded in scientific knowledge and ultimately links to protection of the patient; and the level of effort, formality, and documentation is proportionate to the level of risk.
Every analytical decision spends a finite budget of time, money, and attention. Risk management is how you point that budget at the failures that would actually hurt a patient, and stop gold-plating the ones that wouldn’t. It is the machinery behind “scientifically justified” — the phrase that appears in almost every ICH guideline and is doing a lot of quiet work.
ICH Q9(R1) — Quality Risk Management (the R1 revision, adopted 2023, added guidance on subjectivity, the hazard-versus-risk distinction, formality, and risk-based decision-making). The process is a loop, not a form:
| Stage | What happens | Analytical example |
|---|---|---|
| Risk assessment — identification | What could go wrong? | A co-eluting degradant is not resolved from the API |
| Risk assessment — analysis | How likely, how severe, how detectable? | Estimate occurrence from forced-degradation data; severity from the degradant’s qualification threshold; detection from method specificity |
| Risk assessment — evaluation | Is that acceptable against defined criteria? | Compare against a risk threshold agreed before the assessment |
| Risk control — reduction | Change the design to lower likelihood or raise detection | Switch to an orthogonal column; add a peak-purity check |
| Risk control — acceptance | Some residual risk is accepted, explicitly and on the record | Document the residual and the justification |
| Risk communication | The assessment and decisions are shared with everyone who acts on them | The control strategy, the filing, the SOP |
| Risk review | Revisit when something changes | A new impurity at month 9 of stability reopens the assessment |
Two ideas from Q9(R1) matter for the analyst:
Each tool below gets its own full walkthrough — mechanics, a worked analytical example, and where it breaks down:
| Tool | Best for | Notes |
|---|---|---|
| FMEA / FMECA | Failures of a process or method built from many steps | The workhorse in analytical development — full walkthrough → |
| Fault tree analysis (FTA) | Working backward from one defined failure to its contributing causes | Good for OOS root-cause work |
| HACCP | Identifying and controlling critical points in a process | Origin in food safety; maps well to manufacturing |
| HAZOP | Deviations from design intent, guided-word by guided-word | More common in process/engineering than in the QC lab |
| Risk ranking and filtering | Comparing many risks that don’t share a scale | Portfolio-level and site-level decisions |
| Ishikawa (fishbone) / PHA | Structuring a first-pass hazard identification | Often the front end of an FMEA |
Failure Mode and Effects Analysis decomposes a method or process into steps, and for each step asks: what could fail (failure mode), what would that do (effect), why would it happen (cause), and how would we catch it (controls). Each mode is scored:
Risk Priority Number = Severity × Occurrence × Detection
Modes with a high RPN, or a high severity regardless of RPN, get an action; then the mode is re-scored to show the action worked. The number is easy to game and easy to over-trust — see the full FMEA walkthrough for a worked multi-failure-mode example and the known weaknesses worth teaching so students don’t over-trust it.
A control strategy is the planned set of controls — derived from current product and process understanding — that assures performance and quality. It is the output of risk management, not a separate exercise:
Worked example — nitrosamine risk assessments. Between 2018 and 2023 every marketing authorization holder had to assess every product for the risk of N-nitrosamine impurities (NDMA, NDEA, and drug-specific nitrosamines), triggered by the valsartan recalls. The assessment is a textbook QRM: identify the hazard (potent mutagenic carcinogens), analyze the risk (synthetic route, nitrite sources, secondary amines, recovered solvents, water; then confirmatory testing), control it (route changes, nitrite scavengers, tightened limits at ppb levels), and communicate it (to the agency, on a deadline). It also shows the analyst’s exposure directly: the risk conclusion depended entirely on whether a method existed that could see a nitrosamine at its acceptable intake — a detection problem.
Source note. Risk management is anchored in ICH Q9(R1), with ICH Q8(R2), Q10, and Q14. FMEA methodology follows IEC 60812 and the AIAG-VDA FMEA handbook. The nitrosamine case follows the EMA/FDA guidance and Article 5(3) referral outcomes. (Instructor: confirm the Q9(R1) adoption date and current EMA nitrosamine guidance revision.)
Failure Mode and Effects Analysis worked end to end on an HPLC assay method: the RPN formula, a full failure-mode table with a before/after action, why detection runs backward, and the known weaknesses that make RPN easy to over-trust.
FTA starts from a failure that already happened and works backward through AND/OR logic to its contributing causes — the standard tool for an OOS root-cause investigation, and the mirror image of FMEA’s forward-looking approach.
Hazard Analysis and Critical Control Points asks a narrower question than FMEA: not every failure mode in a process, but where the few points are whose failure directly threatens the patient — worked through a sterile-fill bioburden-control example.
Hazard and Operability study asks, guided word by guided word, what happens if a process parameter is too much, too little, reversed, or accompanied by something unintended — a process/engineering tool applied here to a chromatography example.
When risks come from different processes, products, or sites and don’t share a common scale, risk ranking and filtering normalizes them against weighted criteria to build one prioritized list — worked through a site quality council’s quarterly resourcing decision.
Before an FMEA can score failure modes, it needs a reasonably complete list of them — fishbone diagrams and Preliminary Hazard Analysis are how that list gets brainstormed systematically, worked through an unexpected-peak example that feeds directly into an FMEA.