Quality risk management (QRM) is a systematic process for the assessment, control, communication and review of risks to the quality of a medicinal product across its lifecycle. ICH Q9 describes the process: risk assessment (identification, analysis and evaluation), risk control (reduction and acceptance), risk communication and risk review. Its revision, Q9(R1), adopted in 2023, adds guidance on subjectivity, formality and risk-based decision making.
ICH Q9 lists tools that can support QRM, including failure mode and effects analysis (FMEA), fault tree analysis, hazard analysis and critical control points (HACCP) and risk ranking. The choice of tool, and the formality of the exercise, should reflect the complexity and criticality of the question.
Why it matters in GMP
Risk thinking runs through modern GMP: EU GMP Chapter 1, the contamination control strategy in Annex 1, risk-based validation in Annex 11, qualification in Annex 15 and Revised Schedule M in India all expect decisions to rest on documented risk assessments. Inspectors look for assessments that are scientific, kept up to date and actually used.
- Base the evaluation of risk on scientific knowledge and protection of the patient.
- Record who assessed the risk, how, and the residual risk accepted.
- Review risk assessments when processes change or new knowledge appears.
How Swat iQua Suite handles it
Swat iQua Suite provides controlled FMEA risk registers for a product, process, change or deviation. Each risk item moves from identification through assessment and mitigation to residual acceptance; the server calculates the risk priority number so it cannot be typed in, and recalculates residual risk after mitigation. QA approval is e-signed by someone other than the preparer and the item owner.