Quality Risk Management (QRM) is a systematic process for managing risks to product quality throughout its lifecycle, aiming to ensure patient safety and product efficacy. It involves risk assessment, control, communication, and review, with interdisciplinary teams analyzing potential hazards and implementing appropriate measures. The methodology supports a scientific approach, utilizing various tools to evaluate and mitigate risks related to product development and manufacturing.

1. QRM
(Quality Risk Management)
QRM is the overall and continuing
process of appropriately managing
risks to product quality throughout
the product's lifecycle in order to
optimize its benefit–risk balance.
QRM a systematic process for the
assessment, control, communication
and review of risks to the quality of
the drug product across the product
lifecycle.

2. Primary Principles of QRM
The evaluation of the risk to quality should be based on scientific
knowledge and ultimately linked to the protection of the patient
The level of effort, formality and documentation of the QRM
process should be commensurate with the level of risk.

3. Purpose of a QRM
 Determine and manage risks to safety, efficacy and product quality.
 During development to acquire sufficient product and process
knowledge to assess risks associated with formulation development of
the finished pharmaceutical product (FPP) according to the quality
target product profile (QTPP).
 Differentiate process parameters and quality attributes from critical
process parameters (CPPs) and critical quality attributes (CQAs),
thereby contributing to defining and refining the control strategy
NOTE: QRM activities are focused on the product/process development and
product manufacturing, ultimately to ensure a robust, safe and effective
FPP.

4. Definitions
 Risk: The combination of the probability of occurrence of harm and
the severity of that harm
 Harm: Damage to health, including the damage that can occur from
loss of product quality or availability
 Detectability: The ability to discover or determine the existence,
presence, or fact of a hazard.
 Severity: A measure of the possible consequences of a hazard.
 Hazard: The potential source of harm
 Failure: When an item does not work as it should/ as intended.
 Failure Mode: How the item failed.
 Product lifecycle: All phases in the life of the product from the initial
development through marketing until the product’s discontinuation.
 RPN (Risk Priority Number)- The mathematical product of the
numerical Severity, Occurrence and Detection ratings

5. General Quality Risk Management Process

6. Personnel Involved in the QRM
Quality risk management activities are usually, but not always,
undertaken by interdisciplinary teams. When teams are formed,
they should include experts from the appropriate areas in
addition to individuals who are knowledgeable about the quality
risk management process.
The personnel should also have appropriate product-specific
knowledge and expertise to ensure effective planning and
completion of QRM activities.

7. Initiating A Quality Risk Management Process
 Define the problem and/or risk question, including pertinent
assumptions identifying the potential for risk;
 Assemble background information and/ or data on the potential
hazard, harm or human health impact relevant to the risk
assessment
 Identify a leader and necessary resources
 Specify a timeline, deliverables and appropriate level of decision
making for the risk management process.

8. Risk assessment
Consists of the identification of hazards and the analysis and evaluation
of risks associated with exposure to those hazards
As an aid to clearly defining the risk(s) for risk assessment purposes,
three fundamental questions are often helpful:
 1. What might go wrong?
 2. What is the likelihood (probability) it will go wrong?
 3. What are the consequences (severity)?

9.  Risk identification is a systematic use of information to identify hazards referring to
the risk question or problem description. Risk identification addresses the “What might
go wrong?” question, including identifying the possible consequences. This provides the
basis for further steps in the quality risk management process.
 Risk analysis is the estimation of the risk associated with the identified hazards. It is
the qualitative or quantitative process of linking the likelihood of occurrence and
severity of harms. In some risk management tools, the ability to detect the harm
(detectability) also factors in the estimation of risk.

10. Value (P) Probability
5 Almost certain, Failure is almost inevitable
4 Likely, Repeated Failures
3 Possible, Occasional Failures
2 Unlikely, Relatively few failures
1 Rare, Failure is unlikely
Value (D) Detectability
5 Very Low, the risk will not be detected
4 Low, the risk is unlikely to be detected
3 Moderate, a potential risk may be detected
2 High, has a good chance of detecting the risk
1 Very High, will almost certainly be detected

11.  Risk evaluation compares the identified and analyzed risk against
given risk criteria. Risk evaluations consider the strength of evidence
for all three of the fundamental questions.
Severity
(S)
Probability (P)
Negligible
(1)
Marginal
(2)
Moderate
(3)
Critical
(4)
Catastrophic
(5)
Almost certain (5) 5 10 15 20 25
Likely (4) 4 8 12 16 20
Possible (3) 3 6 9 12 15
Unlikely (2) 2 4 6 8 10
Rare (1) 1 2 3 4 5
Risk class: Minor (1- 4), Major (5 - 10), Critical (12 - 25)

12. RPN
RISKEVALUATIONSCORE
25 25 50 75 100 125
20 20 40 60 80 100
16 16 32 48 64 80
15 15 30 45 60 75
12 12 24 36 48 60
10 10 20 30 40 50
9 9 18 27 36 45
8 8 16 24 32 40
6 6 12 18 24 30
5 5 10 15 20 25
4 4 8 12 16 20
3 3 6 9 12 15
2 2 4 6 8 10
1 1 2 3 4 5
1 2 3 4 5
DETECTABILITY
Risk is acceptable, routine procedure exists to address risk (1 - 20)
Risk needs review of existing controls and additional applicable mitigation
measures to minimize the risk (24 - 50)
Risk is unacceptable, immediate action must be taken to mitigate (60 - 125)

13. Risk Control
Risk control includes decision making to reduce and/or accept risks.
The purpose of risk control is to reduce the risk to an acceptable
level. The amount of effort used for risk control should be
proportional to the significance of the risk.
Risk control might focus on the following questions:
 Is the risk above an acceptable level?
 What can be done to reduce or eliminate risks?
 What is the appropriate balance among benefits, risks and
resources?
 Are new risks introduced as a result of the identified risks being
controlled?

14.  Risk reduction focuses on processes for mitigation or avoidance of
quality risk when it exceeds a specified (acceptable). Risk reduction
might include actions taken to mitigate the severity and probability
of harm. The implementation of risk reduction measures can
introduce new risks into the system or increase the significance of
other existing risks. Hence, it might be appropriate to revisit the
risk assessment to identify and evaluate any possible change in risk
after implementing a risk reduction process.
 Risk acceptance is a decision to accept risk. Risk acceptance can be
a formal decision to accept the residual risk or it can be a passive
decision in which residual risks are not specified. For some types of
harms, even the best quality risk management practices might not
entirely eliminate risk. In these circumstances, it might be agreed
that an appropriate quality risk management strategy has been
applied and that quality risk is reduced to a specified (acceptable)
level. This (specified) acceptable level will depend on many
parameters and should be decided on a case-by-case basis.

15. Risk Communication
 Risk communication is the sharing of information about
risk and risk management between the decision makers
and others(stakeholders).
 Parties can communicate at any stage of the risk
management process. The output/result of the quality risk
management process should be appropriately
communicated and documented

16. Risk Review
 Risk management should be an ongoing part of the quality
management process.
 A mechanism to review or monitor events should be implemented.
 The frequency of any review should be based upon the level of risk.
 Risk review might include reconsideration of risk acceptance
decisions.

17. Verification of QRM process and methodologies
 The established QRM process and methodologies need to be
verified. Verification and auditing methods, procedures and
tests, including random sampling and analysis, can be used
to determine whether the QRM process is working
appropriately.
 Initial verification of the planned QRM activities is
necessary to determine whether they are scientifically and
technically sound, that all risks have been identified and
that, if the QRM activities are properly completed, the risks
will be effectively controlled.

18. Risk Management Methodology
Quality risk management supports a scientific and practical approach to
decision-making
It provides documented, transparent and reproducible methods to accomplish
steps of the quality risk management process based on current knowledge about
assessing the probability, severity and sometimes detectability of the risk.
Below is a non-exhaustive list of some of these tools:
 Basic risk management facilitation methods (flowcharts, check sheets etc.);
 Failure Mode Effects Analysis (FMEA);
 Failure Mode, Effects and Criticality Analysis (FMECA);
 Fault Tree Analysis (FTA);
 Hazard Analysis and Critical Control Points (HACCP);
 Hazard Operability Analysis (HAZOP);
 Preliminary Hazard Analysis (PHA);
 Risk ranking and filtering;
 Supporting statistical tools.

19. Potential applications for Quality Risk Management
 Integrated Quality Management
 Regulatory Operations
 Product Development
 Facilities, equipment and utilities
 Hygiene aspects in facilities
 Materials management
 Production
 laboratory control and stability studies
 packaging and labelling

20. References
ICH Guidelines Q9, Quality Risk Management, Step 4 version dated 9
November 2005
European Medicines Agency, EMA/CHMP/ICH/24235/2006
Committee for Human Medicinal Products Dated, September 2015
WHO Guidelines, WHO Technical Report Series No. 981, 2013

21. THANK YOU
By Ezekiel K. Kilimo & Charles M.