Quality Risk Management (QRM) is a systematic process for assessing, controlling, communicating, and reviewing risks to the quality of a medicinal product across its life cycle. ICH Q9(R1) provides internationally harmonized principles and tools for applying QRM in pharmaceutical quality.
ICH Q9(R1) is based on two primary principles: evaluation of risk to quality should be based on scientific knowledge and ultimately linked to patient protection; and the level of effort, formality, and documentation should be commensurate with the level of risk.
The QRM process includes risk assessment, risk control, risk communication, and risk review. The degree of formality and the selected method should be appropriate to the complexity, uncertainty, importance, and risk of the decision.
For computerized systems, QRM principles support decisions about validation scope, assurance rigor, supplier evidence, change impact, and maintenance of the validated state. GAMP 5 and FDA CSA both emphasize risk-based decision making and critical thinking, while also addressing broader life-cycle and assurance considerations.
Frequently Asked Questions
What is the difference between QRM and a risk assessment?
Risk assessment is one part of QRM and includes risk identification, analysis, and evaluation. QRM is the broader management process, including risk control, communication, and review as information and circumstances change.
What is ICH Q9?
ICH Q9(R1) is the internationally harmonized guideline for Quality Risk Management in pharmaceutical quality. The 2023 revision strengthened guidance on formality, risk-based decision making, subjectivity, and product-availability risks.
Does QRM apply to computerized systems?
Yes. QRM principles can be applied to computerized-system decisions such as GxP scope, validation strategy, assurance activities, change impact, supplier reliance, and validated-state maintenance.
Which QRM tools should we use?
Use a method appropriate to the decision’s risk, complexity, and uncertainty. A simple risk-ranking approach may be sufficient in some cases, while a structured method such as FMEA may be appropriate when deeper analysis is needed.