Quality Risk Management: State of the Industry—Part 1. Has the Industry Realized the Full Value of ICH Q9? | IVT

Peer Reviewed: Quality Risk Management


This paper is the first in a series that explores the state of implementation of Quality Risk Management (QRM) in the pharmaceutical and biopharmaceutical industries. A brief history of QRM in these industries with regard to ICH Q9 Quality Risk Management is offered, and the high-level risk maturity model proposed by the Parenteral Drug Association (PDA) is described. A comprehensive review of US and Irish recall data and cGMP-related compliance/enforcement actions was performed to determine whether those data provide insight into the maturity of implementation of QRM in these industries and whether the anticipated benefits of QRM have been realized. Results of this analysis show that maturity in QRM is lagging and that the benefits of QRM in terms of improved product quality and patient safety have not yet been fully harnessed.



…the challenge ahead is significant… the pharmaceutical community has arrived at a cross-road; one path goes towards the desired state and the other maintains the current state. The path towards the desired state is unfamiliar to many while the current state provides the comfort of predictability. [We hope] the pharmaceutical community will choose to move towards the desired state. – Food and Drug Administration, 2004 (1) 

Over a decade ago, a paradigm shift in the regulatory environment surrounding the supply and manufacture of medicines emerged—a transition from traditional rule-based compliance to a modern risk-based view of compliance. The traditional approach was characterized by rigid conformity with regulatory statutes that defined the minimum requirements necessary to ensure medicines were produced with the appropriate quality, whereas the risk-based view tasked each manufacturer with the responsibility to develop a deep product and process understanding and tailor their quality management systems through a scientifically sound risk management framework. In the United States, the initial mobilization towards a risk-based model was championed by the Food and Drug Administration (FDA) through an initiative known as Pharmaceutical Current Good Manufacturing Practices (cGMPs) for the 21st Century. This initiative, announced in August 2002, sought to “enhance and modernize the regulation of pharmaceutical manufacturing and product quality” by re-envisioning the underpinnings of compliance through the lens of science and risk. (1)

The final report on this initiative, issued in September 2004, summarized the key accomplishments since the 2002 announcement, including the establishment of risk-based inspection planning, change review, and dispute resolution within the Agency, among other deliverables. Most notably, the report expressed FDA’s desire to improve harmonization of regulation through collaboration and knowledge sharing with sister organizations throughout the world. (1) Working groups in the International Conference on Harmonization of the Technical Requirements for Registration of Pharmaceuticals (ICH) were tasked with the creation of a risk- and science-based quality systems model, later to materialize as a triad of guidelines known as ICH Q8 Pharmaceutical Development, ICH Q9 Quality Risk Management, and ICH Q10 Pharmaceutical Quality System. (2, 3, 4) While the final report looked towards the future with a sense of optimistic pragmatism, it also acknowledged that further work must be done in order to realize this vision.

The movement towards a science- and risk-based approach to cGMPs was advanced with the finalization of ICH Q9 in 2005, Q10 in 2008, and Q8(R2) in 2009. ICH Q8 described drug development concepts commonly known as Quality by Design (QbD) in which an intimate scientific understanding of the product and its clinical utility is used, along with risk management techniques, to define critical aspects of the product and the enabling manufacturing processes. (2) ICH Q9 focused on defining a lifecycle process for quality risk management (QRM), offering a list of risk management tools that had seen success when applied in other industries and describing potential applications of QRM within pharmaceutical development, manufacturing, and control systems. (3) While the concepts set forth in Q8 and Q9 showed significant theoretical promise, industry stumbled with the application of these guidelines in the absence of an overarching framework within which to apply them. The concepts were finally synthesized in ICH Q10, which established a quality systems structure to be applied throughout the product lifecycle, enabled by knowledge management and QRM. (4) The remainder of this paper will focus on QRM as described in ICH Q9 and its application in the quality system per ICH Q10.

ICH Q9 introduced the concept of risk management, which had been successfully applied in other industries such as aerospace, nuclear energy, and finance, to the pharmaceutical and biotechnology arena by focusing on its application in the definition and assurance of medicinal product quality. Q9 notes that the use of QRM principles and practices has the potential to yield multiple benefits for patients, regulators, and manufacturers alike. Such benefits include:

  • Better assurance of product quality through proactive identification and mitigation of potential risks
  • Improved compliance by enabling an understanding of the relationship between regulatory requirements and the unique concerns of the product or process
  • More informed and consistent decisions relative to product quality (for realized/reactive risks) and quality system process design
  • Potential reduction in the level or frequency of regulatory oversight through improved communication and higher confidence in quality system effectiveness (3) 

This multi-faceted value proposition was both ambitious and attractive, and the guidance as a whole offered significant insight into the execution and iterative nature of QRM.

To further characterize QRM application (as well as the concepts laid out in ICH Q8 and Q10), and to accelerate the learning curve relative to these guidances, the Parental Drug Association (PDA) launched the “Paradigm Change in Manufacturing Operations” program in 2008 (5). One of several outputs of this program was a comprehensive technical report aimed at providing a detailed review of how QRM could be implemented throughout the product lifecycle and supporting quality system. The technical report described the notion of a QRM maturity model, depicting the general transition towards maturity associated with QRM program deployment. This QRM maturity model illustrated the expected growth phases as a manufacturer gained comfort and confidence with QRM:

  • Maturity Phase 1: No quality risk management activities performed
  • Maturity Phase 2: Informal quality risk management in place
  • Maturity Phase 3: Mostly retrospective and/or corrective quality risk management in use
  • Maturity Phase 4: Prospective, preventive quality risk management in use
  • Maturity Phase 5: Quality risk management integrated throughout manufacturing operations and quality systems (adapted from PDA Technical Report No. 54, reference 5)

The QRM maturity model provided general direction regarding the focus of a firm as they progress towards a robust QRM program—ostensibly, with each successive phase of maturity, a QRM program grows more efficient, effective, and pervasive throughout operations and quality systems (5). While the model can serve as a useful indicator of the maturity of implementation at a given firm without measurement against the model, it does not answer the question of whether we have achieved the value proposition offered in ICH Q9. Twelve years after the announcement of the 21st century cGMP initiative and almost a decade following the inception of ICH Q9 and these questions remain:

  1. Have we realized the full benefits of QRM?
  2. Are we making better quality products?
  3. Are we more compliant?

This paper describes research undertaken by the Pharmaceutical Regulatory Science Team at the Dublin Institute of Technology (DIT) in an effort to find the answers.



The research sought to provide a systematic review of US and Irish product recall and compliance enforcement data spanning the 2006 through 2013 time period. This timeframe was selected based on the potential to identify trends in product quality and cGMP compliance following the publication of ICH Q9 in 2005, through the most current period in which a comparable data set (i.e. a complete year of data) was available.

Data from the US was sourced from the weekly enforcement report and warning letter databases available through the Food and Drug Administration website (6, 7). Drug recall data was reviewed in an effort to characterize product quality, and by extension patient safety, over time. In the US, drug recalls are divided as individual events, each assigned a unique recall tracking number and associated classification level based on risk to patient or consumer. While most recalls are separated based on product presentation and dosage form, in certain instances (e.g., where all products manufactured by a single firm in a given time period were subject to recall) a single tracking number was assigned to a portfolio of products. The data reviewed and presented in this paper retains the separation and classification as assigned by FDA, including subsequent corrections for previously reported data (e.g. expansion of recalled lots).

Warning letters issued by FDA for cGMP-related concerns were selected based on the insight they may provide into the industry’s state of compliance over time. FDA is charged with protecting public health and as such has several levels of compliance enforcement options available to facilitate this mandate (8). Compliance observations noted during inspections are summarized on a Form 483. Unlike the practice in the European Union (EU), these observations are not categorized according to criticality and, therefore, may not delineate the gravity of noncompliance concerns as identified during inspections; in addition, access to individual Form 483s are not readily available from FDA. Warning letters represent the “principal means of achieving prompt voluntary compliance” with applicable regulations and are typically issued for significant violations of related statutes or, in many cases, inadequate responses or commitments from violative firms following the issuance of a Form 483 (9). Warning letters are posted to a public access database and have the potential to offer a rich source of information regarding noncompliance with cGMPs. Various cross checks (e.g., database searches by year, company name, warning letter category, product type, and keywords) were performed throughout the research period to assure the collected data were both valid and comprehensive. 

Data from the EU, particularly in the area of inspectional observations, proved more difficult to retrieve, despite allowances offered by the Freedom of Information Act. As a result, the research focused on Irish recall and quality defect data ascertained through publicly available annual reports written by the Health Products Regulatory Authority (HPRA; formerly the Irish Medicines Board) as well as research assistance for this project provided directly by the HPRA (10, 11). As the world’s largest drug exporter and the hub of the Dublin Institute of Technology’s Pharmaceutical Regulatory Science Team (of which the authors are part), Ireland is an attractive source for European data (12).

All data were categorized and analyzed as discussed in the Results and Analysis section of this paper.



State of the Industry: Product Quality and Patient Safety

One of the potential benefits of QRM is improved product quality and resultant patient safety; indeed, one of the primary principles of ICH Q9 is that QRM activities should “. . . ultimately link to the protection of the patient” (3). One indicator of trends in this area is the number of recalls that may result from inadequate quality products reaching the marketplace. Improvements in product quality, such as the ability to meet specifications prior to drug product release, should therefore, manifest as a reducing trend in the number of recall events over time. Figures 1 and 2 illustrate the number of quality-related recall events initiated from 2006 through 2013 in the US and Irish markets, respectively.

Total Number of Quality-Related Drug Recall Events in the US

Figure 1: Total Number of Quality-Related Drug Recall Events in the US, 2006 through 2013 (6)

  otal Number of Quality-Related Medicinal Product Recalls in Ireland, 2006 through 2013

Figure 2: Total Number of Quality-Related Medicinal Product Recalls in Ireland, 2006 through 2013 (10)

As shown in Figures 1 and 2, an increasing trend is apparent. Further analysis of US data reveals that in peak recall years (2009 and 2011), seemingly isolated issues resulted in multiple recall events. For example, Penicillium spp. cross-contamination at a single firm (Aidapak Services) led to 1,021 recall events in November 2011 while cGMP deviations in June and July 2009 led to 1,107 recall events from another manufacturer (Advantage Dose LLC). While variables such as improved detection of quality defects or increases in volume of drug products on the US and Irish markets cannot be ruled out as contributing factors for the trends seen, the data indicate that recall events are increasingly common.

This led to examination of how the application of QRM may have influenced these outcomes. Table I listed the top three categories of recall events for each year included in the research:

  Top Three US and Irish Recall Categories, 2006 through 2013

Table I: Top Three US and Irish Recall Categories, 2006 through 2013 (6)

* “cGMP deviations” is a classification for recall events given by FDA. Information regarding the impact of such deviations, or the specific nature of the deviation, was not readily available from the Agency.

Annex II of ICH Q9 highlights potential applications of QRM that, when employed appropriately, could be used to avoid these types of recalls.

For example, OOS release specification events might have been prevented through the application of QRM:

…to establish appropriate specifications, identify critical process parameters and establish manufacturing controls (e.g., using information from pharmaceutical development studies regarding the clinical significance of quality attributes and the ability to control them during processing)” and “to decrease variability of quality attributes [to] reduce product and material defects [and to] reduce manufacturing defects. (3) 

Similarly, QRM could have minimized instances of cross contamination, lack of sterility assurance / sterility failure, and microbial contamination of non-sterile products if used:

…to determine appropriate zones when designing buildings and facilities, e.g., [to] minimize contamination, prevent mix-ups, and [to determine the need for] dedicated or segregated facilities / equipment (3).

Though it is not clear in the context of these specific recall events whether QRM was ineffective or whether it was simply not used at all, the data demonstrate that product quality (and potential patient exposure to defective product) has not improved since the inception of ICH Q9. 

State of the Industry: cGMP Compliance

Another potential benefit of QRM implementation is reduced regulatory oversight, which may be achieved through demonstration of quality system effectiveness in the form of a robust QRM program (3, 4). When firms fully embrace the principles and practices of QRM, incidences of breaches of GMP, product quality deficiencies, and risks to patient safety should reduce and compliance status should improve. This should allow manufacturers to demonstrate the enhanced effectiveness of their pharmaceutical quality systems through the use of meaningful measures of quality or quality metrics. Improved quality outcomes for the products and site in regard to numbers of deviations, CAPAs, customer complaints, or evidence of a proactive self-inspection program would also confirm their increased understanding of how to apply current guidance and regulations in a meaningful way within the context of their individual operations.

Figure 3 illustrates the overall number of cGMP-related warning letters issued by FDA from 2006 through 2013. The increased numbers of compliance enforcement actions since 2006 indicates that cGMP compliance has not improved since the inception of ICH Q9.


Total Number of US FDA cGMP-related Warning Letters, 2006 through 2013

Figure 3: Total Number of US FDA cGMP-related Warning Letters, 2006 through 2013 (7)

We acknowledge that further analysis of variables such as the total number of GMP inspections conducted in each calendar year and the proportion of inspection observations (Form 483s) that resulted in warning letters may refine the interpretation of these data; however, such information is not readily available from FDA.

A review of warning letters through the lens of QRM reveals an increasing trend of citations against the QRM programs and practices themselves, as shown in Figure 4. This would indicate that many applications of QRM do not inspire confidence that the manufacturing site has understood the current guidance and regulations in a meaningful way within the context of their individual operations.

  US FDA cGMP-related Warning Letters with one or more QRM citations, 2006 through 2013

Figure 4: US FDA cGMP-related Warning Letters with one or more QRM citations, 2006 through 2013 (7)

While further research within industry is warranted to identify and benchmark effective QRM programs that have not been subjects of warning letters, these data confirm a gap between regulatory expectations and current industry practice. This conclusion is reinforced with a review of the nature of the QRM citations. Figure 5 illustrates whether each individual citation indicates either an absence (i.e., failure to apply QRM where warranted based on an individual event or circumstance) or misapplication (i.e., inappropriate use of QRM principles or faulty conclusions drawn as a result of QRM implementation). For example:

  • Absent QRM: “…we note that your response includes a commitment to retrain personnel, revise procedures, and use of premade agar plates to address [deficiencies in aseptic processing techniques]. Your response is inadequate because your firm failed to conduct a comprehensive risk assessment of these poor aseptic process activities, and the inadequate environmental monitoring program, to evaluate their impact on product quality” (13).
  • Misapplied QRM: “We are concerned…with your risk assessment, which suggests that the failure of these products to meet acceptance criteria for defects during the 100% inspection has no bearing on the quality of the released units. Please provide detailed information regarding how you reached your conclusion” (14).

 Type of Quality Risk Management Deficiency in US FDA Warning Letters Issued between 2006 and 2013

Figure 5: Type of Quality Risk Management Deficiency in US FDA Warning Letters Issued between 2006 and 2013 (7)

An absence of QRM was cited in the overwhelming majority of instances. This is striking considering that ICH Q9 has been available for nearly a decade. It would be reasonable to expect that sufficient time has elapsed to allow industry to overcome some of the initial inertia inherent in any paradigm shift, even one of the magnitude of transitioning from rule-based to risk-based compliance.

Further analysis with respect to the QRM lifecycle stage that was cited in the warning letter is similarly informative. Figure 6 shows the proportion of citations for the various sections of the lifecycle: risk assessment, risk control, risk review, risk communication, or risk management as a whole.

  Quality Risk Management Deficiency by Lifecycle Stage in US FDA Warning Letters Issued between 2006 and 2013

Figure 6: Quality Risk Management Deficiency by Lifecycle Stage in US FDA Warning Letters Issued between 2006 and 2013 (7)

The majority of citations indicate that risk assessment, the first phase of QRM, was implicated. Because QRM is an iterative process beginning with a robust and science-based risk assessment, citations in this area of the lifecycle are particularly concerning since it is unlikely that the remaining phases would prove effective if built upon a faulty or absent risk assessment. No citations were given for the risk review portion of the lifecycle; if firms struggle to initiate the QRM lifecycle and successfully complete a risk assessment, it is likely that the risk review phase was not reached, thus explaining the absence of citations for this lifecycle phase. These data support the hypothesis that certain firms within industry are still in the early phases of QRM maturity (i.e., “no quality risk management” or “informal quality risk management”) with challenges centered on the initial risk assessment phase of the QRM lifecycle.

Another indicator as to the expected level of QRM maturity from the perspective of FDA is whether warning letter citations include reference to a focus on reactive or prospective QRM implementation. While it is broadly acknowledged that risk management applied in response to a realized issue (i.e., reactive) can be helpful to get to true root cause and plan and appropriate remediation strategy, most risk management practitioners will assert that the full value of QRM is achieved through proactive anticipation and mitigation of potential risks to ensure those issues do not materialize (3, 5, 15). The PDA QRM maturity model positioned reactive risk management as a characteristic of a moderately mature program, with more effective programs transitioning towards a prospective and fully integrated focus (5). When QRM-related warning letter citations are classified by emphasis (i.e., prospective or reactive; Figure 7), it is evident that industry shortcomings are primarily focused on reactive QRM during the prior eight-year period.

 Quality Risk Management Deficiency Emphasis in US FDA Warning Letters Issued between 2006 and 2013

Figure 7: Quality Risk Management Deficiency Emphasis in US FDA Warning Letters Issued between 2006 and 2013 (7)

Examples of this emphasis are evident in the following excerpts:

  • Please provide a copy of your investigation [surrounding breach of data integrity through the deletion of critical analytical data and backdating records], along with your risk assessment regarding the extent and impact of the missing data on the quality of all finished drug products released for distribution” (16).
  • “…your firm failed to investigate numerous customer complaints for several lots of [product] concerning cracked vials… your firm's response failed to include a risk assessment for the product currently on the market” (17).
  • “…your firm failed to conduct and document a verification under actual conditions of use of [multiple] laboratory test methods… [in your response] please provide a risk assessment for possible impurities present in [lots of API released to market]” (18). 

In these instances FDA is calling for the application of QRM in situations where an impact assessment might have been used traditionally, i.e., where the full breadth and gravity of a cGMP-related event or circumstance must be determined. This trend implies that FDA expects industry to have mastered a moderate (reactive/corrective) level of QRM maturity; therefore, a gap between the current state of industry (no to low maturity) and FDA expectations is apparent.

While a comparable data set was not available from Ireland, excerpts from HPRA inspectional observations similarly indicate a gap in risk maturity. For example:

  • With regard to the usage of the flexible isolator / barrier for the dispensing of [material X] in [room Y], there was no formal risk assessment documented assessing the impact of the introduction of the flexible isolator on pre-existing activities in the room.” (emphasis proactive, risk assessment [11])
  • Following a risk assessment exercise that had been performed in 2011 on the use of diaphragm pumps at the site following a diaphragm pump failure issue that had occurred at a sister site, appropriate actions had not been taken to ensure that the controls on which the risk had been deemed acceptable in (Site) were effective…” (emphasis proactive, risk control [11])

Without focused effort on behalf of industry, this disparity may intensify as the FDA, European Medicines Agency (EMA), and its member states continue along the current path towards an increasingly risk-focused regulatory model (19, 20).



This paper summarizes research designed to characterize the current state of pharmaceutical and biotechnology industries with respect to the adoption of Quality Risk Management as per ICH Q9. The research supports the hypotheses that the full value of QRM with respect to product quality and patient safety has not yet been realized. In addition, industry appears to be lagging behind regulatory expectations with respect to QRM maturity, indicating that current approaches to QRM require significant improvement. While causality has yet to be established, further research in this area as well as the development of more robust roadmap towards maturity may offer additional insight into what is necessary to achieve these goals. The next paper in this series will explore this line of inquiry.




  1. FDA, “Pharmaceutical cGMPs for the 21st Century – A Risk-based Approach.  Final Report.”  September 2004.
  2. ICH Q8 (R2), Pharmaceutical Development
  3. ICH Q9, Quality Risk Management
  4. ICH Q10, Pharmaceutical Quality System
  5. PDA Technical Report No. 54.  “Implementation of Quality Risk Management for Pharmaceutical and Biotechnology Manufacturing Operations.”  2012.
  6. FDA, Enforcement Reports, http://www.fda.gov/Safety/Recalls/EnforcementReports/default.htm,  accessed July 3 through August 2, 2014.
  7. FDA, Warning Letters, http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/default.htm, accessed June 1 through July 1, 2014.
  8. FDA, “About FDA.”  http://www.fda.gov/AboutFDA/Transparency/Basics/ucm192695.htm.  Retrieved August 21, 2014.
  9. FDA, Regulatory Procedures Manual, Chapter 4 “Advisory Actions.”  2011.
  10. HPRA (formerly IMB), Annual Reports, 2006 through 2009.  http://www.hpra.ie/homepage/about-us/publications-forms/corporate-and-policy-documents.  Retrieved June 23, 2014.
  11. Extracted inspectional observations (anonymous) specifically related to observed QRM deficiencies provided by Dr. K. O’Donnell from HPRA on August 8, 2014. 
  12. Looney, W.  “Ireland’s Celtic Tiger: Back on the Hunt.”  Pharmaceutical Executive.  September 1, 2014.  http://www.pharmexec.com/pharmexec/Europe/Irelands-Celtic-Tiger-Back-on-the-Hunt/ArticleStandard/Article/detail/853390.  Retrieved September 22, 2014.
  13. FDA, Warning Letter issued to Hemofarm A.D., June 20, 2012.  http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/2012/ucm310959.htm.  Retrieved June 2, 2014.
  14. FDA, Warning Letter issued to Jubilant HollisterStier General Partnership, February 20, 2013. http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/2013/ucm341683.htm.  Retrieved June 2, 2014.
  15. Vesper, James L.  Risk Assessment and Risk Management in the Pharmaceutical Industry: Clear and Simple.  Davis Healthcare Publishing International LLC, River Grove, IL. 2006.
  16. FDA, Warning Letter issued to RPG Life Sciences Limited, May 28, 2013. http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/2013/ucm355294.htm.  Retrieved June 2, 2014.
  17. FDA, Warning Letter issued to Bracco Diagnostics Inc., January 31, 2012. http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/2012/ucm375606.htm.  Retrieved June 21, 2014.
  18. FDA, Warning Letter issued to Ercros S.A., June 20, 2012. http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/2012/ucm310963.htm.  Retrieved June 18, 2014.
  19. FDA, “Strategic Priorities 2014 – 2018.”  Draft for Public Comment.  http://www.google.com/url?url=http://www.fda.gov/downloads/AboutFDA/ReportsManualsForms/Reports/UCM403191.pdf&rct=j&frm=1&q=&esrc=s&sa=U&ei=dFbzU9_ZKMvioASmnIG4Cg&ved=0CBQQFjAA&usg=AFQjCNEvMy6uqINSw2C8tJ7rqhjIHzNclg.  Retrieved August 10, 2014.
  20. EMA, “Road map to 2015.” December 16, 2010. http://www.ema.europa.eu/docs/en_GB/document_library/Report/2011/01/WC500101373.pdf.  Retrieved September 13, 2014.

Product Added Successfully

This product has been added to your account and you can access it from your dashboard. As a member, you are entitled to a total of 0 products.

Do you want access to more of our products? Upgrade your membership now!

Your Product count is over the limit

Do you want access to more of our products? Upgrade your membership now!

Product added to cart successfully.

You can continue shopping or proceed to checkout.

Comments (0)

Post new comment

The content of this field is kept private and will not be shown publicly.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
  • Use to create page breaks.
Enter the characters shown in the image.
Validated Cloud logo