In a recent episode of the Pharma Conversations podcast, Kevin O’Donnell of the Health Products Regulatory Authority (HPRA) offered a detailed and thought-provoking reflection on the evolution, implementation, and future direction of Quality Risk Management (QRM) within the pharmaceutical industry. Speaking in a personal capacity, he drew on decades of experience as a GMP inspector and contributor to international regulatory initiatives to examine both the persistent weaknesses he has observed in quality risk management practice and the opportunities created by the 2023 revision of International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use guideline ICH Q9. His central message was clear and consistent throughout the discussion: effective QRM is fundamentally dependent on the integration of knowledge management, scientific discipline, cultural maturity, and measurable risk reduction.
For O’Donnell, QRM cannot be reduced to a set of risk assessment templates or risk scoring tools. It is, rather, a way of thinking that must permeate an organisation’s Pharmaceutical Quality System (PQS). At its core lies the recognition that risk assessment without knowledge is inherently flawed. One cannot meaningfully assess probability, severity, or detectability without understanding the underlying process, the science behind the product, historical process performance data, and the effectiveness of existing GMP controls. Knowledge management, therefore, is not a peripheral concept but a prerequisite for robust QRM. Organisations must know where their knowledge resides, how it is curated, how it is updated, and how it informs risk assessment and risk-based decisionmaking. Without this structured approach, risk assessments becoming exercises in subjective judgment, driven more by opinion than by data and evidence.
He emphasised that effective QRM should ultimately demonstrate measurable risk reduction. The objective of risk assessment is not documentation, but improvement.
However, measuring risk reduction presents inherent challenges. Risk assessment is probabilistic by nature, and probability is not easily measured, particularly in complex manufacturing systems with limited failure data. Nevertheless, O’Donnell argued that other industries have addressed similar challenges. Fields such as nuclear power and aerospace have long employed probabilistic risk assessment methodologies, quantitative fault tree analyses, and simulation techniques to estimate system failure probabilities. While the pharmaceutical industry has historically relied on more qualitative and semiquantitative tools, the scientific foundation for more robust approaches already exists. The challenge is cultural and educational, rather than conceptual.
The impetus for revising ICH Q9 stemmed from repeated observations within the GMP inspectorate community that quality risk management practices were often not delivering on their promise. O’Donnell described encountering risk assessments characterised by high subjectivity, minimal use of empirical data, and a tendency toward predetermined conclusions. Brainstorming sessions were frequently used to estimate probabilities, yet little attention was paid to cognitive biases such as anchoring, confirmation bias, or groupthink. While subjectivity can never be fully eliminated, since human perception and judgement are intrinsic to risk evaluation, it can and should be systematically reduced. Over nearly two decades since the original publication of Q9 in 2005, GMP inspectors continued to observe similar shortcomings, suggesting that the industry had not sufficiently internalised the scientific underpinnings of quality risk management.
The discovery of nitrosamine impurities in pharmaceutical products in 2018 provided a powerful case study of systemic limitations within quality risk management activities by the pharmaceutical industry. These impurities, identified in a large range of medicinal products, highlighted weaknesses in hazard identification and cross-industry learning. The issue underscored the need for more anticipatory, science-driven approaches to hazard identification and risk evaluation. Against this backdrop, the HPRA initiated discussions with the European Medicines Agency, which ultimately supported a formal proposal to revise ICH Q9 through the ICH process. Work commenced on revising the guideline in 2020, leading to the publication of Q9(R1) in early 2023.
