A starting point, not the finish line

Over the past three years, pharmaceutical Quality Risk Management has gained two important new references. In 2023, the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) revised ICH Q9, the first international guideline on the subject, eighteen years after its original publication, issuing the revised version as Q9(R1). In this revision, ICH acknowledged subjectivity as an inherent limitation of risk assessment, introduced the risk question as a formal prerequisite and – less conspicuously, but more profoundly – included lack of product availability among the potential harms to patients. In June 2026, ISPE published its Quality Risk Management Guide, the most extensive operational treatment of the guideline to date and one directly aligned with ICH Q9(R1).

Read together, these documents provide a more structured and comprehensive framework than anything previously available to the industry, and it would be natural to regard this as a milestone. The benchmark, however, needs to be chosen carefully: compared with the pharmaceutical sector of ten years ago, the progress is undoubtedly substantial; compared with other industries that have used the same tools for decades, the picture looks quite different.

Borrowed tools

The toolkit used by the pharmaceutical industry today originated elsewhere. Failure Mode and Effects Analysis (FMEA) was developed in 1949 by the US military for missile systems; Ford adopted it in the 1970s, and the automotive industry standardised it in the following decade. Fault Tree Analysis (FTA) originated at Bell Telephone Laboratories in 1961 and subsequently became a certification requirement in aviation.

The pharmaceutical industry formally adopted these tools in 2005 with the first version of ICH Q9: fifty years after FMEA and forty years after FTA. Their adoption was also selective. HAZOP achieved limited uptake outside specific applications, while HACCP was used to address biological risks – with modest results, probably more because the Food and Drug Administration (FDA) was already familiar with it from the food sector than because it genuinely suited the problem.

The delay would not in itself be a problem: mature tools can be adopted when they are needed. What matters is what happened in the meantime in the industries that began implementing them earlier.

How other industries evolved the tools

The automotive industry did not merely use FMEA: it rewrote it. The 2019 AIAG-VDA handbook replaced the Risk Priority Number (RPN) with the Action Priority Table for a specific reason. The RPN, calculated as the product of severity, occurrence and detection, can produce counterintuitive outcomes: a severity score of nine combined with occurrence and detection scores of one gives an RPN of nine. Under a threshold-based approach, this would trigger no action even though the effect could be catastrophic. Action Priority establishes that high severity cannot be offset by the other two factors.

In the pharmaceutical industry, the RPN remains widely used, often as the sole prioritisation criterion. The tool was borrowed, but its subsequent evolution was left behind.

Aviation took a different path: there, risk assessment determines certification. Failure probabilities are expressed as events per flight hour, with mandatory thresholds based on the severity of the consequence, and the evidence must be numerical and traceable down to component reliability.

Under the pressure of extremely short development cycles, the consumer electronics industry conducts Design FMEA at the concept stage, before prototypes even exist, and uses it to guide design choices. Field data – real-world evidence of problems and risks – feed into the next generation, creating a virtuous cycle: risk assessment helps define the product while it is being designed and supports continuous improvement throughout its lifecycle.

The difference that matters

The common denominator in these examples is the outcome achieved, which follows directly from where the tool is positioned in the decision-making process.

In those industries, risk management operates primarily during design: to build more robust products and processes, choose between design alternatives and determine where mitigations are justified. It provides the information needed to make sound decisions, and it provides that information before implementation.

In the pharmaceutical sector, it operates predominantly as a verification activity: to demonstrate that an existing process is under control, justify a change that has already been decided, or support a change control. It produces documents downstream of decisions made elsewhere.

This is the result of a history shaped by a stringent regulatory framework, in which demonstrating compliance rightly takes precedence. But a historical consequence is not destiny, and the difference comes at a cost: analyses that merely confirm what the team already knew, and impeccable documents attached to unchanged processes.

A risk assessment that does not change any decision has created no value; in most cases, it has simply produced paperwork destined to remain in a drawer.

What the two new documents add

ICH Q9(R1) did two important things. First, it explicitly named the problem of subjectivity instead of leaving it implicit: recognising that estimates depend on those making them is the prerequisite for managing that influence. It also distinguished risk measurement from risk acceptance – the former a technical assessment based on data, the latter a governance decision. In practice, the two are continually conflated, often in the same meeting.

The ISPE Guide adds practical guidance and highlights a relationship that deserves attention: it recognises Operational Excellence as a co-enabler of QRM, linking it to the Lean and Six Sigma toolkit. The ground had already been prepared, as ICH consistently calls for analytical tools to be combined with data generated through statistics and design of experiments – one of the foundations of Quality by Design. The Guide makes that connection systematic: it provides a bridge to the industrial use of risk management, where the tools remain the same but the objective changes.

Another interesting signal comes from ISPE’s decision to introduce a tool for assessing the maturity of a QRM programme. A maturity scale is developed when there is a gap between where an organisation is and where it could be. The very fact that such a scale is needed is telling.

Two areas remain insufficiently addressed in day-to-day practice.

The first concerns the concept of benefit-risk and, more specifically, how risk acceptability is determined. The concept appears in ISO 14971 and belongs to the sphere of risk tolerance, which regulators deliberately leave to individual companies: no authority has established a universal acceptability threshold. An implicit reference exists in the market – for an equivalent benefit, the accepted risk should not exceed that of products already authorised. Translating this into an operational criterion, however, remains the responsibility of each organisation, and the cost-benefit reasoning needed to make it applicable requires a quantification of expected harm that FMEAs conducted using current practices seldom provide.

The second concerns situations in which data do not exist. All the tools assume that a probability can be estimated. But when there are no experimental data for a parameter – not merely limited data, but none – someone will make an estimate, which enters the document and becomes indistinguishable from a value derived from years of historical evidence. The uncertainty disappears from the worksheet. An uncharacterised parameter represents an unmeasured risk, which is not the same as a low risk. Treating lack of knowledge as an explicitly declared state, with a clear rule governing what may proceed, is still a step that needs to be taken. It is no coincidence that ICH Q9(R1) explicitly addresses uncertainty.

The finish line that is not there

The pharmaceutical industry uses risk management for a narrower purpose than the discipline allows.

Ensuring product quality and patient safety is the system’s raison d’etre and is non-negotiable. Yet it remains the baseline: in other industries, the same framework also delivers more robust processes, faster development, less rework and therefore lower costs, as well as better-informed investment decisions. These are benefits that the pharmaceutical industry currently captures only in part.

ICH Q9(R1) and the ISPE Guide have clarified the foundations and made the tools available: an excellent starting point. Treating them as the finish line would be an excellent way to waste them, and the pharmaceutical industry must not miss this major opportunity for improvement.