Risk assessment is a key competency for modern Pharma/Biopharma organizations. Since the publication of ICH Q9 “Quality Risk Management” in 2005, the use of both formal and informal risk assessment tools has become a critical activity and a focus of regulatory attention. This week’s PSC blog post in our Regulatory series will discuss the appropriate use of some of the formal methods of risk assessment.

One Objective – Multiple Paths

The objective of any risk assessment is to identify, analyze and evaluate potential risk. Risk is the combination of the probability of the occurrence of harm and the severity of that harm. In the healthcare industries, risk and harm are primarily defined in the context of the risk of harm to patients using healthcare products. One of the primary principles of Q9 is: “The evaluation of the risk to quality should be based on scientific knowledge and ultimately linked to the protection of the patient”.

A non-exhaustive list of formal risk assessment methods includes:

    • Failure Mode Effects Analysis (FMEA)
    • Failure Mode, Effects and Criticality Analysis (FMECA)
    • Fault Tree Analysis (FTA)
    • Hazard Analysis and Critical Control Points (HACCP)
    • Hazard Operability Analysis (HAZOP)
    • Preliminary Hazard Analysis (PHA)
    • Risk Ranking and Filtering
Risk Assessment

In addition to the formal risk assessment methods above, other informal methods and related tools can also be employed to evaluate risk. These informal assessments can complement formal processes and are not replacements for formal risk assessment.  Among these methods and tools are:

    • Brainstorming
    • Impact Assessment
    • Technical Evaluation
    • Statistical Tools

Principles of choosing a risk assessment method

A second primary principle of Q9 is that: “The level of effort, formality and documentation of the quality risk management process should be commensurate with the level of risk”. This principle can be applied to the selection of the risk assessment method as well. FMEA/FMECA are probably the most frequently used methods in the pharma/biopharma industries to identify, analyze, and prioritize risks and identify and evaluate current or potential controls. However, FMEA is resource-intensive, requiring significant time from frequently scarce technical experts, and requires some skill and experience with the method itself to apply efficiently and effectively. Furthermore, FEMA may be overkill for less critical, simple, or well-understood scenarios.

Comparing the advantages (“Pros”) and disadvantages (“Cons”) of an FMEA and two less formal risk assessment methods:





  • Detailed identification of failure modes and controls
  • Can establish a basis for system design elements, process controls, Critical Aspects
  • Best regulatory acceptance
  • Quickly separate GMP vs. non-GMP systems with a documented rationale for the latter decision
  • A 20-year history of industry use so it is well accepted by regulators
  • High-level risk assessment identifies the area of impact (data, etc.)
  • Technical reports/evaluations generated by SME(s)
  • Can be very process and application specific
  • Only need process/application SMEs to generate


  • Resource/time-intensive
  • Best used with preliminary screening tools such as risk-ranking
  • Need trained facilitators to achieve consistent results
  • Does not identify specific risks or harms or evaluate controls
  • “Bottom-Up” asset-based approach w/o direct ties to process requirements
  • Without component-level analysis, it does not identify Critical Aspects
  • Not appropriate for complex and critical applications
  • Potential for inconsistent execution/documentation
  • May not be recognized as RA by regulators unless formalized to include Q9 risk assessment elements

Risk assessment is at the heart of the FDA and other regulatory agencies ’ shift from validation to quality assurance. Maximize your resources by focusing on assessing risk and appropriately using your engineer’s time to test and document critical components that have a direct impact on your manufacturing. Your engineer should have the expertise to utilize critical thinking in choosing the testing parameters for assessing risk.

Mitigating risk


Every situation in pharmaceutical manufacturing requiring the application of Quality Risk Assessment is different. ICH Q9 applies Quality Risk Assessment as a tool in overall Quality Risk Management programs such as:

    • Quality Management
    • Regulatory Operations
    • Product Development
    • Facilities, Equipment, and Utilities
    • Materials Management
    • Production
    • Laboratory Operations
    • Packaging and Labeling

Consider that all situations are not alike and require consideration of the appropriate tools and methods for effective and cost-efficient Quality Risk Management.

PSC Biotech®

At PSC Biotech®, our Engineers take a risk-based approach; thus, we always work with ICH Q9 guidelines in place. We have qualified and experienced engineers in over 35 countries with over 25 years of experience providing engineering consultants to the life sciences. Contact us for more information on how our engineering consultants can help you.


See Also

PSC Software Solutions


Hire Consultants

PSC Biotech Services provide fast, budget-friendly, high-level expertise.

Follow Us

Share, Engage, Stay Current

Related Articles

Regulatory Strategy Development for Life Sciences: Best Practices

Regulatory Strategy Development for Life Sciences: Best Practices

Regulatory Affairs and Winning Regulatory Strategy Regulatory strategy development is critical for life sciences companies seeking to bring new drugs, medical devices, and other products to market. Developing an effective regulatory strategy can help companies...

The Secret to Writing Successful Grant Proposals

The Secret to Writing Successful Grant Proposals

Grant writing aims to prepare and submit a proposal to request funding from a grant-making organization, such as a government agency, private foundation, or corporation. Grant writing involves researching potential funders, understanding their priorities and...

Benefit- Risk Assessment for Regulatory process 

Benefit- Risk Assessment for Regulatory process 

Benefit-risk assessment is critical to the regulatory review process for life science companies and healthcare products, including drugs, biologics, and medical devices, before it is approved for use by regulatory agencies such as the Food and Drug Administration...