Most risk assessments are completed, signed off and never looked at again. Everyone is happy. Or are they?
On paper, this looks like compliance with ICH Q9(R1) Quality Risk Management Principles. In reality, it often misses the point entirely.
Risk assessment is not QRM, and treating it as a one-off exercise can undermine the very control and understanding it is intended to create.
Completing the Risk Assessment is only the starting point. True QRM requires communication, continuous review, cross-functional engagement, and the willingness to reassess the risks as processes, data and conditions evolve. A document alone does not manage the risk. A dynamic system does.
QRM needs to be embedded in all aspects of the manufacturing process flow, from product development through manufacturing and across the entire product life cycle.
Frameworks like ICH Q9(R1) serve a very clear and important function. They bring structure, consistency and a shared language for risk management.
But truly effective risk management depends on a connected system between ICH Q8, Q9 (R1) and Q10.
In March 2026, an updated ICH Q9(R1) briefing and training pack was released, which also reinforced how ICH Q8, Q9(R1) & Q10 should be applied together across the product lifecycle.
Here’s how they work together in risk management:
ICH Q8 focuses on pharmaceutical development, building process and product understanding through science and design. It provides the scientific understanding (CQAs, CPPs, control strategy) that informs where the risks truly exist.
ICH Q9(R1) provides the framework for QRM. It structures how risks are identified, evaluated, controlled, communicated, and reviewed.
ICH Q10 establishes the PQS, the management structure that embeds quality and continuous improvement throughout the product lifecycle through change control, CAPA, and monitoring.
Put simply: Q8 helps organisations understand the process, Q9(R1) helps manage uncertainty and risk within that process, and Q10 ensures those activities are sustained, reviewed and continuously improved within the quality system.
This is why risk assessment alone is not enough. A risk assessment without the supporting systems described in Q10 can quickly become static documentation. Likewise, development knowledge generated through Q8 loses value if it is not reassessed through effective QRM practices.
The intent of these guidelines was never to create isolated compliance activities; rather to create connected, knowledge-driven systems where science, risk management and quality oversight continuously inform one another.
Inspectors are no longer just asking whether risks have been assessed. They are also asking how those risks are managed, scientifically justified, and maintained throughout the product lifecycle.
This is where companies continue to get cited during inspections. In many cases, the issue is not the absence of risk assessments. It is the absence of an effective QRM system behind them. Risk assessments exist on paper, but they are not actively used, reviewed, challenged, or connected to operational reality. And if the risk assessment is completed, approved, and never looked at again, it may satisfy a procedure, but it has fallen short of the real purpose of QRM.
