SOP: Quality Risk Management Process and Tool Selection

This is a ready-to-use SOP. It governs how a quality risk management (QRM) assessment gets run, from the decision that one is needed through to a closed, accepted, and reviewed outcome. It does not replace the tool-specific worksheets (an FMEA worksheet, a HACCP CCP determination, a risk register); it is the procedure that tells a team which tool to reach for and how to carry the assessment through all four ICH Q9(R1) phases so the result is defensible. Replace every <<FILL: ...>> placeholder with your own specifics, set your document numbers and dates, and route it through your normal document control, review, and approval. A worked filled specimen follows the template. Verify each cited regulation against the current source before you rely on it.

Document control header

1. Purpose

This procedure defines how <<FILL: COMPANY NAME>> identifies when a formal quality risk assessment is needed, selects a method proportionate to the decision, runs the assessment through identification, analysis, and evaluation, decides on risk control, communicates the outcome, and sets a review trigger. It exists so that risk-based decisions across the site, validation scope, deviation depth, supplier tiering, change acceptability, follow one consistent, auditable process rather than a different improvised process each time.

2. Scope

This procedure applies to any GxP decision that depends on a judgment about risk to product quality, patient safety, or data integrity, across development, technology transfer, commercial manufacturing, and discontinuation. It covers both the fully documented, cross-functional assessments (FMEA, FTA, HACCP, risk ranking) and the shorter documented risk discussions used for low-impact decisions. It does not define the technical content of any single tool’s worksheet, those are governed by the tool-specific templates referenced in section 5.3, or the criteria for when a risk assessment is mandatory for a particular activity type, which is set by <<FILL: SOP-ID or policy reference for QRM triggers, e.g. change control, deviation management>>.

3. Responsibilities

4. Definitions

• Hazard: anything that could act as a source of harm.
• Harm: injury to health, including harm that flows from a product losing quality or from the product not being available.
• Risk: how likely harm is to occur, taken together with how bad that harm would be. Not probability alone.
• Severity, occurrence, detectability: the three dimensions scored in most GxP risk tools; detectability is inverted (a high score means harder to detect).
• Residual risk: whatever risk remains once controls and mitigations are in place.
• Risk acceptance: a deliberate, documented decision by a person with the authority to do so, to live with the residual risk.
• Proportionality: the ICH Q9(R1) principle that the effort, formality, and documentation applied to a risk decision should match the significance of that decision, not be fixed at one level for everything.

5. Procedure

5.1 Set the proportionality tier

Before choosing a tool, classify the decision into a tier. Use the table below as the default; document any deviation from it with a stated rationale.

A Tier 1 decision does not need to proceed past this step; record the conclusion and stop. Tier 2 and Tier 3 continue to section 5.2.

5.2 Select the method

Work through these questions in order. Stop at the first one that applies.

Record the method chosen and the reason in the assessment header. Q9(R1) does not mandate a particular tool; it names FMEA, FMECA, FTA, HACCP, HAZOP, PHA, and risk ranking and filtering as examples and leaves the choice to the team, provided the choice and its rationale are documented.

5.3 Assemble the team and set the boundary

1. Name a facilitator who does not own the decision the assessment will inform.
2. Name the risk owner and at least one subject matter expert from each function closest to the failure mode or hazard, not only the function requesting the assessment.
3. Write down the scope and boundary before scoring: which process steps, systems, or unit operations are in and which are explicitly out.
4. Pull the tool-specific template that matches the method chosen in 5.2 (<<FILL: internal template references>>, or use /templates/assessment-validation-risk-fmea for a computerized-system FMEA and /templates/worksheet-haccp-ccp-determination for a CCP determination) and agree the scoring scales and, where the method uses RPN, the action thresholds, before scoring begins.

5.4 Phase 1: risk assessment

1. Identify. List the hazards or failure modes, with their causes.
2. Analyze. Score each item against the pre-agreed scales. Record the basis for each score, what data or experience it rests on, in a notes column; a score with no stated basis is treated as a placeholder, not a finding.
3. Evaluate. Compare the scored items against the criteria set in advance (an RPN band, a risk class, a CCP decision). Flag any item where severity alone warrants attention regardless of the combined score.

5.5 Phase 2: risk control

1. For every item above the acceptance threshold, or flagged on severity, decide and record whether to reduce the risk, accept it as is, or accept it with monitoring.
2. Where risk reduction is chosen, name the specific mitigation, whether it is a technical control (a system lock, an interlock, an automated check) or a procedural control (an SOP, a second review), and who owns it.
3. Re-score the residual risk after the mitigation is verified in place, not merely planned. A mitigation credited before it is verified is not a mitigation yet.
4. Accept the residual risk at the authority level set in section 6.

5.6 Phase 3: risk communication

1. Share the assessment, including items that were not actioned and why, with the risk owner, QA, and the process or system owners affected.
2. Where the outcome changes a downstream decision (validation scope, review frequency, change acceptability, investigation depth), name that decision explicitly in the assessment so the link is traceable later.
3. Route high-tier outcomes to management review per <<FILL: SOP-ID for management review>>.

5.7 Phase 4: risk review

1. Set a review trigger at the time of approval: a stated calendar cadence for Tier 3 assessments (<<FILL: e.g. annually>>) and, for every tier, a trigger on any relevant change, recurring finding, or new knowledge about the hazard.
2. A review record states what was reconsidered and why the conclusion did or did not change; “reviewed, no change” with no supporting statement is not sufficient.
3. Log the assessment, its residual risk, its owner, and its review trigger in the site quality risk register (/templates/register-quality-risk or <<FILL: internal register reference>>) so it is visible as a living record, not an archived file.

6. Sign-off authority for risk acceptance

7. Acceptance criteria

• The proportionality tier and the method chosen are both stated and consistent with sections 5.1 and 5.2.
• The team is cross-functional for any Tier 2 or Tier 3 assessment; no assessment above Tier 1 is signed by a single author.
• Every score has a recorded basis; every item above threshold, or flagged on severity, has a documented decision.
• Residual risk is re-scored only after the mitigation is verified, and is accepted at the authority level in section 6.
• A review trigger is set and the outcome is logged in the quality risk register.

8. Records generated

• The completed assessment (FMEA worksheet, HACCP CCP determination, risk ranking table, or documented risk discussion for Tier 1).
• The risk register entry.
• The review record at each triggered or scheduled review.

9. References

ICH Q9(R1), Quality Risk Management (Step 4, 18 January 2023). ICH Q10, Pharmaceutical Quality System, quality risk management enabler. 21 CFR Part 211 (current good manufacturing practice for finished pharmaceuticals), the underlying process and quality controls QRM decisions support. EU GMP Chapter 1 (Pharmaceutical Quality System) and the quality risk management principles applied across the GMP chapters and annexes.

Confirm the current version of each reference before issue.

10. Revision history

11. Approvals

Filled specimen

The following shows a Tier 3 assessment run through the procedure for an example biologics fill-finish site, so you can see the level of detail expected. The company, system, and numbers are illustrative; replace them with your own.

Trigger: a proposed change to introduce an automated stopper-height sensor at the stoppering station, replacing a purely visual in-process check.

Common inspection findings this SOP prevents

• A team runs a full FMEA for a decision that plainly did not need one, or skips any documented assessment for a decision that clearly did, because no tier framework exists to decide which.
• Different teams pick different tools for the same type of decision with no consistent rationale, so risk assessments across the site are not comparable.
• A residual risk is re-scored lower with no verification that the mitigation actually works, so the “after” number is aspirational.
• A high residual risk is accepted by the project team instead of the authority level in section 6.
• An assessment sits in a file and never reaches the quality risk register, so it is invisible to anyone reviewing site risk posture.

How to adapt this SOP

1. Set your document number, owner, and effective date in the header.
2. Point section 2’s cross-reference to your real change control, deviation, and QRM-trigger procedures.
3. If your site already has a validated risk register or an FMEA template, name it directly in sections 5.3, 5.7, and 8 rather than the generic references given here.
4. Adjust the proportionality tiers and the sign-off authority table to your organization’s actual delegation of authority.
5. Confirm every regulation in section 9 against the current published version before issue.