Evolving Quality Risk Management
A Deep Dive into ICH Q9 (R1) with Kevin O'Donnell (HPRA) on Pharma Conversations Podcast
Episode 4 of the Pharma Conversations Podcast, hosted by Shada Warreth and Elizabeth Hunt, features an in-depth discussion on Quality Risk Management (QRM) with Kevin O’Donnell, Senior GMP Inspector and Market Surveillance Manager at the HPRA. Kevin is widely recognised for his leadership in the revision of ICH Q9 (R1) and his long standing contributions to global QRM practice. This article distils the most actionable insights from the conversation including regulatory expectations, practical implementation challenges, and the evolving role of QRM in strengthening quality culture across organisations.
Kevin O’Donnell is Market Surveillance Manager and a Senior GMP Inspector at the Health Products Regulatory Authority (HPRA) in Ireland (currently on secondment from HPRA to PMDA Japan and Tokyo University of Science). He has been with the HPRA since 2001. Kevin obtained his PhD in Quality Risk Management from the Dublin Institute of Technology in 2008. He is currently Chair of the PIC/S Expert Circle on QRM, and he is also Rapporteur for the revision of ICH Q9.
In this position, Kevin is a member of the senior management team of the HPRA Compliance Department and holds responsibility for various compliance programmes. Kevin is currently Rapporteur for ICH Q9(R1).
In a recent episode of the Pharma Conversations Podcast, Kevin O’Donnell of the Health Products Regulatory Authority (HPRA) offered a detailed and thought-provoking reflection on the evolution, implementation, and future direction of Quality Risk Management (QRM) within the pharmaceutical industry.
Speaking in a personal capacity, he drew on decades of experience as a GMP inspector and contributor to international regulatory initiatives to examine both the persistent weaknesses he has observed in quality risk management practice and the opportunities created by the 2023 revision of International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use guideline ICH Q9. His central message was clear and consistent throughout the discussion: effective QRM is fundamentally dependent on the integration of knowledge management, scientific discipline, cultural maturity, and measurable risk reduction.
For O’Donnell, QRM cannot be reduced to a set of risk assessment templates or risk scoring tools. It is, rather, a way of thinking that must permeate an organization’s Pharmaceutical Quality System (PQS). At its core lies the recognition that risk assessment without knowledge is inherently flawed. One cannot meaningfully assess probability, severity, or detectability without understanding the underlying process, the science behind the product, historical process performance data, and the effectiveness of existing GMP controls.
Knowledge management, therefore, is not a peripheral concept but a prerequisite for robust QRM. Organizations must know where their knowledge resides, how it is curated, how it is updated, and how it informs risk assessment and risk-based decision-making. Without this structured approach, risk assessments becoming exercises in subjective judgment, driven more by opinion than by data and evidence.
He emphasized that effective QRM should ultimately demonstrate measurable risk reduction. The objective of risk assessment is not documentation, but improvement. However, measuring risk reduction presents inherent challenges. Risk assessment is probabilistic by nature, and probability is not easily measured, particularly in complex manufacturing systems with limited failure data. Nevertheless, O’Donnell argued that other industries have addressed similar challenges. Fields such as nuclear power and aerospace have long employed probabilistic risk assessment methodologies, quantitative fault tree analyses, and simulation techniques to estimate system failure probabilities. While the pharmaceutical industry has historically relied on more qualitative and semi-quantitative tools, the scientific foundation for more robust approaches already exists. The challenge is cultural and educational, rather than conceptual.
The impetus for revising ICH Q9 stemmed from repeated observations within the GMP inspectorate community that quality risk management practices were often not delivering on their promise. O’Donnell described encountering risk assessments characterized by high subjectivity, minimal use of empirical data, and a tendency toward predetermined conclusions. Brainstorming sessions were frequently used to estimate probabilities, yet little attention was paid to cognitive biases such as anchoring, confirmation bias, or groupthink.
While subjectivity can never be fully eliminated, since human perception and judgement are intrinsic to risk evaluation, it can and should be systematically reduced. Over nearly two decades since the original publication of Q9 in 2005, GMP inspectors continued to observe similar shortcomings, suggesting that the industry had not sufficiently internalized the scientific underpinnings of quality risk management.
The discovery of nitrosamine impurities in pharmaceutical products in 2018 provided a powerful case study of systemic limitations within quality risk management activities by the pharmaceutical industry. These impurities, identified in a large range of medicinal products, highlighted weaknesses in hazard identification and cross-industry learning. The issue underscored the need for more anticipatory, science-driven approaches to hazard identification and risk evaluation. Against this backdrop, the HPRA initiated discussions with the European Medicines Agency, which ultimately supported a formal proposal to revise ICH Q9 through the ICH process. Work commenced on revising the guideline in 2020, leading to the publication of Q9(R1) in early 2023.
The revised guideline focuses on six interrelated themes: managing subjectivity, applying appropriate levels of formality to QRM activities, strengthening hazard identification, improving risk-based decision-making, enhancing risk review, and addressing product availability risks, including drug shortages. O’Donnell explained that these areas were selected not to expand the scope of QRM, but to clarify and strengthen areas where implementation had proven weak.
Subjectivity was perhaps the most complex topic to address. The revision acknowledges that human judgment plays an unavoidable role in risk assessment, but encourages structured approaches to minimize bias. Techniques such as minimizing subjectivity in the design of risk scoring tools, calibration of expert judgment, structured opinion elicitation methods, and transparent documentation of assumptions can enhance reliability.
Formality in QRM, another focal point of the revision, refers to proportionality rather than bureaucracy. The level of structure, documentation, and analytical depth applied to a risk assessment should correspond to the importance of the risk assessment and its decision outcomes, the degree of uncertainty that is involved, and the complexity of the process being risk assessed.
Highly consequential decisions with significant uncertainty warrant greater rigour and effort in the associated risk assessments. Conversely, low-risk, well-understood issues may justify simpler QRM approaches, with lower levels of rigour and effort. O’Donnell noted that even the interpretation of “formality” can vary across cultural contexts, highlighting the importance of thoughtful and flexible implementation rather than rigid rule-making.
Hazard identification was repeatedly emphasized as foundational. If the wrong hazards are identified, or if significant hazards are overlooked, no amount of risk scoring or mathematical manipulation can correct the error. O’Donnell suggested that pharmaceutical quality professionals could learn from health and safety colleagues, who often excel in systematically identifying physical and behavioural hazards in workplaces and in manufacturing processes. Translating that mindset to product quality risks could strengthen QRM practices significantly. Without comprehensive hazard identification, risk assessments become disconnected from operational reality and may provide a false sense of security.
Risk-based decision-making, as addressed in the revision, acknowledges that decisions are multi-dimensional. Research referenced in the discussion illustrates how structured multi-criteria decision-making can improve clarity and defensibility. Pharmaceutical company decisions often balance product quality, patient safety, regulatory compliance, operational feasibility, and business continuity. Making these criteria explicitly and transparently enhances accountability and reduces the influence of hidden assumptions.
Risk review, another critical element in the QRM process, may currently be one of the least developed areas in practice. But risk review is highly important, because it is here that organizations have perhaps the most information and knowledge about risk assessment outcomes, unintended consequences, and control effectiveness. Embedding systematic review processes ensures that quality risk management evolves rather than stagnates and that prior decisions are evaluated against real-world knowledge and process performance data.
Product availability risks represent a further dimension of modern QRM. Drug shortages have become increasingly prevalent, and they reflect complex, multi-factorial causes, including supply chain fragility, manufacturing capacity constraints, regulatory challenges, and economic pressures. This area has, for some time now, been characterized in the literature as what is called a ‘wicked problem’, and addressing it requires collaboration among many stakeholders, including manufacturers, regulators, and supply chain partners. The revised guideline encourages broader thinking about risk, beyond immediate product quality concerns, recognizing that medicine availability itself is a public health concern, and that decisions in one part of the system can have ripple effects across others.
Integration of QRM into the PQS was described as essential. Quality risk management should meaningfully underpin change control, deviation management, CAPA systems, training programs, process performance monitoring, management review processes, and many other areas of GMP. Inspectors frequently trace serious marketplace quality defects back to inadequately assessed changes, whether related to suppliers, equipment, raw materials, or process parameters.
Effective change management requires robust hazard identification, evidence-based evaluation of impact and risk, and validation of controls before implementation. Organizational culture strongly influences how risks are surfaced and discussed. If leadership discourages the identification of high-risk findings, or if it implicitly favours risk registers with all entries showing ‘green’, transparency is compromised. A culture that supports open communication and does not penalize the reporting of significant risks is fundamental to a living QRM system.
O’Donnell also explored the implications of emerging technologies, particularly artificial intelligence (AI) and digitalization. AI-supported manufacturing and data analytics introduce a wealth of new opportunities, but they also can introduce new hazards related to data integrity, cybersecurity, model bias, and lack of generalizability beyond training and testing datasets. Applying the Q9(R1) concepts of ‘importance’, ‘uncertainty’ and ‘complexity’ when determining how much formality to apply to a pending risk assessment or another kind of QRM activity provides a more proportionate way to assess and manage the related risks.
AI systems with greater autonomy, or those directly influencing product quality decisions, warrant higher levels of scrutiny, control, human oversight and validation. Implementation should involve clear definition of AI or machine learning model boundaries, ongoing performance monitoring, and transparent documentation of assumptions and limitations. Risk communication will be increasingly important as stakeholders, including patients and regulators, seek assurance that such technologies are deployed responsibly and ethically.
Advanced Therapy Medicinal Products (ATMPs) offer another example of risk-based regulation in practice. The European GMP framework for ATMPs, introduced in 2017, embeds risk-based thinking throughout, including in decentralized or modular manufacturing contexts, which are starting to come to the fore now. While O’Donnell considers this framework largely fit for purpose, he acknowledges that continued adaptation will be required as scientific innovation accelerates and manufacturing models evolve.
A detailed discussion addressed the widespread use of Risk Priority Numbers (RPNs) in Failure Modes and Effects Analysis (FMEA). O’Donnell explained that RPNs are derived from ordinal scale numbers and therefore lack precise mathematical properties. Treating RPBs as exact quantitative measures and applying rigid thresholds to them, below which no risk controls are implemented, can lead to highly questionable risk acceptance decisions. RPN scores of 48 versus 52, in an FMEA exercise where an RPN threshold is set at 50, does not represent a meaningful mathematical distinction when both are derived from subjective ordinal scale risk rankings.
He advocated recognizing these limitations, avoiding strict RPN cut-offs, and focusing instead on relative prioritization, on the clustering of risks, and on the evaluation of the robustness and validation status of all associated GMP controls. Embedding explicit consideration of control qualification, monitoring effectiveness, and evidence of performance within risk assessments can significantly enhance scientific rigor and strengthen the linkage between quality risk management and real-world process control.
Looking ahead, O’Donnell anticipates that the coming years will be defined by efforts to implement ICH Q9(R1) effectively, and to transition toward evidence-based risk reduction. This evolution may involve greater use of probabilistic modelling, structured expert calibration techniques, such as those developed in experimental psychology fields, and quantitative analysis methods such as Monte Carlo simulations. Cross-industry learning will likely play an important role, as pharmaceutical professionals draw insights from sectors that have long managed high-consequence risks using advanced analytical tools. Education and training will also be critical to building capability in these areas.
Throughout the conversation, O’Donnell conveyed cautious optimism. While acknowledging persistent weaknesses in practice, he emphasized that the scientific knowledge required for improvement already exists and that the revised guideline provides a clear framework for progress. QRM must move beyond compliance-driven approaches toward a mature, evidence-informed discipline that genuinely informs strategic and operational decisions.
The integration of knowledge management, cultural openness, quantitative thinking, and transparent communication will determine whether QRM fulfils its potential as a cornerstone of pharmaceutical quality and patient safety. In an increasingly complex global environment marked by technological innovation, supply chain complexity and interdependence, and rising public expectations, robust and adaptive quality risk management will be indispensable to sustaining trust in medicines and in the organisations that manufacture and regulate them.