Risk Management Process Steps
The risk management process defined in ICH Q9 provides a structured approach to making risk-based decisions in GMP systems, forming the core of Quality Risk Management (ICH Q9).
It is not a linear checklist.
It is a decision cycle that supports consistent evaluation, control, and review of risk.
The process includes:
Risk identification
Risk analysis
Risk evaluation
Risk control
Risk review
Risk communication
These steps are interconnected.
Decisions at one stage influence the others.
Why a Structured Process Is Required
Unstructured decision-making leads to inconsistency.
Without a defined process:
Similar risks are handled differently
Decisions depend on individual judgement
Justification becomes difficult to defend
The risk management process ensures that decisions are:
Traceable
Consistent
Aligned with available knowledge
It provides a common framework across functions and systems.
Step 1: Risk Identification
Risk identification defines what could go wrong.
This includes:
Potential failure modes
Process variability
Equipment or system limitations
Human factors
Environmental conditions
The objective is not completeness for its own sake.
It is relevance.
Over-identification creates noise.
Under-identification creates blind spots.
Effective identification focuses on risks that could impact:
Product quality
Patient safety
Data integrity
Regulatory compliance
Step 2: Risk Analysis
Risk analysis examines the nature of identified risks.
This typically includes:
Severity of impact
Likelihood of occurrence
Ability to detect the issue
These elements may be evaluated qualitatively or quantitatively.
Risk tools such as FMEA or risk matrices may be used, but they do not define the analysis.
They structure it.
The objective is to understand risk - not to generate scores.
The distinction becomes critical when uncertainty is not clearly separated from severity.
Weak analysis often results in:
Uniform scoring across different risks
Lack of differentiation between scenarios
Reliance on default values rather than data
Step 3: Risk Evaluation
Risk evaluation determines whether the level of risk is acceptable.
This step requires:
Defined acceptance criteria
Clear thresholds for escalation
Alignment with regulatory expectations
Without predefined criteria, evaluation becomes subjective.
Different teams may interpret the same risk differently, leading to inconsistent decisions.
The absence of defined criteria is a common gap during inspections.
Step 4: Risk Control
Risk control defines what actions are required to reduce or manage risk.
This may include:
Implementing new controls
Strengthening existing controls
Increasing monitoring frequency
Revising procedures
Risk control should be proportional to the level of risk.
Excessive controls create complexity without improving outcomes.
Insufficient controls leave risks unmanaged.
Decisions made at this stage must align with earlier analysis and evaluation.
Step 5: Risk Review
Risk review ensures that risk assessments remain current.
Risk is not static.
It changes based on:
Process performance
Deviation trends
New data
System changes
Risk assessments should be revisited when:
Recurring issues occur
Process changes are implemented
New knowledge becomes available
Failure to review risk leads to outdated decisions that no longer reflect actual conditions.
Step 6: Risk Communication
Risk communication ensures that decisions are understood and applied consistently.
This includes communication between:
Quality and operations
Different functional groups
Management and execution teams
Poor communication leads to:
Inconsistent application of decisions
Misunderstanding of control requirements
Breakdown in execution
Risk decisions must be clearly documented and communicated to those responsible for implementation.
How the Steps Work Together
These steps do not occur in isolation.
In practice:
Identification may be revisited during analysis
Evaluation may change after control measures are defined
Review may trigger new identification
The process is iterative.
Treating it as a one-time activity leads to incomplete or outdated assessments.
Where the Process Fails in Practice
Common issues include:
Performing steps superficially to complete documentation
Skipping evaluation due to lack of defined criteria
Implementing controls without clear linkage to risk
Failing to revisit assessments after changes
In many cases, failure occurs because the process is followed mechanically rather than used for decision-making.
Evidence of an Effective Risk Management Process
An effective process is visible through outcomes.
Inspectors look for:
Clear linkage between identified risks and actions taken
Consistency in how steps are applied
Documented justification at each stage
Updates based on new information
This expectation aligns with how regulators evaluate risk demonstration across systems.
An effective risk management process is not evaluated by its format.
It is evaluated by its impact on decisions.
Regulatory Perspective
Regulators expect the risk management process to be applied consistently across GMP systems.
They do not expect rigid adherence to a single tool or format.
They expect:
Structured reasoning
Defined criteria
Traceable decisions
A well-functioning process produces decisions that remain consistent under inspection.
A poorly applied process produces documentation that does not align with actual actions.
