Advanced Risk Management: ICH Q9 and ICH Q10

The ICH Q9 framework: structure, purpose and the 2023 revision

The course opens with the ICH Q9 framework in full. Learners will understand the six-stage risk management process – hazard identification, risk analysis, risk evaluation, risk control, risk communication and risk review – and how each stage connects to the next in a cycle that is designed to be iterative rather than linear.

The 2023 revision of ICH Q9 is addressed with the attention it deserves. Learners will understand the specific concerns the revision was designed to address: the inappropriate use of subjectivity in risk scoring, the absence of formality in high-impact risk decisions, the disconnection between risk assessment outputs and organisational decisions, and the insufficient attention to risk review and risk communication as active elements of the process. The revision’s clarifications are explained in practical terms – what they mean for how risk assessments should be designed, documented, reviewed and used, and how they change the standard against which regulators will assess risk management adequacy.

The concept of proportionality is addressed carefully. ICH Q9 expects risk management to be proportionate to the level of risk: not every quality decision requires a full FMEA, and applying elaborate risk tools to low-stakes decisions wastes time and dilutes the attention available for high-stakes ones. Learners will understand how to calibrate the formality and depth of a risk assessment to the significance of the decision it supports.

Risk Management Tools: Selection, Application and Documentation

The most widely used pharmaceutical quality risk management tools are covered in operational depth. Learners will understand not just how each tool works, but what type of risk problem it is best suited to, what its assumptions and limitations are, and how to avoid the common failure of applying a familiar tool to a problem it was not designed for.

Failure Mode and Effects Analysis is addressed in full, including how to identify failure modes, how to assess severity, occurrence and detectability, how to calculate or assign risk priority, how to identify and document risk controls, and how to conduct a meaningful FMEA review. The course addresses the subjectivity problem directly: FMEA scores that vary significantly between assessors are not conveying useful information, and the course explains how to structure scoring criteria that reduce inappropriate variation without eliminating expert judgement.

HACCP principles and their application in pharmaceutical manufacturing are covered, including how HACCP thinking connects to contamination control, process design, critical control point identification and monitoring system design. The course explains how HACCP complements rather than duplicates FMEA and when each approach is more appropriate. Ishikawa or fishbone analysis is revisited in the context of risk management, showing how the tool’s application in risk identification differs from its use in root cause analysis. Risk ranking and filtering matrices, preliminary hazard analysis and process hazard analysis are covered at the level needed for pharmaceutical quality applications, with guidance on documentation requirements and review cycles.

Quality Risk Management Applied Across Pharmaceutical Processes

A substantial section of the course examines how quality risk management should be applied across the key pharmaceutical quality processes where it is most operationally significant.

Validation programme planning using risk management is addressed in depth. Learners will understand how risk-based approaches to validation – identifying which systems, processes and methods carry the highest impact on product quality and patient safety – should drive the scope, depth and frequency of qualification, process validation and method validation activities. The course connects this to the validation lifecycle model and to the ICH Q8, Q9 and Q10 integrated approach to product and process understanding.

Contamination control risk assessment is covered with reference to the Annex 1 CCS requirement, showing how a risk-based approach to contamination hazard identification, risk evaluation and control selection should underpin the CCS document and its associated monitoring and review programme.

Change control risk assessment is addressed as a distinct application, showing how quality risk management should drive change classification, cross-functional review scope, validation impact assessment and regulatory filing assessment – and why a change control risk assessment that merely confirms the planned classification rather than genuinely testing it misses its purpose.

Supplier qualification risk assessment is addressed, including how risk-based approaches to supplier classification, audit frequency and qualification depth should be based on the potential impact of the supplier on product quality and patient safety rather than on administrative convention or historical precedent.

Risk management in regulatory submissions is covered, including how risk-based justification is used in IMPD and CTD sections, how ICH Q9 principles underpin design space justification, control strategy development and post-approval change management, and how regulators assess the quality and credibility of risk-based arguments in submissions.

ICH Q10: the Pharmaceutical Quality System Framework

The ICH Q10 section introduces the framework as the organisational structure within which risk management and all other quality system elements operate. Learners will understand the four major elements of ICH Q10 – management responsibilities, process performance and product quality monitoring, CAPA and change management – and how they interact.

Management responsibilities under ICH Q10 are addressed with particular emphasis on what genuine senior leadership commitment to quality looks like, as distinct from formal endorsement of quality policy. Learners will understand how management behaviour, resource decisions, escalation responses, management review participation and organisational culture either support or undermine the ICH Q10 framework.

Knowledge Management

Knowledge management is addressed as one of the most practically important and most frequently underdeveloped elements of ICH Q10. Learners will understand what pharmaceutical knowledge management includes – product knowledge, process knowledge, quality system knowledge, regulatory knowledge and supplier knowledge – and how it should be captured, maintained, applied and transferred throughout the product lifecycle.

The course examines how knowledge management failures create risk. An organisation that does not capture the process understanding generated during development cannot use it to inform manufacturing decisions. One that does not maintain knowledge of why specific controls were designed as they were cannot assess the impact of proposed changes on those controls. One that allows knowledge to reside only in experienced individuals rather than in documented systems is at risk each time a key person leaves. Knowledge that exists but is not shared across the organisation is not being used to its full protective value.

Product Lifecycle Management

Product lifecycle management under ICH Q10 is addressed as a framework for connecting pharmaceutical development, technology transfer, commercial manufacturing, product discontinuation and the regulatory submissions that reflect each stage. Learners will understand how the knowledge generated at each lifecycle stage should inform the next, how quality system elements apply differently across the lifecycle, and how lifecycle thinking supports more coherent and defensible regulatory submissions.

Management Review as an Active Governance Tool

Management review is addressed with the critical attention it deserves. Learners will understand what a genuine ICH Q10 management review includes – quality system performance data, process performance indicators, product quality metrics, CAPA status, change control status, audit outcomes, customer complaints, deviation trends, supplier performance, regulatory intelligence and resource requirements – and how those inputs should generate decisions, commitments and resource allocations rather than acknowledgements.

The course examines the common failure mode of the management review that reviews without reviewing: a meeting that proceeds through agenda items, notes that the quality system is functioning, and produces minutes without substantive decisions. This is inspection theatre at senior management level, and regulators are not deceived by it. The course explains how to design and facilitate a management review that performs its ICH Q10 function.

Building a Risk-Based Quality Culture

The final section addresses how organisations move from applying risk tools to building a risk-based culture – one in which risk thinking is embedded in daily decisions rather than activated by compliance requirements. Learners will understand how leadership behaviour, training approaches, CAPA culture, escalation expectations and management review effectiveness all contribute to or undermine the quality risk culture that ICH Q9 and ICH Q10 are designed to create.

Cross-functional risk culture is addressed specifically. A risk-based approach to quality cannot function if risk thinking is concentrated in quality and regulatory functions and absent from production, engineering, supply chain, procurement and IT. The course examines how to develop risk literacy across the organisation and how to create the conditions in which people at all levels apply proportionate risk thinking to their daily decisions.

• QA Managers, Quality System Leads and Risk Management professionals responsible for implementing, governing and improving quality risk management and pharmaceutical quality system frameworks.
• Validation and Technical Operations professionals applying risk-based approaches to validation programme design, change impact assessment and process control strategy development.
• Regulatory Affairs professionals preparing and reviewing risk-based justifications in regulatory submissions, CTD sections, design space documentation and post-approval change assessments.
• Site Quality Directors, VP Quality and QPs responsible for pharmaceutical quality system governance and management review.
• Manufacturing, Operations and Production Managers involved in operational risk assessment, contamination control, process design and change management.
• QC Managers and Laboratory professionals applying risk-based thinking to analytical method selection, qualification scope, OOS investigation and laboratory change management.
• Engineering, Validation and Facilities professionals applying risk management to equipment qualification, utility design, maintenance programmes and facility change assessment.
• Supply chain, procurement and supplier quality professionals applying risk-based approaches to supplier classification, qualification depth and supply chain risk management.
• Regulatory Affairs and technical writing professionals integrating ICH Q9 risk arguments into submission documents.
• Internal auditors and compliance professionals assessing the quality and rigour of risk management programmes and pharmaceutical quality system implementation.
• Senior leaders and management review participants who need to understand how ICH Q10 management responsibilities connect to quality system performance and regulatory standing.
• Any professional whose daily work involves making decisions under uncertainty – which, in a regulated pharmaceutical environment, is effectively everyone.

You will develop the depth of quality risk management knowledge needed to design rigorous risk assessments, challenge their adequacy, facilitate cross-functional risk reviews, select appropriate risk tools, and apply ICH Q9 thinking in ways that produce genuinely better decisions rather than better-documented predetermined ones. You will also understand the ICH Q10 pharmaceutical quality system framework at the level needed to contribute to and govern it effectively.

For those in senior quality, regulatory, technical or leadership roles, this course provides the advanced risk and quality system competence that distinguishes professionals who drive quality improvement from those who manage quality process compliance.

Organisations that apply quality risk management rigorously across their quality processes make better resource allocation decisions, reduce the frequency and severity of quality failures, manage regulatory submissions with greater scientific credibility, and demonstrate the proactive, risk-intelligent quality thinking that builds long-term regulatory confidence.

A quality system governed by ICH Q10 principles – with active management review, effective knowledge management, genuine CAPA and change management, and senior leadership accountability for quality – is a system that improves over time rather than maintaining a stable level of compliance risk. The organisations that achieve this are not simply better at writing risk assessments. They are organisations where the people responsible for quality decisions understand risk, apply it consistently and work within a system designed to learn from its own performance. That is what regulators mean when they talk about quality culture, and it is what this course helps build.

• Comprehensive expert video content covering ICH Q9 (including the 2023 revision), ICH Q10, risk management tools, cross-process application and quality culture development.
• Real-world case studies from pharmaceutical manufacturing, validation, regulatory affairs, supply chain, laboratory and quality systems environments.
• In-depth treatment of the 2023 ICH Q9 revision, including practical implications for risk assessment design, documentation, subjectivity management and formality in high-impact decisions.
• Risk tool application exercises covering FMEA, FMECA, HACCP, Ishikawa analysis and risk ranking matrices applied to real pharmaceutical quality scenarios.
• Cross-process risk management exercises covering validation programme planning, CCS risk assessment, change control impact assessment, supplier qualification and regulatory submission support.
• ICH Q10 framework exercises covering management review design, knowledge management gap assessment and product lifecycle quality system mapping.
• Management review scenario exercises distinguishing active governance from compliance performance.
• Cross-functional scenarios showing how production, QC, engineering, regulatory affairs, supply chain, procurement, IT and senior leadership affect risk management quality and pharmaceutical quality system effectiveness.
• Quality culture development guidance including risk literacy assessment, escalation behaviour design and leadership impact on risk-based culture.
• Multi-choice assessment.
• Certificate of completion upon passing the assessment.