How to Perform a Quality Risk Assessment
Apply ICH Q9 without drowning in RPN numbers.
What a how-to is not
A how-to is SPEQ’s practitioner method, not a procedure. It does not replace your own SOP, it is not a validated approach, and the judgement calls in it belong to your quality unit.
Quality risk management (ICH Q9(R1)) is how you make science- and risk-based decisions about product quality — which changes need what controls, where to focus validation, how much to worry about a deviation. A good risk assessment answers a specific question with proportionate rigour; a bad one generates a spreadsheet of numbers no one acts on.
- 1
Define the question and scope
State the specific decision the assessment must inform — "what controls does this change need?", not "assess the risk of the process". A risk assessment without a question produces analysis without a decision.
- 2
Assemble a cross-functional team
Risk lives across functions — manufacturing, QC, engineering, regulatory. A single-function assessment misses hazards the other functions see every day.
- 3
Identify the hazards
List what could go wrong and how it could harm product quality or the patient. Breadth here matters more than precision — a hazard you never name cannot be controlled.
- 4
Analyse the risk
Assess each risk — commonly by severity, probability, and detectability — using a tool fit for the question (FMEA, HACCP, risk ranking). The tool is a means to a decision, not the deliverable.
- 5
Evaluate against criteria
Compare the analysed risk to pre-defined acceptability criteria. Deciding acceptability after seeing the numbers invites bias; set the threshold first.
- 6
Control the risk
For unacceptable risks, reduce them (eliminate, mitigate, add controls) or formally accept them with justification. Then confirm the controls actually lower the risk you were worried about.
- 7
Communicate and review
Record the assessment, communicate the decisions, and define what triggers a review — a change, a deviation, new data. Risk assessments go stale; a review trigger keeps them live.
- !RPN worship — treating the risk-priority number as the answer instead of a prompt for judgement.
- !Setting acceptability criteria after seeing the scores.
- !False precision — fine-grained numbers on coarse, subjective inputs.
- !No review trigger, so the assessment is never revisited when the process changes.
How to Perform a Quality Risk Assessment: frequently asked questions
Common questions on perform a quality risk assessment.
Which risk tool should I use — FMEA, HACCP, or risk ranking?
Whichever fits the question. FMEA suits failure-mode analysis of a process or design; HACCP suits process flows with critical control points; simple risk ranking suits a bounded decision. ICH Q9 is deliberately tool-agnostic — pick the lightest tool that answers the question, not the most elaborate.
What is wrong with relying on the RPN?
The risk-priority number (severity × probability × detectability) is a prompt, not a verdict. Coarse, subjective inputs produce numbers with false precision, and a low RPN can still hide a high-severity risk. Use it to focus discussion, then apply judgement — especially to anything with severe consequences.
When should a risk assessment be reviewed?
When something changes the risk — a process or equipment change, a deviation, a complaint trend, or new data — or on a defined periodic cadence for critical assessments. Building the review trigger into the assessment is what keeps it from going stale.
Do I set acceptability criteria before or after scoring?
Before. Defining what "acceptable" means after you have seen the scores invites confirmation bias — the threshold quietly moves to match the answer you want. Set the criteria up front so the evaluation is honest.