How to Write a Risk Management Plan
Specify what you do not yet know about a product’s safety, and how you will find out.
What a how-to is not
A how-to is SPEQ’s practitioner method, not a procedure. It does not replace your own SOP, it is not a validated approach, and the judgement calls in it belong to your quality unit.
A risk management plan describes a product’s safety profile, what remains uncertain about it, and the activities that will characterise and minimise its risks. Its centre of gravity is the safety specification — the honest statement of important identified risks, important potential risks and missing information. A plan whose safety specification is thin produces pharmacovigilance activities that measure nothing in particular.
- 1
Build the safety specification first
Set out the important identified risks, important potential risks, and missing information, each with the evidence behind it. Importance is judged by impact on the benefit-risk balance, not by frequency alone — a rare risk that would change prescribing belongs here, and a common mild one may not.
- 2
Justify each entry and each omission
State why a risk is classified as identified rather than potential, and why populations not studied are recorded as missing information. Omissions are as inspectable as inclusions: a plan that lists no missing information for a product studied in a narrow population is making an implausible claim.
- 3
Specify the pharmacovigilance activities
Decide, risk by risk, whether routine pharmacovigilance suffices or an additional activity is required, and say what question the additional activity is designed to answer. An imposed study with no stated question produces data nobody can act on.
- 4
Specify the risk minimisation measures
Distinguish routine measures — the product information, pack size, legal status — from additional measures such as controlled access or educational material. Additional measures need a defined objective and a way of telling whether they worked.
- 5
Define how effectiveness will be measured
For every additional risk minimisation measure, define the indicator, the data source, and the point at which effectiveness will be assessed. Measures that were never evaluated are the ones that persist for years without evidence they change anything.
- 6
Keep the plan aligned to the evolving profile
Update the plan when the safety profile changes materially, when a milestone is reached, or when an authority requests it. A plan that has not changed while the safety specification has is out of date by definition.
- !A safety specification that lists everything reported rather than what is important to the benefit-risk balance.
- !No missing information stated for a product studied in a narrow population — an implausible claim.
- !Additional risk minimisation measures with no defined effectiveness indicator, so nobody can tell whether they work.
- !The plan left static while the safety profile it describes has moved on.
How to Write a Risk Management Plan: frequently asked questions
Common questions on write a risk management plan.
What separates an important risk from any other adverse reaction?
Impact on the benefit-risk balance and on prescribing. A risk is important where it would change how the product is used, monitored or contraindicated. Frequency alone does not decide it — a rare but serious risk usually qualifies, while a common transient one may not.
Why is missing information a category at all?
Because absence of data is not evidence of safety. Populations not studied — the pregnant, the very young or old, those with organ impairment — represent uncertainty that a plan must state and, where warranted, address, rather than leave the reader to infer from silence.
When do routine activities stop being enough?
When routine collection cannot answer the question a risk raises. Spontaneous reporting will not quantify an incidence, characterise a long-latency outcome, or tell you whether an educational measure changed behaviour — those need an activity designed for the question.