[ RISK-BASED QMS ]
From reactive to predictive: the risk-based QMS journey.
Most quality systems manage risk after something goes wrong. A risk-based quality system does the opposite — it spends attention in proportion to risk, before failure. This is the path from one to the other, in five stages, with the concrete first move at each.
[ THE FIVE STAGES ]
ICH Q9(R1) tells you quality risk management should be proportionate to risk and integrated across the quality system — but not how to get there from a reactive starting point. This journey is that route, and the free Risk-Readiness Check places you on it. A SPEQ synthesis to make ICH Q9(R1) actionable — not an official maturity model.
[ FREE · RISK-READINESS CHECK ]
Where are you on the journey? Eight questions, no account.
Answer eight questions and get your stage, your top three gaps, and your next moves — computed in your browser, nothing stored.
When does your organisation perform a risk assessment?
What happens to a completed risk assessment?
How consistent is your risk-assessment method?
How is the depth of a risk assessment decided?
How connected is risk management to the rest of your quality system?
How are significant quality decisions made?
Do you use trends to anticipate risk?
How safe is it to raise a risk or a problem in your organisation?
[ FREQUENTLY ASKED ]
What is a risk-based quality management system?
A quality system that allocates effort in proportion to risk — more rigour where a failure would harm patients or product, less where it would not — rather than applying uniform controls to everything. ICH Q9(R1) is the reference: quality risk management should be commensurate with the level of risk and integrated across the quality system, not run as a parallel paperwork exercise.
How do I start implementing ICH Q9 in a small organisation?
Begin at the Reactive stage moves: adopt one simple, consistent risk-assessment method, start a risk register so risks are named and owned, and make one real decision from a risk assessment. You do not need a sophisticated toolset to be risk-based — you need proportionality and the discipline to actually use the output. The Risk-Readiness Check on this page places you on the journey and names your top gaps.
Is the five-stage journey an official maturity model?
No. The five stages, the diagnostic signatures, and the first-moves are SPEQ synthesis — a practitioner interpretation to make ICH Q9(R1) actionable. They are not an FDA, ICH, or ISO certification scheme, and the Risk-Readiness Check is a self-assessment aid, not an audit or a score of record.
How is this different from the SPEQ maturity assessment?
The maturity assessment scores twelve GxP domains of your whole quality system. The Risk-Readiness Check is narrower and faster — it places you specifically on the risk-management journey and points to the next move. They complement each other: the journey is the risk lens, the assessment is the full picture.