Martin J. Lipa, PhD, martin.lipa@prst.ie, is a senior research fellow at Pharmaceutical Regulatory Science Team.

Martin J. Lipa


This article was peer-reviewed by a member of 

Submitted: September 8, 2023
Accepted: January 19, 2024

Business woman holding checked icon on virtual screen. Business process automation, quality assurance management, certification, digital transformation. Service guarantee, Validation concept.| Image Credit: ©Atomic62 Studio - stock.adobe.com

In 2020, the International Council for Harmonisation (ICH) published a concept paper (1) that outlined a limited revision to the published guideline ICH Q9 

 (2) to address the fact that “the benefits of QRM [quality risk management], as envisaged by ICH Q9, have not yet been fully realized.”

Arguably, despite the publication of the companion ICH guidelines in the first decade of the 21st century, ICH Q9 (2) and ICH Q10 

(3), there are still numerous challenges in enhancing manufacturing operations, which lead to quality issues and drug shortages. Even with significant efforts in QRM by both the industry and regulators, there are signs that unmitigated risks persist within the pharmaceutical industry, resulting in quality defects as reported by Kevin O’Donnell, Market Compliance Manager at the Health Products Regulatory Authority (HPRA) in Ireland, who observed that the number of total quality defects reported to the Irish regulator between 2002 and 2021 had increased by more than 10-fold (4). In addition, a survey of chief quality officers of 30 global pharmaceutical companies found that the benefits envisioned by ICH Q10 have generally not been realized, and in some cases the situation was slightly worse or more complex (5).

FDA’s 2019 Drug Shortage Report underscored the ongoing problem of drug shortages in the United States, suggesting manufacturers might prioritize cost reduction over quality investment because quality is not viewed as a competitive marketplace advantage (6). Concurrently, the US Senate Committee on Homeland Security drew attention to the escalating trend of essential medication shortages, impacting a broad spectrum of products from emergency hospital drugs to over-the-counter remedies. By the end of 2022, drug shortages reached a new peak. This crisis was rooted in various factors, such as an overreliance on foreign sources for active ingredient, a lack of domestic manufacturing capacity, and insufficient supply chain visibility into all the companies involved, leading to a misleading appearance of supplier diversity. These shortages have profound cascading effects on patient care (7).

As a tangible step to help address some of these challenges, a targeted revision of ICH Q9 was approved. ICH Q9(R1) was published in January 2023 (8), superseding the original ICH Q9 guidance issued in 2005 (2). This revision narrowly focused on the following four topics deemed critical to advance the competency and effectiveness of the industry in risk management:

high levels of subjectivity in risk assessments and QRM outputs

lack of understanding into what constitutes formality in QRM work

lack of clarity on risk-based decision-making.

The ICH Q9(R1) concept paper further suggested risk review and hazard identification as two additional points to be addressed.

Considering the topic of subjectivity, the ICH Q9(R1) Concept Paper (1) noted the challenge associated with subjectivity as follows:

“High levels of subjectivity in risk assessments and in QRM outputs—the reasons for this can include highly subjective risk scoring methods and differences in how risks are assessed and how hazards, risk, and harms are perceived by different stakeholders. This can lead to varying levels of effectiveness in the management of risks. While subjectivity cannot be completely eliminated from risk assessment and QRM activities, it may be controlled using well recognized strategies, including addressing bias and behavioral factors.”

The Concept Paper further went on to describe potential benefits of addressing subjectivity and suggests:

“Less subjective risk assessments to support manufacturing processes should lead to fewer quality defects that could present risks to patients. Recalls are required every year to protect patients from the real and/or potential risks presented by defects in medicines, leading in some cases to shortages of important medicines. Less subjective risk assessments should also lead to more science-based manufacturing operations, control strategies, and validation activities, resulting in the potential for reduced costs and the possibility to free up resources for other necessary activities. ICH Q8, Q10, and Q11 expect science- and risk-based applications, and revising ICH Q9 to address subjectivity in QRM more explicitly will help enable/accelerate the continued implementation of Q8, Q10, Q11 (and Q12), because of the foundational relevance of QRM.”

Drivers to reduce subjectivity are compelling when one considers the opportunity to reduce defects (and, in turn, recalls). Reduced defects will ultimately lead to reduced costs and resources, and further realization of the goals of a modern PQS. Indeed, one could argue that subjectivity casts a long shadow over many facets of the pharmaceutical business not just QRM. This paper provides an introductory exploration into the topic of subjectivity in QRM by:

reviewing contemporary QRM literature on subjectivity

creating a shared understanding of subjectivity for QRM

examining how subjectivity is addressed in the original Q9 guidance, and comparing it to the revised guidance.

Subjectivity: insights from contemporary QRM-related literature

The emphasis on subjectivity in ICH Q9(R1) is not surprising when one reviews contemporary literature on the topic published since the 2005 release of ICH Q9. Notably, H. Gregg Claycamp, the Regulatory Rapporteur of the original ICH Q9 guidance document, published a paper in 2018 entitled “Controlling Subjectivity in Risk-based Decision Making: The Benefits of Multi-criteria Decision Analysis” (9). In this paper, in addition to brief discussions on subjectivity inherent in risk assessment and risk management, and linking subjectivity and uncertainty, Claycamp proposed that the problem with subjectivity in QRM stems from two elements as follows:

“A failure to recognize where and when subjectivity enters and might create problems in risk assessment and risk-based decision-making.

“A failure to implement control on subjectivity where it is known
to occur.”

Several other papers have further highlighted the challenges posed by subjectivity, including a paper by ICH Q9(R1) rapporteur Kevin O’Donnell (10). This paper discusses elements of subjectivity and uncertainty such as the impact of human heuristics, which are cognitive behaviors that can introduce bias and errors in judgment during activities like brainstorming and probability estimation. It suggests incorporating design elements into QRM tools to counteract the adverse effects of heuristics and reduce guesswork. Practical strategies and cognitive approaches are presented to improve the accuracy of risk analyses and enhance the outcomes of QRM exercises. These insights can be valuable to facilitators in achieving more accurate risk assessments.

In a follow up paper (11), O’Donnell discusses the significance of risk communication in the QRM process, highlighting potential challenges of subjectivity and uncertainty in this activity. Stakeholders’ individual perceptions can lead to subjective differences in risk judgments, introducing uncertainty in risk management outcomes. To address these issues, O’Donnell suggests adopting a more rigorous approach to risk communication. Practical strategies based on research from experimental psychology and uncertainty analysis to improve risk communication and reduce subjectivity and uncertainty are presented. These strategies include stakeholder selection, employee roles in risk communication, and essential information to be communicated within pharmaceutical companies.

In a 2016 publication (12), authors Vesper and O’Donnell highlight multiple issues encountered 10 years after the publication of ICH Q9. One of the issues discussed was the relationship between risk and uncertainty, with risk defined as the “effect of uncertainty on achieving one’s objectives.” Subjectivity in risk assessment can emerge due to differences in perceptions, values, and experiences among stakeholders. This subjectivity influences the evaluation of potential harms, probabilities, and severities in the QRM process. This may be compounded by groupthink during risk assessment activities, leading to difficulties in reaching consensus on risk acceptability and appropriate courses of action. Vesper and O’Donnell emphasize the importance of addressing subjectivity and uncertainty in risk assessment and offer strategies to do so. These strategies include fostering diverse team composition, using key words in scales, acknowledging uncertainty, and relying on validated data. Additionally, this publication suggests integrating good science into risk assessments and documenting current controls before assigning ratings to failure modes or hazards.

A 2018 paper by Emma Ramnarine and Kevin O’Donnell (13) emphasizes the role of subjectivity during risk assessment activities and how subjectivity can negatively impact the state of control and the delivery of products with consistent quality throughout their commercial life.

In addition to QRM-related literature that directly highlights subjectivity, related research by Valerie Mulholland explores the impact subjectivity plays in effective risk-based decision-making. In a paper on Key Decision Review Points (14), Mulholland proposes that each decision within a QRM process has the potential to be sub-optimal due to subjectivity (among other causes). Furthermore, in another paper from the same four-paper series focused on uncertainty (15), Mulholland discusses the presence of high uncertainty, which poses significant challenges in decision-making. In some cases, the risk itself may be uncertainty. Uncertainty can arise from various sources, including variability in data, lack of knowledge, and ambiguity in interpretations. Decision-making under uncertainty may rely on different mental abilities and competencies compared to evidence-based decision-making. Overall, addressing uncertainty in risk management requires a thoughtful and strategic approach, acknowledging the interconnectedness of risk and subjectivity.

Considering these articles in aggregate, the authors of this paper suggest that Claycamp’s 2018 assertion that the problem with subjectivity in QRM arises from two elements (9) captures the essence of an important theme across this literature. The authors propose restating these two challenges more simply as follows:

knowing what to do about it when it does.

In the opinion of the authors, creating a common understanding of subjectivity is a prerequisite for both of these challenges and is an important need for the industry and those involved in the practice of QRM, as discussed in the next section.

Subjectivity: seeking a common understanding

While high levels of subjectivity were identified as an issue, it is notable that neither ICH Q9 (2), the ICH Q9(R1) Concept Paper (1), nor ICH Q9(R1) (8) provide a definition for subjectivity. In the opinion of the authors of this paper, this lack of a common operational definition and/or associated examples poses the risk of an inconsistent comprehension and understanding of what subjectivity is. Therefore, establishing a common definition of subjectivity as it pertains to QRM is important.

Basic definitions of the word subjectivity exist, including the following
dictionary entries:

“The quality of being based on or influenced by personal feelings, tastes, or opinions” (Cambridge Dictionary)

“The influence of personal beliefs or feelings, rather than facts” (Oxford Dictionary).

While these definitions certainly provide a good starting point, the world of QRM has many different challenges, including:

leading-edge science and new types of therapies

expectations for speed (e.g., product development in response to a pandemic or other market pressures)

human behaviors (e.g., expert opinion, heuristics, bias) multi-step QRM process with many different participants over a long-time horizon.

It is difficult to recognize when subjectivity enters QRM and influences outputs that may affect product quality and patient outcomes. The authors suggest this is an important topic for future study. Notwithstanding, the lack of a definition for subjectivity ICH Q9(R1) does offer important clues by its use of other language, in particular language that evokes objectivity as the antidote for subjectivity in a scientific setting, as explored in next section.

Subjectivity: a closer examination of its emergence in ICH Q9(R1)

While ICH Q9(R1) (8) does not expressly define subjectivity, an examination of it in comparison to the 2005 version of ICH Q9 (2) reveals the emergence of the term subjectivity, which appears 10 times in the revised document in contrast to the lack of being mentioned in the original.

Furthermore, the authors have observed that the language in ICH Q9(R1) includes concepts related to subjectivity- and objectivity as its antonym, for example:

terms which invoke scientific facts which suggests minimizing subjectivity (e.g., evidence, data, information, knowledge)

knowledge management (KM) as a means to manage and deliver scientific knowledge to QRM and risk-based decision-making processes.

A simple comparison of the two documents was conducted by the authors to evaluate the frequency of relevant terms in each ICH Q9 and ICH Q9(R1), the results are presented in 

Table I: Frequency of subjectivity-related terms in International Council for Harmonisation (ICH) Q9(R1) and ICH Q9. KM is knowledge management.

As can be seen by the comparison, there is a significant increase in subjectivity related concepts in ICH Q9(R1). The authors believe this signifies a proactive desire to address subjectivity. By incorporating these related concepts, the revised guideline emphasizes the importance of basing risk assessments on objective evidence and data-driven insights. This shift toward more objective decision-making that is evidence-based, while seeking to minimize the influence of subjectivity enhances the reliability of risk analyses and risk management at large.

Subjectivity emerges in ICH Q9(R1) (8) as a concept that must be addressed to improve the effectiveness of risk management, and in turn the pharmaceutical quality system. In fact, O’Donnell challenges “can an organization do effective Risk-based Decision-making if its risk assessments are highly subjective?” (16). As mentioned by experts, acknowledging and addressing subjectivity are crucial for making informed and effective risk-based decisions, ultimately leading to improved product quality, patient safety, and product availability. Indeed, subjectivity casts a long shadow on QRM and, by extension, the pharmaceutical industry as a whole.

Updates included in the revision to ICH Q9(R1) reflect the growing recognition of the significance of subjectivity in risk management within the pharmaceutical industry. By incorporating language related to bias, evidence, data, information, knowledge, and knowledge management, the revised guideline appears positioned to enhance the objectivity and reliability of risk assessments. These changes included in ICH Q9(R1) provide an opportunity to shine a light on this issue by emphasizing the need to address subjectivity and its connection to business outcomes and patient safety.

However, while subjectivity has emerged as important in ICH Q9(R1), significant work remains to develop a clear and shared understanding of what subjectivity is, when subjectivity might exist and what to do about it when it does. These topics will be the focus of future research by the authors. Such research is also expected to explore subjectivity in other industries and study best practices. In addition, it is anticipated that training on this topic, and exploring emerging technologies and methods, would be beneficial.

The views expressed in this article are those of the authors and are not necessarily those of any organizations with which the authors are affiliated.

ICH. Final Concept Paper ICH Q9(R1): Quality Risk Management. 2020. 

https://database.ich.org/sites/default/files/Q9%20Guideline.pdf

. (ICH, 2008). https://database.ich.org/sites/default/files/Q10%20Guideline.pdf (accessed: Aug. 28, 2023).

O’Donnell, K. Quality Risk Management–An Update on the Ongoing Revision of ICH Q9 ‘Delivering Value and Resilience using QRM’ [Conference Proceeding]. in PDA Ireland, Dublin, Ireland, September 2022.

Ramnarine, E. Solving the Continual Improvement and Innovation Challenge for the Benefit of Patients: How an Effective Pharmaceutical Quality System (PQS) and Risk-Based Approach Could Transform Post-Approval Change (PAC) Management. 2021. DOI: 10.21427/960F-8S69.

https://www.fda.gov/drugs/drug-shortages/report-drug-shortages-root-causes-and-potential-solutions

Peters, G. Risk of Drug Shortages-United States Senate Committee- Homeland Security & Governmental Affairs Report. 2023. 

https://www.hsgac.senate.gov/wp-content/uploads/2023-03-20-HSGAC-Majority-Draft-Drug-Shortages-Report.pdf

https://database.ich.org/sites/default/files/ICH_Q9%28R1%29_Guideline_Step4_2023_0126_0.pdf

Claycamp, G. Controlling Subjectivity in Risk-based Decision Making: The Benefits of Multi-criteria Decision Analysis. DIT Academic Press, 2018.

O’Donnell, K. Strategies for Addressing the Problems of Subjectivity and Uncertainty in Quality Risk Management Exercises Part I-The Role of Human Heuristics. 

O’Donnell, K. Strategies for Addressing the Problems of Subjectivity and Uncertainty in Quality Risk Management–Part 2 Risk Communication and Perception Issues. 

Vesper, J. and O’Donnell, K. Current Challenges in Implementing Quality Risk Management. 

https://ispe.org/pharmaceutical-engineering/ispeak/current-challenges-implementing-quality-risk-management

Ramnarine, E. and O’Donnell, K. Demonstrating Pharmaceutical Quality System Effectiveness and Driving Continual Improvement: Evidence-based Risk Reduction.

 72 (3), pp. 338–345, May 2018, DOI: 10.5731/pdajpst.2017.008524.

Mulholland, V. and Greene, A. Improving Risk Based Decision Making Effectiveness: A Case for Risk Decision Review Points (KDRPs) In The Quality Risk Management Process. 

Mulholland, V. and Greene, A. Improving Risk Based Decision Making Effectiveness: Addressing Uncertainty. 

O’Donnell, K. ICH Q9(R1) and Some Personal Thoughts about Implementing the New Guidance [Conference Proceeding]. in TU Dublin, PRST Conference, Dublin, Ireland, June 2023.

Amin Ziaie, QRM Merck & Co., Inc, PRST; Anne Greene is director PRST; and Marty Lipa, PhD, PRST; all at the Technological University Dublin.

®
Vol. 48, No. 3
March 2024
Pages: 30-33

When referring to this article, please cite it as Ziaie, A.; Green, A.; and Lipa, M. Shining a Light on the Long Shadow of Subjectivity in Quality Risk Management. 

Articles

This article explores the emergence of subjectivity in ICH Q9 (R1).

Shining a Light on the Long Shadow of Subjectivity in Quality Risk Management

Medical concept of compliance. Pharmacy law compliance.| Image credit: wladimir1804 - stock.adobe.com 

 This article was peer reviewed by a member of 

®’s Editorial Advisory Board and was previously published in the September 2023 issue.

The current International Council for Harmonisation (ICH) Q9(R1) Quality Risk Management (QRM) guideline is a targeted revision of the initial guidance issued in 2005, intended to address subjectivity, formality, risk-based decision-making, and other specific areas for improvement. While not a formally defined area for improvement, the revised guidance invokes many new references to “knowledge” and “knowledge management (KM)” in supporting improvement in QRM practice and, by extension, to the goals of an effective pharmaceutical quality system.

Knowledge as the Currency of Managing Risk: A Smart Investment for Patients

Regulating Innovation, Quality, and Risk eBook January 2024

Recognizing that QRM and risk-based decision-making (RBDM) both depend on knowledge to be effective, it could be suggested that knowledge is the currency of managing risk. This paper presents research and perspectives on the opportunity to better connect risk and knowledge through improved integration of QRM and KM, including presenting several potential benefits of such integration. A framework is proposed, the Risk-Knowledge Infinity Cycle (RKI Cycle), which could be used to improve the connectivity of risk and knowledge along with preliminary and practical recommendations to operationalize the RKI Cycle. In addition, the paper invokes concepts of systems thinking in connecting QRM and KM as well as the opportunity to consider the role of knowledge and KM more holistically across the pharmaceutical business through application of a process classification framework.

Pharmaceutical Technology/Pharmaceutical Technology Europe Regulating Innovation, Quality, and Risk

Martin J. Lipa*, PhD, martin.lipa@prst.ie, is senior research fellow, Pharmaceutical Regulatory Science Team. Anne Greene, PhD, is professor, Technological University Dublin, and director, Pharmaceutical Regulatory Science Team.


*To whom all correspondences should be addressed.

Recent research and perspectives shed light on an opportunity to better connect risk and knowledge through improved integration of systems.

Knowledge as the Currency of Managing Risk

The current International Council for Harmonisation (ICH) Q9(R1) 

 (QRM) guideline is a targeted revision of the initial guidance issued in 2005, intended to address subjectivity, formality, risk-based decision-making, and other specific areas for improvement. While not a formally defined area for improvement, the revised guidance invokes many new references to “knowledge” and “knowledge management (KM)” in supporting improvement in QRM practice and, by extension, to the goals of an effective pharmaceutical quality system. 

This article was peer reviewed by a member of 

Submitted: April 24, 2023
Accepted: June 14, 2023

Recognizing that QRM and risk-based decision-making (RBDM) both depend on knowledge to be effective, it could be suggested that knowledge is the currency of managing risk. This paper presents research and perspectives on the opportunity to better connect risk and knowledge through improved integration of QRM and KM, including presenting several potential benefits of such integration. A framework is proposed, the 

), which could be used to improve the connectivity of risk and knowledge along with preliminary and practical recommendations to operationalize the 

. In addition, the paper invokes concepts of systems thinking in connecting QRM and KM as well as the opportunity to consider the role of knowledge and KM more holistically across the pharmaceutical business through application of a process classification framework.

There has been a bolus of activity associated with ICH Q9(R1) (1) finalized in January 2023, as the long-awaited update to the 2005 guidance, ICH Q9 

 (2). This activity included scrutiny of the concept paper (3), comments on the draft revision, and revision of the guideline itself. In addition, there has been a focus on the development of supporting training material by the ICH Expert Working Group (EWG) and to interpreting what it all means to industry and to organizations on an individual level as the deployment and adoption process begins.

Concurrent to this activity surrounding ICH Q9(R1), the Pharmaceutical Regulatory Science Team (PRST) at Technological University Dublin have continued their ongoing research into related topics, including QRM, KM, and RBDM. In particular, the PRST are exploring the relationships and interconnectivity between these practices, applying through “systems thinking” mindset and aspects of complexity theory where appropriate, which provide a more holistic approach to analysis and how the parts of a system interact over time (4).

One of the key areas of focus for the PRST is regarding the practice of KM, including:

The role of KM as a pharmaceutical quality system (PQS) enabler as defined by ICH Q10, 

The relationship between QRM and KM as dual enablers of the PQS

The role of KM in informing risk-based decision making.

The purpose of this paper is to compile and synthesize this KM-related research describing how it supports the intent of the ICH Q9(R1) revision and, ultimately, the objectives of the PQS itself as outlined by ICH Q10 

 (5), which are to achieve product realization, establish and maintain a state of control, and facilitate continual improvement.

To start with, however, it is important to demystify the relationship between the terms “knowledge” and KM. Authoritative definitions are presented in the next section of this paper, and the authors have discussed these concepts in more detail in a 2022 paper (6). Consider the following pragmatic descriptions by the authors.

In a pharmaceutical context, “knowledge” is an asset that includes what is collectively known (e.g., scientific understanding and insight) about products, processes, and platforms (e.g., technology transfer documents, regulatory filings, process experience, etc.) inclusive of both documented (explicit) knowledge and know-how, experience, and other tacit knowledge. To further break it down:

“Explicit knowledge” is “knowledge” that can be expressed in words, numbers, and symbols and can be stored (e.g., in books, computers, etc.). Explicit knowledge can be articulated and easily communicated between individuals and organizations (7).

“Tacit knowledge” refers to “knowledge” that resides in the minds of individuals and is surfaced in response to a situation or action (8). Tacit knowledge is often referred to as “know-how.”

Whereas, KM is a set of practices and associated mindsets and behaviors that determine how knowledge is managed (e.g., captured and made available in the future) in an intentional, repeatable, and systematic manner.Common KM practices include content management processes, lessons learned, knowledge transfer activities, among others. KM as a discipline is most successful when certain enabling practices are in place, such as standard processes, dedicated roles (e.g., community stewards, lessons learned facilitators), communications, and training (9) as well as foundational practices of effective data management (e.g., data strategy, standards, and stewardship).

Essentially, if “knowledge” is considered a noun, then “KM” can be considered a verb. This is perhaps a seemingly obvious but important distinction—as in the authors’ experience—these terms of “knowledge” and “KM” are often used loosely, almost interchangeably. It is crucial that the reader is mindful of the difference and—as the authors will make the case—knowledge is the currency of managing risk, and the smart investment is to ensure that the best possible knowledge is available when and where it is needed—via KM—to inform QRM and risk-based decision making, and to support the PQS objectives.

The foundational role of knowledge and KM for risk management, risk-based decision-making, and pharmaceutical quality

When one looks holistically across the ICH quality guidelines (10), the expectations for managing knowledge are implied through the repeated references to the availability and application of knowledge in support of risk management, science and risk-based decision-making, product and process understanding, and, ultimately, ensuring availability of a safe and efficacious product to the patient. While these references are not each overtly stated as “knowledge” or “knowledge management,” they do repeatedly invoke the availability and application of “knowledge” under the guise of many synonyms, including prior knowledge, platform knowledge, scientific knowledge, science, evidence, product knowledge, process knowledge, experience, product development history, expertise, know-how, product understanding, process understanding, and lessons learned (6).

Knowledge and KM across ICH and other regulatory guidance.

 While ICH Q10 does not define the term “knowledge,” the 2018 International Organization for Standardization (ISO) standard on KM, 

ISO 30401:2018, Knowledge Management Systems—Requirements

 provides a helpful definition of knowledge as:

“Human or organizational asset enabling effective decisions and action in context” (11).

The ISO definition is further clarified as follows:

“Knowledge can be individual, collective, or organizational.

“There are diverse views on the scope covered within knowledge, based on context and purpose. The definition above is general as to the various perspectives. Examples of knowledge include insights and know-how.

“Knowledge is acquired through learning or experience” (11).

Regarding the term “knowledge management,” ICH Q10 introduced the concept of KM and provided a definition in 2008 as:

“Knowledge management is a systematic approach to acquiring, analysing, storing and disseminating information related to products, manufacturing processes and components”

It further stated that product and process knowledge should be managed throughout the product lifecycle and includes examples of sources of knowledge:

“Sources of knowledge include, but are not limited to, prior knowledge (public domain or internally documented); pharmaceutical development studies; technology transfer activities; process validation studies over the product lifecycle; manufacturing experience; innovation; continual improvement; and change management activities”

It is in ICH Q10 that QRM and KM were linked as the dual enablers for an effective PQS by “providing the means for science- and risk-based decisions related to product quality” (5). It is worth noting that while ICH Q10 provided a definition of KM, it does this without any references to KM in the literature, or by discussing KM guidance in other industries.

In addition to ICH Q10, there are many other direct and indirect references to knowledge and KM across ICH quality guidelines, including ICH Q8(R2), ICH Q8/Q9/Q10 Questions & Answers, ICH Q11, and ICH Q12, as well as in other regulatory guidance issued by the World Health Organization (WHO), EudraLex in the European Union, and Pharmaceutical Inspection Co-operation Scheme (PIC/S), which have previously been reviewed in detail by the authors in 2020 (12).Furthermore, since the 2020 review, references to the role of knowledge and KM are also included in ICH Q13, 

Continuous Processing of Drug Substances and Drug Products

 (14), and further in FDA’s pharmaceutical quality initiative, known as knowledge-aided assessment and structured applications (KASA) (15).

Considering regulatory guidance taken in aggregate, while it is ICH Q10 that defined KM in 2008, it is heartening to see the concepts of knowledge and KM emerging and repeatedly reinforced in the interceding 15 years. Indeed, a closer look at the recent ICH Q9(R1) extends this theme and provides an opportunity for risk and knowledge to be intentionally connected.

A closer look: the emergence of knowledge management in ICH Q9(R1).

 The concept paper for ICH Q9(R1) (3) identified four primary areas for improvement in the practice of QRM, for both pharma companies and regulatory authorities as follows:

High levels of subjectivity in risk assessments and in QRM outputs

Lack of understanding as to what constitutes formality in QRM

Lack of clarity and understanding on risk-based decision-making.

Furthermore, two additional points were raised in the concept paper to be addressed, namely:

Emphasis on “hazard identification” (rather than “risk identification”).

Collectively these six areas of focus are referred to as the “revision topics.”

While knowledge-related or KM-related areas for improvement were not identified in the concept paper directly (i.e., as one of the six revision topics), a closer look at the revised ICH Q9(R1) guideline reveals that the concepts of both “knowledge” and “knowledge management” have a significant presence. This is demonstrated by an evaluation carried out by the authors, presented in 

 as a summary of the frequency of the use of each team in the original ICH Q9 guideline, and in the revised ICH Q9(R1) guideline. 

 Frequency of “knowledge” and “knowledge management” in ICH Q9(R1).

While the term “knowledge management” is not as prevalent as “knowledge” there is a significant change in the recognition of the centrality and importance of knowledge to support QRM. This is welcomed by the authors, given the nature of ICH Q9(R1) as a “targeted revision” with “limited and specific adjustments” (1).

In fact, a review of the six revision topics could indeed suggest a dependency of each of these six revision topics on knowledge and/or knowledge management, as summarized in 

 Mapping “knowledge” and “knowledge management” (KM) references to ICH Q9(R1) revision topics. QRM is quality risk management. PQS is pharmaceutical quality system.

Knowledge as an invaluable commodity for risk management and decision making.

 A further literature review by the authors in 2020 (12,16) explored the relationship between knowledge and risk—and knowledge management and risk management—in pharmaceutical regulatory guidance and in other industries and organizations, including the National Aeronautics and Space Administration (NASA). A key assertion resulting from this review is that knowledge is both an input to and an output from QRM, thus highlighting the opportunity for QRM and KM to be thoughtfully and intentionally connected.

Arguably, the authors suggest that emergence of the importance of knowledge and KM in ICH Q9(R1) is a logical evolution of the recognition of the foundational role each play in informing risk and improving risk-based decision-making, as is evident through a holistic review of the document as shown in 

At the end of the day, the pharmaceutical industry is a knowledge industry (17) and, on a daily basis, formally and informally assesses risk and makes countless decisions—each of which should seek to ensure quality products and to protect the patient. Knowledge is an indispensable commodity necessary to make this happen effectively. With greater knowledge comes greater understanding. Greater understanding leads to reduced uncertainty. Reduced uncertainty in turn informs risk management activities and ultimately risk-based decision-making. Knowledge, indeed, is the currency for managing risk—and managing such knowledge is a smart investment for benefitting patients.

Exploring the practical connection between knowledge and risk

The authors, having recognized the disconnect between QRM and KM in practice, turned to systems-thinking principles to explore the connections between risk and knowledge, and between QRM and KM, starting with an assessment of practice at the time.

Current state connectivity of quality risk management and knowledge management. 

In 2021, the authors collected data through a survey (18), which reported that, while 96% of survey respondents believe QRM and KM are highly interdependent as concepts supporting the PQS (i.e., how connected should they be), no one believes they are fully integrated in practice today (0%), with 4% responding they are intentionally but not optimally connected, and 85% reporting they are only partially connected. These data are summarized in 

ALL FIGURES ARE COURTESY OF THE AUTHORS. 

 Exploring the integration of quality risk management (QRM) and knowledge management (KM).

Furthermore, when asked about the potential benefits of improved QRM–KM integration, a variety of important benefits associated with better connectivity between risk and knowledge were identified, including:

Better risk-based decisions where decisions are informed by risk and knowledge

More data/knowledge-driven risk assessments

Increased ability to leverage off of prior knowledge

Improved control strategies that better reflect risk and knowledge

Improved PQS effectiveness, better supporting decision making, validation, change management, outsourcing, etc.

Improved protection and value for patients through reduced risk of defects, drug shortages, etc.

Notably, these anticipated benefits reflect the role of knowledge as a commodity—or currency—in delivering improved risk assessments, control strategies, decision making, and quality outcomes.

 coupled with anticipated benefits identified by survey responses clearly suggest that QRM and KM were not well-connected, nor as connected as they should be, and that important benefits are possible if QRM and KM are better integrated in the future. The authors are hopeful that this connection between risk and knowledge will be more prevalent with the adoption of ICH Q9(R1) which clearly recognizes the role knowledge plays in quality risk management and risk-based decision-making.

A framework to connect risk and knowledge.

 As one potential means to address this need to connect risk and knowledge, a framework was developed by the authors in partnership with Kevin O’Donnell, PhD, market compliance manager, Health Products Regulatory Authority. This framework, the 

 (19), was proposed based on the previously referenced literature review of pharmaceutical regulatory guidance, input from industry and regulatory agency experts, practices in other industries (e.g., aerospace), and fundamental principles of knowledge management (e.g., enabling knowledge to “flow”). 

, highlighting the relationship between risk and knowledge, and underlying key concepts reinforced throughout regulatory guidance.

 as applied to ICH Q10, with proposed guiding principles to connect QRM and KM as a means to operationalize the integration of risk and knowledge.

 over the product lifecycle, illustrating that knowledge increases over time, providing the opportunity to apply this to increase understanding, decrease uncertainty, and, ultimately, reduce risk. 

. QRM is quality risk management. KM is knowledge management.

 and supporting concepts and principles, the following sections will explore its application and contribution to ICH Q9(R1).

 can be applied in different ways to help address the disconnect between risk and knowledge. In the simplest manner, the 

 can readily be applied as a conceptual model for organizations to reflect on whether risk and knowledge are intentionally connected via a connectivity between an organization’s QRM and KM practices. The six guiding principles (

) provide “target conditions” throughout the cycle, which can be qualitatively assessed for alignment of an organization’s practices.

 can also be applied as a detailed process model to operationalize the 

 via deeper assessment of QRM and KM practices and their interdependency, resulting in the identification of gaps and recommended deployment actions to better connect QRM and KM, and thus risk and knowledge. Efforts by the authors are ongoing to develop detailed 

 operationalization guidance. Several preliminary recommendations include the following:

Create a “knowledge map” for QRM (node 1 on 

 A knowledge map is a KM practice used to understand the knowledge necessary for a given activity, in this case, a quality risk assessment (or risk review). An illustrative case study of a knowledge map for the installation of an autoclave has been documented (20), for which the industry participants provided overwhelmingly positive feedback on the knowledge-mapping experience, with 97% of the attendees agreeing that the knowledge mapping exercise helps them think more expansively about knowledge needed for QRM (inclusive of know-how, expertise, and other tacit knowledge). The insights from knowledge maps can be used as requirements to inform KM practices (or improve current practices).

Recognize and manage the knowledge outputs from QRM (node 3 on 

 In addition to the routine outputs of a quality risk assessment (e.g., results of risk ranking) is sufficient tacit knowledge captured to improve future risk assessment and review activities, such as decisions and supporting rationale, alternatives considered, what was known at the time? Other knowledge outputs might include important experiential knowledge surfaced by subject-matter experts that should be codified for broader dissemination, gaps in control strategies, knowledge to inform supply chain, and other types of risks, gaps in knowledge where specific knowledge must be acquired, etc. Organizations can take steps to define expectations for where and how this knowledge is managed, ideally for use in the future (e.g., risk review) or across similar risk assessments.

Inventory existing KM practices (nodes 4, 5, and 6 on 

 Regardless of whether an organization has a formal KM program, understand what KM or “KM-like” practices exist in the categories of content management, search, expertise location, communities of practice, after action review/lessons learned, tacit knowledge transfer, and critical knowledge retention. These KM practices should be catalogued and made visible broadly across the organization. A more comprehensive (and complex) opportunity would be to perform a KM capability assessment (21) to understand an organization’s relative KM maturity and potential actions to improve.

Conduct KM awareness training for QRM practitioners (nodes 1, 2, and 3 on 

 Build KM competency for QRM practitioners via basic training that includes introductory KM concepts (e.g., definitions, principles), mindsets and behaviors, and awareness of existing KM practices at an organization. In the opinion of the authors, the more awareness QRM practitioners have about KM and the opportunity for KM to support QRM, the greater the opportunity to recognize challenges and opportunities, and create a “pull” from QRM to improve KM—and from KM to improve QRM.

Develop and deploy simple KM practices (nodes 4, 5, and 6 on 

 These practices should be based on known challenges and/or insights from QRM knowledge mapping (i.e., the first recommendation on this list). Such practices could be simple steps to provide guidance on where content should be stored (and not stored) and create lists of subject matter experts and decisions or could be more involved, such as creating communities of practice or deploying search tools.

The role of knowledge in enhancing realization of ICH Q9(R1).

 Considering the six revision topics of ICH Q9(R1) and how each invokes a dependency on knowledge availability and application (

), ICH Q9(R1) further reinforces this relationship between knowledge and risk. It is perhaps obvious to say each of the six topics—subjectivity, product availability risks, formality, risk-based decision-making, risk review, and hazard identification—would each benefit by having the “maximum and collective knowledge of the organization available on demand,” as is the intent of the 

The authors anticipate further evolution of KM practices (and, therefore, improved knowledge access and availability) can benefit several of these targeted revision topics.For example:

 Consider the use of a “hazard library” (or “risk bank”) to identify common hazards for a given risk scenario. Such lists could reduce subjectivity by minimizing variability across different teams of experts in identifying common hazards. Furthermore, other KM processes such as lessons learned could funnel new hazards into such standardized lists.

 In addition to such a “hazard library,” processes such as directed recognition (22), aim to reduce “unknown-unknowns.” Many of the processes, such as those described in the referenced article, focused on reducing unwelcome surprises (e.g., checklists and interviews) and are, in fact, KM-like processes to surface, connect, and transfer tacit knowledge.

 Research into risk-based decision-making in the pharmaceutical industry has identified 21 characteristics of risk-based decision-making in high-reliability organizations (e.g., aerospace, nuclear) (23). Many of these characteristics—eight in total—have a dependency on KM practices, including concepts of data and knowledge sources, data and knowledge availability, and taxonomy.

 In addition to the recommendations above involving knowledge capture from QRA to inform future risk review, consider the use of “risk registers” as a KM tool to monitor and track actions identified during risk assessments.