A risk score should not close a quality risk assessment

A quality-risk score is an input to a decision, not the decision itself. Under FDA's final ICH Q9(R1) guidance, a defensible record connects the risk question to scientific evidence, makes uncertainty visible, explains the control choice, states the residual-risk decision and identifies when the conclusion must be reviewed. A multiplication result cannot do those jobs on its own. S1 S2

This article is for U.S. pharmaceutical quality, manufacturing and engineering teams that use scoring tools such as failure mode and effects analysis. It provides a completed fictional decision record and sensitivity test. It is an implementation aid, not an FDA form, a batch-disposition decision, a universal scoring threshold or legal advice.

• Start with the risk question and the possible harm, not a preferred numerical answer.
• Record the strength of evidence and the uncertainty behind severity, occurrence and detectability ratings.
• Separate the score from the control, residual-risk and acceptance decisions.
• Use sensitivity checks to find ratings that can change the conclusion.
• Set a review trigger tied to new knowledge, investigation results or process change.

FDA issued Q9(R1) as final guidance in May 2023. The document contains nonbinding recommendations. Its two primary principles are that quality-risk evaluation should be based on scientific knowledge and ultimately link to patient protection, and that the level of effort, formality and documentation should be commensurate with the level of risk. The guidance applies across the lifecycle of drug substances, drug products and biological and biotechnological products, including development, manufacturing, distribution and inspection or submission activities. S1 S2

The guidance frames risk assessment around three questions: what might go wrong, how likely it is to go wrong, and what the consequences are. It also says the robustness of the data matters, uncertainty should be made visible, and evidence or scientific knowledge should support estimated risks. Scores and qualitative descriptors may help express a risk, but the process still needs risk control, communication and review. S2

Q9(R1) also asks organisations to manage subjectivity. Poorly designed scales, different assumptions and uneven data can change the output without changing the underlying process. Formality should rise when uncertainty, importance or complexity rises; a resource constraint is not a reason to apply less formality to a higher-risk decision. S2

A product of three ordinal ratings can be useful for relative prioritisation inside a defined method. It is not a probability, a clinical-risk calculation or an automatic acceptance rule. Two different failure modes can produce the same product, and one weak rating can move the result sharply. If the record only preserves the total, a later reviewer cannot reconstruct the evidence, assumptions or decision.

A compact record can sit beside an approved tool such as FMEA. It does not replace the organisation's procedure. The useful distinction is between describing the risk, estimating it, deciding how to control it and documenting the residual decision.

Scenario. A U.S. oral-solid-dose packaging line is undergoing a planned software change. During the approved challenge, the vision system intermittently fails to read one variable-data position. The affected lot is placed on hold. The team must decide what evidence and controls are needed before any separate lot-disposition decision. No actual company, product or release decision is represented.

First, recompute the fictional estimate: 5 x 2 x 2 = 20. If the unverified detection control is rated 4 rather than 2, the product becomes 5 x 2 x 4 = 40. That doubling does not prove the risk itself doubled; it shows that the decision is highly sensitive to one weakly supported rating. The corrective response is to resolve the evidence gap, not to negotiate the rating.

The collision at 20 is the practical warning. Multiplication loses meaning when the underlying profiles differ. Teams should retain the separate ratings and rationale, and they should not use a universal threshold that the approved method, product context and evidence do not support.

• Ask whether the risk question hides more than one failure mode or product population.
• Trace every rating to a source and period; mark estimates and assumptions as such.
• Change one uncertain rating at a time and record whether the control decision changes.
• Test whether the proposed control can fail in the same way as the original control.
• Separate risk acceptance from product disposition and from approval of the change.
• Name the person or role authorised to accept residual risk under the quality system.

This method does not prescribe which risk tool to use. It does not convert ordinal categories into objective probabilities, set an FDA acceptance threshold, replace validation or investigation requirements, or decide whether a lot may be released. The appropriate formality depends on the uncertainty, importance and complexity of the actual decision. Product commitments, approved procedures and applicable law and regulation may require additional controls.

A sensitivity check also has limits. Changing one rating can expose fragility, but it cannot repair poor population boundaries, biased evidence or an omitted harm pathway. Where the potential consequence is serious or evidence is weak, obtain the necessary technical, medical, regulatory or quality expertise rather than treating the score as a substitute.

After a control is implemented, use the corrective-action effectiveness evidence guide to plan evidence that can show whether the control works. If detection depends on a measurement or inspection device, use the calibration-certificate review guide to test whether the measurement evidence supports its intended use.

The FDA guidance page and final guidance PDF were retrieved on 13 October 2026. Recheck them and the organisation's approved procedure before relying on this method for a live decision. Readers can report a correction through the QSE Advisory corrections page or contact office@qseadvisory.com.

AI assistance was used for research organisation, drafting, calculation checking and conceptual cover generation. Reviewer and Assessor: Laraib Naveed Ahmad.

This article is general information. Verify current requirements and seek qualified advice for your specific circumstances.

Spotted an issue? Contact our editorial desk.