WHO drafts updated guideline on quality risk management
The World Health Organization (WHO) has issued an updated draft guideline to assist manufacturers establish an effective quality risk management (QRM) system and to help regulators in planning their inspections. The guidance incorporates concepts from the International Council for Harmonization’s (ICH) Q9 (R1) guideline on quality risk management (QRM).
The new guidance, issued in September, replaces an earlier Annex 2 WHO guideline on quality risk management issued in January 2013. A June 2026 report from the WHO Expert Committee on Specifications for Pharmaceutical Preparations (ECSPP) noted that experts identified “gaps in decision-making, subjectivity and harm assessment” in the 2013 guidance. They recommended revising the guideline to align with the International Council of Harmonization’s (ICH) Q9(R1) guidance and the International Organization for Standardization’s (ISO) ISO 31000 standards.
“In most countries compliance with good manufacturing practices (GMP), medicines regulatory activities and inspections, together with supply chain controls throughout the product life-cycle, provide good assurance that risks are largely controlled. However, where control is less effective, patients may be put at risk through the production of medicines of inadequate quality. Quality risk management (QRM) is a process that is relevant to all countries and should provide a rationale to understand risk and mitigate it through appropriate and robust controls,” the draft guideline states.
The guideline defines QRM as “the overall and continuing process of appropriately managing risks to product quality throughout the product's life-cycle in order to optimize its benefit–risk balance. It is a systematic process for the assessment, control, communication and review of risks to the quality of the pharmaceutical product. It can be applied both proactively and retrospectively.”
For manufacturers, it emphasizes that evaluating quality risk through science-based decisions is ultimately connected to protecting patients by ensuring the product's quality, safety, and efficacy. A corporate culture should promote the production of cost-effective medicines without compromising quality, while keeping the patient as the primary stakeholder in all activities.
The guidance outlines how to initiate a QRM process, identifies the personnel needed for QRM, and details how to conduct risk assessment activities.
It states that potential risks should be considered across a range of factors relevant to a product, including materials, physical characteristics and composition, processing steps, microbial limits, premises, equipment, packaging, sanitation and hygiene, environment, personnel, utilities, and supply chain.
For regulatory authorities, QRM can help determine the best allocation of inspection resources. This includes identifying the types of products to inspect and specific areas to focus on during each inspection. By using QRM, authorities can efficiently and effectively scrutinize the most significant health risks. Manufacturers with a history of poor GMP compliance may be subject to more frequent and thorough on-site inspections compared to those with a better compliance record.
The guideline focuses on how to apply these QRM principles to inspection strategies. It emphasizes that various factors should be considered in the risk assessment process, and that these factors may differ depending on the specific types of Good Practice (GXP) inspections being conducted.
These risk factors depend on the type of inspection, the outcome of an inspection conducted by another regulatory authority, the outcome of a previous inspection, the complexity of the manufacturing process or the products, including whether the product is sterile or non-sterile, and complaints and recalls.
The draft states that “during inspections, inspectors should assess whether a manufacturer has appropriate skills and scientific knowledge, as well as product and process knowledge, for the QRM procedure being inspected. This requirement is also relevant where a company has made use of contracted parties.”
The guidance notes that a variety of tools can be used for QRM, either alone or in combination. These QRM tools include failure modes effects analysis (FMEA), hazard operability analysis (HAZOP) and hazard analysis and critical control point (HACCP).
WHO is accepting comments on the document through an online platform. The deadline for submitting feedback is 15 November.
WHO plans to have a revised working document incorporating feedback ready for its Expert Committee on Specifications for Pharmaceutical Preparations (ESCPP) in June or July.
