WHO Draft Guidelines on Quality Risk Management: A Lifecycle Approach to Pharmaceutical Quality and Patient Safety
The World Health Organization (WHO) has issued a draft working document, QAS/26.994, titled WHO Guidelines on Quality Risk Management, dated September 2026. The draft provides recommendations for implementing quality risk management (QRM) throughout the pharmaceutical product lifecycle, covering development, manufacturing, quality control, distribution, and regulatory oversight.
The proposed guidance focuses on science-based decision-making, risk assessment and control, documentation, and continuous improvement. It also addresses the application of QRM by pharmaceutical manufacturers and medicines regulatory authorities, including risk-based inspections and dossier assessments.
The document is open for public consultation, with comments requested by 15 November 2026. It remains a draft and may be revised before publication.
The draft aims to support the development and implementation of effective QRM systems across pharmaceutical, biological, and biotechnological products. It covers activities including research and development, material sourcing, manufacturing, packaging, testing, storage, distribution, regulatory assessment, inspection, and market surveillance.
Principles of Quality Risk Management
The draft identifies two primary principles of QRM:
Risk evaluation should be based on scientific knowledge and ultimately linked to patient protection.
The effort, formality, and documentation applied to QRM should be proportionate to the level of risk.
QRM activities should also be dynamic, iterative, responsive to change, and designed to support continual improvement. The level of formality may vary according to the importance of the decision, the uncertainty involved, and the complexity of the risk.
QRM should not be used to justify practices that would otherwise be unacceptable under applicable regulations or guidance.
Quality Risk Management Process
The draft describes a systematic process for identifying, evaluating, controlling, communicating, and reviewing risks to pharmaceutical product quality. It can be applied proactively before an issue occurs or retrospectively when an event or deviation has already taken place.
The process begins by defining the problem or risk question, collecting relevant background information, identifying the responsible team, and establishing timelines and deliverables.
A multidisciplinary team with appropriate product and process knowledge should conduct the assessment. The team should identify potential hazards, evaluate their likelihood and consequences, consider how readily they can be detected, and determine appropriate risk controls.
Risk management should continue throughout the product lifecycle as new information becomes available.
Risk Assessment and Risk Control
Risk assessment should consider product quality, safety, and efficacy. Relevant factors include starting materials, processing steps, equipment, facilities, personnel, sanitation, packaging, storage, and supply chains.
Potential risks should be evaluated using appropriate qualitative or quantitative methods. The rationale for risk ratings and decisions should be supported by available evidence, with assumptions and uncertainties appropriately considered.
Risk control aims to eliminate risks where possible or reduce them to an acceptable level. Possible measures include removing the source of risk, changing the likelihood or consequences of an event, or deciding not to proceed with a risky activity.
Risk assessments and control measures should be documented. Corrective actions should be defined for deviations, particularly those involving higher risks, with responsibilities clearly assigned.
Risk Review, Verification and Documentation
QRM should include periodic review to determine whether new information affects previous decisions. Changes in equipment, processes, suppliers, contractors, or organisational structures may require reassessment.
Verification activities may include reviewing QRM records, examining deviations and product dispositions, conducting audits, and confirming that identified risks remain controlled.
The draft also emphasises risk communication and documentation. Risk assessment reports should explain the rationale for decisions, identify mitigation measures, and communicate relevant information to stakeholders. Documentation requirements should be proportionate to the level of risk.
Managing Subjectivity and Supporting Risk-Based Decisions
The draft highlights that personal opinions, cognitive biases, inconsistent interpretations, and poorly designed scoring systems can influence QRM outcomes.
To reduce subjectivity, organisations should strengthen knowledge management, use historical and process data, develop data analytics capabilities, promote knowledge sharing, and establish structured decision-making criteria.
The draft also identifies opportunities to use statistical process control and machine learning to identify manufacturing trends and predict potential quality issues based on historical patterns.
Risk-based decisions should be supported by the best available knowledge, documented assumptions, agreed criteria, and an appropriate level of scientific and technical rigour. New knowledge generated during QRM should be captured and used in future assessments and decisions.
Application During Pharmaceutical Product Development
QRM should evolve as product and process knowledge increases. Early development activities may focus on identifying knowledge gaps and assessing formulation and process risks.
As development progresses, assessments should consider active pharmaceutical ingredients, excipients, product stability, bioavailability, manufacturing processes, and patient safety. Risk assessments can help identify critical quality attributes (CQAs), critical process parameters (CPPs), and the control strategy.
The draft also addresses QRM during validation and qualification. Risk-based approaches may help determine the scope of validation and qualification activities, as well as maintenance, monitoring, calibration, and requalification schedules.
Application During Commercial Manufacturing
During commercial manufacturing, QRM can support the management of product quality risks, patient safety concerns, supply interruptions, GMP compliance, and risks associated with multiple products or manufacturing sites.
The draft describes applications across manufacturing operations, laboratory controls, stability studies, packaging, labelling, storage, transport, and distribution.
QRM can also support deviation and investigation management, change control, supplier assessment, technology transfer, and the management of facilities, equipment, utilities, and computerised systems.
However, QRM does not remove the manufacturer's obligation to comply with regulatory requirements, approved filings, and inspection commitments.
Quality Risk Management by Medicines Regulatory Authorities
The draft recommends that medicines regulatory authorities also apply QRM to regulatory reviews and inspection programmes.
Risk-based inspection planning can help authorities determine inspection frequency, scope, resource allocation, and the level of scrutiny according to product and patient risks.
Inspectors may examine how manufacturers apply QRM within their quality systems, including the management of complaints, recalls, deviations, and product quality reviews.
The draft also addresses the use of QRM during dossier assessment, supporting a more structured approach to identifying and evaluating risks during regulatory review.
Risk Management Tools
The draft includes a dedicated section on risk management tools and supporting statistical methods. It identifies tools that can help organisations structure risk assessments and support decisions, depending on the nature of the problem and the available information.
Examples discussed in the document include failure mode and effects analysis, Preliminary Hazard Analysis (PHA), decision trees, cause-and-effect diagrams, fault-tree analysis, and statistical tools.
The selection of a tool should be appropriate to its intended use, the complexity of the risk, and the available evidence.
As this document is still under consultation, its recommendations should be understood as draft guidance rather than final WHO requirements.
Comments