Sep 21, 2026

What Is Quality Risk Management (QRM)? Process + Template

Quality risk management is a systematic process for assessing, controlling, communicating, and reviewing risks to product quality across a product's lifecycle. It uses scientific evidence to decide what could go wrong, how likely it is, and what to do about it.

It started in pharmaceutical manufacturing. It now shows up in medical devices, biotechnology, food production, and most regulated manufacturing.

This guide covers the QRM full form, the five-step process, which risk tool suits which situation, what the current ICH Q9 guideline expects, and what a QRM record needs to survive an audit.

QRM Full Form and What It Actually Means

QRM stands for quality risk management.

That definition is easy. Applying it is where teams struggle, and usually for one of two reasons.

Why the Word "Quality" Narrows Everything

The risk being managed is risk to product quality. Through that, risk to the patient or the consumer.

Financial risk sits outside this. So does project risk and reputational risk, unless they affect the product.

This matters more than it sounds. A lot of registers labelled "quality risk" are actually mixed business risk registers. An auditor will notice.

The Proportionality Rule Most Teams Ignore

The effort, formality, and documentation you apply should match the significance of the risk.

A low-consequence risk does not deserve the same machinery as one that could reach a patient.

In practice, almost everyone runs every assessment at maximum formality. Full cross-functional team, full template, full sign-off, for a risk that a two-line note would have covered.

That is not rigour. It is a way of burying the assessments that actually matter under the ones that do not.

Where the QRM Framework Came From

Risk assessment in manufacturing is old. A shared framework for it is not.

The International Council for Harmonisation published Q9, Quality Risk Management, and it gave the pharmaceutical sector a common vocabulary, a defined process, and an annex of accepted tools. Regulators across the major markets adopted it. It was written into the European GMP guidelines.

Q9 has since been revised. The current version is Q9(R1), issued in 2023. It kept the framework intact and addressed four places where implementation had drifted. More on those below.

If you work outside pharmaceuticals, Q9 is still the most complete published description of how quality risk management is meant to work. That is why it gets cited well beyond the industry that produced it.

The Quality Risk Management Process

Three phases. Risk assessment, risk control, risk review.

The Quality Risk Management Process

Communication is not a fourth phase. It runs across all of them, which is a distinction people get wrong often enough that it is worth stating plainly.

Here is the full sequence.

Step 1. Risk Identification

Identification asks what could go wrong.

Your inputs are the process itself, product design, historical data, deviation and complaint records, and the people who run the process every day. That last one gets skipped and it is usually the best source you have.

Sources of risk include equipment failure modes, design gaps, material variability, human error, environmental conditions, and supply interruption.

The output is a list of hazards described specifically enough that somebody else could evaluate them.

"Contamination" is not an identified risk. "Cross-contamination from shared equipment during changeover between product A and product B" is.

The difference is whether the next person can act on it without asking you what you meant.

Step 2. Risk Analysis

Analysis estimates the risk attached to each hazard.

Three dimensions usually get assessed. Severity of harm if it happens. Probability of it happening. Detectability before it reaches the patient or consumer.

Detectability earns its place. An undetected failure carries far more risk than the same failure caught two steps downstream.

Qualitative or quantitative both work. The framework accepts either.

What matters is that you record why each rating was given. A reviewer should be able to follow how you arrived at a number.

Step 3. Risk Evaluation

Evaluation compares the analysed risk against defined criteria and decides whether it is acceptable.

One condition makes this step work: the criteria have to exist before the assessment starts.

Set the threshold after seeing the scores and the outcome quietly shapes the threshold. It happens more than anyone admits.

A risk assessment matrix is the usual instrument here. It maps severity against probability to give a consistent decision boundary.

The output is binary. Accept, or control.

Step 4. Risk Control

Control has two legitimate responses. Teams remember the first and forget the second.

Risk Reduction

Act to lower severity, probability, or both. Or improve detectability.

Design changes, added process controls, revised procedures, training, equipment modification. All of it sits here.

These actions often overlap with corrective and preventive action work already running in your quality system. Worth checking before you create a parallel workflow.

One thing to watch. Risk reduction can introduce new risks.

A control added in one place can create a failure mode somewhere else. This is why the process loops back rather than closing here.

Risk Acceptance

Decide that a residual risk does not warrant further action.

This is valid. It is not a failure to act, and it is not a shortcut.

It needs documented justification against the acceptance criteria you set earlier, plus approval from someone with the authority to give it.

Teams that never accept a risk usually are not being more careful. They are just not writing down the decision they already made.

Step 5. Risk Review

Review is the step that quietly goes undone.

QRM is not a one-time exercise. Assessments need revisiting when the process changes, when new data arrives from deviations or complaints, when regulatory expectations shift, or on a set periodic cycle.

Review is also where you check whether the controls you implemented actually worked.

An assessment that was never revisited after its controls went in has not been completed. It has been filed.

Risk Communication Runs Across All Five

Communication happens between the assessment team, decision makers, and where required, regulatory authorities.

There is a simple test for whether it is working. Do the people who operate the process know which risks were identified, and which controls exist because of them?

If the assessment lives only in the quality department, it has not changed anything on the floor.

Quality Risk Management Tools and When to Use Each

The framework does not mandate one method. It offers a set of recognised tools, each suited to a different situation.

Picking the wrong one is a common reason assessments produce very little.

Tool	Best used for	Direction
FMEA	Breaking a process into steps and evaluating failure modes at each	Bottom up, cause to effect
FMECA	FMEA plus criticality analysis, where severity drives prioritisation	Bottom up
FTA	Working backwards from a known failure to find contributing causes	Top down, effect to cause
HACCP	Identifying and controlling critical points in a production process	Process flow based
HAZOP	Deviation analysis using guide words, common in process plant	Deviation based
PHA	Early screening when detail is thin and possibilities need ranking	Preliminary
Risk ranking and filtering	Comparing and prioritising a large portfolio of dissimilar risks	Comparative

How to Pick the Right One

It comes down to what you already know.

A failure has already happened and you need the cause? FTA.

The process is well understood and you want systematic examination? FMEA.

Early design work, detail still thin? PHA.

Many risks competing for the same limited resource? Risk ranking and filtering.

Two of these travel well outside pharmaceuticals. HAZOP is standard in process and chemical operations. HACCP underpins food safety systems, where identifying a critical control point is a regulatory requirement rather than a preference.

What ICH Q9(R1) Changed

The revision left the process alone. It went after four implementation problems instead.

Subjectivity

Assessments were producing different answers depending on who ran them.

The revision does something useful here. It accepts that subjectivity cannot be removed, then asks you to manage it deliberately - diverse assessment teams, clearly defined scoring scales, awareness of where bias creeps in.

Formality

Proportionality was written everywhere and applied almost nowhere.

The revision reframes formality as a spectrum rather than a switch. You choose the level based on uncertainty, complexity, and importance.

Risk-Based Decision Making

The revision separates the decision from the assessment supporting it.

Methods, roles, and authority need to be defined rather than assumed. Who actually signs off, and on what basis.

Product Availability

Quality risk had been treated as separate from supply continuity.

The revision brings them together. A manufacturing or supply chain failure that interrupts availability is itself a risk to patients.

For most organisations the practical change is not a new procedure. It is being able to show why an assessment ran at the formality level it did, and who held authority for what followed.

What a QRM Record Must Contain

An assessment you cannot reconstruct later has limited value, whatever it concluded at the time.

What a QRM Record Must Contain

A complete record holds:

The scope and the question the assessment set out to answer
The team involved, with their functions
The tool selected, and why it suited this assessment
Each hazard, described specifically
Severity, probability, and detectability ratings with the reasoning behind each
Acceptance criteria, defined before evaluation
The evaluation outcome for each risk
Control actions, with owners and target dates
Residual risk after controls, plus justification for anything accepted
Approval, with the authority of the approver
The review date and what triggers an early review

Item 5 is the one most often missing.

A score of 4 with no rationale cannot be defended in an audit. It also cannot be meaningfully reassessed two years later by a team that was not in the room.

Documented information requirements apply here as they do everywhere else - version control, retention, access.

Four Mistakes That Show Up in Audits

Some patterns repeat often enough to be worth naming.

The register nobody reads. Assessments completed, filed, never revisited. Usually visible from the review dates, which are all blank or all in the past.

Scores without reasoning. Numbers in every cell, justification in none. This one is easy to fix and rarely gets fixed.

Everything at maximum formality. A sign proportionality was never really applied. It also makes it impossible to tell which assessments the organisation thought were serious.

Risk acceptance treated as failure. Teams that reduce every risk regardless of cost, because accepting one feels like admitting something. The result is effort spread thin across risks that did not need it.

How QRM Connects to the Rest of Your Quality System

Quality risk management is not a standalone activity. Treating it as one is exactly why assessments end up in a folder nobody opens.

It feeds internal audit planning, because audit effort should concentrate where risk is highest.

It feeds change control, because proposed changes need assessment before approval.

It draws from non-conformance and complaint data. That is the best evidence you have about what actually fails, as opposed to what you expected to fail.

It feeds management review, where residual risk should be visible to leadership rather than buried a level down.

Working to ISO 9001 instead? The same logic appears as risk-based thinking, which asks you to determine and address risks and opportunities across the management system. Different vocabulary, different regulatory weight, same discipline. Our walkthrough of the risk and opportunity identification process covers that side.

Running Quality Risk Management in Effivity

The framework is rarely the hard part.

The hard part is keeping hundreds of assessments current, connected, and retrievable across multiple sites, years after the people who wrote them moved on.

Effivity's risk and opportunity module holds each assessment as a live record rather than a document. Risks are captured with source, description, probability, and impact, scored against criteria you configure, then carried through to control actions with owners and due dates.

Because it sits inside the wider quality management system software, assessments connect to the records that should inform them. Non-conformances, corrective actions, audit findings, and change requests link back to the risks they relate to. Review then has real data behind it instead of recollection.

Version history with date and time stamps, role-based access, e-signatures, and automated review reminders mean an assessment from several years back comes out with its decision trail intact.

The platform arrives pre-configured. That matters in regulated pharmaceutical, healthcare, and manufacturing operations, where implementation time is itself a risk.

Frequently Asked Questions

What is the full form of QRM?

QRM stands for quality risk management. It is the systematic assessment, control, communication, and review of risks to product quality across the product lifecycle.

What are the five steps of the quality risk management process?

Risk identification, risk analysis, risk evaluation, risk control, and risk review. Risk communication runs across all five rather than sitting as a separate step. The first three together make up risk assessment.

What is ICH Q9?

ICH Q9 is the International Council for Harmonisation guideline on quality risk management. It defines the QRM process and lists the accepted risk assessment tools. The current version is Q9(R1).

What changed in ICH Q9(R1)?

Four things. Managing subjectivity in risk assessment. Applying proportionate formality instead of defaulting to maximum. Defining risk-based decision making explicitly. Bringing product availability risk into scope. The core process was left unchanged.

Which QRM tool should I use?

It depends on what you know. FMEA for detailed examination of a well understood process. FTA for working backwards from a failure that has occurred. HACCP for control points in production flow. HAZOP for deviation analysis in process operations. PHA for early screening. Risk ranking and filtering for prioritising many dissimilar risks.

Is quality risk management only for pharmaceuticals?

No. The framework started in pharmaceuticals and carries regulatory weight there. The same process runs in medical devices, biotechnology, food production, and regulated manufacturing. ISO 9001 organisations apply comparable logic through risk-based thinking.

Can a risk be accepted rather than reduced?

Yes. Acceptance is valid where further reduction would cost more effort than the benefit justifies. It needs documented justification against acceptance criteria defined before the assessment, and approval at an appropriate level.

How often should a quality risk assessment be reviewed?

On a defined periodic cycle, plus whenever the process changes, new data emerges from deviations or complaints, or regulatory expectations shift. Review should also confirm that the controls you implemented worked as intended.

Shanker

Co-Founder & CEO at Effivity Technologies Pvt. Ltd.

Shanker brings over 20+ years of tech experience, including senior roles at Intel. At Effivity, he built the IT team from Scratch, managed budgets, and improved the product based on customer feedback. Shanker's leadership keeps Effivity at the forefront of the tech industry.

View All Posts

Improve Workflow & Profitability with Superior Integrated Management System Software free-demo

Schedule a Free Demo