Why Quality Risk Management Must Be Embedded in SOP Decision-Making

Introduction to the Audit Finding

1. Issue Summary

Quality Risk Management (QRM) principles are not consistently applied during SOP development, revision, or implementation. This audit finding reveals the disconnect between risk-based thinking and procedural design.

2. What Happens When QRM is Absent

• Critical SOPs may overlook high-risk failure modes
• Decisions on scope, frequency, or controls may not be proportional to the actual risk
• Resources may be misallocated to low-risk areas, leaving high-risk zones vulnerable

3. Operational Impact

Without QRM input, procedures are often generic, misaligned with product or process-specific risk profiles, and may result in over-control or under-protection.

4. Consequences in Inspections

This disconnect is frequently cited by GMP auditors as evidence of a weak quality system and lack of science-based decision-making.

Regulatory Expectations and Inspection Observations

1. ICH Q9 and Q10 Guidelines

Emphasize the integration of QRM into all aspects of pharmaceutical quality systems, including SOP development and revision control processes.

2. USFDA Observations

“The firm lacks documentation of risk evaluation steps while drafting SOPs affecting sterile operations.”

3. EMA and WHO Position

• EMA: Encourages QRM in SOPs under GMP Annex 15 and Chapter 1
• WHO: Points to the absence of structured risk assessment as a common source of procedural non-compliance

4. Example Audit Failure

Cleaning validation SOPs lacked a risk-based rationale for selection of product-matrix combinations — flagged during stability testing inspection.

Root Causes of QRM-SOP Disconnection

1. Legacy SOP Practices

Many SOPs were written before QRM became a regulatory expectation and have not been updated with risk-based justifications.

2. Isolated QRM Programs

Risk assessments are conducted but not linked or referenced in SOP lifecycle documentation.

3. Lack of SOP-QRM Workflow Integration

SOP authors are not trained or required to consult QRM tools such as FMEA, HACCP, or Fault Tree Analysis.

4. Absence of Policy Requirement

There is no corporate-level mandate requiring QRM documentation as a prerequisite for SOP approval.

Prevention of Risk Management Oversights in SOPs

1. Mandatory Risk Assessment Before SOP Drafting

Ensure that each SOP begins with a formal QRM evaluation, outlining the potential risks the procedure addresses.

2. Embed QRM Tools in SOP Templates

Include risk-ranking matrices, decision trees, and failure mode tables in the standard SOP format.

3. Cross-functional QRM-SOP Teams

Form teams with members from QA, risk management, and the concerned functional area to collaboratively develop SOPs.

4. Annual Risk Review of SOPs

Conduct periodic risk-based reviews to update SOPs in line with emerging process risks or deviations.

5. Use of Technology

Link QRM platforms with electronic document management systems (EDMS) to enforce traceability and integration.

Corrective and Preventive Actions (CAPA)

1. CAPA for Existing SOPs

• Review all critical SOPs to check if risk assessments were performed
• Where absent, initiate retrospective QRM evaluations
• Document results and revise SOPs accordingly

2. QRM-SOP Policy Update

Revise the master SOP on SOP writing (e.g., SOP-001) to include QRM as a required step in creation, revision, and approval phases.

3. SOP-QRM Link Validation

Implement audits to verify that QRM reports are referenced in applicable SOPs and reflect risk-based decisions.

4. Training and Accountability

Train all SOP authors and reviewers in basic QRM principles and their application to documentation.

5. Benchmark Against Best Practices

Align internal QRM-SOP integration with global standards from agencies such as the Health Canada and USFDA.