Q&A:

Risk Management for Pharmaceutical

Companies Under FDA’s Q9 Guidance
Questions and Answers:
The following questions and answers were prepared by MasterControl Inc., the leading provider of software
solutions for FDA-regulated industries.

Q: What is Q9?

A: It refers to a document titled “Guidance for Industry: Q9 Quality Risk Management,” issued by the
FDA in June 2006.

Q: What is it about?

A: The guidance, which is for industry and regulators alike, offers a systematic approach to quality
risk management. It outlines principles and examples of tools for quality risk management that can be
applied to all aspects of pharmaceutical quality. These aspects include development, manufacturing,
distribution, inspection, and submission/review processes throughout the lifecycle of drug substances,
drug products, biological, and biotechnological products. The guidance aims to help industry and
regulators make more effective and consistent risk-based decisions.

Q: What makes Q9 different?

A: Unlike other FDA guidances, Q9 was prepared under the auspices of the International Conference on
Harmonisation of Technical Requirements for Registration of Pharmaceuticals for Human Use (ICH).
This group provides a forum for harmonization initiatives based on input from regulatory, industry,
and consumer representatives. Its goal is to achieve harmonization of technical requirements for the
registration of pharmaceutical products in the United States, the European Union, and Japan.

Q: What is risk management?

A: Risk is defined in this guidance as the combination of the probability of occurrence of harm and
the severity of that harm. Pharmaceutical manufacturing entails a degree of risk. Q9 focuses on the
importance of managing product quality risks. The guidance says: “It is important to understand that
product quality should be maintained throughout the product lifecycle such that the attributes that are
important to the quality of the drug product remain consistent with those used in the clinical studies.”

Under Q9, quality risk management is a systematic process for the assessment, control, communication,
and review of risks to the quality of the drug product across the product lifecycle.

Q: How can Q9 be implemented?

A: Both industry and regulatory personnel (reviewers and inspectors) can implement Q9 by assessing
and managing risk using recognized risk management tools and/or internal procedures. The guidance
suggests some risk management tools.

Q9 Guidance Page  Q&A

Q: How can MasterControl help pharmaceutical companies implement risk management principles
under Q9?

A: The main body of the Q9 guidance explains what risk management is and the advantages of applying
appropriate risk management tools. Annex II of the guidance identifies potential uses of quality risk
management principles depending on a company’s situation. One of the areas suggested is integrated
quality management system. By incorporating risk management in the quality management system,
companies can make informed, practical decisions about the use of existing resources.

The MasterControl software solution provides a solid quality management infrastructure that will make
continual quality improvement possible. Using MasterControl as a platform for quality management
and FDA compliance makes risk management more feasible because quality processes become more
transparent and easier to monitor. With MasterControl, performing risk assessment, risk control, risk
communication, and risk review is more manageable.

The following are some of the areas of quality management where risk management could potentially be
incorporated and how MasterControl can help.

Q9, Annex II: Potential Applications for Quality The MasterControl Solution
Risk Management

Annex II.1 Quality Risk Management as Part of

Integrated Quality Management

Documentation (Determine the desirability of and/or
develop the content for SOPs, guidances, etc.)
MasterControl Documents™, the building block
within the MasterControl quality suite, automates and
streamlines document routing, approval, escalation,
and revision control. Provides a single, Web-based
repository for all quality documentation, making risk
assessment of SOPs, policies, and other documents
easier. Provides advanced analytics and reporting
capability for a real-time view of the system.

Training and education (Determine the MasterControl Training™ automates assignment

appropriateness of initial and/or ongoing training;
Identify the training, experience…that allow personnel
to perform an operation reliably and with no adverse
impact on the quality of the product)
and monitoring of training tasks and grading of
online exams. Allows sequencing of training
courses, so after a prerequisite is completed, the next
course is automatically launched. Keeps training
documentation current and provides continuous
training gap analysis, making risk assessment of
training requirements easier.

Q9 Guidance Page  Q&A

Quality Defects (Provide basis for identifying,
evaluating, and communicating the potential impact of preventive action (CAPA) process to investigate,
suspected quality defect, complaint, trend, etc.)
Auditing/Inspection (Define the frequency and scope
of audits, both internal and external, based on certain
factors.)
Periodic Review (Select, evaluate, and interpret trend
results of data.)
Q9 Guidance
Most pharmaceutical companies use the corrective/
correct, and prevent recurrence of quality issues.
MasterControl CAPA™ automates this process and
integrates it with other quality processes. A CAPA
form can be launched directly from another form
(i.e., audit finding), automatically entering relevant
data into a CAPA form. This reduces data entry and
eliminates errors from manual transfer of information.
Customer complaints serve as an important source of
information about quality defects. MasterControl
Customer Complaints™ automates the complaint-
handling process and reduces the lifecycle from
submission to resolution. A simple, three-step
process is incorporated in a pre-configured, multi-
page form. Allows a timely escalation to an adverse
events specialist while ensuring that required data is
immediately collected.
The MasterControl™ suite facilitates FDA
compliance by optimizing processes and keeping the
quality system always ready for internal audits and
FDA inspections. All relevant documents and records
will be stored in a centralized, Web-based repository,
making it easy to track and retrieve them during audit
or inspection.
MasterControl Audit™ automates, streamlines,
and effectively manages the audit process. Provides
advanced tracking capability, from scheduling and
planning to execution and completion. Offers best
practice forms and automates scheduling of all
recurring audit-related activities.
MasterControl Analytics™, a reporting solution
available across MasterControl applications, provides
real-time reports that will show trends by process, by
product, etc. It includes dashboard, drill-down, and
advanced scheduling features.
Page  Q&A
Change Management/Change Control (Evaluate
impact on product quality of changes to facility,
equipment, material, etc.)
Continual Improvement (Facilitate continual
improvement in processes throughout the product
lifecycle.)
Q9 Guidance
MasterControl Change Control™ automates
the change control process and provides a single,
centralized repository for all change control
documentation, facilitating risk evaluation of all
change orders. This solution streamlines the entire
change management procedure for faster turnaround.
It offers a best-practice form that incorporates priority
level and prompts risk assessment and classification
of the change as low, medium, or high. Customizable
reports provide real-time status of change control
tasks and the entire quality system.
The MasterControl™ suite can serve as a
platform for continual quality improvement. The
system automates all quality-related tasks such as
routing, tracking, escalation, review, and approval
of documents and forms. Automation helps
sustain compliance by simplifying the compliance
environment, standardizing and streamlining
processes, and promoting efficiency. Provides best-
practice forms and workflow that facilitate proactive
management of quality issues.
Page  Q&A
About MasterControl Inc.
MasterControl Inc. has been at the forefront of providing quality management software solutions since 1993. Hundreds of
companies worldwide use MasterControl to help ensure compliance with FDA regulations such as 21 CFR Parts 11, 210-
211, 820, 606; ISO quality standards such as ISO 9000, ISO 13485, ISO 14000; and Sarbanes-Oxley Act requirements.
In addition to providing off-the-shelf products, MasterControl also offers comprehensive technical and customer support,
including product training, implementation, and validation services.

For additional industry white papers about automating quality and regulatory processes, visit www.mastercontrol.com,
or call, 800-825-9117.

MasterControl’s integrated quality management system helps connect quality processes enterprise-wide. The solution
provides automatic triggers to ensure tasks for handling quality-related incidents don’t fall through the cracks.
MasterControl’s integrated architecture ensures that the completion of one system process automatically launches the next
quality sub-system until the process loop is closed. Managers have analytical and reporting capabilities at their fingertips
to track and manage each quality process through completion.

© 2007 MasterControl Inc. All rights reserved.

Q9 Guidance Page  Q&A

MasterControl Inc.
6322 S. 3000 E. Suite 110
Salt Lake City, UT 84121

P. 800.825.9117
F. 801.942.7088
www.mastercontrol.com