Issue:April 2019

RISK MANAGEMENT - FDA’s Quality Risk Management Approach to New Drug Applications


The US Food and Drug Administration (FDA) is responsible for advancing the public health by helping to speed innovations that make medicines safer and more effective and by helping the public get the accurate, science-based information it needs to use medicines to maintain and improve public health. This publication emphasizes quality risk management approaches to the development and availability of new drug information presented in the premarket applications. In 2004, the FDA provided a guidance document for innovations, challenges, and solutions for new drug products that examine the critical path needed to bring therapeutic products to completion, and how the FDA can collaborate in the process, from laboratory to production to end use, to make medical breakthroughs available to those in need as quickly as possible. In new drug applications, risk management is one of the most important features, while a sponsor’s drug product development team deals with the formulation, manufacturing processes, container closure features, and user instructions. The FDA guidances help users of new drug products by providing organized data and appropriate labeling information in support of the new drug’s intended clinical use.


Risk management is one of the most important tools in new drug applications to assess the risk level of a drug product (ie, physical injury and/or damage to health of the user). Risk Management promotes quality, through increased efficiency and knowledge transfer, with strong potential to reduce catch-up work done to mediate the effects of poor quality (ie, non-conformance, deviations/investigations, corrections, rework, scrap, complaints, etc). Risk management helps to provide rationale for not spending time and resources on low risk activities, rather focusing on the things that are really important. Risk management is highly beneficial in that it can also be used to identify and justify process improvements (ie, process validation). Additionally, the use of risk assessments can allow pharmaceutical manufacturers to explore weaknesses and to construct scientific and data based rationales. The risk management process is an ongoing process, which requires documentation throughout design development and product life cycle (Figure 1). Risk management is a process consisting of well-defined steps that, when taken in sequence, supports quality of the product as intended. Risk assessment tools can also provide a means for the validation of processes (such as the approach referred to in the FDA Code of Federal Regulations, CFR 21, Part 820, Quality Management Regulations).

Risk management process includes the following elements:

-Risk analysis
-Risk evaluation
-Risk controls
-Production and post-production data maintenance

This publication emphasizes quality system risk management approaches to the development, manufacturing, and new drug applications (NDAs) approvals. Quality risk management (QRM) is a critical component of an effective quality system framework. It can, for example, help guide the setting of specifications and process parameters for drug manufacturing, assess and mitigate the risk of changing a process or specification, and determine the extent of non-conformance investigations and corrective actions.


The drug product development section of an NDA contains information on the development studies conducted to establish that the dosage form, formulation, manufacturing process, container closure system, microbiological attributes, and usage instructions are appropriate for the intended purpose specified in the NDA. The studies included in this section are in addition to those routine control tests conducted on a lot-by-lot basis according to specifications (ie, release testing and stability testing). A brief description of each of the components of this development section is indicated according to ICH Q8 guidance. A brief summary describing the development of the drug product taking into consideration the proposed route of administration and intended clinical use is provided as part of the NDA. Any parameters relevant to the performance characteristics or manufacturability (ie, active ingredients, release testing, stability, etc) are addressed in the NDA. Physicochemical and biological properties, such as pH, osmolarity, dissolution, redispersion, reconstitution, particle size distribution, aggregation, polymorphism, potency, and/or immunological activity can be essential elements of drug product performance characteristics. For development activities that include quality-by-design (QbD) approaches and description of testing technologies and summary results are important elements of product development and quality system control.1-7


The concept of quality by design (QbD) is related to designing and developing a drug product and associated production processes that are used during product development to ensure that the product consistently attains a predefined quality at the end of the manufacturing process.1 QbD, along with an effective quality system, provides the framework for the transfer of product knowledge and process understanding from drug development to the commercial manufacturing processes and for post-development changes and optimization. This is the main concept within the FDA’s cGMP Quality System guidance on process validation.2,3,5

The FDA issued a final report on Pharmaceutical cGMPs for the 21st Century-A Risk-based Approach. This report resulted in modernization of the FDA’s approach with a revised framework of science-based regulation of drugs quality that encompass quality systems and risk management. This report is intended for pharmaceutical companies to innovate and adopt state-of-the-art science and technologies applicable to their product’s manufacturing critical control points and intended clinical use. Critical quality attributes (CQA) of manufacturing processes associated with the drug product are physico-chemical, biological, or microbiological limits, ranges, or distribution to ensure the desired product quality. Critical process parameters (CPP) are those parameters whose variability has an impact on CQA, and therefore require monitoring to ensure that the manufacturing process produces the desired quality.2-6 According to ICH Q8, design space involving multidimensional combination and interaction of input variables (ie, drug material attributes) and process parameters that have been demonstrated to provide assurance are not considered as a change; however, movement out of the design space is considered to be a change and would normally initiate a regulatory post-approval review.2,6 Design space is proposed by the NDA’s sponsor and is subject to regulatory assessment and approval. Design controls are a planned set of controls derived from a product and process that is related to drug substance and drug product materials, pre-clinicals, clinicals, manufacturing equipment operating conditions and space, finished product specifications, and continuous quality control as described in Figure 1. In a typical NDA, Drug Product Life Cycle (DPLC) covers all phases in the life of a drug product from the initial development through marketing until the product’s discontinuation.2,4-7 QbD approach incorporates the philosophy of “built-in-quality” whereby the drug substance/drug product, and the respective manufacturing process and controls are designed and developed through systematic understanding and controlling of the critical variables affecting the product quality based on HACCP principles in conformance with quality target product profile (QTPP).2 QTPP covers a prospective summary of the quality characteristics of a drug product that ideally will be achieved to ensure the desired quality, taking into account safety and efficacy of the drug product described in the NDA.3-7


Pharmaceutical companies that manufacture drug products and submit NDAs for FDA approval are subjected to pre-New Drug Application Approval Inspection and it is very important for companies to consider the Code of Federal Regulations that may apply to the company’s premarket applications.3-7 The FDA filing and premarket applications consist of the following categories:

  1. Investigational New Drug Application (IND)
  2. New Drug Application (NDA)
  3. Abbreviated New Drug Application (ANDA)

For a drug manufacturer to introduce a product in the market for human use, a regulatory procedure is applicable. This procedure includes preclinical and clinical studies (good laboratory practice-GLP and good clinical practice-GCP studies).3-7 Much of the Good Clinical Practices (GCP) requirements are derived from 21 CFR Part 211: Current Good Manufacturing Practice for Finished Pharmaceuticals.1,3,5 These GCP requirements also include considerable input from International initiatives and guidances. Much of the GLP and GCP requirements used in the conduct of clinical trials are “best practices” derived from regulations, guidance, and industry standards and practices.7

Continuous quality improvement is the result of the FDA’s adoption of Industry-sponsored guidelines (ISBN 0273-3099). The FDA appears committed to support ways to promote drug development and is willing to accommodate NDA sponsors to use improved quality risk management approaches to foster innovations and improvements. These approaches help enhance the consistency and coordination of the FDA’s drug quality risk management programs, in part, by integrating quality system and CAPA corrective actions into agency’s regulatory processes. The ICH Q9 and Q10 were adopted by US in 2009. The FDA guidance, Quality Systems Approach to Pharmaceutical cGMPs describes the aim of the agency to help manufacturers implementing modern quality systems and risk management tools to meet the requirements of the agency’s current approaches to cGMPs. The implementation of ICH Q10 throughout the product life cycle facilitates and strengthens the link between drug development and manufacturing activities.7 In addition to ICH Q10, the FDA adopted Industry-sponsored guidelines for quality risk management. This current emphasis toward a risk-based approach has been projected by adopting ICH Q9 and Q10 in addition to WHO Technical Report Series No. 908, 2003, Annex 7-Application of Hazard Analysis-Critical Control Points (HACCP) Methodology.2,6 HACCP Risk management techniques can be applicable to establish manufacturing critical limits, critical control points monitoring, corrective actions, and record-keeping verification procedures.2,5,6 HACCP is a risk management system in which product or process safety can be addressed through the analysis and control of biological, chemical, and physical hazards from incoming raw materials from production to manufacturing, distribution to use of the finished product. The HACCP system identifies specific hazards and measures for their control.2,6 Examples of hazards within the pharmaceutical setting are: environmental aspects of the facility (ie, environmental conditions, hygiene aspects); material flow; manufacturing steps; personnel hygiene gowning and technical aspects relating to process design. HACCP is a tool that is used to focus more on prevention and can be used to reduce the reliance upon in-process monitoring or end-product testing. HACCP systems are generally useful for examining changes, such as advances in equipment design, processing procedures, or technological development. The HCCP team should identify all of the hazards that may be reasonably expected to occur at each step from primary production, processing, manufacture, and distribution until the point of intended clinical use.2,4

In conducting HACCP risk analysis, the likely occurrence of hazards and severity of their adverse health effects are considered for qualitative and quantitative analysis. In the analysis approach, critical limits are specified and validated for each critical control point (CCP) in the manufacturing process.2,6 More than one critical limit may be required at a particular step (ie, criteria often used include measurements of temperature, time, moisture level, pH, microbial bioburden, and endotoxins).2 Risk assessment for pharmaceuticals requires a system monitoring to control the CCP. This step may require specific corrective actions developed for each CCP in the HACCP system in order to deal with deviations when they occur. The corrective actions must ensure that CCP has been brought under control. Actions taken must also include a product risk assessment. These actions include deviation reports and a review of the effectiveness of corrective and preventive actions to provide valuable information for periodic monitoring. The advantages of the HACCP approach are that it allows for a systematic overview of the process for the evaluation of each processing step, and allows each step to examine the possible risks, and allows for the specifications of the measure required for controlling each risk. The primary objective of the HACCP system is to map out an entire process and provide a CAPA approach to quality risk management of the end product.

The FDA’s QbD guidances provide essential elements for design controls from product development to the commercial manufacturing processes and for post-development changes in the drug molecules as effective as possible. The QbD approach can be maintained throughout the life cycle of the product in order to facilitate continuous quality improvement (CQI) in the final outcome of the drug product (Figure 1). In contrast, previous traditional pharmaceutical manufacturing relied heavily on end product testing, and the process typically lacked the flexibility needed to respond to variables encountered during manufacturing processes. The application of HACCP quality risk analysis approach identifies CCPs in the manufacturing process that require control monitoring because of detection of out-of-limits or drifts when they occur.2,6 The HACCP management system provides a focus on the CCPs most likely to control product safety. This approach allows FDA reviewers and investigators to evaluate and verify that significant drug product safety hazards are properly identified and the appropriate controls are in place.


The FDA’s mission is to facilitate the premarket review and evaluation of INDs and NDAs. A central theme over the past few years has been a standardized approach to evidence-based review and evaluation. The FDA emphasizes the Quality Risk Management approach to design of studies by providing oversight and objective review of risk-benefit analysis that guides the use of new drug products by providing patients organized data and appropriate labeling information in support of the new drug’s intended clinical use.


  1. Aziz KJ, et al. Do it by Design – An Introduction to Human Factors in Medical Devices;1996. (
  2. Aziz KJ, et al. Pharmaceutical Risk Management Using HACCP Principles; 2008-2011. (http.www.FDA’s Global Risk Management Alliance, Blacksburg, VA, USA).
  3. Aziz KJ. The FDA’s Perspective on clinical devices: premarket review and evaluation Process. J Biomed Lab Sci. 1993,5:151-158.
  4. Aziz KJ. Global harmonization & quality system applications for medical products. Clin Lab Med. 2001;39:76-78.
  5. Aziz KJ. Clinical trial design: integrating biomarkers into drug development. Clin Lab & Analytical Sciences. 2007;30:10-19.
  6. Lozier T. HACCP for medical devices and pharmaceuticals: quality management system for life sciences. ETQ 2010. Website accessed:
  7. Aziz KJ. The FDA’s new drug approval process. Drug Development & Delivery. 2018;3:50-56.
  8. Rodriguez-Peres, J. Quality Risk Management in the FDA Regulated Industry; 2012:51-58.
  9. Friedhoff LT. Guide to the FDA’s New Drug Approval Process;2009:107-113.
  10. Rodriguez-Peres J. CAPA for the FDA-Regulated Industry;2011:9-28.

Dr. Kaiser J. Aziz is the former Director of Mechanics and Materials Science and Associate Director of Clinical Devices for the FDA. He is currently an independent consultant for clinical research, product development, and training. He has extensive regulatory experience in medical devices and pharmaceutical premarket evaluations and approvals. He has served as an adjunct faculty in the Department of Medicine and Physiology, NIH, Graduate School, where he developed and taught courses and workshops in Applied Clinical Trials. He has been a frequent invited speaker and educator at the Center for Health Sciences, Virginia Polytechnic Institute and State University, where he developed and taught medical device and pharmaceutical risk management courses and workshops. His expertise includes FDA’s Quality System Inspection Technique (QSIT) and medical products risk management using hazard analysis and critical control points (HACCP) Applications. Dr. Aziz earned his MS from Michigan State University, his PhD from American University, and a Post Doctorate in Health Services from the University of Southern California.