Jason J. Orloff

As a statistician, I have never been comfortable with subjective risk analysis. The process is fundamentally imperfect because it cannot anticipate the unknown. Furthermore, it lacks the rigor of actuarial risk analysis, which is beyond all but the most critical factors related to safety and efficacy. After conducting tremendous research and development to turn data into process knowledge, it seemed a disappointing end to boil all the information down to a human judgment call. Translating that effort into a subjective scale of 1 to 10 for severity, probability, and detectability left me wanting more than a notional approximation. However, after three days of discussion with the authors of the International Conference on Harmonization's quality guidelines, Q8, Q9, and Q10, at an ICH workshop in Washington, DC, last fall^*, I've gained a new understanding of risk assessment's value.

Risk assessment enables subject-matter experts to say to the best of their ability, "This is important, and that is not." Risk assessment is not a perfect tool by which analysts can anticipate all dangers—known and unknown—but it is valuable precisely because we cannot anticipate all danger. Risk assessment provides a framework within which to capture the knowledge upon which we have made risk-control decisions. Within this framework, learning can be fed back for capture and future review. The QRM process then enables management to establish priorities and move a project forward from the laboratory to manufacture with an understanding of, diligent control of, and conscious acceptance of risk.