Skip to main content
MyTrial AcademyFormerly FreeGCP
Account
ICH E6(R3) quality guidance
Last updated September 2026

Risk-Based Quality Management (RBQM) Training

Learn the proportionate, risk-based quality approach described in ICH E6(R3), including risk identification, evaluation, control, communication, review, and reporting.
See the six-part lifecycle

Working definition

Risk-Based Quality Management (RBQM) is a systematic approach to clinical trial quality management described by ICH E6(R3) that focuses resources on identifying, evaluating, controlling, communicating, reviewing, and reporting risks to participant safety and data reliability.

Guidance aligned
ICH E6(R3)
Risk lifecycle
Six-part
Verifiable record
Free

Foundation

What is risk-based quality management?

Risk-Based Quality Management (RBQM) is a systematic approach described in ICH E6(R3) that focuses trial resources on identifying, assessing, controlling, and reviewing risks to participant safety and data reliability.

Core RBQM principles

01

Critical to Quality Focus

Focus on what matters

RBQM directs attention and resources to the processes and data most critical to participant protection and reliable trial results. Instead of treating all data equally, you focus on Critical to Quality (CtQ) factors.

02

Risk-Proportionate

A proportionate approach

The intensity of quality activities should be proportionate to the risks involved. Low-risk activities need less oversight than high-risk ones. This is not about doing less. It is about doing the right things.

03

Dynamic Process

Continuous improvement

RBQM is not a one-time activity. It requires ongoing monitoring, periodic review of risk assessments, and adaptation as new information emerges during the trial.

04

Collaborative

Communication among stakeholders

Effective risk management requires clear communication among all stakeholders: sponsors, CROs, sites, and regulators. Everyone needs to understand the risks and their roles in managing them.

05

Prevention-Focused

Proactive, not reactive

Traditional quality approaches often found problems after they occurred. RBQM emphasizes anticipating risks before they happen and designing controls to prevent them.

06

Safety-Centered

Participant safety first

At its core, RBQM exists to protect trial participants. Every risk assessment starts with the question: 'What could harm participants or compromise the data needed to assess benefits and risks?'

Primary guidance context

ICH E6(R3)

Describes an appropriate quality system and a proportionate, risk-based approach across all stages of the trial

Ref: Sections 3.10 and 3.10.1

FDA E6(R3)

Advances quality by design and risk-based quality management as nonbinding FDA guidance

Ref: Final guidance, September 2025

FDA Risk-Based Monitoring

Encourages sponsors to consider risk-based monitoring and explains that it can satisfy legal requirements under appropriate circumstances

Ref: Final guidance, August 2013

How the FDA publication differs from the ICH text

The framework

The six-part E6(R3) risk lifecycle

ICH E6(R3) section 3.10.1 describes six connected risk-management elements. Identification through review is iterative; reporting records important quality issues and remedial actions.

  1. 01

    Step 1

    Risk identification

    Systematically identify what could go wrong

    The first step is to systematically identify risks that could affect participant safety, data integrity, and trial objectives. This involves analyzing the protocol, study population, investigational product, and operational complexity.

    Key activities

    • Review protocol for complex procedures and high-risk activities
    • Identify Critical to Quality (CtQ) factors for your trial
    • Consider risks specific to study population (vulnerable subjects, etc.)
    • Assess investigational product risks and handling requirements
    • Evaluate site and vendor capabilities and experience

    Deliverables

    • Risk inventory
    • CtQ factor list with rationale
    • Initial risk categorization
  2. 02

    Step 2

    Risk evaluation

    Assess likelihood and impact of each risk

    Once risks are identified, evaluate each one based on the likelihood it will occur and the potential impact if it does. This prioritization helps focus resources on the most significant risks.

    Key activities

    • Score each risk for probability of occurrence
    • Assess potential impact on participant safety
    • Evaluate impact on data reliability and trial objectives
    • Consider detectability: how easily would you find this problem?
    • Prioritize risks using a risk matrix or scoring system

    Deliverables

    • Risk scores and rankings
    • Risk matrix visualization
    • Priority list for risk control
  3. 03

    Step 3

    Risk control

    Implement strategies to mitigate risks

    For each significant risk, determine the appropriate control strategy. Options include eliminating the risk, reducing its likelihood, reducing its impact, or accepting it with monitoring.

    Key activities

    • Design controls proportionate to risk level
    • Implement preventive measures (training, SOPs, system design)
    • Establish detective measures (monitoring, audits, data checks)
    • Define acceptance criteria and escalation thresholds
    • Document controls in the risk management plan

    Deliverables

    • Risk management plan
    • Control procedures and SOPs
    • Monitoring strategy aligned to risks
  4. 04

    Step 4

    Risk communication

    Share risk information with stakeholders

    Effective risk management requires clear communication among all parties. Sponsors, CROs, sites, and regulators all need appropriate information about risks and their management.

    Key activities

    • Document risks and controls in accessible formats
    • Train site staff on risk-relevant procedures
    • Communicate role-specific responsibilities clearly
    • Establish channels for reporting new or emerging risks
    • Include risk context in monitoring visit reports

    Deliverables

    • Risk communication materials
    • Training documentation
    • Stakeholder-specific risk summaries
  5. 05

    Step 5

    Risk review

    Continuously monitor and adapt

    RBQM is not a one-time activity. Regularly review the effectiveness of risk controls, incorporate lessons learned, and adapt to new information that emerges during the trial.

    Key activities

    • Monitor key risk indicators (KRIs) and quality metrics
    • Conduct periodic risk assessment reviews
    • Evaluate effectiveness of implemented controls
    • Update risk assessments based on new information
    • Document lessons learned and apply to future trials

    Deliverables

    • Updated risk assessments
    • Trend analysis and reports
    • Lessons learned documentation
  6. 06

    Step 6

    Risk reporting

    Summarize important quality issues and actions

    E6(R3) closes the risk lifecycle with reporting. Important quality issues, excursions beyond relevant acceptable ranges, and the remedial actions taken should be summarized in the clinical trial report.

    Key activities

    • Identify important quality issues for the trial report
    • Summarize relevant range excursions and evaluations
    • Record remedial actions and their rationale
    • Connect reporting to the trial's documented quality approach
    • Retain supporting records in accordance with applicable requirements

    Deliverables

    • Quality issue summary
    • Remedial action record
    • Clinical trial report inputs

Implementation

Putting RBQM into practice

RBQM only works once it is written into plans, systems, and habits. These six areas are where that happens.

01

Risk management plan

Write the RBQM approach down in a risk management plan (RMP): the identified risks, evaluation criteria, control strategies, and review schedule.

Key elements

  • Risk identification methodology
  • Risk evaluation criteria and scoring
  • Critical to Quality (CtQ) factors
  • Risk control strategies
  • Monitoring approach aligned to risks
  • Review frequency and triggers

Tip: The RMP should be a living document, updated as trial circumstances change.

02

Centralized monitoring

Use timely centralized review where it fits the trial to identify site-specific or systemic issues across accumulating data.

Key elements

  • Key Risk Indicators (KRIs)
  • Quality Tolerance Limits (QTLs)
  • Statistical process control charts
  • Cross-site comparison analytics
  • Automated alert thresholds
  • Dashboard visualization

Tip: KRIs should directly relate to your identified CtQ factors.

03

Risk-based monitoring

Design the mix of centralized and site monitoring around identified risks. E6(R3) does not prescribe a universal source-data-verification percentage; the sponsor determines the appropriate extent and nature of monitoring for the trial.

Key elements

  • Targeted source data verification
  • Risk-triggered on-site visits
  • Remote monitoring capabilities
  • Site risk stratification
  • Focused monitoring visit agendas
  • Issue escalation pathways

Tip: Document your rationale for the monitoring approach selected.

04

Data-driven decisions

Use data analytics to drive quality decisions. Move from reactive problem-finding to proactive trend detection and prevention.

Key elements

  • Timely data quality metrics
  • Protocol deviation trend analysis
  • Enrollment and retention analytics
  • Safety signal detection
  • Site performance scoring
  • Predictive risk modeling

Tip: Invest in tools that enable cross-functional visibility into trial data.

05

Stakeholder training

Everyone in the RBQM system needs to know their role. Training should cover both the what and the why of risk-based approaches.

Key elements

  • Sponsor/CRO team training
  • Site staff orientation
  • Risk reporting procedures
  • Escalation pathways
  • Documentation requirements
  • Continuous improvement mindset

Tip: Use scenario-based training to make RBQM concepts practical.

06

Continuous improvement

Build feedback loops that capture lessons learned and drive improvements across trials. RBQM effectiveness improves with experience.

Key elements

  • Post-trial risk assessment reviews
  • Control effectiveness evaluation
  • Process improvement initiatives
  • Cross-trial learning capture
  • Industry benchmarking
  • Technology enhancement roadmap

Tip: Document what worked and what didn't for future trial planning.

RBQM FAQs

Common questions about risk-based quality management

These FAQs distinguish E6(R3)'s recommended quality framework from binding legal, study, and organizational requirements.

What is Risk-Based Quality Management (RBQM)?
Risk-Based Quality Management (RBQM) is a systematic approach that focuses quality activities on risks that could meaningfully affect participant rights, safety, well-being, or the reliability of trial results. ICH E6(R3) describes a proportionate, risk-based approach that spans quality by design, risk identification, evaluation, control, communication, review, and reporting.
Does ICH E6(R3) make RBQM legally mandatory?
ICH E6(R3) recommends that sponsors implement an appropriate quality system and adopt a proportionate, risk-based approach. FDA publishes E6(R3) as nonbinding guidance: legally enforceable duties come from applicable statutes and regulations, while study protocols, contracts, and organizational procedures may add further requirements.
What are the six elements of the E6(R3) risk lifecycle?
ICH E6(R3) section 3.10.1 describes six connected elements: risk identification, risk evaluation, risk control, risk communication, risk review, and risk reporting. The work is iterative: controls and assessments should be revisited when emerging knowledge or experience changes the trial's risk picture.
How does RBQM relate to Quality by Design (QbD)?
Quality by Design (QbD) and RBQM are complementary approaches that work together. QbD focuses on designing quality into the trial from the start: identifying Critical to Quality factors during protocol development, before problems occur. RBQM is the framework for managing risks to those CtQ factors for the rest of the trial. QbD is the planning; RBQM is the ongoing management.
What are Critical to Quality (CtQ) factors?
Critical to Quality (CtQ) factors are the processes, data points, and activities that are essential to participant protection and the reliability of trial results. Examples include informed consent processes, eligibility verification, primary endpoint data collection, serious adverse event reporting, and investigational product accountability. Identifying CtQ factors is the foundation of RBQM. You cannot manage risks to quality until you have defined what quality means for your trial.
What is the difference between RBQM and risk-based monitoring (RBM)?
RBQM is the quality management approach for the whole trial, from protocol design through database lock. Risk-based monitoring (RBM) is one component within it: how you conduct site visits and data review. RBQM also covers trial design, protocol development, vendor oversight, data management, safety surveillance, and every other quality activity, not only site monitoring.
Is RBQM training included in MyTrial Academy's free course?
Yes, RBQM training is included in our free ICH E6(R3) GCP course. Module 4, Quality, Proportionality, and Protocol Design, covers Quality by Design, Critical to Quality factor identification, the proportionate approach, protocol requirements, and a practical RBQM framework. You'll receive a free verifiable completion record; the printable PDF certificate is a separate, optional purchase.
What do FDA sources say about risk-based quality approaches?
FDA's 2013 monitoring guidance encourages sponsors to consider risk-based monitoring and explains that it can satisfy applicable statutory and regulatory requirements under appropriate circumstances. FDA's September 2025 E6(R3) final guidance advances quality by design and risk-based quality management while retaining the standard guidance disclaimer that the document is nonbinding.
What should RBQM documentation make clear?
RBQM records should make the reasoning traceable: the trial's Critical to Quality factors, identified risks, evaluation criteria, selected controls, monitoring rationale, communication and review decisions, and important quality issues and remedial actions. The exact document set and approvals depend on applicable law, the protocol, contracts, and the organization's quality system.
How do I get started implementing RBQM?
Make sure the team understands the principles first, then: (1) Identify Critical to Quality factors for your trial during protocol development; (2) Conduct initial risk assessments before first patient enrolled; (3) Develop a Risk Management Plan documenting your approach; (4) Design your monitoring strategy to align with identified risks; (5) Implement centralized monitoring with Key Risk Indicators; (6) Schedule regular risk review meetings; (7) Document everything and iterate based on lessons learned.

Continue learning

Explore related topics to deepen your understanding

Get started

Start with the GCP track.

Free to complete, with a record anyone can verify in seconds. Coordinators, monitors, and investigators train here on the current ICH E6(R3) standard.

  • No credit card or hidden trials
  • Verifiable completion record
  • Progress syncs across every device
View the curriculum

Create your account in under a minute