Risk ranking and filtering per ICH Q9 MCQs With Answer

Introduction: Risk ranking and filtering per ICH Q9 is a core topic in pharmaceutical quality risk management. This blog offers M.Pharm students a focused set of multiple-choice questions to deepen understanding of methods used to prioritize risks, set risk acceptance criteria, and apply pragmatic filtering to concentrate resources on high-impact issues. The questions bridge theory and practice — covering qualitative and semi-quantitative scoring, severity/probability/detectability concepts, matrices and thresholds, documentation and communication expectations, and common pitfalls in implementation. Use these MCQs to test knowledge, prepare for exams, and reinforce how ICH Q9 principles inform effective quality systems in pharmaceutical development and manufacturing.

Q1. Which primary purpose of risk ranking and filtering is emphasized in ICH Q9 for pharmaceutical quality systems?

• To eliminate all potential risks regardless of impact
• To identify and prioritize risks to focus resources on those most relevant to product quality
• To replace process validation activities
• To provide a numerical score for regulatory submission only

Correct Answer: To identify and prioritize risks to focus resources on those most relevant to product quality

Q2. In a typical risk-ranking approach per ICH Q9, which three factors are most commonly combined to derive a risk score?

• Cost, time, and personnel
• Severity, probability (likelihood), and detectability (or control capability)
• Regulatory precedence, audit findings, and media coverage
• Supplier location, batch size, and environmental conditions

Correct Answer: Severity, probability (likelihood), and detectability (or control capability)

Q3. Which statement best describes “filtering” in the context of risk ranking per ICH Q9?

• Filtering eliminates risks with the highest scores to simplify reporting
• Filtering provides a binary accept/reject decision for product release
• Filtering applies predefined thresholds to exclude low-priority risks from detailed analysis
• Filtering automates corrective actions without human review

Correct Answer: Filtering applies predefined thresholds to exclude low-priority risks from detailed analysis

Q4. When using a semi-quantitative matrix for risk ranking, what is a common and appropriate next step after identifying high-ranked items?

• Immediately stop the process until the risk is eliminated
• Conduct deeper risk assessment (e.g., FMEA, fault tree analysis) and define mitigation/controls
• Ignore stakeholder input as it may bias the score
• Archive the result with no further action

Correct Answer: Conduct deeper risk assessment (e.g., FMEA, fault tree analysis) and define mitigation/controls

Q5. Which of the following is a correct justification for using qualitative risk ranking rather than quantitative probabilistic models in routine pharmaceutical risk filtering?

• Qualitative methods are always more accurate than quantitative models
• Qualitative ranking is simpler, faster, and often sufficient when data are limited or when screening is the goal
• Quantitative models are banned by regulators
• Qualitative methods do not require documentation

Correct Answer: Qualitative ranking is simpler, faster, and often sufficient when data are limited or when screening is the goal

Q6. In defining risk acceptance criteria for filtering, ICH Q9 recommends that criteria should be:

• Arbitrary and changed for each project
• Predefined, justified, and based on product, process, and patient impact considerations
• Kept confidential from stakeholders
• Set to exclude all risks from further consideration

Correct Answer: Predefined, justified, and based on product, process, and patient impact considerations

Q7. Which is a potential pitfall when using a simple numeric Risk Priority Number (RPN) without further context?

• RPN always gives a perfect prioritization and needs no review
• Different combinations of severity, probability, and detectability can yield the same RPN but imply different actions
• RPN measures cost directly
• RPN eliminates the need for cross-functional input

Correct Answer: Different combinations of severity, probability, and detectability can yield the same RPN but imply different actions

Q8. Which approach aligns with ICH Q9 when dealing with residual risk after mitigation measures are applied?

• Assume residual risk is zero and stop monitoring
• Document residual risk, assess acceptability against criteria, and implement monitoring or further controls if needed
• Always escalate to regulatory submission without further assessment
• Transfer responsibility to an external vendor without records

Correct Answer: Document residual risk, assess acceptability against criteria, and implement monitoring or further controls if needed

Q9. For filtering to be effective and defensible, ICH Q9 emphasizes the importance of:

• Keeping all filtering rules undocumented
• Having transparent, reproducible criteria and documented rationale for inclusion/exclusion
• Changing thresholds frequently to adapt to audits
• Using only management intuition without team input

Correct Answer: Having transparent, reproducible criteria and documented rationale for inclusion/exclusion

Q10. Which of the following best describes an appropriate use of risk ranking in change control per ICH Q9?

• To rank changes only after implementation to avoid delays
• To screen and prioritize proposed changes so that higher-risk changes receive more detailed assessment and controls
• To avoid assessing supplier changes entirely
• To assign blame for deviations

Correct Answer: To screen and prioritize proposed changes so that higher-risk changes receive more detailed assessment and controls

Q11. In a scoring matrix, detectability is intended to represent:

• The cost required to detect the risk
• How likely an existing control will detect the failure or deviation before it reaches the patient
• The time taken to report an incident to regulatory authorities
• The ease of training personnel

Correct Answer: How likely an existing control will detect the failure or deviation before it reaches the patient

Q12. When multiple low-severity risks collectively could impact product quality, ICH Q9 suggests:

• Treat each low-severity risk as negligible and filter all out
• Consider aggregated effects and assess whether combined risks require higher-level attention
• Only evaluate risks with high detectability
• Aggregate them without documentation

Correct Answer: Consider aggregated effects and assess whether combined risks require higher-level attention

Q13. Which documentation is most critical to retain after conducting a risk ranking and filtering exercise?

• Only the final list of filtered-out items without rationale
• Detailed rationale for scoring, decision rules, thresholds, and actions for high-priority risks
• Only email summaries with no supporting data
• No documentation is required per ICH Q9

Correct Answer: Detailed rationale for scoring, decision rules, thresholds, and actions for high-priority risks

Q14. In applying risk filtering, what role does cross-functional input play according to ICH Q9 principles?

• Cross-functional input should be minimized to speed up decisions
• It ensures diverse expertise informs scoring, leading to more robust and defensible prioritization
• It is only needed for regulatory-facing documents
• It should be replaced by automated algorithms exclusively

Correct Answer: It ensures diverse expertise informs scoring, leading to more robust and defensible prioritization

Q15. Which statement about dynamic thresholds for filtering in ongoing operations is true?

• Thresholds must be static and never revisited
• Thresholds may be periodically reviewed and adjusted based on new data, process capability, or change context
• Thresholds should be changed daily to reflect minor variations
• Thresholds are irrelevant once initial ranking is done

Correct Answer: Thresholds may be periodically reviewed and adjusted based on new data, process capability, or change context

Q16. If two failure modes have equal risk scores but different severity levels, ICH Q9 suggests prioritizing based on:

• Neither; equal scores always mean equal priority
• Severity and potential patient impact, even if another factor is lower
• Which one is cheaper to mitigate
• Which one was discovered later

Correct Answer: Severity and potential patient impact, even if another factor is lower

Q17. Which technique is commonly used to make risk ranking more quantitative when limited data exist?

• Use expert judgment with structured scoring scales and sensitivity analysis
• Ignore expert input and use random numbers
• Conduct large-scale clinical trials for every risk
• Use only historical sales data

Correct Answer: Use expert judgment with structured scoring scales and sensitivity analysis

Q18. How should risk communication be handled for items filtered out as low risk?

• No one should be informed to avoid confusion
• Communicate the decision, rationale, and any monitoring plan so stakeholders understand why these risks were deprioritized
• Only notify external regulators
• Delete all related records after communicating

Correct Answer: Communicate the decision, rationale, and any monitoring plan so stakeholders understand why these risks were deprioritized

Q19. In the context of ICH Q9, which metric is least appropriate as a sole basis for risk filtering?

• Patient safety impact (severity)
• Statistical probability of occurrence supported by data
• Public perception without relation to actual product risk
• Control effectiveness/detectability

Correct Answer: Public perception without relation to actual product risk

Q20. Which action demonstrates application of risk ranking and filtering to continuous improvement in manufacturing?

• Relying on a one-time ranking and never revisiting it
• Using ranking results to target process capability studies, monitoring plans, and CAPAs for highest-priority risks
• Filtering out all variability-related risks permanently
• Only documenting risks after a major regulatory inspection

Correct Answer: Using ranking results to target process capability studies, monitoring plans, and CAPAs for highest-priority risks

Download