Overview. Quality risk management supports structured decisions about patient, product and process risk. In cannabis organisations, it should connect botanical variability, contamination, controlled-substance governance, manufacturing controls and evidence uncertainty without becoming a paperwork exercise.
Risk principles
The level of effort, formality and documentation should be proportionate to risk. Decisions should be based on scientific knowledge and ultimately linked to patient protection.
Risk question and scope
A clear risk question defines what decision is required. Broad assessments such as 'risk assessment for the facility' are often too vague to support action.
Cannabis-specific hazards
Relevant hazards include pesticides, heavy metals, microbial contamination, mycotoxins, potency variability, cross-contamination, diversion, data integrity and supply interruption.
Risk tools
FMEA, HACCP, fault-tree analysis, risk ranking and hazard analysis may be useful. The tool should fit the question and available evidence.
Risk controls
Controls should follow a hierarchy: prevent hazards at source, control the process, detect failures and respond effectively. Finished-product testing alone is a weak primary control.
Subjectivity and bias
ICH Q9(R1) emphasises control of subjectivity. Teams should define scoring criteria, use diverse expertise and distinguish data from assumptions.
Risk review
Assessments should be reviewed after changes, deviations, new evidence or at a justified frequency. A risk assessment that never changes may not reflect the process.
Practical reference table
| Risk topic | Example hazard | Preferred control strategy |
|---|---|---|
| Cultivation | Pesticide or metal contamination | Input/site qualification and preventive controls |
| Drying | Microbial growth | Environmental and endpoint control |
| Extraction | Residual solvent | Validated removal and monitoring |
| Laboratory | False result | Validated method, data integrity and QC |
| Packaging | Wrong label or poor barrier | Line controls and stability evidence |
| Supply chain | Unqualified imported material | Supplier qualification and verification |
Control and decision path
Frequently asked questions
Does every risk assessment need FMEA?
No. The tool should match the decision and complexity.
What changed in ICH Q9(R1)?
It strengthened attention to subjectivity, formality, supply and product-availability risks.
Can testing be the main risk control?
It is generally stronger to prevent or control the hazard earlier in the process.
How often should risk assessments be reviewed?
After significant changes, adverse events, new knowledge or at a justified periodic frequency.
Who should participate?
A cross-functional team with relevant technical, quality, regulatory and operational knowledge.
Primary references and guidance
- ICH Q9(R1), Quality Risk Management
- ICH Q10
- EU GMP Part I, Chapter 1
- EU GMP Annex 15
- PIC/S PE 009
- WHO Quality Risk Management guidance
- ISO 31000 principles
- Applicable controlled-substance and cannabis regulations
Confirm the current effective revision and national applicability before operational or regulatory use.