Beyond “Knowing Is Half the Battle”

Dr. Valerie Mulholland’s recent exploration of the GI Joe Bias strikes gets to the heart of a fundamental challenge in pharmaceutical quality management: the persistent belief that awareness of cognitive biases is sufficient to overcome them. I find Valerie’s analysis particularly compelling because it connects directly to the practical realities we face when implementing ICH Q9(R1)’s mandate to actively manage subjectivity in risk assessment.

Valerie’s observation that “awareness of a bias does little to prevent it from influencing our decisions” shows us that the GI Joe Bias underlays a critical gap between intellectual understanding and practical application—a gap that pharmaceutical organizations must bridge if they hope to achieve the risk-based decision-making excellence that ICH Q9(R1) demands.

The Expertise Paradox: Why Quality Professionals Are Particularly Vulnerable

Valerie correctly identifies that quality risk management facilitators are often better at spotting biases in others than in themselves. This observation connects to a deeper challenge I’ve previously explored: the fallacy of expert immunity. Our expertise in pharmaceutical quality systems creates cognitive patterns that simultaneously enable rapid, accurate technical judgments while increasing our vulnerability to specific biases.

The very mechanisms that make us effective quality professionals—pattern recognition, schema-based processing, heuristic shortcuts derived from base rate experiences—are the same cognitive tools that generate bias. When I conduct investigations or facilitate risk assessments, my extensive experience with similar events creates expectations and assumptions that can blind me to novel failure modes or unexpected causal relationships. This isn’t a character flaw; it’s an inherent part of how expertise develops and operates.

Valerie’s emphasis on the need for trained facilitators in high-formality QRM activities reflects this reality. External facilitation isn’t just about process management—it’s about introducing cognitive diversity and bias detection capabilities that internal teams, no matter how experienced, cannot provide for themselves. The facilitator serves as a structured intervention against the GI Joe fallacy, embodying the systematic approaches that awareness alone cannot deliver.

From Awareness to Architecture: Building Bias-Resistant Quality Systems

The critical insight from both Valerie’s work and my writing about structured hypothesis formation is that effective bias management requires architectural solutions, not individual willpower. ICH Q9(R1)’s introduction of the “Managing and Minimizing Subjectivity” section represents recognition that regulatory compliance requires systematic approaches to cognitive bias management.

In my post on reducing subjectivity in quality risk management, I identified four strategies that directly address the limitations Valerie highlights about the GI Joe Bias:

Leveraging Knowledge Management: Rather than relying on individual awareness, effective bias management requires systematic capture and application of objective information. When risk assessors can access structured historical data, supplier performance metrics, and process capability studies, they’re less dependent on potentially biased recollections or impressions.
Good Risk Questions: The formulation of risk questions represents a critical intervention point. Well-crafted questions can anchor assessments in specific, measurable terms rather than vague generalizations that invite subjective interpretation. Instead of asking “What are the risks to product quality?”, effective risk questions might ask “What are the potential causes of out-of-specification dissolution results for Product X in the next 6 months based on the last three years of data?”
Cross-Functional Teams: Valerie’s observation that we’re better at spotting biases in others translates directly into team composition strategies. Diverse, cross-functional teams naturally create the external perspective that individual bias recognition cannot provide. The manufacturing engineer, quality analyst, and regulatory specialist bring different cognitive frameworks that can identify blind spots in each other’s reasoning.
Structured Decision-Making Processes: The tools Valerie mentions—PHA, FMEA, Ishikawa, bow-tie analysis—serve as external cognitive scaffolding that guides thinking through systematic pathways rather than relying on intuitive shortcuts that may be biased.

The Formality Framework: When and How to Escalate Bias Management

One of the most valuable aspects of ICH Q9(R1) is its introduction of the formality concept—the idea that different situations require different levels of systematic intervention. Valerie’s article implicitly addresses this by noting that “high formality QRM activities” require trained facilitators. This suggests a graduated approach to bias management that scales intervention intensity with decision importance.

This formality framework needs to include bias management that organizations can use to determine when and how intensively to apply bias mitigation strategies:

Low Formality Situations: Routine decisions with well-understood parameters, limited stakeholders, and reversible outcomes. Basic bias awareness training and standardized checklists may be sufficient.
Medium Formality Situations: Decisions involving moderate complexity, uncertainty, or impact. These require cross-functional input, structured decision tools, and documentation of rationales.
High Formality Situations: Complex, high-stakes decisions with significant uncertainty, multiple conflicting objectives, or diverse stakeholders. These demand external facilitation, systematic bias checks, and formal documentation of how potential biases were addressed.

This framework acknowledges that the GI Joe fallacy is most dangerous in high-formality situations where the stakes are highest and the cognitive demands greatest. It’s precisely in these contexts that our confidence in our ability to overcome bias through awareness becomes most problematic.

The Cultural Dimension: Creating Environments That Support Bias Recognition

Valerie’s emphasis on fostering humility, encouraging teams to acknowledge that “no one is immune to bias, even the most experienced professionals” connects to my observations about building expertise in quality organizations. Creating cultures that can effectively manage subjectivity requires more than tools and processes; it requires psychological safety that allows bias recognition without professional threat.

I’ve noted in past posts that organizations advancing beyond basic awareness levels demonstrate “systematic recognition of cognitive bias risks” with growing understanding that “human judgment limitations can affect risk assessment quality.” However, the transition from awareness to systematic application requires cultural changes that make bias discussion routine rather than threatening.

This cultural dimension becomes particularly important when we consider the ironic processing effects that Valerie references. When organizations create environments where acknowledging bias is seen as admitting incompetence, they inadvertently increase bias through suppression attempts. Teams that must appear confident and decisive may unconsciously avoid bias recognition because it threatens their professional identity.

The solution is creating cultures that frame bias recognition as professional competence rather than limitation. Just as we expect quality professionals to understand statistical process control or regulatory requirements, we should expect them to understand and systematically address their cognitive limitations.

Practical Implementation: Moving Beyond the GI Joe Fallacy

Building on Valerie’s recommendations for structured tools and systematic approaches, here are some specific implementation strategies that organizations can adopt to move beyond bias awareness toward bias management:

Bias Pre-mortems: Before conducting risk assessments, teams explicitly discuss what biases might affect their analysis and establish specific countermeasures. This makes bias consideration routine rather than reactive.
Devil’s Advocate Protocols: Systematic assignment of team members to challenge prevailing assumptions and identify information that contradicts emerging conclusions.
Perspective-Taking Requirements: Formal requirements to consider how different stakeholders (patients, regulators, operators) might view risks differently from the assessment team.
Bias Audit Trails: Documentation requirements that capture not just what decisions were made, but how potential biases were recognized and addressed during the decision-making process.
External Review Requirements: For high-formality decisions, mandatory review by individuals who weren’t involved in the initial assessment and can provide fresh perspectives.

These interventions acknowledge that bias management is not about eliminating human judgment—it’s about scaffolding human judgment with systematic processes that compensate for known cognitive limitations.

The Broader Implications: Subjectivity as Systemic Challenge

Valerie’s analysis of the GI Joe Bias connects to broader themes in my work about the effectiveness paradox and the challenges of building rigorous quality systems in an age of pop psychology. The pharmaceutical industry’s tendency to adopt appealing frameworks without rigorous evaluation extends to bias management strategies. Organizations may implement “bias training” or “awareness programs” that create the illusion of progress while failing to address the systematic changes needed for genuine improvement.

The GI Joe Bias serves as a perfect example of this challenge. It’s tempting to believe that naming the bias—recognizing that awareness isn’t enough—somehow protects us from falling into the awareness trap. But the bias is self-referential: knowing about the GI Joe Bias doesn’t automatically prevent us from succumbing to it when implementing bias management strategies.

This is why Valerie’s emphasis on systematic interventions rather than individual awareness is so crucial. Effective bias management requires changing the decision-making environment, not just the decision-makers’ knowledge. It requires building systems, not slogans.

A Call for Systematic Excellence in Bias Management

Valerie’s exploration of the GI Joe Bias provides a crucial call for advancing pharmaceutical quality management beyond the illusion that awareness equals capability. Her work, combined with ICH Q9(R1)’s explicit recognition of subjectivity challenges, creates an opportunity for the industry to develop more sophisticated approaches to cognitive bias management.

The path forward requires acknowledging that bias management is a core competency for quality professionals, equivalent to understanding analytical method validation or process characterization. It requires systematic approaches that scaffold human judgment rather than attempting to eliminate it. Most importantly, it requires cultures that view bias recognition as professional strength rather than weakness.

As I continue to build frameworks for reducing subjectivity in quality risk management and developing structured approaches to decision-making, Valerie’s insights about the limitations of awareness provide essential grounding. The GI Joe Bias reminds us that knowing is not half the battle—it’s barely the beginning.

The real battle lies in creating pharmaceutical quality systems that systematically compensate for human cognitive limitations while leveraging human expertise and judgment. That battle is won not through individual awareness or good intentions, but through systematic excellence in bias management architecture.

What structured approaches has your organization implemented to move beyond bias awareness toward systematic bias management? Share your experiences and challenges as we work together to advance the maturity of risk management practices in our industry.

Meet Valerie Mulholland

Dr. Valerie Mulholland is transforming how our industry thinks about quality risk management. As CEO and Principal Consultant at GMP Services in Ireland, Valerie brings over 25 years of hands-on experience auditing and consulting across biopharmaceutical, pharmaceutical, medical device, and blood transfusion industries throughout the EU, US, and Mexico.

But what truly sets Valerie apart is her unique combination of practical expertise and cutting-edge research. She recently earned her PhD from TU Dublin’s Pharmaceutical Regulatory Science Team, focusing on “Effective Risk-Based Decision Making in Quality Risk Management”. Her groundbreaking research has produced 13 academic papers, with four publications specifically developed to support ICH’s work—research that’s now incorporated into the official ICH Q9(R1) training materials. This isn’t theoretical work gathering dust on academic shelves; it’s research that’s actively shaping global regulatory guidance.

Why Risk Revolution Deserves Your Attention

The Risk Revolution podcast, co-hosted by Valerie alongside Nuala Calnan (25-year pharmaceutical veteran and Arnold F. Graves Scholar) and Dr. Lori Richter (Director of Risk Management at Ultragenyx with 21+ years industry experience), represents something unique in pharmaceutical podcasting. This isn’t your typical regulatory update show—it’s a monthly masterclass in advancing risk management maturity.

In an industry where staying current isn’t optional—it’s essential for patient safety—Risk Revolution offers the kind of continuing education that actually advances your professional capabilities. These aren’t recycled conference presentations; they’re conversations with the people shaping our industry’s future.

Finding Rhythm in Quality Risk Management: Moving Beyond Control to Adaptive Excellence

The pharmaceutical industry has long operated under what Michael Hudson aptly describes in his recent Forbes article as “symphonic control, “carefully orchestrated strategies executed with rigid precision, where quality units can function like conductors trying to control every note. But as Hudson observes, when our meticulously crafted risk assessments collide with chaotic reality, what emerges is often discordant. The time has come for quality risk management to embrace what I am going to call “rhythmic excellence,” a jazz-inspired approach that maintains rigorous standards while enabling adaptive performance in our increasingly BANI (Brittle, Anxious, Non-linear, and Incomprehensible) regulatory and manufacturing environment.

And since I love a good metaphor, I bring you:

Rhythmic Quality Risk Management

Recent research by Amy Edmondson and colleagues at Harvard Business School provides compelling evidence for rhythmic approaches to complex work. After studying more than 160 innovation teams, they found that performance suffered when teams mixed reflective activities (like risk assessments and control strategy development) with exploratory activities (like hazard identification and opportunity analysis) in the same time period. The highest-performing teams established rhythms that alternated between exploration and reflection, creating distinct beats for different quality activities.

This finding resonates deeply with the challenges we face in pharmaceutical quality risk management. Too often, our risk assessment meetings become frantic affairs where hazard identification, risk analysis, control strategy development, and regulatory communication all happen simultaneously. Teams push through these sessions exhausted and unsatisfied, delivering risk assessments they aren’t proud of—what Hudson describes as “cognitive whiplash”.

From Symphonic Control to Jazz-Based Quality Leadership

The traditional approach to pharmaceutical quality risk management mirrors what Hudson calls symphonic leadership—attempting to impose top-down structure as if more constraint and direction are what teams need to work with confidence. We create detailed risk assessment procedures, prescriptive FMEA templates, and rigid review schedules, then wonder why our teams struggle to adapt when new hazards emerge or when manufacturing conditions change unexpectedly.

Karl Weick’s work on organizational sensemaking reveals why this approach undermines our quality objectives: complex manufacturing environments require “mindful organizing” and the ability to notice subtle changes and respond fluidly. Setting a quality rhythm and letting go of excessive control provides support without constraint, giving teams the freedom to explore emerging risks, experiment with novel control strategies, and make sense of the quality challenges they face.

This represents a fundamental shift in how we conceptualize quality risk management leadership. Instead of being the conductor trying to orchestrate every risk assessment note, quality leaders should function as the rhythm section—establishing predictable beats that keep everyone synchronized while allowing individual expertise to flourish.

The Quality Rhythm Framework: Four Essential Beats

Drawing from Hudson’s research-backed insights and integrating them with ICH Q9(R1) requirements, I envision a Quality Rhythm Framework built on four essential beats:

Beat 1: Find Your Risk Cadence

Establish predictable rhythms that create temporal anchors for your quality team while maintaining ICH Q9 compliance. Weekly hazard identification sessions, daily deviation assessments, monthly control strategy reviews, and quarterly risk communication cycles aren’t just meetings—they’re the beats that keep everyone synchronized while allowing individual risk management expression.

The ICH Q9(R1) revision’s emphasis on proportional formality aligns perfectly with this rhythmic approach. High-risk processes require more frequent beats, while lower-risk areas can operate with extended rhythms. The key is consistency within each risk category, creating what Weick calls “structured flexibility”—the ability to respond creatively within clear boundaries.

Consider implementing these quality-specific rhythmic structures:

Daily Risk Pulse: Brief stand-ups focused on emerging quality signals—not comprehensive risk assessments, but awareness-building sessions that keep the team attuned to the manufacturing environment.
Weekly Hazard Identification Sessions: Dedicated time for exploring “what could go wrong” and, following ISO 31000 principles, “what could go better than expected.” These sessions should alternate between different product lines or process areas to maintain focus.
Monthly Control Strategy Reviews: Deeper evaluations of existing risk controls, including assessment of whether they remain appropriate and identification of optimization opportunities.
Quarterly Risk Communication Cycles: Structured information sharing with stakeholders, including regulatory bodies when appropriate, ensuring that risk insights flow effectively throughout the organization.

Beat 2: Pause for Quality Breaths

Hudson emphasizes that jazz musicians know silence is as important as sound, and quality risk management desperately needs structured pauses. Build quality breaths into your organizational rhythm—moments for reflection, integration, and recovery from the intense focus required for effective risk assessment.

Research by performance expert Jim Loehr demonstrates that sustainable excellence requires oscillation, not relentless execution. In quality contexts, this means creating space between intensive risk assessment activities and implementation of control strategies. These pauses allow teams to process complex risk information, integrate diverse perspectives, and avoid the decision fatigue that leads to poor risk judgments.

Practical quality breaths include:

Post-Assessment Integration Time: Following comprehensive risk assessments, build in periods where team members can reflect on findings, consult additional resources, and refine their thinking before finalizing control strategies.
Cross-Functional Synthesis Sessions: Regular meetings where different functions (Quality, Operations, Regulatory, Technical) come together not to make decisions, but to share perspectives and build collective understanding of quality risks.
Knowledge Capture Moments: Structured time for documenting lessons learned, updating risk models based on new experience, and creating institutional memory that enhances future risk assessments.

Beat 3: Encourage Quality Experimentation

Within your rhythmic structure, create psychological safety and confidence that team members can explore novel risk identification approaches without fear of hitting “wrong notes.” When learning and reflection are part of a predictable beat, trust grows and experimentation becomes part of the quality flow.

The ICH Q9(R1) revision’s focus on managing subjectivity in risk assessments creates opportunities for experimental approaches. Instead of viewing subjectivity as a problem to eliminate, we can experiment with structured methods for harnessing diverse perspectives while maintaining analytical rigor.

Hudson’s research shows that predictable rhythm facilitates innovation—when people are comfortable with the rhythm, they’re free to experiment with the melody. In quality risk management, this means establishing consistent frameworks that enable creative hazard identification and innovative control strategy development.

Experimental approaches might include:

Success Mode and Benefits Analysis (SMBA): As I’ve discussed previously, complement traditional FMEA with systematic identification of positive potential outcomes. Experiment with different SMBA formats and approaches to find what works best for specific process areas.
Cross-Industry Risk Insights: Dedicate portions of risk assessment sessions to exploring how other industries handle similar quality challenges. These experiments in perspective-taking can reveal blind spots in traditional pharmaceutical approaches.
Scenario-Based Risk Planning: Experiment with “what if” exercises that go beyond traditional failure modes to explore complex, interdependent risk situations that might emerge in dynamic manufacturing environments.

Beat 4: Enable Quality Solos

Just as jazz musicians trade solos while the ensemble provides support, look for opportunities for individual quality team members to drive specific risk management initiatives. This distributed leadership approach builds capability while maintaining collective coherence around quality objectives.

Hudson’s framework emphasizes that adaptive leaders don’t try to be conductors but create conditions for others to lead. In quality risk management, this means identifying team members with specific expertise or interest areas and empowering them to lead risk assessments in those domains.

Quality leadership solos might include:

Process Expert Risk Leadership: Assign experienced operators or engineers to lead risk assessments for processes they know intimately, with quality professionals providing methodological support.
Cross-Functional Risk Coordination: Empower individuals to coordinate risk management across organizational boundaries, taking ownership for ensuring all relevant perspectives are incorporated.
Innovation Risk Championship: Designate team members to lead risk assessments for new technologies or novel approaches, building expertise in emerging quality challenges.

The Rhythmic Advantage: Three Quality Transformation Benefits

Mastering these rhythmic approaches to quality risk management provide three advantages that mirror Hudson’s leadership research:

Fluid Quality Structure

A jazz ensemble can improvise because musicians share a rhythm. Similarly, quality rhythms keep teams functioning together while offering freedom to adapt to emerging risks, changing regulatory requirements, or novel manufacturing challenges. Management researchers call this “structured flexibility”—exactly what ICH Q9(R1) envisions when it emphasizes proportional formality.

When quality teams operate with shared rhythms, they can respond more effectively to unexpected events. A contamination incident doesn’t require completely reinventing risk assessment approaches—teams can accelerate their established rhythms, bringing familiar frameworks to bear on novel challenges while maintaining analytical rigor.

Sustainable Quality Energy

Quality risk management is inherently demanding work that requires sustained attention to complex, interconnected risks. Traditional approaches often lead to burnout as teams struggle with relentless pressure to identify every possible hazard and implement perfect controls. Rhythmic approaches prevent this exhaustion by regulating pace and integrating recovery.

More importantly, rhythmic quality management aligns teams around purpose and vision rather than merely compliance deadlines. This enables what performance researchers call “sustainable high performance”—quality excellence that endures rather than depletes organizational energy.

When quality professionals find rhythm in their risk management work, they develop what Mihaly Csikszentmihalyi identified as “flow state,” moments when attention is fully focused and performance feels effortless. These states are crucial for the deep thinking required for effective hazard identification and the creative problem-solving needed for innovative control strategies.

Enhanced Quality Trust and Innovation

The paradox Hudson identifies, that some constraint enables creativity, applies directly to quality risk management. Predictable rhythms don’t stifle innovation; they provide the stable foundation from which teams can explore novel approaches to quality challenges.

When quality teams know they have regular, structured opportunities for risk exploration, they’re more willing to raise difficult questions, challenge assumptions, and propose unconventional solutions. The rhythm creates psychological safety for intellectual risk-taking within the controlled environment of systematic risk assessment.

This enhanced innovation capability is particularly crucial as pharmaceutical manufacturing becomes increasingly complex, with continuous manufacturing, advanced process controls, and novel drug modalities creating quality challenges that traditional risk management approaches weren’t designed to address.

Integrating Rhythmic Principles with ICH Q9(R1) Compliance

The beauty of rhythmic quality risk management lies in its fundamental compatibility with ICH Q9(R1) requirements. The revision’s emphasis on scientific knowledge, proportional formality, and risk-based decision-making aligns perfectly with rhythmic approaches that create structured flexibility for quality teams.

Rhythmic Risk Assessment Enhancement

ICH Q9 requires systematic hazard identification, risk analysis, and risk evaluation. Rhythmic approaches enhance these activities by establishing regular, focused sessions for each component rather than trying to accomplish everything in marathon meetings.

During dedicated hazard identification beats, teams can employ diverse techniques—traditional brainstorming, structured what-if analysis, cross-industry benchmarking, and the Success Mode and Benefits Analysis I’ve advocated. The rhythm ensures these activities receive appropriate attention while preventing the cognitive overload that reduces identification effectiveness.

Risk analysis benefits from rhythmic separation between data gathering and interpretation activities. Teams can establish rhythms for collecting process data, manufacturing experience, and regulatory intelligence, followed by separate beats for analyzing this information and developing risk models.

Rhythmic Risk Control Development

The ICH Q9(R1) emphasis on risk-based decision-making aligns perfectly with rhythmic approaches to control strategy development. Instead of rushing from risk assessment to control implementation, rhythmic approaches create space for thoughtful strategy development that considers multiple options and their implications.

Rhythmic control development might include beats for:

Control Strategy Ideation: Creative sessions focused on generating potential control approaches without immediate evaluation of feasibility or cost.
Implementation Planning: Separate sessions for detailed planning of selected control strategies, including resource requirements, timeline development, and change management considerations.
Effectiveness Assessment: Regular rhythms for evaluating implemented controls, gathering performance data, and identifying optimization opportunities.

Rhythmic Risk Communication

ICH Q9’s communication requirements benefit significantly from rhythmic approaches. Instead of ad hoc communication when problems arise, establish regular rhythms for sharing risk insights, control strategy updates, and lessons learned.

Quality communication rhythms should align with organizational decision-making cycles, ensuring that risk insights reach stakeholders when they’re most useful for decision-making. This might include monthly updates to senior leadership, quarterly reports to regulatory affairs, and annual comprehensive risk reviews for long-term strategic planning.

Practical Implementation: Building Your Quality Rhythm

Implementing rhythmic quality risk management requires systematic integration rather than wholesale replacement of existing approaches. Start by evaluating your current risk management processes to identify natural rhythm points and opportunities for enhancement.

Phase 1: Rhythm Assessment and Planning

Map your existing quality risk management activities against rhythmic principles. Identify where teams experience the cognitive whiplash Hudson describes—trying to accomplish too many different types of thinking in single sessions. Look for opportunities to separate exploration from analysis, strategy development from implementation planning, and individual reflection from group decision-making.

Establish criteria for quality rhythm frequency based on risk significance, process complexity, and organizational capacity. High-risk processes might require daily pulse checks and weekly deep dives, while lower-risk areas might operate effectively with monthly assessment rhythms.

Train quality teams on rhythmic principles and their application to risk management. Help them understand how rhythm enhances rather than constrains their analytical capabilities, providing structure that enables deeper thinking and more creative problem-solving.

Phase 2: Pilot Program Development

Select pilot areas where rhythmic approaches are most likely to demonstrate clear benefits. New product development projects, technology implementation initiatives, or process improvement activities often provide ideal testing grounds because their inherent uncertainty creates natural opportunities for both risk management and opportunity identification.

Design pilot programs to test specific rhythmic principles:

Rhythm Separation: Compare traditional comprehensive risk assessment meetings with rhythmic approaches that separate hazard identification, risk analysis, and control strategy development into distinct sessions.
Quality Breathing: Experiment with structured pauses between intensive risk assessment activities and measure their impact on decision quality and team satisfaction.
Distributed Leadership: Identify opportunities for team members to lead specific aspects of risk management and evaluate the impact on engagement and expertise development.

Phase 3: Organizational Integration

Based on pilot results, develop systematic approaches for scaling rhythmic quality risk management across the organization. This requires integration with existing quality systems, regulatory processes, and organizational governance structures.

Consider how rhythmic approaches will interact with regulatory inspection activities, change control processes, and continuous improvement initiatives. Ensure that rhythmic flexibility doesn’t compromise documentation requirements or audit trail integrity.

Establish metrics for evaluating rhythmic quality risk management effectiveness, including both traditional risk management indicators (incident rates, control effectiveness, regulatory compliance) and rhythm-specific measures (team engagement, innovation frequency, decision speed).

Phase 4: Continuous Enhancement and Cultural Integration

Like all aspects of quality risk management, rhythmic approaches require continuous improvement based on experience and changing needs. Regular assessment of rhythm effectiveness helps refine approaches over time and ensures sustained benefits.

The ultimate goal is cultural integration—making rhythmic thinking a natural part of how quality professionals approach risk management challenges. This requires consistent leadership modeling, recognition of rhythmic successes, and integration of rhythmic principles into performance expectations and career development.

Measuring Rhythmic Quality Success

Traditional quality metrics focus primarily on negative outcome prevention: deviation rates, batch failures, regulatory findings, and compliance scores. While these remain important, rhythmic quality risk management requires expanded measurement approaches that capture both defensive effectiveness and adaptive capability.

Enhanced metrics should include:

Rhythm Consistency Indicators: Frequency of established quality rhythms, participation rates in rhythmic activities, and adherence to planned cadences.
Innovation and Adaptation Measures: Number of novel risk identification approaches tested, implementation rate of creative control strategies, and frequency of process improvements emerging from risk management activities.
Team Engagement and Development: Participation in quality leadership opportunities, cross-functional collaboration frequency, and professional development within risk management capabilities.
Decision Quality Indicators: Time from risk identification to control implementation, stakeholder satisfaction with risk communication, and long-term effectiveness of implemented controls.

Regulatory Considerations: Communicating Rhythmic Value

Regulatory agencies are increasingly interested in risk-based approaches that demonstrate genuine process understanding and continuous improvement capabilities. Rhythmic quality risk management strengthens regulatory relationships by showing sophisticated thinking about process optimization and quality enhancement within established frameworks.

When communicating with regulatory agencies, emphasize how rhythmic approaches improve process understanding, enhance control strategy development, and support continuous improvement objectives. Show how structured flexibility leads to better patient protection through more responsive and adaptive quality systems.

Focus regulatory communications on how enhanced risk understanding leads to better quality outcomes rather than on operational efficiency benefits that might appear secondary to regulatory objectives. Demonstrate how rhythmic approaches maintain analytical rigor while enabling more effective responses to emerging quality challenges.

The Future of Quality Risk Management: Beyond Rhythm to Resonance

As we master rhythmic approaches to quality risk management, the next evolution involves what I call “quality resonance”—the phenomenon that occurs when individual quality rhythms align and amplify each other across organizational boundaries. Just as musical instruments can create resonance that produces sounds more powerful than any individual instrument, quality organizations can achieve resonant states where risk management effectiveness transcends the sum of individual contributions.

Resonant quality organizations share several characteristics:

Synchronized Rhythm Networks: Quality rhythms in different departments, processes, and product lines align to create organization-wide patterns of risk awareness and response capability.
Harmonic Risk Communication: Information flows between quality functions create harmonics that amplify important signals while filtering noise, enabling more effective decision-making at all organizational levels.
Emergent Quality Intelligence: The interaction of multiple rhythmic quality processes generates insights and capabilities that wouldn’t be possible through individual efforts alone.

Building toward quality resonance requires sustained commitment to rhythmic principles, continuous refinement of quality cadences, and patient development of organizational capability. The payoff, however, is transformational: quality risk management that not only prevents problems but actively creates value through enhanced understanding, improved processes, and strengthened competitive position.

Finding Your Quality Beat

Uncertainty is inevitable in pharmaceutical manufacturing, regulatory environments, and global supply chains. As Hudson emphasizes, the choice is whether to exhaust ourselves trying to conduct every quality note or to lay down rhythms that enable entire teams to create something extraordinary together.

Tomorrow morning, when you walk into that risk assessment meeting, you’ll face this choice in real time. Will you pick up the conductor’s baton, trying to control every analytical voice? Or will you sit at the back of the stage and create the beat on which your quality team can find its flow?

The research is clear: rhythmic approaches to complex work create better outcomes, higher engagement, and more sustainable performance. The ICH Q9(R1) framework provides the flexibility needed to implement rhythmic quality risk management while maintaining regulatory compliance. The tools and techniques exist to transform quality risk management from a defensive necessity into an adaptive capability that drives innovation and competitive advantage.

The question isn’t whether rhythmic quality risk management will emerge—it’s whether your organization will lead this transformation or struggle to catch up. The teams that master quality rhythm first will be best positioned to thrive in our increasingly BANI pharmaceutical world, turning uncertainty into opportunity while maintaining the rigorous standards our patients deserve.

Start with one beat. Find one aspect of your current quality risk management where you can separate exploration from analysis, create space for reflection, or enable someone to lead. Feel the difference that rhythm makes. Then gradually expand, building the quality jazz ensemble that our complex manufacturing world demands.

The rhythm section is waiting. It’s time to find your quality beat.

The Minimal Viable Risk Assessment Team

Ineffective risk management and quality systems revolve around superficial risk management. The core issue? Teams designed for compliance as a check-the-box activity rather than cognitive rigor. These gaps create systematic blind spots that no checklist can fix. The solution isn’t more assessors—it’s fewer, more competent ones anchored in science, patient impact, and lived process reality.

Cognitive Foundations of Risk Management Excellence

Core Roles: The Non-Negotiables

1. Process Owner: The Reality Anchor

Not a title. A lived experience. Superficial ownership creates the “unjustified assumptions.” This role requires daily engagement with the process—not just signature authority. Without it, assumptions go unchallenged.

2. ASTM E2500 Molecule Steward: The Patient’s Advocate

Beyond “SME”—the protein whisperer. This role demands provable knowledge of degradation pathways, critical quality attributes (CQAs), and patient impact. Contrast this with generic “subject matter experts” who lack molecule-specific insights. Without this anchor, assessments overlook patient-centric failure modes.

3. Technical System Owner: The Engineer

The value of the Technical System Owner—often the engineer—lies in their unique ability to bridge the worlds of design, operations, and risk control throughout the pharmaceutical lifecycle. Far from being a mere custodian of equipment, the system owner is the architect who understands not just how a system is built, but how it behaves under real-world conditions and how it integrates with the broader manufacturing program

4. Quality: The Cognitive Warper

Forget the auditor—this is your bias disruptor. Quality’s value lies in forcing cross-functional dialogue, challenging tacit assumptions, and documenting debates. When Quality fails to interrogate assumptions, hazards go unidentified. Their real role: Mandate “assumption logs” where every “We’ve always done it this way” must produce data or die.

A Venn diagram with three overlapping blue circles, each representing a different role: "Process Owner: The Reality Anchor," "Molecule Steward: The Patient’s Advocate," and "Technical System Owner: The Engineer." In the center, where all three circles overlap, is a green dashed circle labeled "Quality: Cognitive Warper." Each role has associated bullet points in colored dots:

Process Owner (top left): "Daily Engagement" and "Lived Experience" (blue dots).

Molecule Steward (top right): "Molecular specific insights" and "Patient-centric" (blue dots).

Technical System Owner (bottom): "The How’s" and "Technical understanding" (blue dots).

Additional points for Technical System Owner (bottom right): "Bias disruptor" and "Interrogate assumptions" (green dots).

The diagram visually emphasizes the intersection of these roles in achieving quality through cognitive diversity.

Team Design as Knowledge Preservation

Team design in the context of risk management is fundamentally an act of knowledge preservation, not just an exercise in filling seats or meeting compliance checklists. Every effective risk team is a living repository of the organization’s critical process insights, technical know-how, and nuanced operational experience. When teams are thoughtfully constructed to include individuals with deep, hands-on familiarity—process owners, technical system engineers, molecule stewards, and quality integrators—they collectively safeguard the hard-won lessons and tacit knowledge that are so often lost when people move on or retire. This approach ensures that risk assessments are not just theoretical exercises but are grounded in the practical realities that only those with lived experience can provide.

Combating organizational forgetting requires more than documentation or digital knowledge bases; it demands intentional, cross-functional team design that fosters active knowledge transfer. When a risk team brings together diverse experts who routinely interact, challenge each other’s assumptions, and share context from their respective domains, they create a dynamic environment where critical information is surfaced, scrutinized, and retained. This living dialogue is far more effective than static records, as it allows for the continuous updating and contextualization of knowledge in response to new challenges, regulatory changes, and operational shifts. In this way, team design becomes a strategic defense against the silent erosion of expertise that can leave organizations exposed to avoidable risks.

Ultimately, investing in team design as a knowledge preservation strategy is about building organizational resilience. It means recognizing that the greatest threats often arise not from what is known, but from what is forgotten or never shared. By prioritizing teams that embody both breadth and depth of experience, organizations create a robust safety net—one that catches subtle warning signs, adapts to evolving risks, and ensures that critical knowledge endures beyond any single individual’s tenure. This is how organizations move from reactive problem-solving to proactive risk management, turning collective memory into a competitive advantage and a foundation for sustained quality.

Call to Action: Build the Risk Team

Moving from compliance theater to true protection starts with assembling a team designed for cognitive rigor, knowledge depth and psychological safety.

Start with a Clear Charter, Not a Checklist

An excellent risk team exists to frame, analyse and communicate uncertainty so that the business can make science-based, patient-centred decisions. Assigning authorities and accountabilities is a leadership duty, not an after-thought. Before naming people, write down:

the decisions the team must enable,
the degree of formality those decisions demand, and
the resources (time, data, tools) management will guarantee.

Without this charter, even star performers will default to box-ticking.

Fill Four Core Seats – And Prove Competence

ICH Q9 is blunt: risk work should be done by interdisciplinary teams that include experts from quality, engineering, operations and regulatory affairs. ASTM E2500 translates that into a requirement for documented subject-matter experts (SMEs) who own critical knowledge throughout the lifecycle. Map those expectations onto four non-negotiable roles.

Process Owner – The Reality Anchor: This individual has lived the operation in the last 90 days, not just signed SOPs. They carry the authority to change methods, budgets and training, and enough hands-on credibility to spot when a theoretical control will never work on the line. Authentic owners dismantle assumptions by grounding every risk statement in current shop-floor facts.
Molecule Steward – The Patient’s Advocate: Too often “SME” is shorthand for “the person available.” The molecule steward is different: a scientist who understands how the specific product fails and can translate deviations into patient impact. When temperature drifts two degrees during freeze-drying, the steward can explain whether a monoclonal antibody will aggregate or merely lose a day of shelf life. Without this anchor, the team inevitably under-scores hazards that never appear in a generic FMEA template.
Technical System Owner – The Engineering Interpreter: Equipment does not care about meeting minutes; it obeys physics. The system owner must articulate functional requirements, design limits and integration logic. Where a tool-focused team may obsess over gasket leaks, the system owner points out that a single-loop PLC has no redundancy and that a brief voltage dip could push an entire batch outside critical parameters—a classic case of method over physics.
Quality Integrator – The Bias Disruptor: Quality’s mission is to force cross-functional dialogue and preserve evidence. That means writing assumption logs, challenging confirmation bias and ensuring that dissenting voices are heard. The quality lead also maintains the knowledge repository so future teams are not condemned to repeat forgotten errors.

Secure Knowledge Accessibility, Not Just Possession

A credentialed expert who cannot be reached when the line is down at 2 a.m. is as useful as no expert at all. Conduct a Knowledge Accessibility Index audit before every major assessment.

Embed Psychological Safety to Unlock the Team’s Brainpower

No amount of SOPs compensates for a culture that punishes bad news. Staff speak up only when leaders are approachable, intolerant of blame and transparent about their own fallibility. Leaders must therefore:

Invite dissent early: begin meetings with “What might we be overlooking?”
Model vulnerability: share personal errors and how the system, not individuals, failed.
Reward candor: recognize the engineer who halted production over a questionable trend.

Psychological safety converts silent observers into active risk sensors.

Choose Methods Last, After Understanding the Science

Excellent teams let the problem dictate the tool, not vice versa. They build a failure-tree or block diagram first, then decide whether FMEA, FTA or bow-tie analysis will illuminate the weak spot. If the team defaults to a method because “it’s in the SOP,” stop and reassess. Tool selection is a decision, not a reflex.

Provide Time and Resources Proportionate to Uncertainty

ICH Q9 asks decision-makers to ensure resources match the risk question. Complex, high-uncertainty topics demand longer workshops, more data and external review, while routine changes may only need a rapid check. Resist the urge to shoehorn every assessment into a one-hour meeting because calendars are overloaded.

Institutionalize Learning Loops

Great teams treat every assessment as both analysis and experiment. They:

Track prediction accuracy: did the “medium”-ranked hazard occur?
Compare expected versus actual detectability: were controls as effective as assumed?
Feed insights into updated templates and training so the next team starts smarter.

The loop closes when the knowledge base evolves at the same pace as the plant.

When to Escalate – The Abort-Mission Rule

If a risk scenario involves patient safety, novel technology and the molecule steward is unavailable, stop. The assessment waits until a proper team is in the room. Rushing ahead satisfies schedules, not safety.

Conclusion

Excellence in risk management is rarely about adding headcount; it is about curating brains with complementary lenses and giving them the culture, structure and time to think. Build that environment and the monsters stay on the storyboard, never in the plant.

Assessing the Quality of Our Risk Management Activities

The Pre-Mortem

A pre-mortem is a proactive risk management exercise that enables pharmaceutical teams to anticipate and mitigate failures before they occur. This tool can transform compliance from a reactive checklist into a strategic asset for safeguarding product quality.

Pre-Mortems in Pharmaceutical Quality Systems

In GMP environments, where deviations in drug substance purity or drug product stability can cascade into global recalls, pre-mortems provide a structured framework to challenge assumptions. For example, a team developing a monoclonal antibody might hypothesize that aggregation occurred during drug substance purification due to inadequate temperature control in bioreactors. By contrast, a tablet manufacturing team might explore why dissolution specifications failed because of inconsistent API particle size distribution. These exercises align with ICH Q9’s requirement for systematic hazard analysis and ICH Q10’s emphasis on knowledge management, forcing teams to document tacit insights about process boundaries and failure modes.

Pre-mortems excel at identifying “unknown unknowns” through creative thinking. Their value lies in uncovering risks traditional assessments miss. As a tool it can usually be strongly leveraged to identify areas for focus that may need a deeper tool, such as an FMEA. In practice, pre-mortems and FMEA are synergistic through a layered approach which satisfies ICH Q9’s requirement for both creative hazard identification and structured risk evaluation, turning hypothetical failures into validated control strategies.

By combining pre-mortems’ exploratory power with FMEA’s rigor, teams can address both systemic and technical risks, ensuring compliance while advancing operational resilience.

Implementing Pre-Mortems

1. Scenario Definition and Stakeholder Engagement

Begin by framing the hypothetical failure, the risk question. For drug substances, this might involve declaring, “The API batch was rejected due to genotoxic impurity levels exceeding ICH M7 limits.” For drug products, consider, “Lyophilized vials failed sterility testing due to vial closure integrity breaches.” Assemble a team spanning technical operations, quality control, and regulatory affairs to ensure diverse viewpoints.

2. Failure Mode Elicitation

To overcome groupthink biases in traditional brainstorming, teams should begin with brainwriting—a silent, written idea-generation technique. The prompt is a request to list reasons behind the risk question, such as “List reasons why the API batch failed impurity specifications”. Participants anonymously write risks on structured templates for 10–15 minutes, ensuring all experts contribute equally.

The collected ideas are then synthesized into a fishbone (Ishikawa) diagram, categorizing causes relevant branches, using a 6 M technique.

This method ensures comprehensive risk identification while maintaining traceability for regulatory audits.

3. Risk Prioritization and Control Strategy Development

Risks identified during the pre-mortem are evaluated using a severity-probability-detectability matrix, structured similarly to Failure Mode and Effects Analysis (FMEA).

4. Integration into Pharmaceutical Quality Systems

Mitigation plans are formalized in in control strategies and other mechanisms.

Case Study: Preventing Drug Substance Oxidation in a Small Molecule API

A company developing an oxidation-prone API conducted a pre-mortem anticipating discoloration and potency loss. The exercise revealed:

Drug substance risk: Inadequate nitrogen sparging during final isolation led to residual oxygen in crystallization vessels.
Drug product risk: Blister packaging with insufficient moisture barrier exacerbated degradation.

Mitigations included installing dissolved oxygen probes in purification tanks and switching to aluminum-foil blisters with desiccants. Process validation batches showed a 90% reduction in oxidation byproducts, avoiding a potential FDA Postmarketing Commitment

The Risk Question

The risk question established the purpose and scope – the context of the risk assessment. This step is critical since it sets the risk assessment’s direction, tone, and expectations. From this risk question stems the risk team; the degree, extent, or rigor of the assessment; the risk assessment methodologies; the risk criteria; and levels of acceptable risk.

The risk problem needs to be clear, concise, and well understood by all stakeholders. Every successful risk assessment needs a tightly defined beginning and end, so the assessment team can set good boundaries for the assessment with internal (resources, knowledge, culture, values, etc) and external (technology, legal, regulatory, economy, perceptions of external stakeholders, etc) parameters in mind.

To ensure the risk team focuses on the correct elements, the risk question should clearly explain what is expected. For example:

For a risk assessment of potential emergencies/disasters, should the assessment be limited to emergencies/disasters at facility sites or include events off-site? Should it include natural, manmade, or technological emergencies/disasters, or all of them?
If the hazards associated with the job of repairing a porch as to be assessed, would it just cover the actual porch repair, or would it include hazards like setting up the space, bringing materials on site, and the hazards associated with use/not-use of the porch?
If the risk assessment covers getting a new family dog does it include just those associated with the dog, or does it include changes to the schedule or even next year’s vacation?

Setting the scope too narrow on the risk question might prevent a hazard and the resulting risk from being identified and assessed or making it too broad could prevent the risk assessment from getting to the real purpose.

Risk questions can be broken down in a tree structure to more define scopes, which can help drive effective teams.

For example, if we are doing a risk assessment on changing the family’s diet, it might look like this:

The current draft of ICH Q9 places a lot of importance on the risk question, rightfully so. As a tool it helps focus and define the risk assessment, producing better results.