"The greatest risk is often not the one we identify. It's the one we never think to question."
If you ask most people what comes to mind when they hear the term risk management, you'll probably hear words like risk register, heat map, risk matrix, or mitigation plan. While those tools are important, they are not risk management; they are the documentation produced throughout the risk management process.
Real risk management begins much earlier. It begins with curiosity and with leaders and teams willing to ask questions that others overlook. Questions like "What assumptions are we making? What could surprise us? Where are we most vulnerable? Which risks have we accepted simply because "it's always been that way? Are we solving today's problems while overlooking tomorrow's?" Those questions, not the spreadsheets, form the foundation of the risk-based quality management approach envisioned by ICH E6(R3).
In our previous article, Why Organizations Keep Solving the Wrong Problems, we explored how organizations often become trapped by recurring issues because they rush toward solutions instead of investing time to understand the problem. Risk management suffers from the very same challenge. When organizations treat risk management as a documentation exercise rather than a way of thinking, they inevitably miss the very risks that matter most.
A New Way of Thinking About Quality
Clinical research has always involved uncertainty. Every protocol amendment, vendor transition, technology implementation, enrollment challenge, staffing change, or investigational product shipment introduces uncertainty that has the potential to affect participant safety, data integrity, or regulatory compliance. What's changed with ICH E6(R3) isn't the existence of these risks but rather the expectation that organizations proactively identify, evaluate, control, communicate, and continuously monitor them throughout the entire clinical trial lifecycle.
This represents far more than a regulatory update. It represents a shift in mindset.
For decades, many quality systems have been built around finding problems after they occur. Investigations, audits, CAPAs, and inspection readiness activities often begin only after a deviation has been identified or a regulatory inspection is imminent. ICH E6(R3) challenges organizations to think differently. Instead of asking, "What went wrong?", organizations are encouraged to ask, "What could go wrong and how would we know before it does?" That subtle difference changes everything.
Risk Management Is a Leadership Discipline
One of the biggest misconceptions surrounding ICH E6 (R3) is that it introduces additional documentation requirements. It doesn't. What it introduces a different way of thinking.
Effective risk management requires organizations to become comfortable asking difficult questions before the answers are obvious. It requires leaders who challenge assumptions, encourage healthy debate, tolerate uncertainty long enough to understand it, and create environments where concerns are raised early instead of after problems have already occurred. More than compliance know-how, these are leadership competencies.
Risk management cannot exist independently of quality culture. Organizations that discourage difficult conversations, reward speed over thoughtful analysis, or accept recurring issues as "business as usual" will inevitably struggle to implement meaningful risk-based quality management regardless of how sophisticated their documentation may appear.
From Crisis Management to Quality Management
Throughout my career, I've met many quality professionals working with sponsors, CROs, and clinical research sites who jokingly referred to themselves as members of the Crisis Management Department rather than the Quality Management Department. Behind their humor lies an uncomfortable truth.
Budget constraints, aggressive timelines, competing priorities, and limited resources have conditioned many organizations to operate reactively. Quality professionals spend much of their time putting out fires rather than building resilience. The result is a cycle of perpetual reaction.
Risk management offers an opportunity to break that cycle, not by predicting every possible problem, but by creating systems that recognize vulnerabilities before they become recurring problems or audit findings.
Why Organizations Struggle
Most organizations understand why risk management is important but fall short when it comes to knowing where to focus. Questions I typically hear from clients include:
- How should we score risk?
- Which methodology should we use?
- How often should risks be reassessed?
- What documentation will satisfy regulators?
- How much detail is enough?
Those are important questions, but they are rarely the hardest ones. The difficult question is this: What if we're worried about the wrong things?
Organizations frequently devote significant effort to mitigating familiar, low-impact risks because they know how to manage them. Meanwhile, higher-impact assumptions often remain unchallenged because no one thought to question them.
The goal of risk management isn't to identify every conceivable risk, it's to identify the risks that matter most. That requires thoughtful discussion, cross-functional collaboration, and a willingness to challenge long-held assumptions.
When Risk Management Becomes Paperwork
Without strong governance and a healthy quality culture, risk management can quickly become an administrative exercise. The discussion quietly shifts from "What keeps us up at night?" to "Has everyone completed their section of the report or spreadsheet?"
One conversation improves clinical trials; the other produces documentation.
ICH E6(R3) clearly expects the first. Quality systems should produce documentation. Documentation should never become the purpose of the quality system.
Building a Framework That Encourages Better Thinking
Every organization is different. A growing biotechnology company preparing for its first Phase I study experiences a different level of maturity than a global sponsor managing dozens of multinational clinical trials. Therefore, an effective quality risk management framework should be practical, scalable, and proportionate to the organization's size, complexity, and portfolio. More importantly, it should encourage better thinkin, not replace it.
The strongest frameworks help organizations:
- Identify the factors that are truly critical to quality.
- Integrate risk discussions into routine operational decision-making.
- Apply consistent methodologies for evaluating and prioritizing risk across functions.
- Monitor meaningful quality and performance indicators and metrics.
- Focus oversight activities where they create the greatest value.
- Encourage communication across functional teams.
- Continuously reassess assumptions as studies evolve.
A strong quality and risk management framework should make good thinking repeatable.
The Future Belongs to Organizations That Think Differently
Quality and risk should never be an afterthought. Organizations that embrace risk-based quality management don't simply become more compliant, they become more resilient, identify issues earlier, allocate resources more effectively, reduce operational rework, improve data reliability, strengthen inspection readiness, and protect study participants while accelerating the development of new therapies.
The future of clinical research will not belong to the organizations with the largest quality departments or the most sophisticated risk registers; it will belong to the organizations that learn to think differently by challenging assumptions, investigating deeply instead or reacting quickly, and viewing uncertainty as something to explore rather than something to avoid.
Risk management isn't about predicting the future. It's about creating organizations that are prepared for it.
How Cedar and Stone Can Help
At Cedar and Stone, we believe quality risk management is a strategic capability that enables organizations to make better decisions.
Drawing on decades of experience in clinical research, quality management, regulatory compliance, and GXP auditing, we partner with sponsors, CROs, Phase I units, and clinical research sites to build practical, sustainable quality systems aligned with ICH E6 (R3).
Whether you're establishing your first Quality Management System, implementing a Quality Risk Management framework, preparing for regulatory inspections, or strengthening an existing quality program, our people-centered approach focuses on more than compliance. We work alongside your team to develop the capabilities, governance, and quality culture needed to support lasting improvement.