What is the first step in risk management according to ICH E6(R3)?

• A. Risk elimination: remove all risks before starting
• B. Risk identification: identify risks that may impact critical quality factors prior to trial initiation and throughout the trial
• C. Risk transfer: delegate all risk to vendors
• D. Risk acceptance: assume risks are low and ignore them

Answer: (B)

Identifying potential risks that may impact critical quality factors before starting and throughout the trial is the essential first step in risk management. You can’t plan or implement effective controls, monitoring, or vendor oversight without knowing what could go wrong. This identification lays the groundwork for evaluating how serious each risk could be, how likely it is, and how detectable it would be, which then informs prioritization and mitigation actions.

In ICH E6(R3), a risk-based approach starts with recognizing risks early in the trial lifecycle and keeps evolving as new information emerges. Once risks are identified, you can develop strategies to prevent or detect problems, allocate resources, and maintain data integrity and patient safety.

Why the other ideas don’t fit as the first step: attempting to eliminate all risks before the trial is not realistic, since some risk will always exist and must be managed rather than assumed away. Transferring all risk to vendors or simply accepting and ignoring risks ignores the reality that risks must be identified and assessed first, so appropriate controls can be put in place.