WHO is rewriting its QRM guideline: what's new in the QAS/26.994 draft
WHO put a redrafted quality risk management guideline out for comment on 18 September 2026. Comments close 15 November. The structure barely moved; the work is in what was added. Here is what is new, where it comes from, and what to check in your own QRM procedure.
On 18 September 2026 the WHO published a rewritten QRM guideline for consultation, working document QAS/26.994. Comments close on 15 November 2026.
Adoption is still a year off: comments get processed in early 2027, followed by two more rounds with the drafting group and presentation to the Expert Committee in October 2027. So the document binds nobody today. That is exactly why it is worth reading now, because this is the only window in which the text still moves.
Most of it is unchanged
Put the draft next to the 2013 guideline (TRS 981, Annex 2) and the difference is smaller than the page count suggests. Same six chapters, same numbering, large passages carried over word for word. If your QRM procedure was written against the 2013 text, nothing here invalidates it.
What is actually new
Section 3.9 on subjectivity is the main addition. The WHO names the causes outright: poorly designed scoring systems, assessors who rate the same hazard differently, and cognitive bias. Subjectivity cannot be eliminated, but it can be managed, and 3.9.1 sets out how: knowledge management, data analysis, explicit decision criteria, and risk tolerance agreed in advance.
Section 3.10 covers risk-based decision making. A sound decision draws on the best available knowledge including tacit knowledge and experience, records its assumptions, and revisits them as soon as something changes. A weak one shows "an insufficient use of knowledge" and "a high level of subjectivity".
Beyond that, 3.6.1 now requires the risk review to be documented and reported, not just performed. Sections 4.5.1 and 4.5.2 cover where QRM meets deviations, change control and CAPA, and how it plays out on the manufacturing floor. And in 6.1 and 6.2, Preliminary Hazard Analysis gets its own treatment rather than a mention in a list, with the supporting statistical techniques (control charts, process capability, design of experiments, regression, Pareto) now properly included. The basis throughout is ICH Q9(R1); anyone who has worked with it will recognise most of this.
On formality
The draft calls formality "a continuum (or spectrum)", explicitly not a binary. Plenty of companies read that as permission to document less. It reads better as an instruction to move the effort to where the risk actually is, which usually means doing more somewhere rather than less everywhere. A room full of people who can recite that formality is a spectrum, and who then still run every assessment as a full FMEA, has learned nothing.
Chapter 5 is the one to read
Chapter 5 tells medicines regulators how to apply QRM to themselves. Q9(R1) has no equivalent, which is what makes it the most interesting part of the document. Authorities are expected to hold a documented risk management plan, reviewed at least annually. Inspection frequency follows a risk score built from the outcome of the previous inspection, site and process complexity, product type, complaints and recalls, change frequency, test results and patient risk: routine inspections every 12, 18 or 24 months depending on the score, capped at 48 months. The same score drives the number of inspectors and inspection days, and whether a complaint leads to a desk review or an on-site visit.
Section 5.3, on inspecting QRM at a manufacturing site, is effectively the checklist that will be run against your own system. If you supply markets that rely on WHO prequalification, or your site is inspected by an authority that follows the WHO line, that chapter is worth the reading time even if you never submit a comment.