A Practical Risk Register for Pharma Projects | Mastering Projects in Pharma

By Dr Michal Urban · Mastering Projects in Pharma · Published 25 October 2026 · 7 min read

Quick answer

Your milestone is approaching, but "recruitment delays" and "supplier problems" still tell nobody when to act. Useful pharma project risk management connects each uncertainty to a delivery objective, an owner, a response and a trigger. Keep the register focused on decisions. Route quality, patient-safety and regulatory concerns through the formal processes that govern the work.

Start with the handoff that could derail the milestone

Imagine a milestone meeting. The register says "recruitment delays", but nobody can explain which dependency is threatened or what would prompt action. Start with a more useful question: "What must be true for the next milestone, and which function controls that dependency?"

For this article, use a simple project convention: a possible future recruitment shortfall is a risk; a shortfall that has already happened is an issue requiring resolution. This distinction is not a definition prescribed by ICH Q9(R1). It helps the team distinguish prevention from recovery.

Use the milestone question across the lifecycle: evidence before development decisions; sites and reliable data before clinical milestones; submission readiness before regulatory review; equipment readiness before manufacturing transfer; and supplier capability before commercial manufacture.

WHO's 2022 technology-transfer guidance says equipment and instruments should be qualified and calibrated before supporting transfer activities. In plain English: demonstrate suitability and check measurement accuracy before handing over manufacturing knowledge and processes. Turn "equipment problems" into a specific readiness dependency with an accountable owner.

A project register is not a quality-system record

A possible recruitment delay raises a delivery question: can the trial reach its next milestone? An actual data-integrity concern raises a specialist question: can the study evidence be trusted? These concerns belong to different processes: a project register tracks delivery risks, while an actual data-integrity concern requires appropriate investigation and corrective action.

FDA states that sponsors or applicants are responsible for study-data integrity and lists notifications involving studies it found unacceptable. When a concern is actual, a register entry cannot substitute for investigation or required corrective action. Follow applicable procedures and involve the responsible specialists, rather than treating the concern only as a future schedule risk.

Concern	Project register	Specialist process
Potential recruitment shortfall	Track the milestone dependency, forecast, owner and response.	Assess implications for the protocol, participant protection and data quality; follow applicable trial procedures.
Actual study-data integrity concern	Track the delivery consequence, decision owner and dependency on the investigation.	Investigate reliability and retain findings and required corrective action in the governing records.

Educational distinction: one concern may require both delivery tracking and specialist action.

ICH Q9(R1) links quality-risk evaluation to scientific knowledge and patient protection. It cannot justify an otherwise unacceptable practice. A manageable schedule impact is therefore not permission to accept an unacceptable quality or safety concern.

Connect records rather than creating competing accounts. Keep the project dependency and owner visible, then cross-reference the governing deviation record (a recorded departure from an approved procedure) or the relevant change-control, corrective-action or quality-risk record. Let the authoritative process retain the specialist assessment.

A high score is not the same as a sound decision

"We have scored the risks, so we know the priorities."

Not necessarily. ICH Q9(R1) recognises subjectivity in identifying hazards and estimating probability, severity and response effectiveness. A numerical result can make an uncertain judgement look more precise without making it better.

Define what likelihood and impact mean before comparing entries. Document the evidence, assumptions and uncertainty. Consider timing, dependencies and, where relevant, detectability: how readily the problem could be found before its consequence. Multiplying scores is a possible assessment convention, not a universal ICH formula.

Ask colleagues from the relevant functions to challenge the assessment. Record unresolved disagreement and identify what evidence would change the decision. Keep delivery exposure separate from quality, safety and compliance exposure; a low schedule score must not neutralise a specialist concern.

Turn a vague concern into an actionable risk entry

Take one concern and write it as: "Because of this cause, this event may happen, leading to this consequence." Then identify the decision the team needs to make. At Mastering Projects in Pharma, we present the template below as an educational aid, not a regulator-prescribed record.

FDA's April 2023 guidance on risk-based clinical-investigation monitoring addresses monitoring planning, plan content and communication of results. It supports assessing clinical concerns systematically. It does not prescribe this project-register template.

Risk register entry checklist

Identify the entry: give it a unique ID, lifecycle phase and category.
Write the cause, uncertain event and consequence for the project objective.
Assess likelihood and impact with rationale; record evidence, uncertainty, timing, dependencies and relevant detectability.
Assign an accountable risk owner, named action owners and action due dates.
Define the preventive response, trigger, contingency and escalation route.
Link governing formal records; record the decision-maker, rationale, assumptions and unresolved disagreement.
Maintain the status and next review date.

Separate ownership from task allocation. The accountable risk owner coordinates the response and brings decisions to the right forum. Action owners complete the agreed tasks. A trigger should tell them when exposure has changed enough to require action, not merely that the risk still exists.

Illustrative recruitment risk (educational example)

Risk statement	Because the trial relies on a small pool of eligible sites, enrolment may fall below plan by the interim milestone, delaying database lock (the finalisation of the trial database for analysis) and submission.
Accountable owner	Clinical operations lead
Preventive response	Validate site-level recruitment assumptions, monitor enrolment weekly and prepare qualified backup sites.
Trigger	Enrolment below an agreed forecast threshold; threshold to be agreed.
Contingency	Activate qualified backup sites through applicable procedures and reforecast.
Rationale, dependencies, detectability	To be assessed with the responsible functions.
Action owners and due dates	To be agreed.
Next review	Next governance checkpoint; date to be agreed.

Separately assess protocol compliance, participant protection and data-quality implications. Cross-reference any governing formal records rather than replacing them with this entry.

When should a pharma project risk register be reviewed?

Review a pharma project risk register at a cadence suited to its exposure, and whenever evidence, assumptions or dependencies change. A meeting schedule alone is not enough. Each review should establish whether the concern is still uncertain, whether the response is working and whether a decision, escalation or reclassification is needed.

ICH Q9(R1) includes risk review but does not prescribe a universal project-register frequency. Agree a regular project cadence and event-driven triggers. A missed milestone, supplier change, significant deviation, unexpected data trend or regulatory feedback should prompt a review of affected entries.

Keep the review centred on decisions: what changed, which action is due, who can decide and what needs escalation? Record the decision and rationale. Close obsolete entries, reclassify realised risks as issues and update links to formal records without duplicating their contents.

Be especially careful with regulatory milestones. Regulatory review timing and outcomes remain uncertain. Track submission completeness, capacity to respond and schedule contingency, but do not turn a speculative approval date into an assured commitment. Decide what the team will do if the planning assumption changes.

Build the skills behind the register

Bring the entry that is blocking your next decision to the next cross-functional meeting. Ask the group to agree an owner, response, trigger and review date. If that conversation stalls, more spreadsheet fields are unlikely to solve the capability gap.

The learning need is to assess evidence, coordinate responsibilities and facilitate decisions across functions. Keep that education separate from medical or regulatory advice. Company procedures and qualified quality, regulatory and safety specialists remain essential wherever those concerns arise.

Build your pharma project management skills

If your risk register lists concerns but leaves decisions unresolved, explore the Pharmaceutical Project Management Course: practical lessons, live workshops and reviewed assignments to strengthen your project-management skills.

Explore the course → | Try the free lessons

Sources

This article is educational and does not constitute medical, regulatory or legal advice. Follow your company procedures and consult qualified specialists.

← Back to all articles