25370417dft_RiskManagementPlans.docx

04/26/22

Risk Management Plans 

to Mitigate the Potential 

for Drug Shortages 

Guidance for Industry 

DRAFT GUIDANCE

This guidance document is being distributed for comment purposes only.

Comments and suggestions regarding this draft document should be submitted within 60 days of 

publication in the Federal Register of the notice announcing the availability of the draft 

guidance. Submit electronic comments to https://www.regulations.gov. Submit written 

comments to the Dockets Management Staff (HFA-305), Food and Drug Administration, 5630 

Fishers Lane, Rm. 1061, Rockville, MD 20852. All comments should be identified with the 

docket number listed in the notice of availability that publishes in the Federal Register. 

For questions regarding this draft document, contact (CDER) Karen Takahashi at 301-796-3191 

or (CBER) the Office of Communication, Outreach, and Development at 800-835-4709 or 240-

402-8010. 

U.S. Department of Health and Human Services

Food and Drug Administration 

Center for Drug Evaluation and Research (CDER)

Center for Biologics Evaluation and Research (CBER) 

May 2022 

Pharmaceutical Quality/Manufacturing Standards (CGMP)
Risk Management Plans 

to Mitigate the Potential 

for Drug Shortages 

Guidance for Industry 

Additional copies are available from:

Office of Communications, Division of Drug Information

Center for Drug Evaluation and Research

Food and Drug Administration

10001 New Hampshire Ave., Hillandale Bldg., 4th Floor 

Silver Spring, MD 20993-0002 

Phone: 855-543-3784 or 301-796-3400; Fax: 301-431-6353; Email: druginfo@fda.hhs.gov

https://www.fda.gov/drugs/guidance-compliance-regulatory-information/guidances-drugs

and/or

Office of Communication, Outreach, and Development 

Center for Biologics Evaluation and Research

Food and Drug Administration

10903 New Hampshire Ave., Bldg. 71, Room 3128

Silver Spring, MD 20993-0002

Phone: 800-835-4709 or 240-402-8010; Email: ocod@fda.hhs.gov

https://www.fda.gov/vaccines-blood-biologics/guidance-compliance-regulatory-information-biologics/biologicsguidances

U.S. Department of Health and Human Services

Food and Drug Administration 

Center for Drug Evaluation and Research (CDER)

Center for Biologics Evaluation and Research (CBER) 

May 2022 

Pharmaceutical Quality/Manufacturing Standards (CGMP)
TABLE OF CONTENTS

I. INTRODUCTION............................................................................................................. 1

II. BACKGROUND ............................................................................................................... 2

III. RISK MANAGEMENT PLANS: STAKEHOLDERS AND PRODUCTS ................ 4

A. Stakeholders in the Manufacturing Supply Chain .....................................................................4

B. Products for Which RMPs Are Required....................................................................................5

C. Products for Which RMPs Are Recommended ..........................................................................7

IV. RMP FRAMEWORK AND DEVELOPMENT STRATEGY...................................... 9

A. Stakeholder RMP Development Strategy....................................................................................9

B. Quality Risk Management Process Framework .......................................................................10

1. Initiating an RMP ..........................................................................................................................11

2. Risk Assessment .............................................................................................................................11

3. Risk Control ...................................................................................................................................12

4. Risk Review: Review Events..........................................................................................................13

5. Risk Communication ......................................................................................................................13

6. Risk Management Tools.................................................................................................................14

APPENDIX: RISK CONSIDERATIONS FOR SPECIFIC RMPS...................................... 15
Contains Nonbinding Recommendations 

Draft — Not for Implementation

1

1 Risk Management Plans to 

2 Mitigate the Potential for Drug Shortages

Guidance for Industry1 3 

 4 

 5 

 6 

7 

8 This draft guidance, when finalized, will represent the current thinking of the Food and Drug 

9 Administration (FDA or Agency) on this topic. It does not establish any rights for any person and is not 

10 binding on FDA or the public. You can use an alternative approach if it satisfies the requirements of the 

11 applicable statutes and regulations. To discuss an alternative approach, contact the FDA staff responsible 

12 for this guidance as listed on the title page.

13 

 14 

 15 

 16 

17 I. INTRODUCTION 

 18 

This guidance is intended to help stakeholders2 19 develop, maintain, and implement risk 

20 management plans (RMPs) to proactively assist in the prevention of human drug product and 

biological product shortages.3 21 RMPs can provide stakeholders with a framework to proactively 

22 identify, prioritize, and implement strategies to mitigate hazards that can cause a supply 

23 disruption. Such a supply disruption may lead to a drug shortage. Effective quality risk 

24 management can facilitate better, more informed decisions; can provide FDA with greater 

25 assurance that stakeholders understand and can manage the associated risks; and can potentially 

1 This guidance has been prepared by the Office of Pharmaceutical Quality (OPQ) in the Center for Drug Evaluation 

and Research (CDER) in cooperation with the Center for Biologics Evaluation and Research (CBER) at the Food 

and Drug Administration. In preparing this guidance, OPQ has also consulted with the Center for Devices and 

Radiological Health and the Office of Combination Products. 2 For the purposes of this guidance, the term stakeholder includes each manufacturer of a drug described in section 

506C(a) of the Federal Food, Drug, and Cosmetic Act (FD&C Act) (21 U.S.C. 356c(a)) or of any active 

pharmaceutical ingredient (API) included in such drugs. (See generally section 506C(j) of the FD&C Act.) The 

term stakeholder also broadly includes any person or entity who has oversight and control over the manufacture of 

drugs to ensure quality or owns or operates an establishment (as defined in 21 CFR 207.1 and 21 CFR 600.3) that 

manufactures a drug or biological product. Examples of stakeholders include: contract facilities as referenced in 

21 CFR 200.10(b); applicants with an approved new drug application, abbreviated new drug application, or an 

approved biologics license application; manufacturers of drug products marketed without an approved application; 

manufacturers of components, including APIs, intended for use in the manufacture of drug products; and 

manufacturers of drug-led, drug-device or biologic-led, biologic-device combination products (as defined in 21 CFR 

3.2(e)) regulated by CDER or CBER. This guidance references specific stakeholders individually where appropriate 

(e.g., if a specific section of the guidance is relevant to specific stakeholders only); otherwise, recommendations that 

refer to the manufacture of drugs are generally relevant to all stakeholders with the roles described above with 

respect to human drug and biological products. 

3 Drug shortage or shortage means a period of time when the demand or projected demand for the drug within the 

United States exceeds the supply of the drug (see section 506C(h)(2) of the FD&C Act). For the purposes of this 

guidance, drug or drug product refers to human drugs and biological products (see section 201(g)(1) of the FD&C 

Act). 
Contains Nonbinding Recommendations 

Draft — Not for Implementation

2

affect the extent and level of direct regulatory oversight.4 26 Based on recent publications and 

reports, the majority of drug shortages are associated with quality issues.5,6,7,8 27 This guidance 

28 describes a framework for stakeholders to consider when developing RMPs that aligns with 

29 principles stated in the International Council for Harmonisation (ICH) guidance for industry 

30 Q9 Quality Risk Management (June 2006). In addition, FDA also recommends risk factors to 

31 consider when developing the content of the RMPs. 

 32 

33 The contents of this document do not have the force and effect of law and are not meant to bind 

34 the public in any way, unless specifically incorporated into a contract. This document is 

35 intended only to provide clarity to the public regarding existing requirements under the law. 

36 FDA guidance documents, including this guidance, should be viewed only as recommendations, 

37 unless specific regulatory or statutory requirements are cited. The use of the word should in 

38 Agency guidance means that something is suggested or recommended, but not required. 

 39 

 40 

41 II. BACKGROUND

 42 

43 FDA recognizes that drug shortages pose a significant public health threat because they can 

44 delay, and in some cases even deny, critically needed care for patients. Recent publications have 

45 explained that proactively assessing risks to drug manufacturing processes and supply chains, 

46 coupled with an understanding of market vulnerabilities, have enabled stakeholders to support 

47 robust manufacturing operations that help to maintain the availability of a high-quality drug 

through the drug’s life cycle.9 48 The publications further explain that proactive risk assessment 

49 has also enabled some stakeholders to predict and prevent supply disruptions that could 

potentially lead to a drug shortage.10 50 

4 See section VI., Integration of Quality Risk Management Into Industry and Regulatory Operations, in the ICH 

guidance for industry Q9 Quality Risk Management (June 2006). We update guidances periodically. For the most 

recent version of a guidance, check the FDA guidance web page at https://www.fda.gov/regulatoryinformation/search-fda-guidance-documents. Note that appropriate use of quality risk management does not obviate 

industry’s obligation to comply with regulatory requirements. 5 The term quality is defined in ICH Q9 as “The degree to which a set of inherent properties of a product, system, or 

process fulfills requirements.”

6 The International Society for Pharmaceutical Engineering’s (ISPE’s) “Report on the ISPE Drug Shortages Survey” 

(June 2013) (https://ispe.org/initiatives/drug-shortages/publications-tools) shows that issues associated with the 

quality system, or the system that assures overall compliance with current good manufacturing practices and internal 

procedures and specifications, was the most common cause of drug shortages.

7 See the FDA report “Drug Shortages: Root Causes and Potential Solutions” (2019), p. 33 and Appendix F, at

https://www.fda.gov/media/131130/download. 8 Chapman, S, G Dedet, and R Lopert, 2022, Shortages of Medicines in OECD Countries, OECD Health Working 

Papers, No. 137, OECD Publishing, Paris, https://doi.org/10.1787/b5d9e15d-en. 9 See the ISPE and The Pew Charitable Trusts report “Drug Shortages: An Exploration of the Relationship Between 

U.S. Market Forces and Sterile Injectable Pharmaceutical Drugs: Interviews With 10 Pharmaceutical Companies” 

(January 2017) at https://www.pewtrusts.org/-/media/assets/2017/01/drug_shortages.pdf. See also the final report 

by the inter-associations team with representatives from the European Federation of Pharmaceutical Industries and 

Associations, Medicines for Europe (formerly European Generics Association), Association of the European SelfMedication Industry, Plasma Protein Therapeutics Association, ISPE, and Parenteral Drug Association “Prevention 

of Drug Shortages Based on Quality and Manufacturing Issues” (December 2014) at 

https://www.pda.org/docs/default-source/website-document-library/scientific-and-regulatory-affairs/drugshortage/interrupted-supply-inter-association-summary-final-report-2014.pdf?sfvrsn=4. 10 Ibid.
Contains Nonbinding Recommendations 

Draft — Not for Implementation

3

 51 

52 In July 2012, with the enactment of the Food and Drug Administration Safety and Innovation 

53 Act (FDASIA), Congress empowered FDA with tools to work in collaboration with industry to 

54 help prevent or mitigate drug supply disruptions and drug shortages, and clarified current good 

55 manufacturing practice requirements relevant to the oversight and controls over the manufacture 

of drugs to ensure quality.

11 56 In 2011 and 2012, FDA assisted in mitigating 368 new drug 

57 shortages and preventing 473 drug shortages. In contrast, in the 6-year span after FDASIA was 

58 enacted, FDA assisted in mitigating 222 new drug shortages and preventing 806 drug 

shortages.12 59 Although the number of new drug shortages has declined significantly since the 

60 peak in 2011, reaching a low in 2015 and 2016, this downward trend did not continue in 

61 subsequent years. Drug shortages continue to occur and at roughly the same levels since 2018. 

62 Further, drug shortages have grown more persistent (i.e., increased length of active drug 

shortages).13 63 Many of the reasons for drug shortages are, for example, issues related to drug 

64 quality, disruptions to supply chain manufacturing operations (e.g., caused by natural disaster or 

65 discontinuation of components by suppliers), limitations in forecasting future demand, and 

market withdrawals of drug products.14 66 Additionally, in recent years, FDA has observed a rise in 

67 number of cyberattacks on drug manufacturers and is increasingly concerned about the effect of 

such attacks on the drug supply chain.15 68 

 69 

70 In March 2020, with the enactment of the Coronavirus Aid, Relief, and Economic Security Act 

71 (CARES Act), Congress added section 506C(j) to the Federal Food, Drug, and Cosmetic Act 

(FD&C Act),16 72 which requires certain manufacturers to develop, maintain, and implement, as 

73 appropriate, a “redundancy risk management plan that identifies and evaluates risks to the supply 

74 of the drug, as applicable, for each establishment in which such drug or active pharmaceutical 

75 ingredient of such drug is manufactured.” Section 506C(j) became effective on September 23, 

76 2020 (see section III. in this guidance). 

 77 

11 Generally, section 506C(a) of the FD&C Act, as amended by FDASIA (Public Law 112-144) and the Coronavirus 

Aid, Relief, and Economic Security Act (Public Law 116-136), requires certain applicants and manufacturers to 

notify the Agency of: (1) a permanent discontinuance in the manufacture of certain drug products; (2) an 

interruption in manufacturing of certain drug products that is likely to lead to a meaningful disruption in the supply 

of such products in the United States; (3) a permanent discontinuance in the manufacture of the API of certain drug 

products; and (4) an interruption in the manufacture of the API of certain drug products that is likely to lead to a 

meaningful disruption in the supply of the API of those products. Notifications under section 506C(a) must include 

disclosure of the reasons for such discontinuance or interruption. Section 506E of the FD&C Act (21 U.S.C. 356e) 

requires FDA to maintain an up-to-date list of drugs that are determined by FDA to be in shortage in the United 

States. Section 711 of FDASIA amended section 501 of the FD&C Act (21 U.S.C. 351) to clarify that, for purposes 

of section 501(a)(2)(B), the term current good manufacturing practice includes the implementation of oversight and 

controls over the manufacture of drugs to ensure quality, including managing the risk of and establishing the safety 

of raw materials, materials used in the manufacturing of drugs, and finished drug products. 12 See the Drug Shortages Infographic web page (https://www.fda.gov/drugs/drug-shortages/drug-shortagesinfographic). These statistics refer to shortages tracked by CDER. 13 See Slides 35 and 36 from the November 28, 2018, conference “Identifying the Root Causes of Drug Shortages 

and Finding Enduring Solutions” at Duke University’s Margolis Center for Health Policy (accessed July 21, 2020, 

https://healthpolicy.duke.edu/sites/default/files/2020-02/presentation_slides__0.pdf). 14 See footnote 7. 15 Millar, A, 2021, Five Pharma Cybersecurity Breaches to Know and Learn From, Pharmaceutical Technology, 

accessed October 15, 2021, https://www.pharmaceutical-technology.com/features/pharma-cyber-attacks/. 16 See Public Law 116-136. 
Contains Nonbinding Recommendations

Draft — Not for Implementation

4

78 FDA believes that its efforts in navigating drug shortage issues through the statutory and 

79 regulatory framework and its partnership with stakeholders have contributed to the reduction in 

80 the number of new drug shortages as well as a reduction in the time to resolve existing drug 

81 shortages. However, the Agency acknowledges that shortages and shortage mitigation efforts 

82 pose a significant financial and resource burden on stakeholders and FDA. FDA views RMPs as 

83 an important mechanism that stakeholders can use to proactively identify, assess, and mitigate 

84 the risks that might lead to a disruption in the supply of drug products, and thus preemptively 

85 reduce the financial and resource burden associated with resolving a shortage and problems that 

86 may lead to a shortage. 

87

88 RMPs involve the systematic application of quality management policies, procedures, and 

89 practices to the tasks of assessing, controlling, communicating, and reviewing risk. These 

90 approaches and techniques are commonly used by multiple industries to manage a broad range of 

91 risks that have the potential to adversely affect their businesses. For the pharmaceutical industry, 

92 drug manufacturers use quality risk management, a systematic process for the assessment, 

93 control, communication, and review of risks to drug product quality, across the drug’s life cycle. 

Quality risk management is based on two principles:17 94 

95

96 (1) The assessment of the risk to quality should be based on scientific knowledge and 

97 ultimately link to the protection of the patient 

98

99 (2) The level of effort, formality, and documentation of the quality risk management process 

100 should be commensurate with the level of risk

101

102 The pharmaceutical industry has taken incremental steps to implement quality risk management 

103 principles since the publication of ICH Q9 in 2006. As a result, the Agency believes that many 

104 stakeholders have already established processes and procedures to proactively identify, assess, 

105 and mitigate the effect of a broad spectrum of risks to their business processes using these risk 

106 management principles. The Agency encourages the use of these approaches to proactively 

107 manage the risk of supply disruptions that may lead to drug shortages. 

108

109

110 III. RISK MANAGEMENT PLANS: STAKEHOLDERS AND PRODUCTS

111

112 This section defines stakeholders in the manufacturing supply chain for drugs and describes 

113 those products for which an RMP is required under section 506C(j) of the FD&C Act, as well as 

114 those products for which an RMP is recommended. 

115

116 A. Stakeholders in the Manufacturing Supply Chain

117

118 The content of an RMP, including the steps needed to reduce risks of a disruption in drug supply,

119 may vary among the different stakeholders in the supply chain for a given drug product. For the 

120 purposes of this guidance, stakeholders in the drug supply chain are categorized as follows.

121

17 See ICH Q9.
Contains Nonbinding Recommendations

Draft — Not for Implementation

5

• Primary Stakeholder.

18 122 The primary stakeholder is generally the entity that determines

123 which materials and services are necessary to produce a drug product. This knowledge 

124 results in greater understanding of the entire supply chain for a drug product, and 

125 therefore, makes the primary stakeholder best positioned to manage many of the risks of 

126 supply chain disruption. Primary stakeholders include: 

127

128 − For drug products with approved applications, the holder of the new drug application,

129 abbreviated new drug application, or biologics license application

130

131 − For drug products without an application, the entity with understanding of and 

132 capability to make changes to the supply chain (e.g., add a redundant active 

133 pharmaceutical ingredient (API) source or mitigate a disruption in the supply of drug 

134 product containers) for the finished drug product 

135

• Secondary Stakeholders.

19 136 Secondary stakeholders are entities that are expected to 

137 have more detailed insight into specific segments of the supply chain for a drug product

138 but may not have an understanding of its entirety. Secondary stakeholders include:

139

140 − Finished product manufacturers that are not primary stakeholders, including any such 

141 manufacturers that operate establishments involved in physically manipulating the 

142 drug product (e.g., blending, tableting) and any such manufacturers of a drug-led, 

143 drug-device combination product or biologic-led, biologic-device combination 

144 product regulated by the Center for Drug Evaluation and Research (CDER) or the 

Center for Biologics Evaluation and Research (CBER).

20,21 145

146

147 − API manufacturers, as well as those manufacturers that physically process (e.g., 

148 milling, coating) or package the API.

149

150 • Other stakeholders. Other stakeholders in the supply chain for drugs that are not 

151 primary or secondary stakeholders, such as inactive ingredient manufacturers, packagers, 

152 and distributors. 

153

154 B. Products for Which RMPs Are Required

155

156 As described in the Background section of this guidance, the CARES Act added section 506C(j) 

157 to the FD&C Act, which requires certain manufacturers to develop, maintain, and implement, as 

158 appropriate, a “redundancy risk management plan that identifies and evaluates risks to the supply 

18 See the Appendix for risk factors for primary and secondary stakeholders to consider when developing an RMP. 19 Ibid. 20 This does not include establishments that only perform testing, relabeling, or repackaging operations. 21 This category includes persons that operate establishments that manufacture drug-led, drug-device or biologic-led, 

biologic-device combination products (i.e., single entity, co-packaged, and cross-labeled combination products, as 

defined in 21 CFR 3.2(e)) but does not include persons that operate establishments that only manufacture the device 

constituent part of such a combination product (e.g., an establishment that only manufactures the device constituent 

part of a cross-labeled combination product).
Contains Nonbinding Recommendations

Draft — Not for Implementation

6

159 of the drug, as applicable, for each establishment in which such drug or active pharmaceutical 

ingredient of such drug is manufactured.”22,23 160

161

162 Each manufacturer of the following drug products, APIs, and associated medical devices must 

163 develop, maintain, and implement, as appropriate, an RMP that identifies and evaluates risks to 

164 the supply of the drug product, as applicable, for each establishment in which such drug product 

or API of such drug product is manufactured:

24 165

166

• Prescription drug products that are:25 167

168

‒ Life-supporting26 169

170

‒ Life-sustaining27 171

172

‒ Intended for use in the prevention or treatment of a debilitating disease or condition,

28 173

including any such drug used in emergency medical care or during surgery29 174 or any 

175 such drug that is critical to the public health during a public health emergency declared 

by the Secretary under section 319 of the Public Health Service Act30 176

177

178 • Any API included in the prescription drug products described above

179

180 • Any associated medical device used for preparation or administration included with the 

181 prescription drug products described above, namely, any device constituent part of drug22 The identification and evaluation of risk specified in section 506C(j) are elements of the risk assessment step of an 

RMP (this concept is further illustrated in Figure 1, Recommended Risk Management Plan Steps Using the ICH Q9 

Framework). Redundancy (e.g., more than one supplier) is an example of a risk control strategy that may help 

reduce risk identified during the risk assessment step but is not the only possible approach to risk control. For the 

purposes of this guidance risk management plan is the same as redundancy risk management plan. 23 Through rulemaking, FDA applied section 506C of the FD&C Act to all biological products, including 

recombinant therapeutic proteins, monoclonal antibody products, vaccines, allergenic products, plasma-derived 

products and their recombinant analogs, blood or blood components, and cellular and gene therapy products (see 

80 FR 38918, July 8, 2015; 21 CFR 600.82; and section 506C(h)(1), (i)(3) of the FD&C Act). Therefore, section 

506C(j) is applicable to all biological products. Section 506C(a) applies only to applicants of blood or blood 

components for transfusion that manufacture a significant percentage of the U.S. blood supply (see 21 CFR 600.82; 

80 FR 38926).

24 See section 506C(j) of the FD&C Act. 25 Excluding radiopharmaceutical drug products and any other product as designated by the Secretary (see section 

506C(a)(2) of the FD&C Act).

26 See 21 CFR 314.81(b)(3)(iii)(f) and 21 CFR 600.82(f). 27 Ibid. 28 Ibid. 29 See section 506C(a)(1) of the FD&C Act. 30 Ibid.
Contains Nonbinding Recommendations 

Draft — Not for Implementation

7

182 led, drug-device combination product or biologic-led, biologic-device combination 

product manufactured by the establishment and regulated by CDER or CBER.31,32 183 

 184 

185 FDA considers the manufacturers that are subject to this requirement under section 506C(j) of 

186 the FD&C Act to include primary and secondary stakeholders as defined in section III.A. of this 

187 guidance. 

 188 

189 C. Products for Which RMPs Are Recommended

 190 

Certain types of drug products33 191 and APIs not included in the requirement under section 506C(j) 

of the FD&C Act,

34 192 if subject to a supply disruption and shortage, would be of particular concern 

193 to the Agency because of the potential effect on patient care. In addition, FDA has found that 

194 certain drug products, such as those with less redundancy in their supply chains, are at higher 

195 risk of shortage. The products listed in this section may or may not be products for which 

196 manufacturers must develop, maintain, and implement RMPs under section 506C(j). For 

197 example, drug products intended to treat rare diseases or conditions may or may not also be drug 

198 products for which RMPs must be developed, maintained, and implemented under section 

199 506C(j). To the extent drug products or APIs incorporated in those products fall within a 

200 category described in the following list but are not drug products described in section 506C(a) of 

201 the FD&C Act or APIs included in such drug products, FDA nevertheless recommends that 

202 stakeholders develop, maintain, and implement RMPs for such products, as appropriate, to 

203 provide reliability of supply: 

 204 

• Drug products intended to treat rare diseases or conditions35 205 

206 

207 • Drug products that lack appropriate alternatives 

208 

209 • Medical countermeasures used in the event of a potential public health emergency 

210 stemming from a terrorist attack with a biological, chemical, or radiological/nuclear 

31 Manufacturers of an associated medical device used for preparation or administration included in the prescription 

drug products described above include persons that operate establishments that manufacture drug-led, drug-device 

or biologic-led, biologic-device combination products (i.e., single entity, co-packaged, and cross-labeled 

combination products, as defined in 21 CFR 3.2(e)) but does not include persons that operate establishments that 

only manufacture the device constituent part of such a combination product (e.g., an establishment that only 

manufactures the device constituent part of a cross-labeled combination product). 32 An RMP developed by such a manufacturer should address the risks associated with sourcing of the device 

constituent part.

33 These considerations also apply to drug-led, drug-device and biologic-led, biologic-device combination products 

regulated by CDER or CBER subject to the requirement in section 506C(a) of the FD&C Act but for which

availability of the device constituent parts could be a reason for, or a risk factor in, the supply disruption or shortage 

of the combination product.

34 See section III.B. of this guidance. 35 See section 526(a)(2) of the FD&C Act.
Contains Nonbinding Recommendations 

Draft — Not for Implementation

8

material, or a naturally occurring emerging disease36 211 and other threat agents (i.e., 

essential to national security)37 212 

213 

• Sole source products38 214 

215 

216 • Drug products with only one API manufacturer in the product’s supply chain that has 

217 been appropriately qualified by the quality unit of the finished dosage form (FDF) 

establishment39,40 218 

219 

• Drug products with only one FDF manufacturer in the product’s supply chain41 220 

221 

222 • Drug products that are manufactured in a facility (including packaging facilities and 

223 laboratories) with an inspection in the last 5 years that was classified as official action 

indicated (OAI)42 224 and there is no other manufacturing facility that is qualified in the 

product’s supply chain to conduct that operation43 225 

 226 

RMPs are a useful tool to facilitate compliance with a firm’s regulatory requirements.44 227 As a 

228 general matter, the Agency believes that RMPs are a good practice to help ensure reliability of 

229 supply of drug products and APIs. Therefore, FDA recommends that stakeholders consider 

230 developing, maintaining, and implementing RMPs for their drug products or APIs that are not 

231 subject to the requirement in section 506C(j) of the FD&C Act, in addition to those that are 

232 subject to that requirement, as described earlier. 

 233 

 234 

36 The term medical countermeasures means items that meet the definition of “qualified countermeasure” in 

42 U.S.C. 247d–6a(a)(2)(A); “qualified pandemic or epidemic product” in 42 U.S.C. 247d–6d(i)(7); “security 

countermeasure” in 42 U.S.C. 247d–6b(c)(1)(B); or personal protective equipment described in 29 CFR part 1910. 37 See Section 7. Facilitate Development of Medical Countermeasures to Protect Against Threats to U.S. and Global 

Health and Security: Strategic Plan for Regulatory Science at https://www.fda.gov/science-research/advancingregulatory-science/section-7-facilitate-development-medical-countermeasures-protect-against-threats-us-and-global. 38 For the purposes of this guidance, a sole source product is a drug product of a specific strength, dosage form, or 

route of administration manufactured by only one entity for sale in the United States. MAPP 5240.3 Rev. 5

Prioritization of the Review of Original ANDAs, Amendments, and Supplements describes criteria to help 

manufacturers evaluate whether a product is a sole source product. MAPPs can be found on the Manual of Policies 

and Procedures web page at https://www.fda.gov/about-fda/center-drug-evaluation-and-research/cder-manualpolicies-procedures-mapp. 39 See 21 CFR 211.84. 40 Additionally, for application products, the API establishment(s) are named in the approved application. 41 Additionally, for application products, the FDF establishment(s) are named in the approved application. 42 The term official action indicated (OAI) generally refers to a classification made following an inspection when a 

facility is observed to be in an unacceptable state of compliance and regulatory action may be warranted. 43 For application products, it is also expected that any other manufacturing facility is named in the approved 

application. 

44 See generally the recommendations in ICH Q9, which describes the scope of the guidance on risk management 

principles for processes throughout the life cycle of drug substances, drug products, biological and biotechnological 

products (including the use of raw materials, solvents, excipients, packaging and labeling materials in drug products, 

and biological and biotechnological products). 
Contains Nonbinding Recommendations 

Draft — Not for Implementation

9

235 IV. RMP FRAMEWORK AND DEVELOPMENT STRATEGY

 236 

237 FDA recommends using the quality risk management process and principles described in ICH 

238 Q9 as the framework to develop an effective RMP. This guidance is intended to add to the 

239 elements of the framework described in ICH Q9, to describe considerations for stakeholder 

240 oversight for RMPs, and to assist with the interpretation of the quality risk management process 

within the context of developing RMPs.45 241 Further, stakeholders may benefit by integrating the 

242 RMP with other aspects of their operations. 

 243 

244 A. Stakeholder RMP Development Strategy

 245 

246 RMPs help to ensure that risks with the potential to disrupt the drug manufacturing process and

247 the drug supply chain have been identified, assessed, and mitigated. An individual stakeholder’s 

248 role in developing and implementing an RMP varies with that stakeholder’s level of involvement 

249 with the drug manufacturing process or supply chain. Nonetheless, FDA believes that risk 

250 management principles should be applied throughout the drug supply chain to help mitigate the 

251 risk of drug shortages. 

 252 

253 A primary stakeholder RMP should contain a broader strategy that establishes overarching 

254 approaches to consistently identify, assess, and mitigate risk across the organization or a 

255 subsector of the organization. This approach is consistent with institutionalized quality 

management maturity46 256 that results in understanding the risk of supply disruptions that may lead 

257 to shortages across the supply chain, integrates redundancy into the supply chain, improves the 

258 forecasting of demand changes at all stages of production, maintains sustainable compliance, 

259 improves overall incentives between purchasers and manufacturers, and fosters collaboration 

260 with regulators. FDA recommends that the primary stakeholder RMP also include plans to 

261 repair the supply chain after a disruption, as appropriate. Further, FDA recommends that the 

262 primary stakeholder initiate RMP development as early as possible in the drug product’s 

263 regulatory life cycle. 

 264 

265 The Agency recommends that the primary stakeholder share as much of its RMP as possible with 

266 secondary and other stakeholders of the drug product to enable secondary and other stakeholders 

267 to incorporate the broad strategies of the primary stakeholder’s RMP into their own plans and

268 also contextualize the risks identified in the primary stakeholder’s RMP, specifically for the 

269 manufacturing facility. Sharing the primary stakeholder’s RMPs with secondary and other 

45 Similarly, for combination products, this guidance would also serve to augment a risk management program based 

on ISO 14971 Application of risk management to medical devices (2019). With regard to combination products, 

either ICH Q9 or ISO 14971/ISO TR 24971 Guidance on the application of ISO 14971 (2020) could serve as a basis 

for developing a suitable framework for risk management, and reference to both can be helpful in developing such a 

framework. For combination products that include a device constituent part, use of an ISO 14971/24971-based 

framework, incorporating relevant considerations from ICH Q9, is recommended to ensure a sufficiently robust risk 

management process consistent with current best practices and global regulatory trends and norms. See, for 

example, AAMI TIR 105 2020, Risk Management for Combination Products. 46 See the FDA report “Drug Shortages: Root Causes and Potential Solutions” (2019) (available at 

https://www.fda.gov/media/131130/download). More advanced levels of quality management maturity aim to 

robustly detect vulnerabilities and address them to prevent the occurrence of problems as well as establishing a 

culture that rewards process and system improvements. 
Contains Nonbinding Recommendations

Draft — Not for Implementation

10

270 stakeholders may also further refine the mitigation and avoidance strategies specific to the 

271 individual drug, or its unique manufacturing process. For example, if a primary stakeholder’s 

272 RMP already addresses availability of raw materials, it may be appropriate for this risk factor not 

273 to be addressed in a contract manufacturer’s RMP. However, in such a situation, FDA 

274 recommends that the contract manufacturer’s RMP still address general and product-specific 

275 facility risks, such as maintaining process control, manufacturing equipment robustness, and

276 product-specific utility requirements.

277

278 The stakeholders that are involved in the supply chain for a particular drug product should work 

279 together to address RMP development and implementation. The Appendix of this guidance 

280 provides risk factors for stakeholders to consider when developing an RMP strategy.

281

282 B. Quality Risk Management Process Framework

283

284 FDA recommends the following process for developing RMPs based on the quality risk 

285 management framework in ICH Q9, as shown in Figure 1. Each process step is detailed in the 

286 following subsections.

287
Contains Nonbinding Recommendations 

Draft — Not for Implementation

11

288 Figure 1: Recommended Risk Management Plan Steps Using the ICH Q9 Framework

 289 

 290 

291 

292 1. Initiating an RMP 

293 

294 The purpose of initiating an RMP is to allow a stakeholder to proactively assess the risks of a 

295 drug supply disruption, rather than wait for an actual disruption to occur. Cross-cutting 

296 coordination and collaboration is critical to development, implementation, and maintenance of an 

297 effective RMP. 

298 

299 2. Risk Assessment 

300 

301 The risk assessment involves identifying the associated hazards, evaluating the risk of each 

302 hazard, and evaluating the risk of a drug supply disruption based on: (1) what might go wrong; 

303 (2) what is the likelihood (probability) it will go wrong; and (3) what are the consequences 

304 (severity). 

Risk Assessment

Initiate Risk Management Plan to Mitigate the 

Potential for Drug Shortages

Risk Identification – identify the risks with a potential to cause drug shortage.

Risk Analysis – identify near misses in terms of drug shortages that were avoided. 

Consider past circumstances or practices associated with the risk. 

Risk Evaluation – identify probability of a drug shortage occurring. Identify the impact 

of a drug shortage event.

Risk Control

Risk Reduction – identify corrective and preventive actions to mitigate current and 

future impact. Assess residual risk.

Risk Acceptance – identify risks that an organization decides to accept or absorb.

Risk Management Plan Report

Risk Review

Review Events - Periodically assess and review current risks to evaluate whether 

mitigation strategies need to be updated. Evaluate drug shortages (actual and near 

misses) to identify, assess, and mitigate any new risks, using this algorithm.

Risk Communication 

Risk Management Tools

unacceptable
Contains Nonbinding Recommendations

Draft — Not for Implementation

12

305

306 • Risk Identification — This involves identifying the hazards, including critical 

307 operations or processes, that have the potential to cause a drug supply disruption. 

308 Potential hazards can be identified through: historical data analysis; theoretical analysis;

309 informed opinions; relationships with suppliers, vendors, and contractors; audits; market 

310 forces that may affect the availability or reliability of raw materials; and overall 

manufacturing process stability and reliability.47,48,49 311

312

313 • Risk Analysis — This involves estimating the risk associated with the identified hazards 

and effects50 314 considering the likelihood of occurrence, severity of harm, and detectability. 

315 That is, is there an increased potential for supply disruption of the finished drug product 

316 based on the hazards (e.g., location of manufacturing, source of components)? This 

317 analysis may include historical information, such as if there were one or more near-miss

318 situations where a shortage was narrowly avoided. 

319

320 • Risk Evaluation — Based on the risk analysis, the probability of each risk resulting in 

321 patient impact or a supply disruption should be systematically evaluated.

322

323 At the end of the Risk Assessment step, the hazards should have been identified, analyzed, and 

324 evaluated, and a determination should have been made as to which hazards are considered a 

325 higher risk to drug supply disruption than others.

326

327 3. Risk Control 

328

329 The Risk Control step is intended to reduce risks of a disruption in supply to an acceptable level 

330 and/or accept these risks. 

331

332 • Risk Reduction — This involves identifying strategies that can be used to potentially 

333 mitigate or avoid the identified risks. This can include building redundancy into 

334 manufacturing operations, establishing adequate controls on the supply chain, 

335 strengthening relationships with suppliers (e.g., contract manufacturers, ingredient 

suppliers), and/or identifying alternative suppliers.

51 336 Once the applicable strategies are 

337 implemented, the risk assessment should be periodically re-evaluated to determine if 

47 With regard to market disruption for combination products, this would include appropriate engagement of 

personnel with requisite expertise and responsibility to understand risks associated with sourcing of device 

constituent parts, which include components of device constituent parts, that might cause disruption to manufacture 

of the combination product including development and management of associated purchasing controls (see 21 CFR 

part 4, 21 CFR 820.50).

48 Since 2013, FDA has been encouraging manufacturers to implement and improve quality metrics and quality 

culture programs in support of overall manufacturing process stability and reliability. The Quality Metrics Program 

is also part of the long-term strategy to mitigate drug shortages by addressing the robustness of quality oversight, 

given that quality issues have been found to be the most common underlying cause of shortages. 

49 See also the Appendix: Risk Considerations for Specific RMPs. 50 See the ISPE/Pew Report mentioned in footnote 9 at p. 11, which identifies potential patient effects of stakeholder 

decisions to remain in the market or invest in new facilities or equipment to mitigate the risk of creating a drug 

shortage.

51 See the requirements for making changes to the conditions established in an approved application under 21 CFR 

314.70 and 21 CFR 601.12.
Contains Nonbinding Recommendations

Draft — Not for Implementation

13

338 additional hazards are present. Risk control strategies also can account for residual risk 

339 arising after a mitigation strategy is implemented.

340

• Risk Acceptance — This involves identifying if the remaining risk is acceptable52 341 or if 

342 the risk should be further reduced through additional risk reduction strategies. 

343

344 At the end of the Risk Control step, a report should be developed to document the risk 

345 assessment and risk control strategies.

346

347 4. Risk Review: Review Events

348

349 The Agency recommends at least an annual, internal review and revision of an RMP throughout 

350 the life cycle of a drug. RMP review and revision should include lessons learned, including the 

351 root cause of new and near-miss supply disruptions. In some instances, it may be useful to 

352 quickly integrate the additional identified risks and mitigation strategies into the RMP rather than 

353 waiting for the next annual review cycle. This review also can include an assessment of 

354 communication with regulators and whether the communication should be improved.

355

356 5. Risk Communication

357

358 FDA encourages stakeholders to engage in proactive communication of their RMPs with 

359 organizations within their drug supply chains, and where appropriate, with external stakeholders 

360 and regulators throughout the process. 

361

362 Certain stakeholders are required to submit notifications to the Agency about drug product and 

363 API permanent discontinuances and certain manufacturing interruptions under section 506C of 

the FD&C Act.

53,54 364 For the notifications received, FDA works with the stakeholder to assess the 

365 situation and prevent or mitigate any shortage that may result, when possible. Stakeholders that

366 are covered by the notification requirement under section 506C must submit certain information 

to FDA as part of the notification.55 367 Along with the information that is required to be submitted, 

368 the Agency recommends that manufacturers provide additional information that may assist the 

369 Agency in addressing the situation. FDA has published a list of questions for manufacturers to 

370 consider as they evaluate the situation and prepare to notify FDA, including whether the 

manufacturer has a proposal for FDA to review to expedite availability of a product.

56 371 This 

372 information would likely be contained in an RMP. A stakeholder can leverage an RMP to 

52 See ICH Q9. 53 For more information, see section 506C(a) of the FD&C Act and FDA’s implementing regulations at 21 CFR 

310.306, 21 CFR 314.81(b)(3)(iii), and 21 CFR 600.82, which address, among other things, which persons and drug 

and biological products are covered by the notification requirement, what information must be submitted in a 

notification, and when notifications must be submitted. 

54 Under section 506J of the FD&C Act, certain medical device manufacturers are required to notify the Agency 

about permanent discontinuances or interruptions in manufacturing likely to lead to a meaningful disruption of the 

supply of the device in the United States. Such notifications are outside the scope of this guidance. For more 

information about device notifications, see section 506J of the FD&C Act. 55 See footnote 53. 56 See the guidance for industry Notifying FDA of a Permanent Discontinuance or Interruption in Manufacturing 

Under Section 506C of the FD&C Act (March 2020); see also 80 FR 38915 at 38922 (July 8, 2015).
Contains Nonbinding Recommendations

Draft — Not for Implementation

14

373 communicate and quickly share information with the Agency to prevent or mitigate a shortage. 

374 Additionally, an established RMP can serve to support stakeholders during these times when 

375 their resources are typically strained with numerous internal and external requests. 

376

377 RMPs that are developed, maintained, and implemented by stakeholders pursuant to the 

378 requirement in section 506C(j) of the FD&C Act are subject to inspection and copying pursuant 

to an FDA inspection or a request under section 704(a)(4) of the FD&C Act (21 U.S.C. 374).

57 379 

380 RMPs, or elements of an RMP, need not be submitted as part of a biologics license application, 

381 new drug application, abbreviated new drug application, or drug master file.

382

383 6. Risk Management Tools

384

385 There are a variety of off-the-shelf and customizable risk management tools that may be helpful 

386 when developing and maintaining an RMP. The Agency believes the recommendations in this 

387 guidance can be applied regardless of the format or tool used.

388

57 See section 506C(j) of the FD&C Act.
Contains Nonbinding Recommendations

Draft — Not for Implementation

15

389 APPENDIX:

390 RISK CONSIDERATIONS FOR SPECIFIC RMPS

391

392 The following risk factors should be considered when developing specific risk management 

393 plans (RMPs) to mitigate the potential for drug shortages.

394

395 All RMPs — Each drug has product-specific characteristics (e.g., dosage form, active 

396 pharmaceutical ingredient source, manufacturing and test methods) that may be used to help 

397 determine instances when the product’s supply may fluctuate. At a high level, the following list 

398 identifies some risk factors that may be considered together with a drug’s product-specific 

399 characteristics to help manufacturers uncover weaknesses that may impact product supply:

400

401 • Determine which drugs, including components, manufactured at the facility are 

402 vulnerable to a supply disruption

403

• Identify weaknesses in manufacturing process specific to individual drugs1 404

405

406 • Determine whether any of the suppliers of drug product container-closure systems or 

407 device constituent parts, which include components of device constituent parts, are a sole 

408 source provider

409

410 • Identify weaknesses in inventory management at the manufacturing facility, including 

411 understanding market forecast for a drug, to ensure that supply is able to meet anticipated 

412 demand

413

414 • Ascertain whether the drug manufacturing relies on incapable or unreliable equipment, 

415 such as older equipment or equipment that breaks down frequently where maintenance is 

416 difficult or parts are not easily replaced or available (incapable equipment may also 

417 include equipment that relies on software or other technologies that are not able to be 

418 updated (i.e., patched), which increases such equipment’s susceptibility to cybersecurity 

419 threats)

420

421 • Identify the normal capacity and surge capacity of the manufacturing facility to 

422 manufacture a drug or its components that are vulnerable to shortage

423

424 • Evaluate the drug’s stability data, including finished product and components, to 

425 determine whether the data demonstrate safety and efficacy beyond the labeled expiry 

426 date or retest date and, if needed, reassess the drug’s stability program 

427

428 • Be aware of and implement changes and alterations to requirements for relevant articles 

429 in the United States Pharmacopeia or National Formulary

430

1 A Quality Metrics Program, as referenced in footnote 48 of the guidance, is intended to measure different key 

performance indicators to assist in identifying which manufacturing processes are weaker than others, in order to 

identify improvement projects and certain products that could be targeted for improvement. 
Contains Nonbinding Recommendations

Draft — Not for Implementation

16

431 Primary Stakeholder’s RMP — The following list provides risk factors for a primary 

432 stakeholder to consider when developing an RMP to ensure that it provides an overarching 

433 strategy to consistently identify, assess, and mitigate risk across multiple manufacturing facilities 

434 and drugs from an oversight perspective. This RMP often can include product-specific concerns, 

435 which in turn should result in further extrapolation at the facility level. The risk factors (not an 

436 exhaustive list) for a primary stakeholder to consider when developing an RMP include: 

437

438 • Geographic risk factors, including potential for natural disasters, as well as political 

439 instability and regulatory uncertainty, that can affect the overall ability to consistently 

440 manufacture a drug.

441

442 • Supply chain vulnerabilities, such as sole source manufacturers of critical components in 

443 a drug product, including active pharmaceutical ingredient, and sole source 

444 manufacturers of a drug product.

445

446 • Manufacturing vulnerabilities, including lack of manufacturing capacity to meet an 

447 unexpected surge in demand, inadequate backup manufacturing capability, lack of 

448 availability of contract manufacturers or other alternate sources, lack of availability of 

449 laboratory services to support manufacturing, and inadequacy of management oversight.

450

451 • Distribution vulnerabilities, including the complexity of distribution or transportation of 

452 components, drug product containers and closures, and drug products.

453

454 • Whether the equipment or systems used in manufacturing or distribution could be 

455 susceptible to cybersecurity threats

456

457 • Emergency situations that reduce staff or facility availability to continue manufacturing.

458

459 • Whether the drug is life-supporting, life-sustaining, intended for use in the prevention or 

460 treatment of a debilitating disease or condition, including any such drug used in 

461 emergency medical care or during surgery or any such drug that is critical to the public 

462 health during a public health emergency declared by the Secretary under section 319 of 

463 the Public Health Service Act, intended to treat rare diseases or conditions, a drug that 

464 lacks appropriate alternatives, used as a medical countermeasure in the event of potential 

465 public health emergency, or critical in response to specific targeted threat agents 

466 (essential to national security).

467

468 • The capability and historical record of the facilities in the supply chain, including 

469 whether there is a history of sustained current good manufacturing practice (CGMP)

470 compliance. This should include inspectional findings at the headquarters unit that 

471 provides global quality oversight and all facilities in the supply chain that might affect the 

472 availability of the drug, and details relating to the presence or recurrence of quality 

473 issues, CGMP violations, recalls, and lapses in quality management oversight.

474
Contains Nonbinding Recommendations 

Draft — Not for Implementation

17

475 • Compliance with applicable regulatory reporting requirements, including: notifications

476 under section 506C or section 506I of the Federal Food, Drug, and Cosmetic Act (FD&C 

Act),2 postmarketing safety reports,

3

 and field alert reports.4 477 

478 

479 • Communication vulnerabilities with secondary and other stakeholders within the supply 

480 chain that might hinder timely distribution or receipt of quality-related information (e.g., 

481 agreements with contract manufacturers that prohibit disclosure of information at other 

482 contract facilities). 

483 

484 RMPs for Secondary Stakeholders and Other Stakeholders — When a stakeholder that is not 

485 the primary stakeholder (i.e., a secondary or other stakeholder) develops its RMP, it typically 

486 should interpret the broader risks identified in the primary stakeholder’s RMP within the context 

487 of a specific manufacturing facility, and address unique risks at a manufacturing facility that are 

488 unlikely to be identified by the primary stakeholder. Furthermore, many of the risks might have 

489 specific implications to the drugs manufactured at a facility (e.g., environmental controls might 

490 affect a sterile, parenteral drug more than a solid, oral dosage drug). The RMP for stakeholders 

491 that are not the primary stakeholder should consider the effect of identified risks on the 

492 manufacturing facility as well as on the drugs manufactured at that facility. The following non493 exhaustive list provides risk factors for such stakeholders to consider as part of developing an

494 RMP. Some of these risk factors may also be useful to the primary stakeholder, depending on 

495 the responsibilities of the primary stakeholder. 

 496 

497 • Identify vulnerabilities in the supply chain for each drug product vulnerable to supply 

498 disruptions. Consider limitations in supply for raw materials, intermediates, components, 

499 and drug product containers and closures. 

500 

501 • Ensure that appropriate communication with contract manufacturing facilities and 

502 component suppliers is established to proactively address risks that might lead to 

meaningful drug supply disruptions.5 503 

504 

505 • Identify weaknesses in the infrastructure and utilities; water systems; heating, ventilation, 

506 air conditioning, and environmental control; and the proximity of support services such 

507 as laboratory testing. 

508 

2 See section 506C(a) of the FD&C Act. 3 See generally the requirements contained in 21 CFR 310.305 (marketed prescription drug products without 

approved new drug applications (NDAs) or abbreviated new drug applications (ANDAs)), 21 CFR 314.80 (drug 

products with approved NDAs), 21 CFR 314.98 (drug products with approved ANDAs), 21 CFR 600.80 (biological 

products with approved biologics license applications), section 760 of the FD&C Act (marketed nonprescription 

drug products without approved NDAs or ANDAs), and 21 CFR part 4, subpart B (combination products and 

constituent parts).

4 See 21 CFR 314.81 (drug products with approved NDAs and ANDAs) and 21 CFR part 4, subpart B (combination 

products and constituent parts).

5 See the guidance for industry Contract Manufacturing Arrangements for Drugs: Quality Agreements (November 

2016). We update guidances periodically. For the most recent version of a guidance, check the FDA guidance web 

page at https://www.fda.gov/regulatory-information/search-fda-guidance-documents. 
Contains Nonbinding Recommendations

Draft — Not for Implementation

18

509 • Ascertain whether the manufacturing facility has incapable or unreliable equipment, such 

510 as equipment that is unsuitable for its intended use, legacy equipment that breaks down 

511 frequently, or equipment with parts that are not easily replaced or available.

512

513 • Identify challenges and weaknesses in monitoring vulnerable equipment.

514

515 • Identify equipment that operates with limited down time, which could be prone to 

516 accelerated wear and tear.

517

518 • Identify the normal capacity and surge capacity of the facility to manufacture a drug that 

519 is vulnerable to shortage.

520

521 • Ascertain whether the equipment or systems used in manufacturing or distribution could 

522 be susceptible to cybersecurity threats.

523

524 • Assess the suitability and competence of potential contractors before outsourcing 

525 operations or selecting material suppliers. 

526

527 • Assess the reliability of potential contractors to deliver operations or materials on time 

528 and of good quality to meet manufacturer deadlines and to avoid interruptions in 

529 processing.

530

531 • Assess the record of CGMP performance, including the presence or recurrence of quality 

532 issues, CGMP violations, potential for major defects and recalls, inspectional findings at 

533 the facilities in the supply chain, and adequacy of quality management oversight, that 

534 might affect the availability of the drug.

535