CQA, CPP, and Material Attribute Risk Assessment

Risk assessment is an important part of process development and validation, but it should not be used as a shortcut that mechanically “identifies CQAs and CPPs.” The correct sequence begins with product and process knowledge.

A Critical Quality Attribute (CQA) originates from understanding what characteristics of the product or intermediate must be appropriately controlled to assure the intended product quality. Material attributes and process parameters are then evaluated to understand whether their variability can affect those CQAs. Quality Risk Management is used to organize that evidence, evaluate uncertainty and risk, prioritize additional studies, and determine what controls are required.

ICH Q8(R2) defines a CQA as a physical, chemical, biological, or microbiological property or characteristic that should remain within an appropriate limit, range, or distribution to ensure the desired product quality. It defines a Critical Process Parameter (CPP) as a process parameter whose variability affects a CQA and therefore should be monitored or controlled.

This distinction is important. A parameter does not become a CPP merely because it receives a high numerical risk score, and a quality attribute does not become a CQA simply because it appears in a Failure Mode and Effects Analysis worksheet.

FDA/ICH implementation guidance specifically states that the Quality Target Product Profile (QTPP) should form the basis for development of CQAs, CPPs, and the control strategy, and that scientific rationale and Quality Risk Management should be used together in reaching criticality conclusions.

For the development studies that generate much of this evidence, see Process Characterization and Development Studies for Process Validation and Design of Experiments for Process Characterization and Validation.

Start With the QTPP and Product Understanding

The Quality Target Product Profile (QTPP) is the prospective description of the quality characteristics a drug product should possess to provide the desired quality, taking into account factors such as dosage form, route of administration, strength, delivery characteristics, stability, and intended clinical performance.

ICH Q8 identifies the QTPP as the basis of pharmaceutical development and recommends identifying potential CQAs from the product characteristics relevant to quality, safety, and efficacy.

This means that the logical sequence is: QTPP → Product Understanding → CQA Identification → Process and Material Understanding → Risk Assessment → Criticality and Control Decisions

It is not: Risk Matrix → CQA List → CPP List

Risk assessment supports the scientific evaluation, but it does not replace the underlying product and process knowledge.

Critical Quality Attributes

A Critical Quality Attribute (CQA) is a physical, chemical, biological, or microbiological characteristic that should remain within an appropriate limit, range, or distribution to assure the intended product quality. Examples can include, depending on the product:

• assay or potency;
• impurities or degradation products;
• content uniformity;
• dissolution;
• sterility;
• endotoxin;
• particulate matter;
• moisture;
• identity;
• biological activity;
• particle-size characteristics;
• viscosity;
• pH; or
• other product-specific characteristics important to quality, safety, or efficacy.

Not every tested product attribute is necessarily a CQA. An attribute may be important for manufacturing convenience, process efficiency, appearance, or another purpose without having the same relationship to product quality as a CQA.

The rationale for CQA identification should therefore remain connected to the QTPP, product knowledge, clinical or performance significance where applicable, stability, prior knowledge, specifications, and scientific understanding.

CQA Criticality Is Not Reduced by Better Controls

An important distinction from FDA/ICH implementation guidance is that quality-attribute criticality is principally connected to the severity of potential harm or consequence.

Implementing a stronger control strategy can reduce the risk that an unacceptable CQA result will occur, but it does not make the underlying quality attribute less important. FDA/ICH specifically notes that a well-developed control strategy reduces risk but does not by itself change the criticality of the quality attribute.

For example, sterility does not cease being critical because an aseptic process has excellent controls. Likewise, potency does not cease being critical because the manufacturing process has demonstrated high capability. Controls reduce risk. They do not erase the underlying quality significance of the attribute.

Material Attributes and Critical Material Attributes

A material attribute is a property or characteristic of a raw material, component, intermediate, drug substance, excipient, or other process input that can influence manufacturing behavior or product quality.

Examples can include particle size, moisture, viscosity, concentration, potency, morphology, density, purity, bioburden, flow properties, or supplier-related characteristics.

The abbreviation CMA — Critical Material Attribute is commonly used in pharmaceutical development to describe a material attribute whose variability has sufficient impact on process performance or a CQA to require appropriate control.

There is an important terminology nuance: ICH Q8 formally defines CQAs and CPPs in its glossary but generally discusses material attributes rather than establishing a separate formal glossary definition for CMA. I would therefore avoid treating “CMA” as though it were an independently prescribed regulatory classification. The scientific question is whether variability in the material attribute has a meaningful effect requiring control.

Process Parameters

A process parameter is a variable associated with execution of a manufacturing operation. Examples can include temperature, pressure, flow rate, mixing speed, mixing time, agitation, feed rate, addition rate, vacuum, drying time, compression force, pH, conductivity, hold time, or other process-specific variables.

Not every process parameter is critical. A process may contain:

• CPPs requiring specific control because variability can affect a CQA;
• parameters important to process performance but not directly critical to product quality;
• parameters controlled primarily for equipment or operational reasons; and
• parameters with sufficiently low impact that routine procedural control is adequate.

The purpose of criticality assessment is therefore not to divide the entire process into only “critical” and “irrelevant” variables.

Critical Process Parameters

ICH Q8 defines a Critical Process Parameter (CPP) as a process parameter whose variability has an impact on a CQA and therefore should be monitored or controlled to assure the desired quality.

Several elements of that definition matter.

• First, the parameter must have a relationship to a CQA.
• Second, variability in the parameter matters. A parameter may influence a process but still have little quality impact within the intended operating range.
• Third, the conclusion leads to appropriate monitoring or control.

A parameter should therefore not be classified as a CPP solely because:

• it is routinely recorded;
• the equipment manufacturer labels it important;
• it has an alarm;
• it was historically called critical;
• it produces a statistically significant DOE result; or
• it receives a particular numerical risk score.

The CPP conclusion should be scientifically supported by the parameter–CQA relationship, relevant variability, process knowledge, and the effectiveness of the proposed control strategy.

Potential CPPs Versus Confirmed CPPs

During early development, knowledge is frequently incomplete. It can therefore be useful to identify a potential CPP rather than prematurely declaring a parameter definitively critical or noncritical.

A potential CPP is a parameter for which existing knowledge indicates a plausible relationship to a CQA but for which the significance, operating range, interaction, or control requirement requires further investigation. Additional evidence can come from:

• process characterization;
• Design of Experiments (DOE);
• mechanistic studies;
• scale-up;
• prior knowledge;
• engineering studies;
• Process Performance Qualification;
• Continued Process Verification; and
• investigations or change assessments.

The terminology should reflect the maturity of the evidence. This avoids creating a permanently fixed CPP list based primarily on early assumptions.

Risk Assessment Supports Criticality Decisions

ICH Q9(R1) defines risk assessment as the systematic organization of information to support a risk decision. It includes hazard identification, risk analysis, and risk evaluation. For process-development criticality assessment, a useful sequence is:

Identify → Understand Relationships → Assess Risk and Uncertainty → Rank/Prioritize → Determine Controls → Review as Knowledge Develops

Risk assessment should incorporate evidence from development rather than operate as a separate administrative exercise.

Severity

Severity is the measure of the possible consequences of a hazard. ICH Q9(R1) defines risk principally as the combination of probability of occurrence of harm and the severity of that harm. For a CQA assessment, severity should focus on the consequence of failure to adequately control the quality attribute.

Relevant considerations can include:

• patient safety;
• efficacy;
• product performance;
• quality;
• dose delivery;
• microbiological risk;
• stability; and
• other product-specific consequences.

Severity should generally be assessed before considering the effectiveness of existing controls. Otherwise, excellent controls can artificially make a fundamentally important quality attribute appear less critical.

Probability or Occurrence

Probability of occurrence, often shortened to occurrence, addresses how likely it is that a hazardous condition or unacceptable result can arise.

For process criticality, occurrence may depend on:

• inherent process variability;
• material variability;
• parameter variability;
• equipment capability;
• historical performance;
• process sensitivity;
• operating range;
• frequency of excursions; and
• effectiveness of existing preventive controls.

Occurrence estimates are frequently uncertain early in development because little manufacturing history exists. That uncertainty should be acknowledged rather than converted into false numerical precision.

Detectability

Detectability is the ability to discover or determine the existence or presence of a hazard. ICH Q9(R1) recognizes that detectability is incorporated into some risk-management methods, but it is not an obligatory component of every risk model. Detectability can consider:

• in-process measurement;
• Process Analytical Technology;
• sampling;
• laboratory testing;
• automation;
• alarms;
• downstream detection;
• finished-product testing; and
• trend monitoring.

A major limitation of detectability scoring is that strong detection does not eliminate the underlying failure mechanism. A process parameter with a serious potential effect on product quality should not be declared noncritical merely because the resulting defect is easy to detect.

Uncertainty

ICH Q9(R1) gives substantially greater emphasis to uncertainty, defining it in the Quality Risk Management context as lack of knowledge about risks. The guideline identifies incomplete process understanding, sources of variability, and gaps in knowledge as contributors to uncertainty.

This is particularly important during Stage 1. Two parameters can receive identical nominal risk scores but have very different evidentiary foundations. For example:

• Parameter A: Extensive DOE, mechanistic knowledge, multiple material lots, and scale-up data demonstrate little CQA effect.
• Parameter B: Only limited historical experience exists and the possible CQA relationship has never been experimentally studied.

Calling both “low risk” would hide an important difference. Parameter B has substantially greater uncertainty. The appropriate response may be additional characterization rather than simply accepting the numerical ranking.

Process Knowledge Must Influence the Assessment

ICH Q9(R1) explicitly states that the rigor and formality of Quality Risk Management should reflect available knowledge, complexity, importance, and uncertainty. Relevant process knowledge can include:

• scientific mechanism;
• prior product/platform experience;
• development studies;
• DOE;
• raw-material variability;
• equipment capability;
• scale-up studies;
• historical manufacturing performance;
• analytical capability;
• deviations and investigations;
• supplier knowledge; and
• commercial manufacturing experience.

The risk assessment should show how this evidence influenced the conclusion. A risk table containing only numbers without the underlying rationale is weak validation evidence.

Parameter Interactions

A parameter may appear low risk when evaluated independently but become important in combination with another variable. For example, temperature may have little effect at low mixing speed but significantly affect a CQA at high mixing speed. Similarly:

• material moisture may alter sensitivity to drying temperature;
• concentration may change the effect of mixing time;
• batch load may alter agitation performance;
• filtration pressure may interact with feed viscosity; or
• hold time may become important only at elevated temperature.

Interactions are one reason criticality assessment should incorporate DOE and mechanistic process understanding rather than relying solely on independent one-variable scoring. FDA/ICH implementation guidance specifically recommends considering potential interactions when choosing DOE variables and ranges for criticality and design-space work.

See Design of Experiments for Process Characterization and Validation for the detailed interaction and multivariate framework.

Statistical Significance Does Not Equal Criticality

A statistically significant parameter effect does not automatically make the parameter a CPP. Statistical analysis answers whether an effect can be distinguished from experimental variability under the assumptions and conditions of the study.

Criticality asks a different question: Does variability in this parameter have a meaningful relationship to a CQA such that appropriate monitoring or control is necessary to assure quality?

The magnitude of the effect, studied range, CQA consequence, process mechanism, commercial relevance, control strategy, and uncertainty should all be considered. The reverse is also true.

A limited development study that does not reach conventional statistical significance does not automatically prove that a parameter is noncritical, especially when data are sparse or the consequence of failure is significant.

Risk Ranking

Risk ranking is useful for prioritization, but the ranking system should remain transparent and scientifically interpretable. Typical approaches use qualitative categories such as: High / Medium / Low or numerical scales representing factors such as severity and occurrence.

ICH Q9(R1) allows qualitative and quantitative descriptions and notes that risk scores may be used, but the descriptors and decision criteria should be sufficiently defined. The numerical score should support—not replace—the rationale.

Be Careful With RPN

Risk Priority Number (RPN) is a numerical value often calculated in Failure Mode and Effects Analysis by multiplying ratings such as:

Severity × Occurrence × Detectability

RPN can be useful for prioritization, but it should not be treated as a universal regulatory requirement or an automatic CPP classifier.

Different combinations of severity, occurrence, and detectability can produce the same RPN while representing very different risks.

For example, a high-severity/low-occurrence condition should not necessarily receive the same control strategy as a moderate-severity/high-occurrence condition merely because the arithmetic result is identical.

Criticality decisions should therefore retain visibility of the underlying components.

FMEA and FMECA

Failure Mode and Effects Analysis (FMEA) is a structured technique used to identify potential failure modes, evaluate their effects, and prioritize risks.

Failure Mode, Effects and Criticality Analysis (FMECA) extends FMEA by explicitly incorporating the degree of criticality, including factors such as severity, probability of occurrence, and detectability. ICH Q9(R1) includes both tools among accepted risk-management methods.

For CPP/CMA assessment, these methods can be useful when the process is decomposed into unit operations and potential failure mechanisms. They are less useful when the exercise consists only of assigning scores to a preexisting list of parameters without evaluating mechanisms or CQA relationships.

Criticality Is a Continuum of Evidence

Process knowledge rarely supports perfectly binary conclusions from the beginning. A more useful concept is a continuum such as:

Known Critical → Potentially Critical → Important but Controlled → Low Demonstrated Impact

The terminology used by a company can differ, but the assessment should distinguish:

• known relationships;
• suspected relationships;
• unresolved uncertainty;
• demonstrated lack of meaningful impact within defined conditions; and
• variables important for process performance even when not classified as CPPs.

This provides more useful information than forcing every variable into a permanent yes/no category during early development.

Evolution of Criticality Across the Lifecycle

Criticality assessment should evolve as knowledge develops. FDA/ICH implementation guidance explicitly states that CQAs and CPPs can evolve throughout the product lifecycle as manufacturing processes change and additional knowledge becomes available.

ICH Q9(R1) likewise requires risk-management outputs to be reviewed in light of new knowledge and experience, including planned events such as change control and product review and unplanned events such as investigations.

Early Development

Early assessments commonly contain relatively high uncertainty. At this stage, the purpose is often to identify:

• potential CQAs;
• candidate material attributes;
• candidate process parameters;
• likely failure mechanisms;
• knowledge gaps; and
• studies required to refine the assessment.

Conservative assumptions can be appropriate when information is limited. They should not become permanent classifications simply because they were documented in the first risk assessment.

Process Characterization and DOE

Development studies should replace assumptions with evidence.

Process Characterization and Development Studies for Process Validation establishes material–process–quality relationships, while Design of Experiments for Process Characterization and Validation can quantify parameter effects, interactions, curvature, and robustness. These studies may demonstrate that:

• a potential CPP has little practical effect within the intended range;
• an apparently minor parameter has an important CQA relationship;
• a material attribute changes process sensitivity;
• multiple parameters interact;
• a proposed operating range is too broad; or
• additional commercial-scale confirmation is needed.

The risk assessment should be updated accordingly.

PPQ

Process Performance Qualification (PPQ) provides commercial-scale evidence that can confirm or challenge Stage 1 criticality assumptions. PPQ can demonstrate:

• whether identified CPPs remain controlled;
• whether the expected CPP–CQA relationships are observed;
• whether material variability is adequately managed;
• whether operating ranges remain appropriate;
• whether the control strategy works under commercial conditions; and
• whether residual uncertainty remains acceptable.

See Verification of CPPs and Process Control Strategy During PPQ for detailed commercial-scale verification. The current live article specifically positions PPQ as confirmation that Stage 1 CPP and control-strategy conclusions remain valid under commercial manufacturing conditions.

Continued Process Verification

Continued Process Verification (CPV) provides longer-term manufacturing evidence. CPV may reveal that:

• a parameter previously considered low risk has greater influence than expected;
• material variability is more significant than development studies suggested;
• interactions emerge only after broader commercial experience;
• a CPP range should be refined;
• existing controls provide greater assurance than initially expected; or
• new changes require criticality reassessment.

FDA’s process-validation lifecycle specifically expects commercial data to expand process knowledge and support continued state-of-control decisions.

See Continued Process Verification Program and Monitoring Strategy for the Stage 3 monitoring framework.

Changes and Investigations

Criticality assessments should also be revisited when relevant lifecycle events occur. Examples include:

• new raw-material suppliers;
• material specification changes;
• equipment changes;
• scale changes;
• process-range changes;
• new analytical capability;
• recurring deviations;
• OOS or OOT investigations;
• CAPA;
• process improvements; and
• new scientific knowledge.

A prior conclusion remains valid only to the extent that the evidence and assumptions supporting it remain applicable.

Criticality and the Control Strategy

The purpose of criticality assessment is not simply to produce lists labeled CQA, CMA, and CPP.

The outputs should influence the process control strategy. For a CPP, the strategy might include:

• a justified operating range;
• automated process control;
• frequent or continuous measurement;
• alarms;
• sampling;
• in-process testing;
• PPQ verification; and
• CPV trending.

For a material attribute, controls might include:

• incoming specifications;
• supplier controls;
• material testing;
• segregation or storage requirements;
• material selection; or
• feed-forward process adjustment.

The level of control should reflect the actual process relationship and residual risk.

See Process Control Strategy and Design Space Development for translation of Stage 1 knowledge into operational process controls.

Control Strategy Does Not Eliminate Criticality

A robust control strategy can substantially reduce risk. It does not necessarily change the fundamental quality significance of a CQA. FDA/ICH implementation guidance makes this distinction explicitly: control strategy can reduce the risk associated with a CQA while its underlying criticality remains.

For process parameters, however, additional knowledge and improved control can change the assessment of whether the parameter should remain classified as a CPP. That conclusion should be scientifically documented rather than achieved by simply lowering a risk score after controls are added.

Residual Risk

Residual risk is the risk remaining after risk-control measures have been implemented. For process validation, residual risk may determine:

• additional characterization;
• PPQ sampling;
• enhanced monitoring;
• additional acceptance criteria;
• increased CPV attention;
• supplier controls;
• periodic review; or
• contingency measures.

Residual risk should be explicit rather than implicitly assumed acceptable because controls exist.

Relationship to Process Risk Management

This article addresses the specific Stage 1 question of CQA, material-attribute, and CPP criticality. The broader lifecycle framework for applying Quality Risk Management to validation strategy, PPQ, monitoring, deviations, changes, and revalidation belongs in Quality Risk Management in Process Validation.

This distinction avoids turning the CQA/CPP article into a generic risk-management article.

Knowledge Management Supports Better Criticality Decisions

ICH Q10 identifies knowledge management and Quality Risk Management as complementary enablers of the Pharmaceutical Quality System and expects product and process knowledge to be managed from development through commercial manufacture. As knowledge increases:

uncertainty should generally decrease → risk assessment should become more evidence-based → controls can become more precisely targeted.

This does not mean risk always decreases. New information can reveal previously unknown risk and lead to stronger controls, additional characterization, or revalidation.

See Lifecycle Integration and Knowledge Management in Process Validation for the broader knowledge-management model.

Documentation and Traceability

The criticality assessment should allow an independent reviewer to understand:

• Why is this attribute a CQA?
• Why is this material attribute important?
• How does this parameter affect the process or CQA?
• What evidence supports the conclusion?
• What uncertainty remains?
• What control is required?
• What subsequent data confirmed or changed the decision?

Relevant documentation can include product-development rationale, QTPP, CQA assessments, process maps, characterization reports, DOE reports, FMEA/FMECA, risk-ranking records, CPP/CMA assessments, control-strategy documentation, PPQ evidence, CPV reports, investigations, and change assessments.

The objective is traceability from product-quality requirement → scientific relationship → risk evaluation → control → validation evidence → lifecycle review.

Key Principles

• CQAs originate from product-quality understanding and the QTPP; they are not generated mechanically by a risk matrix.
• A material attribute is an input characteristic; CMA is commonly used for a material attribute whose variability is sufficiently important to require control.
• A process parameter is not automatically a CPP.
• A CPP is a process parameter whose variability can affect a CQA and therefore requires appropriate monitoring or control.
• Early development should allow provisional classifications such as potential CPP when evidence is incomplete.
• Severity reflects the consequence of harm and should not be artificially reduced because controls are strong.
• Probability or occurrence considers how likely an adverse condition is to arise.
• Detectability is used by some risk tools but is not mandatory for every risk model.
• Uncertainty should be explicitly considered, especially when process knowledge is limited.
• Statistical significance does not automatically establish criticality.
• Parameter interactions can materially change criticality conclusions.
• A Risk Priority Number is a prioritization aid, not an automatic CPP decision rule.
• Risk ranking must remain connected to scientific rationale and evidence.
• Control strategy reduces risk but does not automatically remove CQA criticality.
• PPQ confirms criticality and control assumptions under commercial conditions.
• CPV and manufacturing experience should continue to refine criticality decisions.
• Risk assessments should be reviewed when new knowledge, investigations, or changes affect their assumptions.