How to Develop and Maintain Risk Management Plans for Biological Medicinal Products

A risk management system is the organised set of pharmacovigilance activities and interventions used to identify, characterise, prevent or minimise a medicine’s risks and to assess whether those interventions work. The risk management plan (RMP) is the structured regulatory document that describes that system for a particular medicinal product.

An RMP is prospective. A Periodic Benefit–Risk Evaluation Report looks back across a defined interval and asks what the accumulated evidence means; an RMP asks what is known and uncertain now, what additional evidence is needed, what controls are justified, how success will be measured, and when the plan will be reconsidered. A useful analogy is an engineering control architecture: the safety specification identifies important hazards and gaps in knowledge; the pharmacovigilance plan specifies sensors and investigations; risk minimisation specifies controls; effectiveness evaluation tests whether the controls work. The analogy stops where regulation begins—an RMP is not a free-form engineering document but a prescribed EU format.

Biological medicines require several levels of reasoning. An infection may follow target-mediated immunosuppression and therefore concern the active substance or class. Immunogenicity may depend on the molecule, formulation, route, handling or patient factors. An incomplete dose may concern an injector rather than the protein. A cluster may concern one batch or manufacturing period. The RMP must not force all these into a single undifferentiated “biological risk”.

Table of Contents

• Regulatory basis and current EU format
• Continuing worked example
• Before drafting: construct the risk-management logic
• Part I: Product Overview
• Part II: Safety Specification
• Module SI: Epidemiology of the indications and target populations
• Module SII: Non-clinical part
• Module SIII: Clinical-trial exposure
• Module SIV: Populations not studied in clinical trials
• Module SV: Post-authorisation experience
• Module SVI: Additional EU requirements
• Module SVII: Identified and potential risks
• Module SVIII: Summary of safety concerns
• Part III: Pharmacovigilance Plan
• Part IV: Plans for Post-Authorisation Efficacy Studies
• Part V: Risk-Minimisation Measures
• Routine measures
• Additional measures
• Effectiveness evaluation
• Part VI: Summary of the RMP
• Part VII: Annexes
• Different EU RMP content patterns
• Full initial application
• Generic, hybrid and biosimilar applications
• New indication, route, formulation or device
• Post-authorisation update
• International comparisons
• United Kingdom
• United States REMS
• Japan RMP
• Writing workflow and consistency controls
• Inspection and QPPV perspective
• Key Takeaways
• References
• Regulatory Note

Regulatory basis and current EU format

EU GVP Module V describes risk-management systems. The current integrated EU RMP format is Revision 2.0.1. Initial marketing-authorisation applications require an RMP irrespective of legal basis, although proportionality may permit certain parts or modules to have reduced content or be omitted where the current guidance allows and the competent authority does not require them.

The RMP is submitted as one controlled document, normally in CTD section 1.8.2. It is updated when the risk-management system changes materially, especially when new information may significantly change the benefit–risk profile or when an important pharmacovigilance or risk-minimisation milestone is reached. An update is not required for every administrative change; the reason and regulatory route matter.

The categories important identified risk, important potential risk and missing information are technical judgements. An identified risk has adequate evidence of association. A potential risk has a suspected association for which evidence is insufficient to conclude causality. Missing information is a gap in knowledge about safety in a use or population that is clinically relevant. “Important” means the concern could affect the benefit–risk balance or have public-health implications; it does not mean every labelled adverse reaction belongs in the RMP.

Continuing worked example

The article uses fictional mAb-Y, an immunomodulatory monoclonal antibody for severe inflammatory disease. It has intravenous and self-injected subcutaneous presentations. Key issues are serious infection as an important identified risk; severe hypersensitivity as an important potential risk; limited pregnancy data as missing information; a possible neutralising-antibody/loss-of-effect concern; and incomplete dosing with one injector design.

These are illustrative examples, not real regulatory decisions.

Figure 1. The safety specification defines important knowledge and uncertainty; pharmacovigilance produces evidence; risk minimisation reduces preventable harm; effectiveness evaluation tests the system and feeds the next update.

Before drafting: construct the risk-management logic

Begin with an evidence inventory, not the template. Map non-clinical findings, trial exposure, post-authorisation cases, epidemiology, class effects, literature, signals, immunogenicity, quality/manufacturing history, product complaints, devices, planned studies, product information and existing regulatory commitments.

For each candidate concern ask:

1. What is the evidence and uncertainty?
2. Is it identified, potential or missing information?
3. Is it important enough for the RMP?
4. At what level does it operate: class, active substance, product, batch, formulation, route or device?
5. Is routine pharmacovigilance sufficient?
6. Is an additional activity needed to answer a specific question?
7. Are routine risk-minimisation measures sufficient?
8. If additional measures are proposed, how will effectiveness be assessed?

The answers must remain consistent across Parts II, III and V. A concern should not appear in the pharmacovigilance plan without a traceable safety-specification rationale.

Part I: Product Overview

Part I identifies the product, legal basis, active substance, pharmacotherapeutic group, mechanism, indications, dosing, pharmaceutical forms, strengths, route and regulatory status. It orients every later decision.

For a biological, map reference/biosimilar status, formulation, presentation and device explicitly. Describe mechanism sufficiently to understand target-mediated risks without duplicating the clinical overview. State proposed versus authorised information clearly.

mAb-Y example: identify IV vial and SC injector separately. The antibody mechanism is shared, while incomplete-dose risk applies only to the injector. A common error is to list both presentations but write later controls as though every risk applies equally to both.

Part II: Safety Specification

The Safety Specification is the evidence-based description of important known risks, suspected risks and clinically relevant gaps. It is not a catalogue of all adverse reactions.

Module SI: Epidemiology of the indications and target populations

Describe incidence, prevalence, demographics, natural history, important comorbidity and background event rates for each indication. Explain how untreated disease and standard therapies create events that may be confused with product risks.

For biologicals, include infection burden, malignancy risk, immune dysfunction, vaccination status, prior biologic exposure and concomitant immunosuppression where relevant. For mAb-Y, serious infection is common enough in severe disease that observed cases require comparison with disease severity and corticosteroid exposure.

A scientific analogy is the background of a photograph: without it, a foreground object may appear larger or smaller than it is. Epidemiology provides context but does not itself prove or disprove causality.

Module SII: Non-clinical part

Summarise non-clinical safety findings that remain relevant to human risk. Address pharmacology, off-target binding, tissue cross-reactivity, immune effects, reproductive findings and juvenile-animal data where applicable.

Biologicals may have species-specific binding, making conventional animal models poorly informative. State that limitation. Manufacturing comparability and impurity data principally belong to quality documentation, but a new attribute with plausible clinical safety implications should connect to the safety specification.

For mAb-Y, cytokine findings in a relevant primate model support infection monitoring; they do not quantify human incidence.

Module SIII: Clinical-trial exposure

Describe the clinical development population by number, indication, dose, duration, age, sex and relevant subgroups. For biologicals add formulation, route, repeat courses, prior biological treatment, concomitant immunosuppression and immunogenicity sampling.

Small exposure limits the ability to detect rare events. Do not transform “not observed” into “risk absent”. For mAb-Y, 1,500 exposed subjects may characterise common reactions but cannot reliably exclude a very rare opportunistic infection.

Module SIV: Populations not studied in clinical trials

Identify clinically relevant populations excluded or under-represented and explain the safety consequence. Examples include pregnancy, severe renal or hepatic impairment, older people, children, immunocompromised patients and patients with prior malignancy.

Exclusion alone does not automatically create missing information. The gap must matter to authorised or expected use and to risk prediction. For an IgG monoclonal antibody, pregnancy assessment should consider placental transfer by trimester, target biology and possible neonatal pharmacodynamic effects.

mAb-Y example: pregnancy remains missing information because women of childbearing potential will use the product, placental transfer is plausible and infant immune consequences remain uncertain.

Module SV: Post-authorisation experience

Summarise worldwide exposure and important experience after authorisation. Stratify by indication, route and presentation where needed. Discuss patterns of use, off-label use, switching and important regional differences.

For biologicals, exposure estimates should not merge reference and biosimilar products without a valid reason. Brand and batch completeness affect interpretation. New formulation launch can change reporting behaviour.

Module SVI: Additional EU requirements

Address EU-specific topics required by the template, including potential for misuse, medication error, off-label use, paediatric issues and other specified concerns. Apply only relevant elements and explain why they matter.

Biological examples include wrong route, confusion between intravenous and subcutaneous strengths, incomplete device delivery, cold-chain failure, home administration, product-name confusion after switching and inadvertent live vaccination during immunosuppression.

For mAb-Y, incomplete injector delivery is a medication-use and device pathway. It should not be classified automatically as molecular lack of efficacy.

Module SVII: Identified and potential risks

This module contains the detailed scientific evaluation of important identified and potential risks and missing information. For each risk describe evidence, mechanism, frequency where estimable, seriousness, severity, preventability, risk factors, affected populations and impact on benefit–risk.

An important identified risk requires adequate evidence of association. For mAb-Y, serious infection is supported by trials, post-marketing cases, target biology and class evidence.

An important potential risk remains suspected. Severe delayed hypersensitivity may have coherent cases but uncertain incidence and mechanism. Calling it identified prematurely would distort both label and pharmacovigilance planning.

For immunogenicity, distinguish antibody positivity from clinical risk. Explain assay design, drug tolerance, titres, persistence, neutralising activity, pharmacokinetics, efficacy and reactions. “Antidrug antibodies” alone is not a clinically characterised safety concern.

Module SVIII: Summary of safety concerns

Module SVIII is the controlled summary of important identified risks, important potential risks and missing information that drive later plans. It must match Parts III and V.

The last row illustrates a qualification: not every operational concern belongs in SVIII. Inclusion depends on importance and regulatory agreement. It may instead be managed through product-quality and routine safety systems.

Figure 2. A finding enters the RMP only after evidence, uncertainty, importance and product scope are assessed. The resulting classification determines—but does not mechanically dictate—the plan.

Part III: Pharmacovigilance Plan

The pharmacovigilance plan answers what further evidence is needed and how it will be obtained. Routine pharmacovigilance includes standard case collection, signal management, literature review, periodic reporting and other activities applicable to the product. Additional pharmacovigilance is product-specific work beyond routine systems.

For every additional activity define the safety concern, objective, design, population, milestones and how the result could change risk management. A registry is not justified because “biologicals need registries”; it is justified only if it answers a material question.

For mAb-Y:

Study milestones must be realistic and aligned with protocols and regulatory commitments. Part III tables, Annex 2 and Annex 3 must agree.

Part IV: Plans for Post-Authorisation Efficacy Studies

Part IV describes required or planned post-authorisation efficacy studies where efficacy uncertainty has implications for benefit–risk. It is not a second pharmacovigilance plan.

For biologicals, questions may concern durability, efficacy in an under-studied population, effect after switching or performance of a new route. A biosimilar comparability programme should not be relabelled as post-authorisation efficacy work unless it meets the regulatory purpose.

For mAb-Y’s new SC route, a post-authorisation efficacy study may be relevant if exposure or adherence uncertainty could affect clinical benefit. Device-completion complaints alone remain a quality/use investigation unless broader efficacy uncertainty is established.

Part V: Risk-Minimisation Measures

Risk minimisation aims to prevent an adverse reaction, reduce its probability or lessen severity.

Routine measures

Routine measures include product-information wording, prescription status, pack size and other standard controls. Explain how each measure addresses the risk. Copying SmPC sections into a table without causal logic is inadequate.

For serious infection, routine measures may include contraindications, screening, warnings, dose interruption and patient information. Exact measures depend on the authorised product.

Additional measures

Additional risk-minimisation measures are used when routine measures are insufficient. Examples include healthcare-professional guides, patient cards, controlled access, checklists or specialised training. They require regulatory agreement.

For biologicals, additional measures may address infection recognition, vaccination, pregnancy prevention, home infusion or device technique. Educational material should not be proposed simply because the product is complex. State the behavioural objective.

Effectiveness evaluation

Effectiveness must be planned when the measure is designed. Process indicators show implementation—distribution, training completion or material reach. Outcome indicators show whether knowledge, behaviour or clinical outcomes changed.

For mAb-Y injector training:

• distribution count measures dissemination;
• observed correct preparation measures behaviour;
• incomplete-dose complaint rate measures an operational outcome;
• disease flares after confirmed incomplete dosing provide clinical context.

A fall in reports may mean improvement, under-reporting or reduced exposure. Use multiple indicators and predefined interpretation.

Figure 3. A measure should connect a defined risk mechanism to a target behaviour and measurable outcome. Distribution alone does not establish effectiveness.

Part VI: Summary of the RMP

Part VI communicates key RMP information for a broader audience. It must remain scientifically faithful while using accessible explanations. Define the disease, benefits, important risks, missing information, pharmacovigilance activities and risk-minimisation measures.

For biologicals, explain immunogenicity without implying that any antibody result is harmful. Explain biosimilarity without suggesting molecular identity. Avoid brand ambiguity.

The public summary must agree with SVIII, Parts III and V. Simplification is not permission to change classification.

Part VII: Annexes

The integrated EU format includes controlled annexes. Their exact applicability follows the current template:

1. EudraVigilance interface information where applicable.
2. Tabulated planned, ongoing and completed pharmacovigilance studies.
3. Protocols for studies in the pharmacovigilance plan.
4. Specific adverse-reaction follow-up forms.
5. Protocols for post-authorisation efficacy studies.
6. Details and mock-ups of additional risk-minimisation measures.
7. Other supporting data.
8. Summary of changes to the RMP over time.

For a biological, Annex 4 follow-up forms may capture brand, batch, manufacturing period, route, device, immunogenicity, infusion details and switching history. Ask only questions capable of changing assessment; a long questionnaire that is never completed is not an effective control.

Annex 8 is the lifecycle memory. It should show what changed, why, which evidence triggered it and which sections were affected.

Different EU RMP content patterns

There is one current integrated EU format, but its content is proportional to application type and product circumstances. “Full” and “abridged” are useful informal descriptions, not permission to invent templates.

Full initial application

A full initial application for a new active substance generally requires all parts and modules. Biological development should integrate non-clinical species limitations, clinical exposure, immunogenicity, manufacturing comparability, important class effects and planned post-authorisation evidence.

Generic, hybrid and biosimilar applications

Initial applications still require an RMP, but current GVP and template instructions permit specified modules to be omitted or reduced in defined circumstances. The safety concerns should align with the reference product where appropriate. Product-specific differences—new excipient, route, formulation, device, immunogenicity issue or evidence—must be addressed rather than hidden behind reference-product alignment.

For biosimilars, SI–SV may be omitted where the current template permits, but the author must follow the exact legal-basis instructions and authority expectations. SVIII remains central; SVII may be needed to justify changed or new concerns. Never generalise a generic rule without verifying its applicability to the biosimilar submission.

New indication, route, formulation or device

An update should focus on the change and its effect on the complete risk system. A new route may change local reactions, immunogenicity, medication errors and exposure. A new injector may require device-specific minimisation and effectiveness measures. Reassess every part; do not merely add a paragraph to Part I.

Post-authorisation update

Update when new information materially changes the safety specification, pharmacovigilance or risk-minimisation system, or when requested or linked to an important milestone. Remove completed activities only with clear results and regulatory status. Version control should identify changes and rationale.

International comparisons

United Kingdom

UK RMPs continue to use the EU template framework, with GB/UK-specific information supplied through the applicable national approach and annex where appropriate. An approved EU RMP may be accepted with UK-specific content. Verify current MHRA procedural guidance for the submission route.

United States REMS

A Risk Evaluation and Mitigation Strategy (REMS) is an FDA-required programme for particular serious risks when additional controls are necessary to ensure benefits outweigh risks. It is not the US version of the EU RMP.

A REMS document specifies goals and requirements and may include a Medication Guide, communication plan and elements to assure safe use, such as prescriber certification, pharmacy certification, dispensing conditions, monitoring or registries. Only some products require REMS. The EU RMP is a broader lifecycle risk-management document required with initial EU applications.

Japan RMP

Japan RMPs organise the safety specification, pharmacovigilance activities and risk-minimisation activities, distinguishing routine and additional activities. Japan-specific post-marketing surveillance and Early Post-marketing Phase Vigilance may be relevant. Use PMDA/MHLW templates and local regulatory decisions rather than translating the EU RMP mechanically.

Writing workflow and consistency controls

Step 1: establish product scope

Map active substance, products, strengths, formulations, routes, devices, indications, territories and reference/biosimilar relationships.

Step 2: build the candidate-concern inventory

Collect trial, post-marketing, signal, literature, non-clinical, epidemiology, quality, device and regulatory evidence. Record why each issue is or is not important.

Step 3: classify with evidence

Use identified risk, potential risk or missing information only after applying the definitions. Record disagreements and uncertainty.

Step 4: design activities from questions

Every additional pharmacovigilance activity must answer a defined uncertainty. Every additional risk-minimisation measure must target a defined preventable pathway.

Step 5: design effectiveness assessment

Specify implementation, knowledge, behaviour and outcome indicators as relevant. Define data sources, timing and limitations.

Step 6: reconcile the document

Use a consistency matrix:

A blank cell requires explanation. The same concern must retain the same name and classification across the RMP.

Worked biological update

Suppose mAb-Y’s injector lot produces incomplete doses and disease flares. Investigation confirms a component defect confined to one lot. The update should:

• revise Part I only if product/presentation information changed;
• describe post-authorisation evidence in SV;
• assess the product-use concern in SVI/SVII if it meets importance criteria;
• decide whether SVIII changes;
• add targeted complaint–ICSR reconciliation to Part III if additional evidence is needed;
• add or revise device instructions/training in Part V if routine controls are insufficient;
• define complaint, correct-use and clinical outcome indicators;
• update Part VI if the public risk-management description changes;
• add materials, protocols and change history to the relevant annexes.

It should not reclassify the event automatically as an active-substance lack-of-efficacy risk.

Inspection and QPPV perspective

Inspection evidence should demonstrate that RMP classifications arose from traceable evidence and that activities were implemented, monitored, analysed and escalated. Inspectors may compare the RMP with the signal system, PSUR, SmPC, protocols, educational materials, study reports, quality complaints and governance minutes.

Illustrative failure modes include:

• adding every adverse reaction as an important identified risk;
• calling trial exclusion alone missing information;
• proposing a registry without a decision-relevant objective;
• using antibody positivity as a surrogate for clinical immunogenicity;
• copying reference-product concerns without assessing biosimilar-specific differences;
• losing batch and device information;
• listing additional minimisation without effectiveness measures;
• allowing SVIII, Parts III/V and Part VI to disagree;
• deleting a completed activity without summarising results and regulatory disposition;
• treating REMS and EU RMP as equivalent documents.

These are hypothetical quality failures, not reported inspection findings.

QPPV oversight should ensure access to product-quality and manufacturing information, alignment between safety specifications and emerging signals, feasibility of additional activities, measurable risk-minimisation objectives, and controlled implementation of agreed changes. The QPPV is not required to author every table but should be able to explain the system’s logic and evidence.

Key Takeaways

• The EU RMP is a prospective risk-management architecture, not a list of adverse reactions.
• Biological risks may operate at class, active-substance, product, batch, route, formulation or device level.
• “Important” is a benefit–risk and public-health judgement.
• Immunogenicity requires clinical interpretation, not antibody results alone.
• Part II defines the problem; Parts III and V specify evidence generation and control.
• Effectiveness evaluation must be designed with the measure.
• Reduced content depends on current legal-basis and template instructions, not a free-standing abridged format.
• UK RMP, US REMS and Japan RMP frameworks overlap but are not interchangeable.
• Consistency across SVIII, Parts III/V/VI and annexes is a central quality test.

References

1. European Medicines Agency. GVP Module V: Risk management systems (Rev. 2). EMA/838713/2011; legally effective 31 March 2017. https://www.ema.europa.eu/en/human-regulatory-overview/post-authorisation/pharmacovigilance-post-authorisation/good-pharmacovigilance-practices-gvp.
2. European Medicines Agency. Guidance on the format of the RMP in the EU — integrated format (Rev. 2.0.1). EMA/164014/2018. https://www.ema.europa.eu/en/medicines-regulatory-overview/post-authorisation/pharmacovigilance-post-authorisation/risk-management/risk-management-plans.
3. European Medicines Agency. Risk management plan pre-authorisation guidance. Current Q&A, including RMP presentation and template requirements. https://www.ema.europa.eu/en/human-regulatory-overview/research-development/scientific-guidelines/pre-authorisation-guidance.
4. European Medicines Agency. GVP Module XVI: Risk minimisation measures, current revision.
5. European Medicines Agency. GVP Product- or Population-Specific Considerations II: Biological medicinal products. EMA/168402/2014.
6. European Parliament and Council. Directive 2001/83/EC, as amended.
7. European Parliament and Council. Regulation (EC) No 726/2004, as amended.
8. Medicines and Healthcare products Regulatory Agency. Guidance on pharmacovigilance procedures: Risk Management Plans. https://www.gov.uk/government/publications/guidance-on-pharmacovigilance-procedures.
9. U.S. Food and Drug Administration. Format and Content of a REMS Document: Guidance for Industry. January 2023. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/format-and-content-rems-document-guidance-industry.
10. U.S. Food and Drug Administration. REMS Document Technical Conformance Guide. January 2023.
11. Pharmaceuticals and Medical Devices Agency. Risk Management Plan. https://www.pmda.go.jp/english/safety/info-services/drugs/rmp/0001.html.
12. QPPV.com. GVP Product- or Population-Specific Considerations II: Biological Medicinal Products.

Regulatory Note

This article is an educational interpretation, not a substitute for current legislation, GVP Module V, the current EU RMP template, authority procedural guidance or product-specific advice. Permitted omissions and reduced content depend on legal basis, product characteristics, reference-product information and authority requirements. The mAb-Y examples are fictional and do not establish regulatory precedent.