Risk-Based QC Sampling: Stop Testing Everything Equally

Risk-based QC sampling is the practice of allocating testing frequency and intensity according to the actual consequences of a quality failure — and if your lab is still treating every sample, supplier, and matrix the same way, you are almost certainly misallocating resources.

Equal Sampling Is a Policy Decision Disguised as Neutrality

The default position in many small and mid-size labs is a flat sampling rate: test 10% of every lot, or run one QC replicate per batch, regardless of what the material is or what happens downstream if it fails. That feels fair and defensible. It is neither.

Flat sampling rates protect you from the appearance of bias. They do not protect you from actual risk. A 10% sample rate applied equally to a low-volume internal reference standard and a high-volume raw material destined for a pediatric supplement treats those two things as though they carry identical consequences — they do not.

The argument for equal sampling usually goes: "If we start treating things differently, auditors will ask why." This gets causality backward. Auditors do not expect uniform treatment; they expect documented justification. A risk-based sampling plan with a written rationale is more auditable, not less, because it shows deliberate decision-making rather than inherited habit.

How to Build a Tiered Sampling Strategy

Risk-based sampling rests on two axes: probability of failure and severity of consequence. Score each material or process step on both, and your sampling tiers follow naturally.

Step 1 — Classify by consequence. Ask what happens if this lot fails after release. Does it affect patient safety, regulatory standing, or commercial liability? Or does it slow an internal workflow? These are not the same tier.

Step 2 — Layer in historical failure rate. A supplier with three OOS results in 18 months is not the same risk as one with a clean two-year record. Your own data is the most defensible basis for probability scoring — use it.

Step 3 — Assign sampling frequencies to tiers, not materials. For example:

• Tier 1 (high consequence, elevated failure history): 100% incoming testing, duplicate QC runs, immediate OOS escalation
• Tier 2 (high consequence, clean supplier record): reduced incoming rate (e.g., every third lot) with skip-lot conditions clearly defined
• Tier 3 (low consequence, clean record): periodic surveillance only, with defined triggers that escalate to Tier 1

Step 4 — Build in automatic re-tiering. A Tier 3 material that fails twice in a row should escalate automatically. This is where a LIMS with OOS flagging earns its keep: Aliquora, for instance, can tag a supplier record the moment a second OOS event hits, prompting a sampling tier review before the next lot arrives rather than after.

The Counter-Argument Worth Taking Seriously

Opponents of risk-based sampling raise a legitimate concern: reduced testing can create blind spots. If you skip-lot test a Tier 2 supplier and a contaminant emerges on an untested lot, your sampling plan will look like a liability.

This is a real risk, and it deserves a real answer rather than dismissal.

First, risk-based sampling does not mean less testing overall — it means redistributed testing. The frequency you remove from low-risk, clean-history materials gets reallocated to high-consequence or high-variability ones. Your total QC effort may stay constant or increase at the tails.

Second, skip-lot programs should always include statistically defined triggers. Consider Greenfield Analytics, a mid-size nutraceutical contract lab: they moved their best-performing excipient supplier from 100% incoming testing to a 1-in-4 skip-lot protocol, but defined a hard rule — any out-of-spec result on a tested lot triggers immediate testing of the previous two skipped lots held in quarantine. The quarantine hold is the safety net. Without it, skip-lot is just wishful thinking.

Third, your sampling plan is a living document. Annual re-scoring of supplier tiers, triggered re-tiering on OOS events, and documented rationale at every decision point are what make the plan defensible when something does go wrong.

Frequently Asked Questions

What regulations support risk-based QC sampling?

ICH Q10, FDA 21 CFR Part 211.84, and ISO 17025 all explicitly allow or encourage risk-based approaches to sampling and testing frequency. The requirement is documented justification, not a specific rate.

How often should we re-evaluate supplier tier assignments?

At minimum, annually — but any OOS finding, supplier audit result, or process change should trigger an immediate review outside the annual cycle.

Can risk-based sampling be used for in-process QC, not just incoming materials?

Yes. The same consequence-and-probability framework applies to in-process control points. High-consequence steps (e.g., final blend uniformity before compression) warrant more frequent sampling than low-consequence intermediate checks.

What should a risk-based sampling SOP include?

At minimum: the scoring criteria for consequence and probability, the defined tiers and their associated sampling frequencies, escalation and de-escalation triggers, and a signature block for periodic review.

Is skip-lot testing acceptable under USP or FDA guidelines?

Skip-lot testing is generally acceptable when supported by supplier qualification data, a statistically defensible sampling plan, and a defined protocol for handling a failed lot — including retrospective testing of held material.