Knowledge Management Under ICH Q10: Turning Tribal Knowledge Into Searchable Records

What ICH Q10 Asks For, and What It Leaves to You

Most quality leaders can recite the ICH Q10 model: four quality system elements (process performance and product quality monitoring, corrective and preventive action, change management, and management review), carried across four lifecycle stages, and supported by two enablers. Quality risk management, the second enabler, has its own guideline in ICH Q9 and has become part of daily work at most sites. Knowledge management has had a slower path. It is worth going back to the text to see what the guideline says, because the wording is more specific than many teams remember.¹

The Definition and the Scope

Section 1.6.1 of ICH Q10 defines knowledge management as a systematic approach to acquiring, analyzing, storing and sharing information about products, manufacturing processes and components. The same section sets the scope in time: “Product and process knowledge should be managed from development through the commercial life of the product up to and including product discontinuation.”¹ That sentence matters. It means knowledge management is not a development activity that ends at filing, and it is not a manufacturing activity that begins at process validation. It runs the whole length of the product’s life.

The guideline then lists sources of knowledge. They include prior knowledge (public or internally documented), pharmaceutical development studies, technology transfer activities, process validation studies over the product lifecycle, manufacturing experience, innovation, continual improvement, and change management activities.¹ Look at that list and notice how much of it is produced every week in routine GMP operations. Manufacturing experience and change management are not special projects. They are the daily output of a working site.

Where Knowledge Appears in the Four Quality System Elements

Knowledge is not only named in the enabler section. It appears inside the quality system elements themselves, which is where inspectors and auditors are most likely to look for it.

All quotations in the table are from the ICH Q10 guideline.¹ Read together, these passages describe knowledge as something the quality system produces, keeps and passes on, not as a separate library kept apart from it.

What the 2024 Q&A Revision Clarified

ICH updated its Q8, Q9 and Q10 Questions and Answers document in October 2024 (revision R5), and several of the knowledge management answers were approved in that revision.² Three points from that section are worth knowing well, because they are often misquoted in both directions.

• No single right method. The Q&A states: “Q10 provides a framework and does not prescribe how to implement knowledge management.” Each company decides how to manage knowledge, including how deep to go, based on its own needs.²
• No formal system required, but use is expected. Asked whether agencies expect to see a formal knowledge management approach during inspections, the answer is no: “There is no regulatory requirement for a formal knowledge management system.” The same answer adds that regulators do expect knowledge from different processes and systems to be put to appropriate use.²
• No dedicated software required. A dedicated computerized system is not required, though the Q&A notes such systems can be very useful for capturing, managing and sharing complex data and information. A separate answer adds that “ICH has not endorsed any commercial products and does not intend to do so.”²

The R5 revision also expanded the list of example knowledge sources well beyond the original Q10 text. It now includes stability reports, product quality reviews and annual product reviews, complaint reports, adverse event reports, deviation reports and recall information, technical investigations and CAPA reports, suppliers and contractors, product and manufacturing history, ongoing trend information, and risk assessments.² That is close to a full inventory of a GMP quality system’s records. The message is clear: the knowledge is already being generated. The work is in making it usable.

Why Tribal Knowledge Is a Quality Risk

“Tribal knowledge” is the everyday name for what the knowledge management literature calls tacit knowledge. The ISPE Good Practice Guide on knowledge management, published in May 2021, places particular emphasis on it and describes it as what is often called know-how and know-why.⁴ The guide was written by a team of industry practitioners and academics, co-led by Paige Kane and Melanie Adams.⁵ A 2022 ISPE article by Kane puts the distinction simply: explicit knowledge is captured and written down in procedures, manuals and papers, while “Tacit knowledge is knowledge that resides in the heads of people,” and is much harder to put into words.¹¹

How Undocumented Know-How Turns Into Risk

The link between knowledge and risk is no longer only an argument from knowledge management specialists. It is written into the revised quality risk management guideline. ICH Q9(R1), adopted in January 2023 and issued by FDA as final guidance in May 2023, ties the formality of risk management to uncertainty and says: “Uncertainty may be reduced via effective knowledge management, which enables accumulated and new information (both internal and external) to be used to support risk-based decisions throughout the product lifecycle.”³

A 2020 literature review by Marty Lipa, Kevin O’Donnell and Anne Greene, published in TU Dublin’s Level 3 journal, reached the same point from the other direction. Their review of how quality risk management and knowledge management connect concluded that risk varies inversely with knowledge application: the better the knowledge used in a risk assessment, the lower the remaining risk to quality and to the patient.⁸ Put plainly, a risk assessment is only as good as what the people in the room know, and what they can look up.

Consider what that means on a GMP site. A failure mode and effects analysis for a filling line is scored by a cross-functional team. If the person who remembers the 2019 stopper issue is on the team, detection is scored realistically. If that person has retired and the investigation is hard to find, the score is a guess. The documented risk assessment looks equally complete in both cases. Only one of them reflects what the company knew.

Where Tribal Knowledge Tends to Hide

In our experience, undocumented knowledge in pharma and biotech operations tends to collect in the same few places:

• The reason behind a setting. Batch records state the parameter. They rarely state why it was set there, what was tried first, or what happened at the edge of the range.
• Equipment behavior. Which unit runs warm, which sensor drifts after a certain number of cycles, which cleaning step needs extra attention on a particular vessel.
• Analytical nuance. Method robustness studies cover the documented range. Experienced analysts know which reagent suppliers, column lots or sample preparation habits cause trouble.
• Investigation history. The formal record captures the root cause. The discussion of causes that were ruled out, and why, often stays in email or in memory.
• Supplier and contract partner history. Which supplier needs closer incoming checks, and which contract manufacturer needs extra time for change notifications.
• Regulatory context. Why a commitment was made in a filing, and what the agency asked during review, which matters years later when a change is proposed.

The Workforce Pressure Behind the Problem

This is not only a theoretical concern. The Manufacturing Institute and Deloitte, looking across all of U.S. manufacturing rather than pharma alone, project that as many as 3.8 million additional employees could be needed between 2024 and 2033, and that as many as 1.9 million of those jobs could go unfilled if skills and applicant gaps are not addressed.¹⁵ Pharma and biotech sites draw on the same labor market for engineers, technicians and quality staff. Turnover and retirement mean that every year, some of what a site knows leaves with the people who move on, unless it has been written down in a form the next person can find.

The industry knows this is a gap. ISPE’s description of its Good Practice Guide says the industry has made real progress adopting quality risk management since 2008, but “has been slow in implementing KM.”⁴ A 2021 paper in the PDA Journal of Pharmaceutical Science and Technology by Martin Lipa, Anne Greene and Nuala Calnan goes further, noting that “there is ample evidence that it is not yet a mature discipline within the biopharmaceutical sector.”⁶

Deciding What Knowledge Is Critical

Many knowledge management efforts stall at the start because they try to capture everything. No company can write down everything its people know, and a record nobody reads is not an improvement on a memory nobody can reach. The better first question is which knowledge, if lost, would lead to a wrong quality decision.

A Simple Criticality Test

We use three questions to decide whether a piece of know-how needs to become a record:

1. Does it affect a quality decision? If this knowledge were missing, could someone set a parameter, score a risk, disposition a batch, or close an investigation incorrectly?
2. Is it held by one or two people? Knowledge spread across a large team is at lower risk than knowledge held by a single long-serving expert.
3. Will it be needed again? Knowledge tied to an upcoming transfer, a planned change, a periodic review or a recurring event deserves priority over knowledge about a retired product.

Knowledge that answers yes to all three is critical. It should be captured as a record, reviewed, and linked to the product or process it describes. Knowledge that answers yes to only one can often wait, or can be handled through less formal means such as mentoring or a community of practice.

Knowledge Mapping Without a Large Project

A knowledge map is a simple picture of which knowledge exists, where it is held, and how it flows through a process. The ISPE article on knowledge management in mergers and acquisitions describes knowledge mapping as a way for organizations to understand what knowledge exists in functions and how it flows through business processes, alongside related tools such as expertise location and a shared taxonomy.¹¹ A TU Dublin research team also used a knowledge map in a 2022 ISPE Expert Xchange session to diagnose how well knowledge flows into quality risk management.¹⁰

A useful first map does not need special software. For one product, list the main knowledge areas down the side and three columns across: where the explicit knowledge is recorded, who holds the tacit knowledge, and how confident the team is that a new person could find and use it. The gaps usually become obvious within an afternoon.

Assign an Owner to Each Knowledge Area

Every knowledge area on the map needs a named owner. The owner does not have to write everything personally. The owner decides what is critical, makes sure it is recorded, and confirms that it is still correct at each review. Without an owner, knowledge records follow the same path as unowned shared drive folders: they are created with good intent and then left to go out of date.

Lessons Learned That Change Something

Almost every pharma and biotech company has run lessons learned sessions. Far fewer can show that a lesson from one project changed what happened in the next. The problem is rarely the meeting. It is what happens after it: notes saved to a project folder that closes with the project, no owner for the actions, and no way for the next team to find them.

Use a Short, Consistent Set of Questions

The after action review is one of the most widely used formats. Kane’s ISPE article notes that the U.S. Army has used after action reviews since 1989, and that many organizations keep the format simple by asking “what was supposed to happen, what actually happened, what went well, what did not go well, and who needs to know.”¹¹ The last question is the one most often skipped, and it is the one that turns a meeting into knowledge transfer.

Attach Lessons to Events Your Quality System Already Records

The most reliable way to make lessons learned routine is to attach them to events the quality system already tracks, rather than creating a new process that competes for attention. Each of the following already has a record, an owner and a closure step:

Write Lessons as Records, Not Notes

A lesson that changes something has five parts: a short statement of what was learned, the event it came from, the products or processes it applies to, the action it triggered (a procedure change, a training update, a design rule), and an owner who confirms the action was completed. A lesson without an action is an observation. A lesson without tags linking it to a product or process cannot be found by the next team that needs it.

Quality over quantity matters here. Ten lessons per year that each changed a procedure or a design rule are worth more than two hundred that were recorded and never read. For the same reason, we advise against a separate “lessons learned database” that no one opens between projects. Put the lesson where the next person will look: in the product knowledge record, the procedure it changed, or the risk assessment it informs.

Product Knowledge Across the Lifecycle

ICH Q10 asks for product and process knowledge to be managed from development to discontinuation.¹ In practice, that knowledge is usually spread across a development report written years ago, a filing, a validation master plan, hundreds of batch records, a stream of change controls, and whatever the current process owner remembers. Each record is controlled. The knowledge as a whole is not, because no single place tells a new process owner what the company understands about the product and why.

Keep a Product Knowledge Record

A product knowledge record (some companies call it a product knowledge file or product history file) brings together the understanding behind the product in one place. It does not replace controlled source documents. It summarizes and points to them. A useful one covers:

• The control strategy and the reasoning behind it, with links to the development and validation evidence.
• Known sensitivities and the history of how they were found, including investigations that shaped current understanding.
• A dated log of changes that affected process understanding, with links to change controls.
• Open questions: what the company does not yet understand, and what data would answer them.
• Named experts for each knowledge area, updated when people change roles.

The open questions section is the one most teams leave out, and it is often the most valuable. ICH Q9(R1) connects uncertainty directly to how much formality a risk decision needs.³ A written list of what is not yet known gives the next risk assessment team an honest starting point.

Structure Makes Knowledge Findable

FDA’s own quality assessment work offers a useful model here. The Knowledge-aided Assessment and Structured Application platform (KASA) was launched by CDER’s Office of Pharmaceutical Quality in February 2021 for generic solid oral dosage form applications. A 2026 paper by FDA authors in AAPS Open describes how KASA replaces free narrative with structured data: “Structured descriptors are extensively used in KASA to document required information concisely and minimize extensive narrative details.” Assessors enter key information through controlled vocabularies in drop-down lists, and the authors report that over 1,130 manufacturing assessments of original generic applications had been completed on the platform as of September 2024.¹⁴ The paper also notes that relying on free narratives and unstructured text reduces consistency and complicates lifecycle knowledge management.¹⁴

The lesson for industry is not to copy KASA. It is that knowledge becomes searchable and comparable when the same things are always recorded the same way. A product knowledge record with fixed sections, a controlled list of unit operations and failure modes, and consistent tags for products and equipment can be searched across a portfolio. A set of free-text reports written in each author’s own style cannot, however good the search tool.

Connect Data to Knowledge Deliberately

A 2022 ISPE article by Melanie Adams, Paige Kane and Anne Greene makes the point that data and knowledge are separate disciplines that must still be connected, and that turning data into knowledge does not typically happen on its own.¹² The same article contrasts the ICH Q10 definition with the broader definition used by APQC, which describes knowledge management as “The application of a structured process to help information and knowledge flow to the right people at the right time so they can act more efficiently and effectively to find, understand, share, and use knowledge to create value.”¹² The APQC framing is helpful because it starts with the person who needs the knowledge, not with the repository.

In practice, this means the periodic trend review should end with a written conclusion that goes into the product knowledge record, not only a set of charts filed with the review. A control chart shows that a parameter shifted. The knowledge is the explanation of why it shifted and what the team decided to do about it.

Technology Transfer as Knowledge Transfer

Technology transfer is where knowledge loss is most visible, because it is the one moment when the knowledge has to leave the people who hold it and reach people who do not. ICH Q10 states the goal directly: to transfer product and process knowledge between development and manufacturing, and within or between manufacturing sites, with that knowledge forming the basis for the manufacturing process, control strategy, process validation approach and ongoing improvement.¹

What WHO Guidance Expects

The World Health Organization’s guidelines on technology transfer, published in 2022 as Annex 4 of Technical Report Series No. 1044, frame the whole activity in knowledge terms. The introduction opens: “Technology transfer is a logical procedure involving the transfer of products, processes and knowledge, supported by relevant documentation and professional expertise.”¹³ The guideline lists effective process and product knowledge management among the conditions for a successful transfer, and states that “Product, process and procedure knowledge should be an essential part of the transfer process from the SU to the RU” (the sending unit and the receiving unit).¹³

The WHO text also recognizes that documents alone are not enough. It says that, whenever possible, targeted on-site or virtual visits between the sending and receiving units at critical phases “should be allowed to assist with the transfer of knowledge.”¹³ Its final project phase, review and close-out, calls for the progress and success of the transfer to be monitored and reviewed during and after completion.¹³

What the Research Shows

Research by the TU Dublin team suggests the industry is better at moving documents than at moving understanding. A 2019 paper by Martin Lipa, Paige Kane and Anne Greene in the Journal of Validation Technology found that sources agreed knowledge transfer is very important to technology transfer, yet the sector is not very effective at it. The authors add: “This is especially true of tacit knowledge transfer which is often reported to be ineffective.”⁷

The follow-on 2021 paper in the PDA Journal responded with a four-step framework to improve knowledge transfer during technology transfer, supported by a toolkit of knowledge management practices (tools, processes and behaviors), and showed how the approach could be extended across the product lifecycle to support ICH Q12.⁶ Earlier academic work pointed to the same gap. A 2016 review in Pharmaceutical Research by Anurag Rathore and colleagues screened 356 publications on knowledge management tools for quality by design and gathered input from 34 professionals at 17 major biopharmaceutical organizations. The authors found that knowledge from technology transfer was covered less often in the published literature than other knowledge sources, partly because industry treats transfer information as sensitive and rarely makes it public.⁹

Plan the Knowledge Transfer, Not Only the Batches

Most transfer plans are organized around documents to send and batches to run. A knowledge transfer plan adds a third list: what the receiving team must understand, and how each item will be transferred. Kane’s ISPE article describes the common practice of building a knowledge transfer plan into the technology transfer plan, setting out objectives, timelines, tools and processes for capturing the knowledge created and shared during the transfer.¹¹ It also points out that a transfer is a rich source of new knowledge, because a process is often run on different equipment or in a different facility for the first time.¹¹

Measure Understanding at Close-Out

A transfer is usually declared complete when the receiving site has made acceptable batches. That shows the process can be run. It does not show the process is understood. We recommend adding a simple close-out check: can the receiving site’s process owner explain the control strategy, the main known sensitivities, and what to do if each one appears, without calling the sending site? If the answer is no, the knowledge transfer is not complete, whatever the batch results say. Record the answer, and the gaps, in the product knowledge record.

Governance for Knowledge Records

Once knowledge is written down, it has to be governed. This is where many efforts go wrong in one of two directions. Some treat every knowledge record as a controlled GMP document, with full review and approval, which makes capture so slow that people stop doing it. Others keep everything informal, which means nobody can rely on it and an inspector cannot tell what the company stands behind.

Two Tiers: Controlled Records and Working Knowledge

A practical answer is two tiers, with a clear rule for moving content between them.

The rule between them is simple: if a piece of working knowledge is going to be relied on for a quality decision, it moves into a controlled record first. That keeps capture fast while making sure anything used in a batch disposition, investigation conclusion or risk score has been reviewed.

What Each Controlled Knowledge Record Needs

• An owner accountable for accuracy, named by role as well as by person so the record does not become orphaned when someone leaves.
• A review date tied to an existing cycle, such as the product quality review, rather than a separate calendar.
• Links to sources: each statement points to the controlled document, report or record that supports it.
• Standard tags for product, process step, equipment, site and knowledge area, drawn from a controlled list.
• A retirement path for when a product is discontinued. ICH Q10 expects a predefined approach to retention of documentation at discontinuation, and knowledge records belong in that plan.¹

A Shared Vocabulary Is Part of Governance

Search depends on consistent terms. If one site calls it “granulation end point” and another calls it “wet mass end,” a search for one will miss the other. The ISPE guidance on knowledge management describes taxonomy as standard metadata that works as a common language, and Kane’s article notes that systems using synonyms can help search when two organizations use different terms.¹¹ A controlled list of product names, process steps, equipment classes and failure modes is dull work, but it is the part that makes everything else findable. Most companies already have partial lists in their deviation, CAPA and change control systems. Start there.

Connect Knowledge to Management Review

ICH Q10 lists capture and dissemination of knowledge as a possible output of management review.¹ Very few management review agendas we see include it. Adding a short standing item gives knowledge management the same visibility as other quality system elements. Useful measures are simple ones:

• Share of critical knowledge areas (from the knowledge map) with a current, owned record.
• Number of recurring deviations where the earlier investigation was not found or not used.
• Transfer close-outs completed with the understanding check passed.
• Knowledge areas held by a single person, and the plan for each.

The second measure is often the most revealing. A recurring deviation where the first investigation had the answer is direct evidence that knowledge was generated and not used, which is exactly the situation the ICH Q&A says regulators expect companies to avoid.²

Link Knowledge and Risk Work

At the 2022 ISPE Expert Xchange on risk-based decision making, researchers presented the Risk-Knowledge Infinity Cycle, a framework in which knowledge is both an input to and an output of risk management. They reported that 90% of a targeted group of industry, regulatory and academic experts (32 people) agreed that deploying such a framework would improve integration of quality risk management and knowledge management.¹⁰ A poll in the same session found that only 19% of participants had a formal definition of risk-based decision making in their quality system.¹⁰

The practical step is modest: at the start of every formal risk assessment, list the knowledge sources the team used, and at the end, record any new knowledge the assessment produced. That makes each risk assessment both a user and a producer of the product knowledge record.

Where AI Search Helps and Where It Stops

Many leaders now ask whether an AI assistant that can search every document on the network makes knowledge management work unnecessary. It does not, though it can help in specific ways.

Where It Helps

• Finding earlier events. A search that understands meaning, not only exact words, can find a 2021 investigation described in different terms from today’s deviation. This addresses the recurring deviation problem directly.
• Drafting summaries for review. A first draft of a product knowledge record, built from existing reports, can save the owner many hours, provided the owner checks every statement against its source.
• Capturing tacit knowledge. Recorded and transcribed expert interviews are easier to turn into draft records than handwritten notes. The expert still reviews the result.

Where It Stops

AI search finds and suggests. It does not decide what is true, and it does not replace the controlled record. An answer produced by an assistant is working knowledge in the terms of the previous section: useful for finding things, not a basis for a GMP decision until it is checked against the controlled source. The quality of AI search also depends on the same foundations described above. Structured records with consistent tags and clear owners are much easier to search well than scattered free text, as FDA’s own KASA work shows for regulatory assessment.¹⁴

Two further cautions apply. First, ICH does not endorse any commercial product as “ICH compliant,” and the Q&A expects firms to carry out their own evaluation and validation of software they use for these purposes.² Second, any AI search over GMP content must show users only current, approved versions of controlled documents, with a clear link back to the source. How to design that retrieval layer so it holds up in an audit is a separate subject, covered in our article on retrieval architecture for regulatory content listed below.

Where to Start: One Product, Three Practices

Company-wide knowledge management programs often lose momentum before they show results. We recommend starting with one product where the knowledge risk is real and visible: a product with an upcoming transfer, a long-serving process owner nearing retirement, or a pattern of recurring deviations. Then apply the three practices to that product and measure the result.

This approach has three advantages. It produces a visible result for one product quickly. It uses records, owners and events the quality system already has. And it gives leadership real evidence, rather than a vendor demonstration, on which to base any later decision about tools.

Conclusion

ICH Q10 knowledge management has been in the guideline since 2008, and the October 2024 Q&A revision made the position clearer rather than stricter: no formal system is required, no specific tool is endorsed, and knowledge from across the quality system is expected to be used. The gap in most pharma and biotech companies is not a missing platform. It is that critical understanding about products and processes is still held by a few people, recorded in forms nobody can search, or lost at the end of a project or a career. ICH Q9(R1) has since made the consequence explicit by tying uncertainty in risk decisions to how well knowledge is managed.

The practical answer is steady and unglamorous. Decide which knowledge is critical. Write it into owned, structured records linked to controlled sources. Attach lessons learned to quality events that already happen. Treat every technology transfer as a knowledge transfer and check understanding at close-out. Give knowledge a standing place in management review, and use AI search to reach the records faster, not to replace them. Sakara Digital works with pharma and biotech organizations on exactly this kind of quality system work, from knowledge mapping to the records and governance that make it last. If you are weighing where to start with knowledge management under ICH Q10 and want an independent perspective, we are happy to have that conversation.

For Further Reading