ICH Q9(R1) quality risk management is the revision of the ICH guideline on quality risk management: it keeps the 2005 framework but intervenes exactly where QRM was failing in practice. Four new areas — formality, risk-based decision-making, subjectivity and product availability — plus a terminology clarification that shifts the focus from risk identification to hazard identification. For QA, QPs and validation leads, understanding what changed is not an academic exercise: inspectors increasingly cite the new sections, and a risk assessment built "the old way" is now a finding waiting to happen.
ICH Q9(R1) quality risk management: what changed versus 2005
Revision R1, adopted by ICH at Step 4 in January 2023 and effective in the EU from 26 July 2023 (EudraLex Volume 4, Part III), does not rewrite the QRM process: risk assessment, risk control, risk communication and risk review remain the four core activities. The substantive changes are five:
- Formality (new section 5.1): clarifies how to calibrate effort, formality and documentation against risk, uncertainty and the importance of the decision. Formality is a spectrum, not an on/off switch.
- Risk-based decision-making (new section 5.2): introduces guidance on making good risk-based decisions, anchoring them in product and process knowledge rather than in a tool's score.
- Subjectivity (new section 5.3): acknowledges that differing perceptions of hazards, harms and probability can distort assessments, and asks for bias and behavioural factors to be recognised and controlled.
- Product availability (new section 6.1): links QRM to supply reliability — process variability, state of control, facilities, and oversight of suppliers and outsourced activities.
- Hazard identification: the step previously called "risk identification" becomes "hazard identification", to separate the hazard (the potential source of harm) from the risk (the combination of probability and severity).
The QRM process: four activities, one lifecycle
The process itself is unchanged: risk assessment (hazard identification, risk analysis and risk evaluation) starts from a risk question focused on the decision to be made; risk control decides whether and how to reduce risk and whether residual risk is acceptable; risk communication shares outcomes and decisions with the relevant stakeholders; risk review checks that conclusions remain valid as knowledge, processes or context change.
R1 insists on a point many quality systems overlook: QRM is a lifecycle, not a document. An assessment supporting validation must be traceable in the Validation Master Plan; an assessment born from a deviation must feed CAPA, change control and periodic review. Assessments that are filed and never reviewed are, for an inspector, the first sign of box-ticking QRM.
If your days are spent between risk assessments, deviations and decisions you will have to defend in audits, the free weekly newsletter The Pragmatic GMP brings you pragmatic analysis and operational checklists on exactly these topics: a five-minute read, written for people who actually practise QRM.
Commensurate formality: how to size your QRM
Section 5.1 resolves the most common misunderstanding: proportionate formality does not mean choosing between a cross-functional FMEA workshop and no record at all. It means calibrating the effort against three factors: uncertainty, importance of the decision and complexity. A working reference matrix:
| Decision context | Indicative formality | Expected records |
|---|---|---|
| Routine decision, low uncertainty, established controls, limited impact | Low: focused assessment | Concise documented rationale, identified approver, link to the relevant quality record |
| Change or event with plausible quality impact, cross-functional dependencies, substantial uncertainty | Medium: structured cross-functional assessment | Risk question, evidence and assumptions, identified controls, residual risk, review triggers |
| Potential high impact on the patient or on supply, novel situation, limited knowledge | High: formal tool and governance | Scientific justification, alternatives considered, uncertainty evaluation, escalation, effectiveness check |
This matrix is a GuideGxP implementation recommendation, not an ICH classification: each organisation must adapt it to its own pharmaceutical quality system, defining in a procedure who decides the level of formality and how it is justified.
Subjectivity and uncertainty: the heart of the revision
Section 5.3 is the most innovative. Subjectivity enters QRM through four doors: how the question is framed, which information is selected, how scores are assigned and how results are interpreted. ICH Q9(R1) does not claim it can be eliminated — it cannot — but requires it to be recognised and managed. In practice: separate observed evidence from assumptions and expert judgement; state data gaps and the limits of knowledge transferability; involve relevant expertise, with independent review for significant decisions; and where uncertainty remains substantial, define additional data, interim controls, monitoring or a review date, instead of hiding it behind a score.
FMEA remains useful, but it is not a requirement
ICH Q9(R1) reiterates that no single tool, or set of tools, is applicable to every situation. FMEA works when failure modes and their effects can be described meaningfully; it becomes counterproductive when the Risk Priority Number replaces the decision. Multiplying scores based on expert judgement suggests a precision the evidence does not support, and identical totals can hide very different risk profiles: a severe consequence for the patient must never be softened by arithmetic. Define the scales before the workshop, document the basis of the significant ratings, and always record the narrative decision alongside the numerical output.
The mistakes inspectors find most often
- Template-driven assessments: a pre-filled form turns the assessment into a ritual. First the decision question, then the tool.
- Assumed, not verified, controls: citing an SOP or an alarm does not demonstrate the control is effective for that risk. You need its function, ownership and evidence of effectiveness.
- Acceptance without a rationale: "low risk" is a conclusion, not an explanation. The record must show why the residual risk is acceptable and who has the authority to decide it.
- One-shot assessments: without links to change control, deviations, CAPA and periodic review, risk review stays on paper.
GuideGxP recommendation
Do not rewrite every existing assessment: run a gap assessment of your QRM procedure against sections 5.1, 5.2, 5.3 and 6.1. In most cases three changes are enough: a documented rule for selecting the level of formality, a mandatory "assumptions and uncertainty" field in the assessment templates, and explicit review triggers linked to change control and trending. In an inspection, bring one real example of a well-reasoned low-formality decision: it demonstrates maturity better than any fifty-line FMEA.
For a clause-by-clause analysis of where the ICH Q guidelines carry regulatory weight — Q9(R1) included — plus a ready-to-use Excel/Word toolkit, the guide Quality Guidelines ICH Q: what really applies covers the whole series, from Q8 to the new Q1.
