ICH Q9(R1) vs ISO 14971:2019
Two risk-management standards — one for pharma quality, one for device safety.
What a comparison is not
A comparison is SPEQ’s reading of how two published documents differ. Neither is the right answer, it is not a determination of which applies to you, and neither is summarised in a way that replaces reading it.
ICH Q9(R1) is the pharmaceutical framework for quality risk management — assessing, controlling, communicating and reviewing risk to product quality and, ultimately, the patient. ISO 14971:2019 is the medical-device standard for managing risk to safety across the whole device lifecycle. They share tools (FMEA, risk matrices) but govern different domains and define “risk” differently.
| ASPECT | ICH Q9(R1) | ISO 14971:2019 |
|---|---|---|
| Domain | Pharmaceutical quality (manufacturing, CMC, GMP decisions) | Medical-device safety across the product lifecycle |
| What “risk” means | Risk to product quality → and thence to the patient | Risk of harm from the device (safety), including normal use and foreseeable misuse |
| Lifecycle emphasis | Applied to quality decisions throughout the product lifecycle | A continuous lifecycle process from design through post-production |
| Acceptability | Risk-based, science-based decisions; no fixed acceptability formula | Requires defined risk-acceptability criteria and benefit-risk analysis |
| Residual risk | Managed and reviewed; part of the PQS (ICH Q10) | Explicit residual-risk evaluation and overall benefit-risk conclusion required |
| Tools | FMEA, FTA, HACCP, risk ranking — pick to fit the question | Same toolset, applied to device hazards and hazardous situations |
| Sits within | The pharmaceutical quality system (ICH Q10) | The device QMS (ISO 13485 / QMSR) |
Use ICH Q9(R1) for pharmaceutical and biologics quality decisions — process changes, deviations, supplier risk, validation scope — as the risk-management layer of your ICH Q10 quality system.
Use ISO 14971 for medical devices, where you must document hazards, hazardous situations, risk-acceptability criteria and an overall benefit-risk conclusion as part of the design and quality system.
Same toolbox, different jobs. ICH Q9 protects product quality (and through it the patient) in pharma; ISO 14971 protects the patient from device harm across the lifecycle, with a formal benefit-risk conclusion. If you make a drug-device combination product you will use both — Q9 for the pharma quality side and 14971 for the device-safety side — and should map them deliberately rather than pretend one covers the other.
ICH Q9(R1) vs ISO 14971:2019: frequently asked questions
Common questions on how ICH Q9(R1) and ISO 14971:2019 differ and when each applies.
Can ISO 14971 replace ICH Q9 for a drug?
No. ISO 14971 is written for device safety risk; ICH Q9(R1) is written for pharmaceutical quality risk within an ICH Q10 quality system. They use overlapping tools but define risk and acceptability differently, so a drug programme uses Q9, not 14971.
Which applies to a drug-device combination product?
Both, on their respective sides. The device constituent’s safety risk is managed under ISO 14971; the drug constituent’s quality risk under ICH Q9(R1). Regulators expect a coherent, mapped approach across the two rather than a single framework stretched to cover both.
What changed in ICH Q9(R1)?
The R1 revision sharpened guidance on subjectivity in risk assessments, formality of risk management, risk-based decision-making, and the link to product availability (supply risk). It did not change Q9’s core scope as the pharmaceutical quality-risk framework.
Do both require a risk matrix?
Neither mandates a specific tool. Both are tool-agnostic — FMEA, fault-tree, risk ranking — but ISO 14971 additionally requires documented risk-acceptability criteria and an overall benefit-risk conclusion, which ICH Q9 leaves to science- and risk-based judgement.