QRM

Quality Risk Management (ICH Q9)

ICH Q9 rests on two primary principles, and both are routinely misapplied. First, the evaluation of risk should be based on scientific knowledge and ultimately link to protection of the patient — not to protecting the company from a finding. Second, the level of effort, formality, and documentation should be commensurate with the level of risk. A low-risk question does not need a full cross-functional FMEA, and treating every question with maximum ceremony is itself a failure to apply the standard.

The process is a cycle: risk assessment (identification, analysis, evaluation), risk control (reduction and acceptance), risk communication, and risk review — with the review step reopening the assessment when new information arrives. Tool choice follows the question: FMEA for failure modes in a process, FTA to work backwards from a defined failure, HAZOP for process deviations, risk ranking and filtering to compare a portfolio, and sometimes a simple structured discussion.

The 2023 revision, Q9(R1), addressed what practitioners had struggled with in the original: subjectivity (acknowledging it cannot be eliminated, only managed through diverse input and clear criteria), what formality actually means in practice, how to make genuinely risk-based decisions, and — newly explicit — managing risks to product availability that arise from manufacturing and supply failures.

• —Two primary principles: evaluate risk on scientific knowledge linked to patient protection; scale effort and formality to the risk.
• —Cycle: assessment (identify · analyse · evaluate) → control (reduce · accept) → communication → review.
• —Pick the tool for the question — FMEA, FTA, HAZOP, HACCP, risk ranking and filtering.
• —Q9(R1) (2023) adds subjectivity, formality, risk-based decision-making, and product-availability risk.
• —Risk acceptance is a legitimate documented outcome — not every risk must be eliminated.
• —Assessments are living: they are reviewed when new knowledge or events arrive.

ICH Q9(R1) Quality Risk Management (2023 revision of the 2005 guideline); referenced by ICH Q8(R2), Q10, and Q11; EU GMP Part III (ICH Q9) and Annex 20; expected throughout EU GMP Annex 1 (2022) and Annex 15.