Quality Risk Management
ICH Q9(R1) updates the quality risk management framework with clearer guidance on formality, subjectivity, and the role of QRM in regulatory decision-making. Introduces risk review, risk communication, and guidance on appropriate formality levels.
What this does not cover
stated in the document's own scope- Provides the QRM process and toolbox; it does not itself set the pharmaceutical quality system that operates them — that is ICH Q10.
- Describes how to manage risk, not how to design quality into a product, which is the subject of ICH Q8 pharmaceutical development.
- Is a general framework across the lifecycle, not a prescriptive list of which tool to use for a given problem.
- Applies to product-quality risk; it is not a guideline for clinical-trial or pharmacovigilance risk, which have their own ICH texts.
Always verify against the current published text before relying on it for a submission or inspection.
Overview
ICH Q9(R1) is the harmonised guideline for quality risk management (QRM) — a systematic process for the assessment, control, communication, and review of risks to the quality of a medicinal product across its lifecycle. It describes a general QRM process, a set of principles, and a toolbox of methods (such as FMEA, HACCP, and risk ranking) that can be applied to development, manufacturing, and regulatory decisions. The R1 revision, finalised in 2023, addressed four areas the original left thin: high levels of subjectivity in risk assessments, the role of QRM in ensuring product availability, a clearer treatment of formality in QRM, and better structuring of risk-based decision-making.
Scope & applicability
All pharmaceutical development, manufacturing, and distribution activities. Applicable to both development-stage and commercial manufacturing.
Legal basis & how it acquires force
Q9 is an ICH Quality guideline; the R1 revision reached Step 4 in January 2023. An ICH guideline is not itself law; regions implement it. The European Union publishes Q9 as Part III of the EU GMP Guide (EudraLex Volume 4) — it was originally issued as Annex 20 in 2008 but that text was moved to Part III, and QRM principles are also embedded in Part I, Chapter 1. The FDA issues it as a guidance for industry describing how it interprets QRM expectations, and Japan gives it effect through MHLW. QRM is referenced throughout the wider GMP framework, so Q9 supplies the method those binding frameworks assume.
Document structure
| Part | Covers |
|---|---|
| Introduction and principles | The two QRM principles — science-based evaluation and effort proportionate to risk |
| The general QRM process | Risk assessment (identification, analysis, evaluation), control, communication, and review |
| Formality in QRM (R1) | How the degree of formality should scale with risk, uncertainty, and importance |
| Risk-based decision-making (R1) | Structuring decisions and reducing subjectivity in risk assessments |
| Risk-management methodology (Annex I) | The toolbox — FMEA, FMECA, FTA, HACCP, HAZOP, PHA, and risk ranking |
| Applications (Annex II) | Where QRM is applied across development, facilities, materials, and regulatory operations |
Key requirements
- Formal risk management process: assessment → control → review → communication
- Risk assessment tools appropriate to the question — FMEA, HACCP, fault tree, risk ranking
- Formality proportional to risk level — not all decisions require full FMEA
- Risk review programme — periodic reassessment of previously accepted risks
- Risk communication within and across organisations
Implementation tips
- Define your risk management procedure with tool selection criteria — auditors ask why you chose FMEA vs. another tool
- Risk register should be maintained and reviewed on a defined schedule — quarterly minimum for high-risk areas
- Q9(R1) Annex I provides specific guidance on subjectivity — use it to justify your scoring approach
Revision notes
January 2023 revision of the original Q9 (2005). Key additions: formality guidance, subjectivity/bias discussion, risk review requirements, explicit communication requirements.
Where this control fails
live FDA enforcementLive FDA recalls SPEQ maps to this standard’s topics — a SPEQ interpretation, not an FDA classification.
International alignment
Q9 is the risk-management engine of the ICH quality "trio" with Q8 (development) and Q10 (quality system): Q8 designs quality in, Q9 manages the residual risk, and Q10 sustains both across the lifecycle. It underpins the risk-based reasoning in Q11, Q12, and the Q7 API guide, and its methods align with the HACCP and FMEA approaches used in the wider GMP and PIC/S frameworks that adopt it.
ICH Q9(R1): frequently asked questions
Quick answers to common questions about ICH Q9(R1).
What are the two principles of quality risk management in ICH Q9?
First, the evaluation of risk to quality should be based on scientific knowledge and ultimately link to protection of the patient. Second, the level of effort, formality, and documentation of the QRM process should be commensurate with the level of risk.
What did the R1 revision change?
R1, finalised in 2023, strengthened four areas: reducing subjectivity in risk assessments, clarifying formality in QRM, structuring risk-based decision-making, and recognising QRM’s role in product availability. The core process and toolbox were retained.
Is ICH Q9 the same as the pharmaceutical quality system?
No. Q9 is the risk-management method; the pharmaceutical quality system is ICH Q10. Q9 is used within Q10, alongside Q8 development, as part of the ICH quality framework.
This standard in practice
Recall domain is a SPEQ mapping of this standard’s topics, not an FDA classification.