ICHExecution MethodologyGuidance
ICH Q9(R1)

Quality Risk Management

ICH Q9(R1) updates the quality risk management framework with clearer guidance on formality, subjectivity, and the role of QRM in regulatory decision-making. Introduces risk review, risk communication, and guidance on appropriate formality levels.

LAST REVISED
January 2023
PRODUCT AREAS
SterileSolid DoseBiotechApi
SCOPE & APPLICABILITY

All pharmaceutical development, manufacturing, and distribution activities. Applicable to both development-stage and commercial manufacturing.

KEY REQUIREMENTS
  • 01Formal risk management process: assessment → control → review → communication
  • 02Risk assessment tools appropriate to the question — FMEA, HACCP, fault tree, risk ranking
  • 03Formality proportional to risk level — not all decisions require full FMEA
  • 04Risk review programme — periodic reassessment of previously accepted risks
  • 05Risk communication within and across organisations
IMPLEMENTATION TIPS
›Define your risk management procedure with tool selection criteria — auditors ask why you chose FMEA vs. another tool
›Risk register should be maintained and reviewed on a defined schedule — quarterly minimum for high-risk areas
›Q9(R1) Annex I provides specific guidance on subjectivity — use it to justify your scoring approach
REVISION NOTES

January 2023 revision of the original Q9 (2005). Key additions: formality guidance, subjectivity/bias discussion, risk review requirements, explicit communication requirements.

ICH Q9(R1): frequently asked questions

Quick answers to common questions about ICH Q9(R1).

What is ICH Q9(R1)?

ICH Q9(R1) — Quality Risk Management — is a guidance issued by the International Council for Harmonisation. ICH Q9(R1) updates the quality risk management framework with clearer guidance on formality, subjectivity, and the role of QRM in regulatory decision-making. Introduces risk review, risk communication, and guidance on appropriate formality levels.

Who does ICH Q9(R1) apply to?

All pharmaceutical development, manufacturing, and distribution activities. Applicable to both development-stage and commercial manufacturing.

What are the key requirements of ICH Q9(R1)?

ICH Q9(R1) requires, among other things: Formal risk management process: assessment → control → review → communication; Risk assessment tools appropriate to the question — FMEA, HACCP, fault tree, risk ranking; Formality proportional to risk level — not all decisions require full FMEA; Risk review programme — periodic reassessment of previously accepted risks.

When was ICH Q9(R1) last updated?

The current version of ICH Q9(R1) dates from January 2023. January 2023 revision of the original Q9 (2005). Key additions: formality guidance, subjectivity/bias discussion, risk review requirements, explicit communication requirements.

RELATED STANDARDS
SPEQ TEMPLATES FOR THIS STANDARD

Ready-to-use templates designed to help you comply with ICH Q9(R1).

Browse 2 related templates →
RELATED FDA RECALLS
where Risk Management & CAPA control fails
See all Risk Management & CAPA recalls →

Live openFDA recalls SPEQ maps to this standard’s topics — a SPEQ interpretation, not an FDA classification.

THIS STANDARD IN PRACTICE

Recall domain is a SPEQ mapping of this standard’s topics, not an FDA classification.

Weekly Briefing

Track the standards that move

When ICH Q9(R1) — or any GxP requirement — is revised, recalled against, or clarified by new guidance, the Weekly GxP Briefing surfaces it. Free, one email a week.

Read a past issue →