Quality Risk Management (ICH Q9)
Quality Risk Management (QRM) is a systematic process for the assessment, control, communication, and review of risks to product quality across the product lifecycle. ICH Q9 made it a formal expectation; the 2023 R1 revision sharpened it by tackling the two things that most undermine it in practice — subjectivity and poorly justified risk-based decisions. QRM is the risk method that runs underneath validation, contamination control, data integrity, and the quality system as a whole.
The QRM process and its two principles
ICH Q9 defines a process — risk assessment (identification, analysis, evaluation), risk control (reduction and acceptance), risk communication, and risk review — and rests it on two principles: the evaluation of risk should be based on scientific knowledge and ultimately link to protection of the patient; and the level of effort, formality, and documentation should be commensurate with the level of risk.
That second principle is doing enormous work. It is the licence to be light-touch where risk is low and rigorous where it is high — and the reason a QRM programme that applies the same heavyweight FMEA to everything is misapplying the standard.
Tackling subjectivity — the R1 revision
The 2023 ICH Q9(R1) revision was prompted by a candid observation: risk assessments were too often subjective, and "risk-based" was being used to justify decisions that were not genuinely risk-based. R1 adds explicit attention to subjectivity — the influence of who is in the room, how scoring scales are built, and how hazards are framed — and to formality (how to decide how formal an assessment needs to be) and risk-based decision-making.
The practical takeaway: a defensible risk assessment names its assumptions, uses scales that mean the same thing to everyone, includes the right expertise, and documents the reasoning behind the decision — not just the score.
The toolbox — and choosing the right tool
ICH Q9 is tool-agnostic but references a toolbox: FMEA/FMECA, HACCP, fault tree analysis, HAZOP, PHA, and simple supporting methods like risk ranking and filtering. For medical devices, ISO 14971 provides the parallel, device-specific risk-management standard across the product lifecycle.
The skill is matching the tool to the question. A quick, informal risk-ranking may be the correct level for a low-stakes change; a full HACCP or FMECA is warranted for a novel sterile process. Reaching for the heaviest tool by reflex is a common way to produce impressive-looking but low-value risk documents.
QRM as connective tissue
QRM is not a standalone activity — it is the method underneath the other cornerstones. The Contamination Control Strategy is a QRM output; the number of PPQ batches is a QRM decision; the scope of computer-system validation is set by risk; data-integrity controls are sized by risk. ICH Q10 places QRM alongside knowledge management as an enabler of the entire Pharmaceutical Quality System.
Derived from the 4 standards that anchor this topic.
What is ICH Q9?
ICH Q9 is the international guideline on Quality Risk Management — a systematic process for the assessment, control, communication, and review of risks to product quality across the lifecycle. Its 2023 R1 revision added explicit treatment of subjectivity, formality, and risk-based decision-making.
What are the two primary principles of QRM?
First, the evaluation of risk to quality should be based on scientific knowledge and ultimately link to the protection of the patient. Second, the level of effort, formality, and documentation of the QRM process should be commensurate with the level of risk.
Which risk tool should I use?
ICH Q9 is tool-agnostic — FMEA/FMECA, HACCP, FTA, HAZOP, PHA, and risk ranking are all valid. Match the tool to the risk: a light risk-ranking for low-stakes decisions, a full FMECA or HACCP for high-stakes novel processes. For medical devices, ISO 14971 is the dedicated risk-management standard.
Why was ICH Q9 revised to R1?
Because risk assessments in practice were often subjective and "risk-based" was being used to justify decisions that were not genuinely risk-based. ICH Q9(R1), finalised in 2023, added guidance on managing subjectivity, deciding the appropriate level of formality, and making — and documenting — sound risk-based decisions.
Get the Weekly GxP Briefing
Curated regulatory intelligence — enforcement, recalls, guidance, and quality signals — in one practitioner-grade email each week. Free.