1What quality risk management is.
ICH Q9(R1) defines quality risk management as “a systematic process for the assessment, control, communication and review of risks to the quality of the drug (medicinal) product across the product lifecycle”. It rests on two principles: the evaluation of risk to quality should be based on scientific knowledge and ultimately link to the protection of the patient, and the level of effort, formality and documentation should be commensurate with the level of risk.¹ EU GMP Chapter 1 builds quality risk management into the pharmaceutical quality system with a near-identical definition and the same two principles, adds experience with the process to the basis for evaluating risk, and says it can be applied “both proactively and retrospectively”.²
| Stage | What it covers | What the guideline asks |
|---|---|---|
| Risk assessment | Hazard identification, risk analysis and risk evaluation | What might go wrong? What is the likelihood it will go wrong? What are the consequences? |
| Risk control | Risk reduction and risk acceptance | Is the risk above an acceptable level? What can be done to reduce or eliminate it? What is the appropriate balance among benefits, risks and resources? Are new risks introduced by controlling the ones identified? |
| Risk communication | Sharing information about risk and risk management between decision makers and others | Parties can communicate at any stage, and not every risk acceptance needs to be communicated |
| Risk review | Reviewing the output against new knowledge and experience | A mechanism to review events that might affect the original decision, at a frequency based on the level of risk |
The table follows section 4 of the guideline.¹ Planned events that bear on a review include the results of product review, inspections, audits and change control; unplanned ones include the root cause from a failure investigation and recalls. Quality risk management “does not obviate” the obligation to comply with regulations, and the revision adds that it should not be used to justify a practice that regulations or guidance would otherwise deem unacceptable.¹
2What changed in Q9(R1).
FDA describes Q9(R1) as a targeted revision of the 2006 Q9 guidance that addresses product availability risks due to manufacturing quality issues, lack of understanding of what constitutes formality, lack of clarity on risk-based decision-making, and high levels of subjectivity in risk assessments and their outputs.³ Comparing the two texts shows where each change landed.⁴¹
| Area | Q9 (2005) | Q9(R1) (2023) |
|---|---|---|
| Formality | Said a formal process is not always necessary and informal processes can be acceptable | New section 5.1: formality is a continuum, not a binary choice, set by uncertainty, importance and complexity, and “resource constraints should not be used to justify the use of lower levels of formality” |
| Risk-based decisions | No dedicated section | New section 5.2 and a definition: highly structured, less structured and rule-based approaches to decisions |
| Subjectivity | Not addressed | New section 5.3: subjectivity enters through bias, inadequately defined risk questions and poorly designed scoring scales, and everyone involved should acknowledge, anticipate and address it |
| Product availability | Harm already included loss of availability | A note in the first principle, and new section 6.1 on availability risks from process variability, facilities and equipment, and oversight of suppliers and outsourced activities |
| Terms | Risk identification | Hazard identification |
| Other additions | Not in the 2005 text | Root cause analysis and human-related causal factors in the introduction; digitalisation and emerging technologies; detection controls “can reduce the probability of occurrence of harm” |
Section 6.1 explains why availability belongs in a quality guideline: quality and manufacturing issues, including GMP non-compliance, “are a significant cause of product availability issues (e.g., product shortages)”.¹
3Status, dates and where it applies.
ICH’s regulatory members adopted Q9(R1) under Step 4 on 18 January 2023, with a minor typographical correction on 26 January 2023.¹ ICH records implementation by the European Commission on 26 July 2023, by FDA on 4 May 2023 and by Japan’s MHLW and PMDA on 31 August 2023, with the MHRA also listed as implemented and Health Canada in the process of implementation.⁵ FDA published it as final guidance in May 2023, replacing the draft of 15 June 2022.³ ICH’s quality guidelines page lists no Q9(R2). It shows Q9(R1) at Step 5, and records a Q9(R1) training group set up in August 2024 to review and develop the Q9 briefing pack training materials.⁵
Its scope is drug substances, medicinal products and biological and biotechnological products, across development, manufacturing, distribution, inspection and review.¹ WHO’s own guideline on quality risk management, published in 2013, uses the concepts of ICH Q9 in its 2005 form.⁶
4The tools.
ICH Q9(R1) lists tools in Annex I, says no one tool fits every situation, and accepts less formal methods where appropriate.¹
| Tool | What ICH Q9(R1) says it is for |
|---|---|
| Flowcharts, check sheets, process mapping, cause and effect diagrams | Organising data and facilitating decisions |
| FMEA | Evaluating potential failure modes of processes and prioritising risks |
| FMECA | FMEA extended to severity, probability and detectability, giving a relative risk score |
| Fault tree analysis | Tracing the causes of an assumed failure, including in deviations and complaints |
| HACCP | Seven steps to control physical, chemical and biological hazards at critical control points |
| HAZOP | Guide-words to find deviations from design or operating intent |
| Preliminary hazard analysis | Early assessment when little design detail is available |
| Risk ranking and filtering | Comparing and ranking diverse risks, such as sites for audit |
| Statistical tools | Control charts, design of experiments, histograms, Pareto charts and process capability analysis |
Annex II gives examples of where to apply them: quality defects, audits, periodic review, change management, training, development, facilities and equipment, materials, production, laboratories, packaging and the supply chain.¹ For calculating a risk priority number, see FMEA and the RPN.
5How it runs in Seal.
Seal’s quality risk management blueprint links each scenario and control to its verification and to the complaints and deviations that test it. A failed verification challenges the assessment it concerns while the original observation stays intact, estimates keep their population, observation period and uncertainty, and the residual-risk decision is recorded separately. Distinct templates cover an ICH Q9 risk assessment, a process FMEA, an ISO 14971 risk file and rule-based decisions set as limits in a workflow, with the configured categories and criteria versioned so reviewers can see what an assigned value means. Neil prepares impact assessments and verification cases; your team makes the risk decision.
When you validate Seal itself, the validation and AI assurance guide sets the depth of specification and testing by the risk and complexity of the intended use, and your team owns the intended use, risk acceptance and production approval. Risk sits in Seal’s QMS alongside deviations, CAPA, change control, documents, training, audits, suppliers and complaints.
References
- 1ICH Q9(R1), Quality Risk Management, ICH, adopted 18 January 2023. https:/
/ database. ich. org/ sites/ default/ files/ ICH_ Q9%28R1%29_ Guideline_ Step4_ 2023_ 0126_ 0. pdf (read 6 November 2026) - 2EudraLex Volume 4, Part I, Chapter 1, Pharmaceutical Quality System, European Commission, in operation from 31 January 2013, sections 1.12 and 1.13. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ vol4- chap1_ 2013- 01_ en_ 0. pdf (read 6 November 2026) - 3Q9(R1) Quality Risk Management, Guidance for Industry, FDA, May 2023, docket FDA-2022-D-0705. https:/
/ www. fda. gov/ regulatory- information/ search- fda- guidance- documents/ q9r1- quality- risk- management (read 6 November 2026) - 4ICH Q9, Quality Risk Management, ICH, 9 November 2005. https:/
/ database. ich. org/ sites/ default/ files/ Q9%20Guideline. pdf (read 6 November 2026) - 5Quality Guidelines, Q9 Quality Risk Management, ICH. https:/
/ www. ich. org/ page/ quality- guidelines (read 6 November 2026) - 6WHO guidelines on quality risk management, WHO Technical Report Series No. 981, Annex 2, WHO, 25 January 2013. https:/
/ www. who. int/ publications/ m/ item/ trs981- annex2 (read 6 November 2026)
AQuestions and answers
What risk assessment tools are used in pharma?
ICH Q9(R1) lists basic methods such as flowcharts, check sheets, process maps and fishbone diagrams, then FMEA, FMECA, fault tree analysis, HACCP, HAZOP, preliminary hazard analysis, risk ranking and filtering, and statistical tools such as control charts and Pareto charts. It says no one tool fits every situation and that less formal methods can be acceptable. Choose by the risk question: FMEA for a process you understand step by step, fault tree analysis for the causes of a failure, risk ranking for comparing many different risks.
Is there an ICH Q9(R2)?
No. As of November 2026, ICH lists Q9(R1), adopted in January 2023, as the current version. ICH’s later work on Q9 has been on training materials, such as the briefing pack, rather than on the guideline text.
Is ICH Q9(R1) mandatory?
It is a guideline, and it says it is not intended to create new expectations beyond current regulatory requirements. In the US, FDA publishes it as guidance for industry. In the EU, Chapter 1 of the GMP guide says the pharmaceutical quality system must incorporate quality risk management, and the guide reproduces ICH Q9 in Part III.
What does formality mean in quality risk management?
How much structure and documentation a risk activity gets. Q9(R1) treats it as a continuum: higher uncertainty, importance or complexity call for more formality, such as a cross-functional team, formal tools and a stand-alone report, while lower-risk questions can be handled inside other quality system records. Resource constraints are not a reason to choose less.
Does ICH Q9 apply to medical devices?
No. Its scope is drug substances, medicinal products and biological and biotechnological products. For medical devices, the standard is ISO 14971, Application of risk management to medical devices, which Q9(R1) lists among its references.