ICH Q9 quality risk management: what Q9(R1) requires in practice

ICH Q9 is the international guideline on quality risk management (QRM): a systematic process for assessing, controlling, communicating and reviewing risks to product quality across the product lifecycle. The current version is Q9(R1), finalized in January 2023. It keeps the 2006 framework and tightens three things inspectors care about: subjectivity in risk scoring, the formality of the work, and risks to product availability.

In short:

• Q9(R1) is the version to follow. ICH finalized it in January 2023 and FDA published it as final guidance in May 2023.
• The revision targets subjective risk scoring, unclear formality, weak risk-based decisions, risk review and product availability, and renames "risk identification" to "hazard identification".
• QRM belongs inside your pharmaceutical quality system. Inspectors look for risk assessments that are reopened when deviations, complaints or new data arrive.
• FDA does not cite Q9 itself. It cites the symptoms: weak investigations, CAPA that missed the root cause, and decisions with no documented reasoning.
• Record the decision, the reasoning and the assumptions. A decision with no documented risk logic is hard to defend in an inspection.

What ICH Q9 is, and what Q9(R1) changed

ICH Q9 gives principles and example tools for quality risk management of drug substances and drug products, from development through manufacturing, distribution, inspection and review. FDA's Q9(R1) guidance page describes it as applying across that whole lifecycle, and the European Medicines Agency hosts the same guideline, so it reads the same in the US and the EU.

Its purpose is practical: better, more informed and timelier risk-based decisions by regulators and industry. It adds no regulatory requirements of its own. The enforceable obligations come from the regulations, such as 21 CFR Parts 210 and 211 for drugs and Part 820 for devices.

The revision was targeted, not a rewrite. The ICH Q9(R1) guideline addresses six problems:

1. high subjectivity in risk assessments and QRM outputs
2. weak management of supply and product availability risks
3. poor understanding of what formality in QRM means
4. unclear risk-based decision-making
5. the term "risk identification", now "hazard identification"
6. unclear expectations for risk review

If your QRM procedure predates 2023, check it against that list. Most gaps sit in items 1, 3 and 6.

The QRM process step by step

The guideline outlines a common model, and firms may use another one if it is well founded.

The last row is where many programs fail. A risk assessment signed once and never reopened is exactly what the revision's clarification on risk review is aimed at.

Subjectivity: the problem the revision names outright

Q9(R1) is candid that patients, practitioners, regulators and industry perceive harm and probability differently, and that subjectivity can affect every step, especially hazard identification and risk estimation. You cannot remove it, but you can manage it:

• Write the risk question precisely. "Assess the new filling line" invites opinion. "Assess the risk of particulate contamination from stopper handling on Line 3 during manual interventions" invites evidence.
• Define your scoring scales. State what a severity of 3 means for patient impact or product availability, with examples, so two teams score the same event the same way.
• Record assumptions. If the team assumed a supplier was in control because of a clean audit, write it down so it can be challenged later.
• Use data. Deviation trends, complaint rates and stability results beat workshop consensus.
• Mix perspectives. Include quality, manufacturing, engineering and, where relevant, supply chain.

Formality: matching the effort to the risk

Formality is the most misunderstood term in the guideline. It does not mean every assessment needs a full FMEA workshop. Effort, documentation and rigor should match the importance of the decision and the level of uncertainty. A workable approach is to define tiers in your QRM procedure:

Write down the criteria that move a decision from one tier to the next. Then an inspector can see that the choice of formality was itself a reasoned decision.

Annex I of the guideline lists example tools, including FMEA, fault tree analysis, HACCP, HAZOP, preliminary hazard analysis, risk ranking and filtering, and supporting statistics. None is mandatory. FMEA suits a defined process you can walk step by step, risk ranking and filtering suits comparing many risks such as a supplier portfolio, and fault tree analysis suits working backward from a known failure in an investigation.

Risk-based decisions and product availability

Q9(R1) puts more weight on supply risk. FDA's overview of the changes notes that quality and manufacturing problems, including GMP non-compliance, are a significant cause of drug shortages, and that an effective quality system uses QRM as an early warning for risks at the company and at its external partners.

For sponsors and CDMO clients, that means QRM must cover contract manufacturers, API suppliers and testing labs, not just your own facility. Questions to build in:

• Which suppliers are single-source for a critical material?
• What does each partner's recent inspection history say about the likelihood of a supply interruption?
• What triggers a reassessment: a new Form 483, a warning letter, an import alert, a change of ownership?

Public inspection records are a legitimate input to hazard identification here. The FDA-inspected facilities directory shows each site's inspection history and classifications, and our guide to what FDA checks at foreign contract manufacturers covers the questions to ask. Our SCAR guide covers what to do once a supplier risk turns into a finding.

QRM inside the pharmaceutical quality system

QRM sits within the pharmaceutical quality system described in ICH Q10. It works when it shapes daily decisions on deviations, change control, validation, supplier approval and release.

Teams often run CAPA and QRM as separate worlds. Linking them is straightforward: use the risk question as the CAPA problem statement, use a fault tree or structured cause analysis for root cause, use risk scoring to decide which actions are proportionate, and update the original assessment once the action is in place. Our CAPA guide walks through the process.

How weak risk management shows up on Form 483s

Investigators rarely write "your ICH Q9 program is weak." Q9 is guidance, and observations cite regulations. What appears instead are the symptoms.

For devices the link is direct, because ISO 13485, which FDA has applied through the QMSR since February 2, 2026, requires risk management in product realization. In a sample of 96 device Form 483s issued between May and July 2026, clause 7.1, risk management in product realization, was the most cited clause, on 31% of forms, according to our ISO 13485 clause analytics. Corrective action under clause 8.5.2 followed at 28%.

For drugs, the symptoms land on the investigation and quality unit sections. In 2024 the most cited sections across FDA inspections were 21 CFR 211.22(d), quality unit procedures, with 175 citations, and 211.192, investigation of discrepancies, with 136, per our most cited CFR sections data. Both are where a risk decision without documented reasoning tends to surface.

You can read the exact observation wording behind these numbers in the FDA Form 483 database, and our review of documentation failures FDA flagged in 2024 and 2025 covers the same theme from the observation side.

Atlas

See what the FDA knows about your next investigator.

30 minutes with the founder. No pitch deck.

See it live

What the inspection record says about QRM programs

Firms that struggle in an inspection seldom lack a QRM procedure. They lack evidence that the procedure drove a decision. The assessment exists, but it was written after the fact, it scored everything as medium, or it was never updated after the deviation that should have triggered it.

A quick test for a team revising its program: pick three recent decisions, such as a supplier approval, a deviation closure and a change, and trace the risk reasoning in the record. If an outsider cannot follow it in ten minutes, an investigator will not be able to either. Fix that before buying tools or adding templates.

A checklist for Q9(R1) alignment

• Your QRM procedure uses "hazard identification" and defines risk review triggers.
• Scoring scales are defined with examples and checked for consistent use.
• The procedure defines formality tiers and the criteria for choosing one.
• Risk questions are precise and scoped.
• Assumptions and known biases are recorded in each assessment.
• Supply and product availability risks are assessed, including external partners.
• Deviation, complaint and CAPA trends feed back into existing assessments.
• Facilitators are trained in the tools, and the training is documented.
• Decisions cite the assessment, and the assessment cites the data.

Common mistakes to avoid

• Scoring to a conclusion. Teams pick the answer, then adjust scores to fit. Set acceptance criteria before scoring.
• Uniform formality. A full FMEA for a trivial change wastes time; a one-line rationale for a critical process leaves a gap.
• Ignoring suppliers. Q9(R1) expects QRM to cover external partners, not just a questionnaire.
• Static documents. Risk files that never change after approval fail the risk review test.
• Treating guidance as regulation. Q9 is guidance; the CFR requirements for investigations, CAPA and the quality unit are enforceable. Use Q9 as the method for meeting them.

Atlas

FDA Inspection Intelligence Digest

We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.

Subscribe