ICH Q9 Quality Risk Management was first published in 2005 and revised in 2023 as ICH Q9(R1). It is referenced in virtually every major pharmaceutical regulatory framework — the EU GMP Guide, FDA process validation guidance, ICH Q10, ICH Q11 and EU GMP Annex 1 all explicitly integrate Q9 risk management principles. Understanding ICH Q9(R1) is foundational knowledge for pharmaceutical quality professionals.
This guide explains what ICH Q9(R1) requires, what changed in the 2023 revision and how to apply quality risk management effectively in pharmaceutical manufacturing and quality system decisions.
What ICH Q9 establishes
ICH Q9 provides a framework for risk management that can be applied across all stages of the pharmaceutical product lifecycle — from development through manufacturing, distribution and post-market surveillance. Its core principle is that risk management activities should be proportionate to the level of risk they address, and that risk assessments should be science-based and documented.
The guideline identifies six core risk management tools: Failure Mode and Effects Analysis (FMEA), Failure Mode, Effects and Criticality Analysis (FMECA), Fault Tree Analysis (FTA), Hazard Analysis and Critical Control Points (HACCP), Hazard Operability Analysis (HAZOP) and Preliminary Hazard Analysis (PHA). It also identifies simpler tools including risk ranking and filtering and risk checklists for use where the level of risk does not warrant a full formal assessment.
The risk management process established in Q9 follows four steps: risk identification (what could go wrong), risk analysis (what is the likelihood and severity), risk evaluation (is the risk acceptable), and risk control (how to reduce unacceptable risks). Risk communication and risk review are integrated throughout the process rather than treated as separate activities.
What changed in ICH Q9(R1) — the 2023 revision
The 2023 revision to ICH Q9 introduced two significant additions that were not in the 2005 version. Both have direct implications for how risk assessments should be designed and documented.
Formality proportionate to risk. The revision explicitly states that the degree of formality applied to risk management activities should be proportionate to the level of risk involved. This addresses a well-documented problem in pharmaceutical quality systems — the tendency to apply full formal FMEA exercises to trivial changes and low-risk processes, creating documentation burden without quality value. Q9(R1) makes explicit that a risk ranking and filtering exercise or a simple risk checklist may be entirely appropriate for lower-risk activities, and that applying disproportionate formality is itself a quality system inefficiency.
Subjectivity and bias in risk assessment. The most significant addition in the 2023 revision is the acknowledgement that risk assessments are performed by people, and that people bring cognitive biases, organisational pressures and anchoring effects to every assessment. Q9(R1) explicitly requires that risk management processes consider and mitigate the effect of bias. This includes confirmation bias — the tendency to interpret new information as confirming pre-existing conclusions — as well as optimism bias, groupthink and the influence of commercial or scheduling pressure on risk conclusions.
FDA and EMA inspectors are increasingly asking how risk assessments were conducted, not just what conclusions they reached. A risk assessment that was performed entirely by one person in the QA team, without challenge from independent reviewers or cross-functional input, is now explicitly identified in Q9(R1) as potentially compromised by bias. Having a documented process for managing bias is part of a compliant risk management programme under the 2023 revision.
Applying ICH Q9(R1) in pharmaceutical manufacturing
ICH Q9 risk management applies across a wide range of pharmaceutical quality system activities. Understanding how to apply it correctly — and how FDA and EMA inspectors expect to see it applied — is what distinguishes effective risk management from compliance documentation.
Change control. Every change to a validated process, facility, equipment or system should be risk-assessed before implementation. The formality of the risk assessment should match the potential impact of the change — a minor administrative change to a label format does not warrant the same FMEA that a process parameter change for a critical manufacturing step requires.
Deviation investigations. Q9 risk tools — particularly FMEA and fault tree analysis — are explicitly recommended in Q9(R1) for identifying root causes and assessing the potential impact of deviations on product quality and patient safety.
Validation and qualification. Risk assessments drive the scope of qualification and validation activities. ICH Q9 is the scientific basis for the argument that not every attribute of a system requires the same degree of testing — testing should be focused on the attributes with the highest patient safety risk.
Supplier qualification. Risk-based supplier qualification — where audit frequency, incoming inspection scope and approval requirements are based on the criticality of the supplied material and the supplier's quality history — is a direct application of Q9 principles.
Contamination Control Strategy under EU GMP Annex 1. The CCS is explicitly risk-based. FMEA is specifically cited in USP 1119 and industry guidance as the appropriate tool for identifying contamination risk sources and designing control strategies proportionate to those risks.
GMPify ICH Q9(R1) training
GMPify's ICH Q9(R1) Quality Risk Management course covers the full guideline including the 2023 revision — risk management tools, process steps, the formality proportionality principle and the new bias and subjectivity requirements. The course addresses current FDA and EMA inspection expectations and includes practical application across change control, deviation investigation and validation contexts.
The course includes five knowledge check questions and issues a completion certificate on passing. It is part of the GMPify ICH guidelines series, included in the subscription at $69/month alongside 29 additional courses.
QA managers and specialists, validation scientists, regulatory affairs professionals, manufacturing and engineering managers, laboratory supervisors and anyone responsible for designing, reviewing or approving risk assessments in pharmaceutical manufacturing or quality systems.
GMPify's ICH Q9(R1) Quality Risk Management course
Full 2023 revision covered including the new bias and subjectivity requirements. Certificate on completion.