ICH Q9(R1), the revised Quality Risk Management guideline, was finalised in January 2023 - the first substantive update since the original ICH Q9 was published in 2005. The revision did not overhaul the risk management framework wholesale. It added two specific, practically significant requirements that were absent from the 2005 original: formality proportionate to risk, and explicit guidance on managing subjectivity and bias in risk assessments.
This guide explains what changed in the 2023 revision, why both additions matter in practice and what effective ICH Q9 training needs to cover for a quality risk management programme to actually reflect current expectations.
What ICH Q9 establishes
ICH Q9 provides the framework for quality risk management across the pharmaceutical product lifecycle - covering risk assessment, risk control, risk communication and risk review. It is not a standalone requirement to be applied once. It is intended to be integrated throughout pharmaceutical development, manufacturing and quality decisions, and ICH Q10 explicitly positions quality risk management as one of the enablers of an effective pharmaceutical quality system.
The guideline does not mandate a single risk assessment methodology. It describes a general framework and references specific tools - failure mode effects analysis, fault tree analysis, hazard analysis and critical control points, and others - that can be applied depending on the nature and complexity of the risk being assessed.
What changed in the 2023 revision
Formality proportionate to risk
The 2005 original guideline did not give explicit direction on how much rigour a given risk assessment should receive. In practice, this created two problems industry-wide: some low-risk decisions received disproportionately heavy, resource-intensive risk assessments, while some genuinely high-risk decisions received informal, under-documented assessments that did not reflect the actual stakes involved.
ICH Q9(R1) addresses this directly by introducing the principle that the level of formality applied to a risk assessment - the rigour of the methodology, the extent of documentation, the breadth of cross-functional input - should be proportionate to the level of risk involved. A decision with low potential impact on product quality or patient safety can be assessed with a correspondingly lean, less resource-intensive process. A decision with high potential impact requires a correspondingly more rigorous, thoroughly documented assessment.
Before the 2023 revision, many quality risk management programmes applied a single, uniform level of formality to every risk assessment regardless of actual risk level - either over-engineering low-risk decisions or under-engineering high-risk ones. The formality-proportionate-to-risk principle gives organisations explicit permission, and an explicit expectation, to calibrate the level of rigour to the actual stakes of the decision. This mirrors the same risk-based philosophy now central to FDA's Computer Software Assurance guidance.
Managing subjectivity and bias
The second substantive addition in ICH Q9(R1) is explicit guidance on identifying and managing subjectivity and bias within risk assessments. The 2005 original did not directly address this. The revision recognises that risk assessments are conducted by people, and that individual and group biases - confirmation bias, anchoring on a prior conclusion, groupthink within a risk assessment team, or the availability bias of overweighting a recent incident - can meaningfully distort the outcome of an assessment that is procedurally sound but substantively compromised.
ICH Q9(R1) recommends specific practices to reduce this risk: using structured, cross-functional teams rather than a single assessor or a homogeneous group, using pre-defined risk assessment criteria established before the specific assessment begins rather than criteria that could be unconsciously adjusted to fit a preferred outcome, and building periodic review into the risk management process to catch bias that may not have been apparent when the original assessment was conducted.
Why this training gap matters
A quality risk management programme built entirely on the 2005 ICH Q9 framework, without incorporating the 2023 revision's two additions, is missing content that reflects current regulatory expectations. This matters in two concrete ways for training.
First, risk assessments themselves may not reflect current expectations if the people conducting them have not been trained on formality proportionate to risk. An organisation applying uniform rigour to every risk assessment, rather than calibrating rigour to actual risk level, is operating behind the current guideline - even if every individual risk assessment is procedurally well executed.
Second, and less obviously, an organisation that has never explicitly addressed bias management in its risk assessment training is vulnerable to a specific and hard-to-detect failure mode: a risk assessment process that looks robust on paper - proper methodology, proper documentation, proper sign-off - but that consistently arrives at conclusions shaped by unaddressed team bias rather than genuine risk analysis.
What effective ICH Q9 training needs to cover
Training built to reflect the current guideline, not just the 2005 original, should address the following elements specifically.
The formality-proportionate-to-risk principle applied to real examples. Training should give learners practice actually calibrating the level of rigour to different risk scenarios - not just stating the principle abstractly. A learner should come away able to recognise when a lean assessment is appropriate and when a more rigorous one is genuinely required.
Specific bias types and how they manifest in risk assessment settings. Confirmation bias, anchoring, groupthink and availability bias should be covered with concrete examples relevant to pharmaceutical risk assessment scenarios, not as abstract psychological concepts disconnected from the work.
Structured team composition and pre-defined criteria as bias mitigation tools. Training should cover the specific practices ICH Q9(R1) recommends - cross-functional team structure, criteria defined before assessment begins, periodic review - as concrete, implementable practices rather than general good advice.
Integration with the broader pharmaceutical quality system. ICH Q9 does not operate in isolation. Training should connect quality risk management explicitly to ICH Q10's pharmaceutical quality system framework, showing how risk assessment outputs feed into CAPA prioritisation, change control decisions and management review.
Who needs ICH Q9 training
Quality assurance professionals who conduct or review formal risk assessments are the most direct audience, but ICH Q9 principles have broader relevance. Manufacturing and validation professionals who participate in risk assessment teams, regulatory affairs professionals who need to understand how risk-based justifications are constructed and defended, and quality management personnel who oversee the overall quality risk management programme all benefit from understanding both the framework itself and the 2023 revision specifically.
ICH Q9(R1) did not replace the quality risk management framework established in 2005. It refined it in two specific, practically important ways: giving explicit permission and expectation to calibrate rigour to actual risk, and directly addressing a failure mode - unmanaged bias - that the original guideline did not name. Training that has not been updated to reflect these two additions is teaching a risk management framework that is no longer fully current, even though the underlying structure remains largely the same.
Key regulatory references
- ICH Q9(R1) - Quality Risk Management, 2023 revision
- ICH Q9 - Quality Risk Management, original 2005 guideline
- ICH Q10 - Pharmaceutical Quality System
Our ICH Q9(R1) course covers the 2023 revision in full
Formality proportionate to risk, subjectivity and bias management, structured risk assessment teams and integration with ICH Q10. Certificate on completion.