ICH Q9(R1)

ICH Q9 was adopted in November 2005 and became the foundational QRM document in pharmaceutical regulation. It introduced ICH-wide vocabulary (hazard, risk, harm), endorsed tools like FMEA, HACCP, FTA and HAZOP, and made risk-based decision-making the default expectation. For 18 years it was applied across every quality system in the regulated world.

By the early 2020s the implementation problems were impossible to ignore: risk assessments had drifted into ritual scoring exercises whose outputs no decision-maker actually used; the formality of QRM was wildly inconsistent (six-month FMEAs for trivial changes, perfunctory checklists for major ones); 'risk-based' was being invoked to justify both more and less rigour with no shared framework; and the COVID-era drug shortages had exposed that QRM rarely considered product availability as a patient-safety risk.

Q9(R1) acknowledges directly that subjectivity is intrinsic to risk assessment and cannot be eliminated. The aim is to recognise it, manage it, and prevent it from invalidating the conclusion. The R1 revision specifies that subjectivity can arise from the people performing the assessment (bias, expertise, group dynamics), the tools chosen (some FMEA scoring scales are inherently subjective), and the data used (presence or absence of objective evidence).

• Use multidisciplinary teams to dilute single-person bias.
• Use objective data (deviation history, complaint trends, stability outliers) rather than expert opinion alone.
• Document the rationale for severity, occurrence and detectability scores — not just the numbers.
• Use semi-quantitative scales with explicit anchor descriptions for each score, not bare 1-5 numerics.
• Sense-check the output: does the priority ranking match the team's intuition about what actually matters?

Q9(R1) introduces the explicit principle that the formality of QRM should be commensurate with the level of risk. A change to a tablet coating colour does not require the same risk-management depth as a change to a sterile-filtration step. The original Q9 implied this but never said it.

The choice of formality should itself be documented and justified — under inspection, a low-formality assessment of a high-risk change is harder to defend than a high-formality assessment of a low-risk one.

Q9(R1) re-anchors what 'risk-based decision-making' means: the decision is risk-based when the risk assessment actually drives it. A risk assessment that runs in parallel to a pre-decided outcome is not risk-based decision-making — it is justification theatre.

The R1 revision asks organisations to document who the decision-maker is, what risks were considered, what alternatives were considered, and why the decision was made — in the same record, contemporaneously. The decision-maker should be identifiable and accountable. The risk-based choice should be traceable to the assessment, not to a separate management narrative.

This is the largest substantive addition. The original Q9 framed QRM purely around patient safety from quality defects. Q9(R1) extends the patient-safety frame to include drug-shortage risk: a quality decision that takes a critical product off the market also harms patients, and that harm has to be part of the risk picture.

Practical implications: when a deviation, OOS, recall or supply-chain disruption is being managed, the QRM analysis should explicitly consider the patient-availability consequence of each disposition option. 'Reject the batch' is not automatically the safer option when the product is medically necessary and no alternative supply exists. The trade-off must be documented and made by someone authorised to make it.

Q9(R1) reinforces that the quality of any risk assessment is bounded by the quality of the hazard identification. A team that misses a hazard cannot mitigate it. R1 asks for structured hazard identification techniques (HAZOP, structured 'what-if', SWIFT) before launching into scoring, particularly for novel or complex changes.

The audit-trail integrity and e-signatures satisfy 21 CFR Part 11 and EU Annex 11. The risk-decision record is the inspection evidence that the decision was risk-based, not narrative.

FDA published its Q9(R1) Guidance for Industry in May 2023. EMA and the EU member states implemented through 2023. MHRA, Health Canada, PMDA and Swissmedic have aligned. Inspectors are now actively probing the four target areas — particularly formality choices and the documentation of risk-based decisions — in cGMP inspections from late 2023 onward.

The most common observation pattern is a high-quality FMEA whose conclusions did not actually drive the decision, or a formality choice that does not match the risk. Both are easy to surface in a 30-minute interview if the records do not include the decision-maker, alternatives considered, and the rationale.