Guide
ICH Q9(R1): Quality Risk Management That Actually Drives Decisions
ICH Q9(R1) — adopted in January 2023 and brought into EU GMP Chapter 1 and Annex 20 — is the revision the industry waited fifteen years for. The original Q9 (2005) defined the QRM toolkit but stayed quiet on the hard questions: who owns subjectivity, when does informal QRM suffice, what does 'risk-based decision making' actually look like at a manufacturing site? R1 answers them, and inspectors from EMA, MHRA, FDA and PIC/S authorities are now using R1 to challenge QRM that is performative rather than decision-driving. This guide walks through the R1 additions, the integration with ICH Q10 and Annex 1, and a practical path to a QRM programme that withstands inspection. It is written for QA leads, validation managers, qualified persons, and operational excellence teams at pharmaceutical manufacturers.
Start free trial Free trial, no credit card, onboard in days, not months.
Subjectivity: the elephant R1 finally named
R1's most consequential addition is the explicit treatment of subjectivity in risk assessments. Two assessors looking at the same hazard routinely arrive at different scores; pretending otherwise produced a generation of QRM theatre. R1 requires QRM activities to identify, control, and minimise subjectivity through diverse cross-functional teams, structured scoring guides, calibration of assessors, and documented rationale for scores rather than just the numbers. An inspector in 2026 reading a risk assessment will ask 'how did you control for subjectivity here', and a shrug is now a finding.
Formality: when full QRM, when informal QRM
R1 introduces the concept of QRM formality on a continuum, with the level of formality driven by uncertainty, importance, and complexity. Not every decision needs a 30-page FMEA — but the decision to use informal QRM is itself a documented choice with a rationale, not a default. Conversely, low-formality QRM applied to a high-complexity high-importance decision (a control-strategy change, a new supplier for a critical material) is exactly what R1 is designed to flag. Getting the formality right is the single biggest efficiency lever in a QRM programme.
Hazard identification: beyond the FMEA reflex
R1 reminds the industry that the toolkit (FMEA, FTA, HACCP, HAZOP, PHA, risk ranking) is broad, and that defaulting to FMEA for every problem is itself a quality issue. FMEA is strong at component-level failure modes; weak at systemic, latent, or interaction hazards. FTA is the better choice for top-event analysis; HAZOP for process deviations in continuous processes; PHA for early-stage screening. The right tool for the question — chosen and justified — produces stronger output and shorter assessments. Inspectors are increasingly probing why a tool was chosen, not just the output.
Risk-based decision making in regulatory deliverables
R1 makes clear that QRM is not just an internal exercise — it informs regulatory deliverables (validation strategy, control strategy, change control, manufacturing authorisation variations, recalls). The PQS under ICH Q10 is the home for QRM outputs, and Annex 1's CCS, ICH Q12's product lifecycle management, ICH Q14's analytical procedure development all reference Q9 as the methodology. Inspectors trace the chain — risk assessment → control decision → change-control record → regulatory submission — and gaps in the chain become findings. A QRM programme that ends at the FMEA spreadsheet leaves half the value on the floor.
Integration with Q10 PQS, Annex 1 CCS, and CAPA
Q9(R1) only delivers value when integrated. The ICH Q10 Pharmaceutical Quality System is the framework that holds QRM outputs as living inputs to management review and continual improvement. EU GMP Annex 1 (2022) requires a Contamination Control Strategy explicitly supported by QRM. CAPA effectiveness checks should be defined using QRM. Hazardous deviation classification and recall decisions should be QRM-informed. A QRM programme run as a separate silo — with its own templates, its own meetings, and no wiring into PQS or Annex 1 — is the leading cause of 'QRM exists but does not drive decisions' findings.
A 60-day implementation path
Days 1 to 10: gap assessment of the current QRM programme against Q9(R1) — subjectivity controls, formality decisioning, toolkit diversity, integration with PQS/CAPA/Annex 1. Days 11 to 25: rebuild the QRM standard with formality decision templates, scoring guides, and assessor calibration; retire the FMEA-for-everything default. Days 26 to 45: re-baseline the priority risk files (control strategy, supplier risk, contamination control) under the new standard; document the chain from risk to downstream decision. Days 46 to 60: roll the pattern across all QRM-generating processes; run a QRM-focused internal audit; brief the QP team on how to defend the programme under inspection.
Where this lives in V5 Ultimate
The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.
Modules that do the work
Quality management
PQS as the home for QRM outputs, not a separate silo.
Deviations & CAPA
QRM-informed effectiveness checks and recall decisioning.
Document control
Risk assessments as live, versioned, decision-linked records.
Supplier risk
Supplier qualification depth driven by structured QRM.
Compliance self-assessment
Score the QRM programme against Q9(R1) expectations.
Industries this hits hardest
Frequently asked
Is Q9(R1) mandatory?
ICH Q9(R1) was adopted by the ICH Assembly in January 2023 and implemented in the EU through the revised Chapter 1 and Annex 20 of EU GMP (effective July 2023). For ICH region regulators (EU, US FDA, Japan PMDA, Health Canada, others) it sets the expected QRM standard for GMP inspections — so while it is not 'law' in the same sense as a regulation, inspectors apply it as the baseline.
What's the relationship between Q9(R1) and ISO 31000?
ISO 31000 is the generic enterprise risk management standard; Q9(R1) is the pharmaceutical-specific application focused on quality and patient safety. The principles overlap (risk identification, analysis, evaluation, control, communication, review) but Q9(R1) is the standard inspectors use for GMP. Companies with a mature ISO 31000 enterprise programme can leverage the methodology but should not substitute it for Q9-aligned QRM in the quality system.
How does Q9(R1) treat 'informal' QRM?
Informal QRM is acceptable for low-uncertainty, low-importance, low-complexity decisions — and the decision to use the informal route is itself documented with a rationale. R1 is explicit that informal does not mean undocumented; it means proportionate. Using informal QRM for a high-impact change is itself a Q9 finding.
Does Q9(R1) apply to medical devices?
Q9 is the pharmaceutical QRM standard; ISO 14971 is the medical device risk management standard. They share principles but differ in scope (Q9 targets product quality and patient safety from a manufacturing perspective; 14971 targets the device safety lifecycle). Combination products typically apply both, scoped to the relevant constituent parts.
See it on your shop floor.
Free trial, no credit card, onboard in days, not months.