ICH Q9(R1): risk work that leads to a decision
A risk assessment is only useful if it changes a decision. Q9(R1) asks you to size the effort to the decision and show your reasoning.
In Short
- Match formality to uncertainty, importance and complexity.
- Write down why each score was given.
- A named person accepts the residual risk.
The Pharmaceutical Operations Guide
Right material. Right record. Released by a person.
- Who decides, and who may not
- Supplier to finished bulk
- Test, review, investigate
- Packs, serialisation and recall
Plus Evidence map and four worksheets.
Get the pharmaceutical guideWe ask for your name and email so we can handle this request. The full guide then opens on this site, ready to translate, print or save. Privacy policy. Practical orientation, not legal advice; your quality unit decides which rules apply.
UltimateFree guide
The Pharmaceutical Operations Guide
Right material. Right record. Released by a person.
ICH Q9(R1) is the international guideline for quality risk management in medicines manufacturing. FDA lists it as final guidance, and EU GMP points to it. It is guidance, not law, but inspectors use it to judge whether risk assessments actually inform decisions. This guide covers the R1 themes buyers ask about most. Sources were checked on 2 Oct 2026.
What R1 added
The revision clarifies four areas: how formal a risk assessment needs to be, how to manage subjectivity in scoring, how quality risk management links to product availability, and what risk-based decision making looks like in practice. The original toolkit (FMEA, HACCP, fault tree and others) is unchanged.
Formality is a spectrum
Formality should match the uncertainty, importance and complexity of the decision. A routine, well-understood change can be assessed briefly; a novel process or a high-uncertainty hazard calls for a structured method, a cross-functional team and written rationale.
How formal does this assessment need to be?
Pick a change to see a proportionate level of formality.
- Well understood, low impact.
- Short documented assessment with rationale.
More on formality is a spectrum
Record why you chose the level.
Controlling Subjectivity
Different assessors often score the same hazard differently. Practical controls include defined scoring scales, people with different expertise in the room, written reasons behind each score and review of scores that look out of line.
More on controlling Subjectivity
The rationale matters as much as the number.
From assessment to decision
A risk assessment earns its keep when it changes something: a control, a test frequency, a change approval or a decision to accept residual risk. Name who accepts the residual risk and when the assessment will be reviewed again.
Worked example: risk work that changed a decision
- Day 0Change CC-0431: new granulation drying time proposedProcess engineering
- Day 2FMEA by QA, production and lab; scores and reasons recordedCross-functional team
- Day 3Moisture risk scored high; extra in-process moisture test addedTeam
- Day 5Residual risk accepted and review date setHead of QA
Where V5 fits
V5 includes risk management aligned with FMEA and ICH Q9, alongside change control with impact assessment and approvals, deviations and CAPA. It records the team, scores, rationale and signatures.
More on where V5 fits
Your quality unit chooses the method and formality and accepts residual risk.
Questions
Is ICH Q9(R1) a legal requirement?
No. It is harmonised guidance. FDA lists it as final guidance and EU GMP refers to it, so inspectors use it as the expected approach, but the binding requirements are in your applicable GMP law.
Do we need an FMEA for every change?
No. R1 says formality should match uncertainty, importance and complexity. Simpler, documented assessments can be appropriate for well-understood, low-impact changes.
How do we show we controlled subjectivity?
Use defined scoring scales, a cross-functional team, written rationale for each score and review of outlying scores, and keep that record with the assessment.
Does V5 decide whether a risk is acceptable?
No. V5 records the assessment, rationale and approvals. People in your quality unit decide whether residual risk is acceptable.
Practical orientation, not legal advice. Rules differ by jurisdiction; your quality and compliance team decides what applies.
Keep reading
ICH Q10 Pharmaceutical Quality System Guide: Four Elements, Management Review
ISO 14971:2019 Medical Device Risk Management Guide
What Is a QMS? Quality Management Systems Explained
Calibration Management Program: a Practical Guide
CMO CDMO Quality Systems: Responsibilities and Handoffs
Cosmetic Microbiological Quality (ISO 17516) Readiness Guide