ICH Q9(R1) in Practice: Formality, Subjectivity and What Inspectors Now Expect

Quality risk management (QRM) has been part of pharmaceutical good manufacturing practice since ICH Q9 was adopted in 2005. Yet regulators on both sides of the Atlantic spent the following decade and a half observing the same problems: risk assessments that justified decisions already made, scoring systems that produced precise-looking numbers from guesswork, and formal tools used where a simple, documented judgment would have been better, or informal judgments used where rigor was needed.

ICH Q9(R1), adopted by ICH in January 2023, was written to fix those problems. FDA published it as final guidance in May 2023, and it became effective in the EU as part of EudraLex Volume 4 Part III on 26 July 2023. Three years on, inspectors increasingly evaluate QRM against Q9(R1)'s specific expectations on subjectivity, formality and product availability. This article explains what changed, why it matters in inspections, and how regulatory affairs and quality teams can apply the revision in practice.

Why ICH Revised Q9

The ICH concept paper that launched the revision identified four problem areas:

• High levels of subjectivity in risk assessments and QRM outputs.

• Failing to adequately manage supply and product availability risks, contributing to drug shortages.

• Lack of understanding of what constitutes formality in QRM work.

• Lack of clarity on risk-based decision-making.

The resulting revision is not a rewrite. Much of the 2005 text remains. But the additions change how inspectors read QRM documentation, and they align with regulators' broader push toward quality management maturity.

The Six Areas of Change

1. Subjectivity

Q9(R1) acknowledges that subjectivity cannot be eliminated from QRM but can be controlled. It identifies sources of subjectivity, including differences in how stakeholders perceive risk, cognitive biases, poorly framed risk questions, and inconsistent use of risk scales. It states that subjectivity can directly affect the effectiveness of QRM activities and the decisions made.

The guideline expects organizations to take steps to manage subjectivity, such as defining the risk question clearly, using appropriate expertise, using data where available, and recognizing that the scores produced by risk tools are not objective measurements.

What this means in practice: An FMEA where risk priority numbers are presented with no explanation of how severity, occurrence and detectability ratings were assigned is now an easy target. Each rating should reference its basis (data, prior experience, literature, or documented expert judgment), and the team composition should reflect the expertise needed for the risk question.

2. Formality

Q9(R1) introduces a clear principle: the level of effort, formality and documentation of the QRM process should be commensurate with the level of risk. Formality is not binary; it is a spectrum. The guideline identifies factors that determine where on the spectrum a given QRM activity should sit:

• Uncertainty: the lack of knowledge about hazards, harms and risks. Greater uncertainty generally warrants greater formality.

• Importance: the more important a risk-based decision is with respect to product quality, the higher the level of formality.

• Complexity: the more complex a process or subject area, the higher the level of formality.

The guideline describes characteristics of higher-formality approaches (a dedicated cross-functional team, recognized QRM tools, a formal risk management report, and all parts of the QRM process explicitly performed) and lower-formality approaches (which may not use formal tools or a separate report, and may be documented as part of an existing quality system record such as a deviation or change control).

What this means in practice: Organizations should define, in their QRM procedure, how the formality level is chosen, with criteria based on uncertainty, importance and complexity. A simple change to a non-critical SOP should not require a full FMEA; a new aseptic process step should. Inspectors now ask how the formality level was chosen.

3. Risk-based decision-making

The revision adds a section clarifying that decision-making occurs throughout QRM: in defining the risk question, choosing formality, identifying hazards, deciding on risk controls, and accepting residual risk. It emphasizes that decisions should be supported by knowledge and, where appropriate, by data, and that the rationale should be documented at a level consistent with the formality chosen.

4. Product availability risks

Q9(R1) makes explicit that QRM should consider risks to product availability arising from quality and manufacturing issues, recognizing that drug shortages harm patients. It highlights that QRM outputs can support proactive detection of manufacturing and supply chain problems and that robust QRM can serve as an early warning system for potential shortages.

What this means in practice: Risk assessments for supplier changes, facility changes, equipment failures and capacity constraints should consider not only the risk to product quality, but also the risk that a failure could interrupt supply. For products with limited alternatives, this can change which risk controls are justified, such as qualifying a second supplier or maintaining safety stock.

5. Hazard identification

The term "risk identification" was replaced with "hazard identification," consistent with ISO/IEC Guide 51 and ISO 14971. The change clarifies that the first step is to identify hazards (potential sources of harm) and then evaluate the risks they present, rather than listing risks directly. This is a small wording change with a meaningful effect on how teams frame assessments.

6. Risk review

The revision clarifies that risk review should consider new knowledge and experience, and that the frequency of review should be based on the level of risk. It links risk review to the pharmaceutical quality system's knowledge management and continual improvement elements under ICH Q10.

How Inspectors Are Applying Q9(R1)

Regulators have signaled through training materials, inspection guidance and public presentations that Q9(R1) concepts are now part of the inspection lens. Common themes in observations and inspection discussions include:

• Risk assessments used to justify predetermined outcomes, for example to close a deviation without CAPA or to avoid process validation after a change.

• Unexplained risk scores, particularly occurrence and detectability ratings that are not supported by data.

• Inappropriate formality, either excessive (large FMEAs for trivial decisions, which consume resources and dilute attention) or insufficient (undocumented judgments for complex, high-uncertainty decisions).

• Risk assessments never revisited despite deviations, complaints or process changes that should have prompted review.

• Contamination control strategies under EU GMP Annex 1 that do not demonstrate a QRM basis for the controls selected.

• Supply risks not considered in change control and supplier management decisions.

Applying Q9(R1): A Practical Framework

Step 1: Update the QRM procedure

Revise the site or corporate QRM procedure to include:

• A definition of formality with criteria for selecting the level, based on uncertainty, importance and complexity.

• Expectations for managing subjectivity: clear risk questions, defined scales with anchoring examples, data sources for ratings, and appropriate team composition.

• A requirement to consider product availability in relevant risk assessments.

• Hazard identification terminology.

• Triggers and frequencies for risk review.

Step 2: Build a formality decision tool

A simple matrix can make formality decisions consistent. For example, rate uncertainty, importance and complexity as low, medium or high, then map combinations to formality levels. Lower formality might mean a documented rationale within a change control record; medium formality might mean a structured tool such as a preliminary hazard analysis with a small team; higher formality might mean a full FMEA or HACCP with a cross-functional team and a standalone report approved by quality.

Step 3: Anchor your risk scales

For each scale used in risk tools, provide descriptive anchors with examples. For occurrence, tie ratings to observed frequencies where possible (for example, deviations per batch or failures per thousand operations). For detectability, describe the control that would detect the failure and its demonstrated capability. Anchored scales reduce variation between teams and make reviews faster.

Step 4: Integrate product availability

Add a product availability question to change control and supplier management risk assessments: if this risk materializes, what is the effect on supply? For products on critical or essential medicine lists, or with single-source components, require explicit consideration of supply continuity controls.

Step 5: Connect risk review to the quality system

Link risk assessments to the deviation, CAPA, change control and product quality review systems so that relevant events trigger review. Include a summary of QRM reviews in management review under ICH Q10.

Step 6: Train for judgment, not just tools

Many QRM training programs focus on how to fill out an FMEA template. Q9(R1) calls for training on framing risk questions, recognizing bias, choosing formality and interpreting scores. Case-based training using the organization's own past assessments is particularly effective.

Q9(R1) and the Broader Regulatory Picture

Q9(R1) does not stand alone. It connects to:

• ICH Q10 (pharmaceutical quality system), where QRM is one of two enablers alongside knowledge management.

• ICH Q12 (lifecycle management), where risk-based categorization of post-approval changes and established conditions depend on robust QRM.

• EU GMP Annex 1 (2022), which requires QRM principles to underpin the contamination control strategy for sterile products.

• FDA's Quality Management Maturity (QMM) program, which evaluates how effectively manufacturers use quality practices, including risk management, beyond minimum CGMP compliance.

• ICH Q9(R1) training materials published by ICH, which provide worked examples that can be adapted for internal training.

Common Questions

Does Q9(R1) require us to redo existing risk assessments?

No. But existing assessments should be reviewed under normal risk review triggers, and when they are, they should be updated to reflect Q9(R1) expectations. High-risk assessments supporting critical decisions (for example, sterility assurance, cross-contamination controls, or process validation strategies) are worth prioritizing for proactive review.

Is FMEA still acceptable?

Yes. Q9(R1) does not discourage any tool. It asks that the tool's outputs be interpreted with an awareness of subjectivity and that the tool's formality be appropriate to the decision.

How does this apply to medical devices?

ICH Q9(R1) applies to pharmaceutical products, including the drug component of combination products. Device risk management follows ISO 14971. For combination products, manufacturers should align the two approaches so that the constituent parts' risks are assessed consistently.

Worked Example: Choosing Formality for Three Decisions

Consider three risk-based decisions a sterile injectables site might face in the same month.

Decision A: Revising a cleaning SOP for a non-product-contact area

Uncertainty is low (the change is well understood), importance to product quality is low, and complexity is low. Lower formality is appropriate: a documented rationale within the change control record, identifying the hazard (for example, residue buildup) and explaining why the change does not increase risk, reviewed by the area owner and quality.

Decision B: Qualifying a second supplier for a stopper

Uncertainty is moderate (the new supplier's process is not yet well known), importance is high (the stopper is a primary container closure component for a sterile product), and complexity is moderate. Product availability considerations also apply, since a second source improves supply resilience. Medium to higher formality is appropriate: a structured risk assessment using a recognized tool, a cross-functional team including quality, microbiology, packaging engineering and supply chain, and a documented conclusion covering both quality and availability risks.

Decision C: Introducing a new aseptic filling line

Uncertainty, importance and complexity are all high. Higher formality is required: a full FMEA or equivalent, a dedicated cross-functional team, a standalone risk management report approved by quality, and integration with the site's Contamination Control Strategy under EU GMP Annex 1.

Documenting the formality choice itself, with reference to the three factors, is what inspectors now look for. It shows that effort was allocated deliberately rather than by habit.

A Template for Controlling Subjectivity

Teams can reduce subjectivity by adding a short section to each higher-formality risk assessment that records:

• The risk question, stated precisely, including scope and boundaries.

• Team composition, with the expertise each member contributes and any relevant perspective gaps.

• Data sources used for occurrence and detectability ratings, with references to deviation trends, environmental monitoring data, supplier performance data, or literature.

• Assumptions made where data were unavailable, and how they will be verified.

• Areas of disagreement and how they were resolved, including dissenting views where the team did not reach consensus.

• Sensitivity check: whether the conclusion would change if key ratings were one level higher or lower.

The sensitivity check is particularly effective. If a conclusion depends on a single rating that is based on judgment rather than data, that is exactly the area where additional data or more conservative controls may be needed.

The Bottom Line

ICH Q9(R1) is short, but it changes the conversation between manufacturers and inspectors. The question is no longer only "did you perform a risk assessment?" but "was it the right level of formality, how did you control subjectivity, and did you consider the patient's access to the medicine?" Organizations that can answer those questions with documented criteria and evidence will find QRM becoming a source of credibility in inspections rather than a source of observations.

Sources

• ICH Q9(R1) Quality Risk Management, Step 4 guideline: database.ich.org

• FDA, Q9(R1) Quality Risk Management, Guidance for Industry (May 2023): fda.gov

• FDA, "Overview of Changes: ICH Q9(R1) Quality Risk Management": fda.gov

• Federal Register notice of availability, 4 May 2023: federalregister.gov

• EudraLex Volume 4, Part III, ICH Q9(R1) (effective 26 July 2023)

• ICH Q10 Pharmaceutical Quality System; ICH Q12 Lifecycle Management