Quality risk management in practice: applying ICH Q9(R1)
What the 2023 revision of ICH Q9 changed, how to choose FMEA, risk ranking or HACCP in proportion to the decision, and how to tie risk to deviations, change control and CAPA.
Most quality teams already have a risk management SOP, a template FMEA spreadsheet and a five-by-five matrix. They also have a pile of risk assessments that were written after the decision was made, scored by whoever was in the room, and never opened again. Ask "show me how risk drove this decision" and the honest answer is that the decision came first.
This article closes that gap. It covers what the 2023 revision of ICH Q9 changed, how much formality a risk question deserves, how to choose between FMEA, risk ranking and HACCP, and how to wire quality risk management into deviations, change control and CAPA. It ends with how this differs from ISO 14971 for device and combination product makers.
What ICH Q9(R1) changed in 2023
ICH Q9(R1) was adopted by ICH in January 2023 and came into effect in the EU in July 2023. The process model is unchanged: risk assessment (hazard identification, analysis, evaluation), risk control, risk communication and risk review. What changed is the guidance on how people use it.
Subjectivity. New section 5.3 says plainly that subjectivity can affect every stage, especially hazard identification and the estimation of probability and severity. It names the causes: differences in how stakeholders perceive hazards and harms, risk questions that are poorly defined, and tools with poorly designed scoring scales. It accepts that subjectivity cannot be eliminated and asks you to control it through attention to bias and assumptions, proper use of tools and maximum use of relevant data.
Formality. Section 5.1 removes the old formal/informal split. Formality is a continuum, and where you sit on it depends on three factors: uncertainty (how much you don't know about the hazards and harms), importance (how much the decision matters to product quality) and complexity. It also says, in so many words, that resource constraints should not be used to justify a lower level of formality.
Risk-based decision making. Section 5.2 describes three ways decisions get made: highly structured analysis of options, less structured decisions drawing on existing knowledge, and rule-based decisions where an SOP already sets the outcome. All three are legitimate. The point is to know which one you are using and why.
Product availability. The first principle now notes that risk to quality includes situations where product availability may be affected, leading to patient harm. Section 6.1 treats quality and manufacturing problems as a significant cause of shortages and lists the factors to watch: process variability and state of control, ageing facilities and equipment, and oversight of outsourced activities and suppliers.
There are smaller changes too. "Risk identification" became "hazard identification" in the process description. The risk review section still expects the original assessment to be revisited when planned events (product review, audits, change control) or unplanned ones (failure investigations, recalls) might affect the original decision, which is easy to lose sight of.
Deciding how much formality a risk question needs
Turn section 5.1 into a short decision aid in your QRM procedure so the choice of formality is made consciously and recorded:
| Situation | Typical formality | What it looks like |
|---|---|---|
| Known risk, rule already set by SOP (for example, a temperature excursion within validated limits) | Rule-based | Apply the SOP; the record of the decision lives in the deviation or log |
| Familiar process, moderate importance, little uncertainty (for example, a like-for-like replacement part) | Lower | Risk questions answered inside the change or deviation form; no stand-alone report |
| Important decision, some uncertainty (for example, releasing a batch after a minor process excursion) | Medium | Structured assessment with defined scales, at least two functions involved, rationale written down |
| High importance, high uncertainty or complexity (for example, a new aseptic line, a new contract manufacturer, a shortage-critical product) | Higher | Cross-functional team, recognised tool such as FMEA, facilitator, stand-alone report, scheduled risk review |
Two things matter more than the table's wording. First, record why you chose the level of formality. "Lower formality: like-for-like part, same supplier, same material certificate, no change to qualified state" takes one line and answers the inspector's first question. Second, low formality still means the thinking happened. Q9(R1) says lower-formality work can be documented inside other parts of the quality system. It cannot be absent.
Choosing the tool: FMEA, risk ranking or HACCP
Annex I of Q9(R1) lists the familiar tools: basic facilitation methods such as flowcharts and fishbone diagrams, FMEA, FMECA, fault tree analysis, HACCP, HAZOP, preliminary hazard analysis and risk ranking and filtering. Treating FMEA as the default for everything produces enormous spreadsheets for small questions and teaches people that risk assessment is paperwork. Match the tool to the question.
FMEA fits when you need to break a process or piece of equipment into steps and ask how each can fail. A new tablet compression line, a packaging line with a new vision system, or a cleaning process for a shared facility are good candidates. It needs people who know the process in the room.
Risk ranking and filtering fits when you need to compare unlike things on one scale. Prioritising suppliers for audit, deciding which open deviations need investigation resources first, or ranking SOPs for periodic review are all ranking problems. Q9(R1) gives prioritising sites for audit as an example of its use.
HACCP fits where the hazards are physical, chemical or microbiological and you can identify control points with measurable limits: water systems, bioburden control before sterilisation, environmental monitoring in a cleanroom. Its seven steps include monitoring critical control points, setting corrective actions and verifying that the system works, which suits contamination control strategies.
Fixing the scoring problem in FMEA GMP assessments
Q9(R1) calls out "poorly designed risk scoring scales" as a source of subjectivity, and FMEA is where they do the most damage. Multiplying severity by occurrence by detection gives a risk priority number that hides what you need to see. A failure scored 10 for severity, 1 for occurrence and 2 for detection has the same RPN as one scored 2, 2 and 5, yet the first could harm a patient and the second is a nuisance.
Three changes make FMEA scores defensible:
- Write anchored definitions for every score. Occurrence 3 should mean something observable, such as "seen once in the last 50 batches or in the deviation log in the last two years", not "occasional".
- Treat high severity as its own trigger. Any failure mode with a severity of 9 or 10 needs a control regardless of the RPN.
- Score from data where it exists. Pull deviation history, complaint trends and equipment downtime before the meeting, and record where each occurrence score came from. Where a score is a judgement, say so.
Linking quality risk management to deviations, change control and CAPA
Risk assessments in a separate folder go stale. Keep them alive by making each quality process consume and feed the risk record. EU GMP Chapter 1 already expects this: paragraph 1.4(xiv) says the appropriate level of root cause analysis for deviations can be determined using quality risk management principles, and that the effectiveness of corrective and preventive actions should be monitored in line with them.
Deviations. The initial classification (minor, major, critical) is a risk-based decision and should use the same severity definitions as your FMEAs. When an investigation finds a failure mode that the process FMEA scored as unlikely, or did not list at all, that is a signal for risk review. A mislabelled carton that reaches packaging because the vision system missed a smudged batch code tells you the detection score for that failure mode was optimistic. Our deviation management guide covers classification and investigation in more depth.
Change control. Annex II of Q9(R1) lists change management as an application: evaluating the impact of changes on product quality and on availability, and deciding what must happen before implementation, such as additional testing, requalification or communication with regulators. The change form should ask which existing risk assessments the change touches and require them to be updated as part of closure. Our article on change control impact assessment sets out the method.
CAPA. A corrective action is a risk control, so record it as one. When the CAPA closes, the residual risk in the relevant assessment should be re-scored, and the effectiveness check should test whether the occurrence actually went down. Our guide to the CAPA effectiveness check shows how to define that test before implementation.
Trend these links in management review. If deviations keep arising from failure modes your FMEAs rate as low risk, the assessments need revisiting; the PIC/S aide-memoire on QRM implementation (PI 038) gives inspectors questions on review of residual risk.
Product availability as a quality risk
Q9(R1) now expects you to ask whether a decision could stop supply. In practice, add a question to change control and supplier qualification: if this goes wrong, could we lose the ability to supply a product patients rely on? A single-source active substance, a filling line with no qualified backup, or a contract laboratory that is the only one validated for a method are all availability risks. Section 6.1 suggests the level of formality for shortage prevention should match the risk associated with loss of availability, and points to measures such as monitoring process drift, maintaining ageing equipment and pre-qualifying alternative suppliers.
How ICH Q9 differs from ISO 14971 product risk management
Device makers often ask whether their ISO 14971 file covers process and QMS decisions. The two overlap but answer different questions.
ISO 14971:2019 is about the safety of a medical device across its lifecycle. It works from hazards to hazardous situations to harm, requires top management to set a policy for risk acceptability, and requires risk control options in a fixed priority: inherent safety by design and manufacture, then protective measures, then information for safety. It ends with an evaluation of overall residual risk against benefit, and production and post-production monitoring that feeds back into the file. EU MDR Annex I adds that risks must be reduced as far as possible without adversely affecting the benefit-risk ratio.
ICH Q9(R1) is about risk to the quality of a medicinal product, linked ultimately to protection of the patient, and it applies to any decision in the quality system: an audit schedule, a cleaning validation strategy, a batch disposition. It leaves scales and acceptability criteria to you.
ISO 13485 sits between them. Clause 4.1.2(b) asks for a risk-based approach to controlling QMS processes, and clause 7.1 requires documented risk management processes in product realisation. A device maker uses ISO 14971 for the device and a Q9-style approach for QMS decisions like supplier oversight. Combination product makers need both, with explicit links: a process FMEA failure mode that leads to a device hazard should trace to the ISO 14971 file.
Takeaway
Pick one product or process this week and check three things: whether your QRM procedure tells people how to choose a level of formality and record it, whether your FMEA scales have anchored definitions, and whether your last three closed CAPAs updated the risk assessment they relate to. Those three checks will tell you whether quality risk management is driving decisions or recording them afterwards.
If you want deviations, change records and CAPA actions held in one connected system with an append-only audit trail, the InnoQualis platform is built for that.
