ICH Q9(R1): Quality Risk Management — Plain-English Guide

Think of formality as a dial, not a switch. On one end, a production supervisor notices a recurring deviation pattern and decides — based on experience and process knowledge — that an equipment adjustment is needed. No formal risk tool is used, no standalone report is generated, and the decision is documented in the batch record. This is low-formality QRM, and it is perfectly appropriate for routine, well-understood situations.

On the other end, a cross-functional team assembles to evaluate a proposed change to a sterile filling line. They use FMEA to systematically identify failure modes, score severity, occurrence, and detection, document every assumption, and produce a standalone risk assessment report reviewed by quality leadership. This is high-formality QRM, appropriate because the stakes are high (patient safety), the process is complex, and there is meaningful uncertainty about the impact of the change.

Most real-world situations fall somewhere in between. The three factors that determine where you land on the spectrum — uncertainty, importance, and complexity — are not abstract concepts. They map directly to questions your team already asks: "How much do we know about this?" (uncertainty), "How bad could it get?" (importance), and "How many moving parts are involved?" (complexity). When all three are high, go formal. When all three are low, keep it simple. When they are mixed, use judgement — and document why you chose the level of formality you did.

Every risk assessment involves human judgement, and human judgement is inherently subjective. The problem is not that subjectivity exists — it is that most organisations do nothing to control it. Two assessors scoring the same failure mode can arrive at different severity ratings simply because the scale definitions are vague, or because one person has experienced a recall while the other has not.

R1 requires organisations to acknowledge this problem and take concrete steps. Start with well-defined scoring scales: instead of "moderate severity," define what "moderate" means for your product and process (for example, "batch rejection with no patient impact"). Use calibration exercises where the team scores example scenarios before the real assessment. Bring data into the room — process capability data, complaint trends, inspection histories — so that scores are anchored in evidence rather than gut feeling.

The guideline also points to the risk question itself as a source of subjectivity. A vague question like "What are the risks of this process?" will produce vague, inconsistent answers. A precise question like "What failure modes in the granulation step could lead to out-of-specification dissolution results?" focuses the team and reduces the range of subjective interpretation. The better your inputs, the less subjectivity contaminates your outputs.

Completing a risk assessment is not the same as making a risk-based decision. Many organisations produce detailed FMEAs or risk matrices and then file them away without clear action. R1 draws a direct line from assessment to decision: every QRM activity should answer five questions. What hazards exist? What are the associated risks? What risk controls are required? Is the residual risk acceptable? How will QRM outputs be communicated and reviewed?

The guideline describes three decision-making styles. Highly structured decisions — such as whether to approve a critical process change — demand formal analysis of all options and may require multiple rounds of assessment. Less structured decisions — such as prioritising which deviations to investigate first — draw on existing knowledge and experience without a full formal tool. Rule-based decisions — such as rejecting a batch that fails a specification — are pre-determined by SOPs and require no new risk assessment at the point of decision.

Importantly, the first risk-based decision in any QRM activity is choosing the right approach. Before you decide which tool to use or how many people to involve, you need to determine how much formality the situation demands. This meta-decision connects RBDM (Section 5.2) directly to the formality spectrum (Section 5.1), and it is where many organisations previously went wrong — applying the same heavyweight FMEA template to every situation regardless of actual risk.

Before R1, ICH Q9 focused on product quality and patient safety — the harm that comes from a defective product reaching a patient. R1 expands the definition of harm to include the damage caused when a product does not reach the patient at all. Drug shortages can delay treatment, force clinicians to use less effective alternatives, and in extreme cases directly contribute to patient harm.

The guideline identifies quality and manufacturing issues as a significant cause of product availability problems. A facility operating at the edge of its validated range, a single-source API supplier with no contingency plan, or aging equipment prone to unplanned downtime — all of these are risks that QRM should identify and mitigate before they cause a supply disruption.

For pharmaceutical manufacturers, this means risk assessments should explicitly consider supply continuity alongside product quality. When evaluating a new supplier, assess not just whether they can meet specifications but whether they can maintain reliable supply. When reviewing facility investments, consider whether deferred maintenance creates availability risk. R1 makes clear that a robust pharmaceutical quality system — as described in ICH Q10 — drives both product quality and sustainable supply.