ICH Q9(R1): Quality Risk Management

Context and history

ICH Q9 on quality risk management reached Step 4 on 9 November 2005. The revision, Q9(R1), was released for consultation on 18 November 2021 and adopted on 18 January 2023. It sits with ICH Q10 at the heart of modern pharmaceutical quality, and is referred to throughout GMP, including Annex 11 and its revision.

The revision addresses high subjectivity in risk assessments, how formal risk work should be, decision-making, and risks to product availability.

Who and what it applies to

Drug substances and products, including biological products, across their lifecycle. It addresses industry and regulators.

What it contains

1 to 3 Introduction, scope, principles

Risk is a combination of the probability and severity of harm. Risk evaluation should rest on scientific knowledge and link to patient protection, and effort, formality and documentation should match the level of risk.

4 General process: responsibilities

Risk work usually needs interdisciplinary teams, with people who understand the subject and the process.

4 General process: stages

Initiating the process, risk assessment (identification, analysis, evaluation), risk control (reduction, acceptance), communication, and review.

5 Methodology

Formality in quality risk management, risk-based decision making, and managing and minimising subjectivity. The degree of formality can vary with uncertainty, importance and complexity.

6 Integration

Into industry and regulatory operations, including the link to product availability risks, where quality or manufacturing failures can cause shortages.

7 to 8 Definitions and references

Terms and sources.

Annex I

Risk management methods and tools.

Annex II

Potential applications.

Key points

• Risk work should protect the patient.
• Effort, formality and documentation should match the level of risk.
• Formality is a spectrum, and not every risk needs a large formal exercise.
• Subjectivity should be managed and minimised, and scoring tools do not remove it.
• Risk review is ongoing, not a one-off.
• Risks to product availability are now addressed explicitly.

In practice

General reading, not advice. This is drafted with AI and may not fit your situation. It does not replace the official text, your own quality system or qualified advice, and an inspector may take a different view.

• Check your templates ask who took part and why, which helps to show how subjectivity was managed.
• Use lighter methods for lower risks, and record the reason.
• Set triggers for reviewing a risk assessment, so it is not left to go stale.
• Link your computerised system risk assessments to this process, since Annex 11 and its draft revision rely on it.

Read from the source document on 1 Nov 2026. This is our own description, not the official text. Check the full dated history in the change log below.