ICH Q9(R1) Implementation: Turning Quality Risk Management Into Practice

What Q9(R1) Actually Changed, and What It Left Alone

The original ICH Q9 was adopted in November 2005. It gave the industry a shared vocabulary for risk, a process diagram, and an annex of tools. It was genuinely useful. It was also, in practice, absorbed as a documentation requirement more than a decision discipline. In 2019 ICH decided a revision was warranted, and the concept paper endorsed in November 2020 named four specific areas for improvement: high levels of subjectivity in risk assessments and quality risk management outputs, product availability risks, a lack of understanding of what constitutes formality in quality risk management work, and a lack of clarity on risk-based decision making.³

Note the framing. The concept paper does not say Q9 was wrong. It says the industry applied it in ways that produced weak outputs. That distinction matters for how you plan an implementation program, because it means the fix is not a new procedure that replaces the old one. The fix is a set of changes to how existing procedures are executed and reviewed.

The structural changes

The Step 4 guideline adds three subsections to Chapter 5 on risk management methodology: 5.1 Formality in Quality Risk Management, 5.2 Risk-Based Decision-Making, and 5.3 Managing and Minimizing Subjectivity. Chapter 6 gains a new section 6.1, titled “The role of Quality Risk Management in Addressing Product Availability Risks Arising from Quality/Manufacturing Issues.” Annex II gains a section on quality risk management as part of supply chain control. The introduction was expanded to address subjectivity and the value of understanding formality, and Chapter 4.3 now uses “hazard identification” where the earlier text used “risk identification.”¹⁵

Everything else is broadly recognizable. The two primary principles are unchanged in substance, though one carries a new note. The evaluation of risk to quality should be based on scientific knowledge and link to protection of the patient, with a note added that risk to quality includes situations where product availability may be impacted. The level of effort, formality, and documentation should be commensurate with the level of risk. Annex I still lists FMEA, FMECA, FTA, HACCP, HAZOP, PHA, and risk ranking and filtering. Annex II still lists application areas.

The regulatory timeline

The FDA published Q9(R1) as final guidance for industry, with the availability notice appearing in the Federal Register on 4 May 2023.⁴⁶ The EMA adopted the guideline at Step 5 with effect in the EU from July 2023.⁷⁸ ICH released official training materials in October 2023, developed by a dedicated implementation working group and organized into modules with worked examples and case studies covering subjectivity, formality, risk-based decision making, hazard identification, product availability, and risk review.¹⁰⁹

Those training materials matter more than they usually would. The concept paper treated harmonized training and its rollout as a key component of the revision, not an afterthought.³ If your implementation plan does not include putting the ICH modules in front of the people who actually score risk assessments, you have skipped the part ICH considered central.

Subjectivity: The Admission at the Center of the Revision

Section 5.3 of Q9(R1) contains the most quietly significant sentence in the whole document. It states that while subjectivity cannot be completely eliminated from quality risk management activities, it may be controlled by addressing bias and assumptions, the proper use of quality risk management tools, and maximizing the use of relevant data and sources of knowledge.¹ It closes by saying that all participants involved with quality risk management activities should acknowledge, anticipate, and address the potential for subjectivity.

Read that as a regulator’s polite way of saying something blunter: risk scores are frequently the product of who was in the room. The guideline says subjectivity can affect every stage of the process, and singles out hazard identification and the estimation of probability of occurrence and severity of harm. It also names the mechanisms. Subjectivity enters through differences in how risks are assessed, through differences in how hazards, harms, and risks are perceived by different stakeholders (the guideline names bias explicitly), through inadequately defined risk questions, and through tools with poorly designed risk scoring scales.

Where it actually enters, in order

In our experience the leakage is predictable and happens in the same four places.

The risk question. A vague question produces a vague assessment. “Assess the risk of this change” is not a risk question. “What is the risk that the revised buffer preparation step introduces a bioburden excursion that is not detected before the product reaches filling?” is. The guideline notes that when the risk in question is well defined, both the appropriate tool and the types of information needed become more readily identifiable. A badly framed question forces the team to invent scope as they go, and each member invents a slightly different one.

Hazard identification. This is where the composition of the team shows up most. A group of process engineers finds process hazards. Add a microbiologist and you find contamination hazards. Add someone from the receiving warehouse and you find material handling hazards nobody upstream had considered. Missing hazards do not appear anywhere in the output. They are invisible, which is exactly why they are the most damaging form of subjectivity.

Scale definitions. A severity scale that reads “1 = negligible, 3 = moderate, 5 = severe” is not a scale. It is four adjectives and a hope. Two competent people will disagree on whether a given failure is moderate or severe, and neither will be wrong, because the scale never told them.

Group dynamics during scoring. The most senior person speaks first, proposes a number, and the room converges on it. This is not a failure of character. It is what happens by default in any meeting where a number has to be agreed and someone has more authority than the others.

Four Techniques That Actually Reduce Score Variability

The guideline tells you to manage subjectivity but does not prescribe how. Here are four methods that work, in rough order of how much improvement they deliver per unit of effort.

1. Replace adjectives with worked examples in your scoring criteria

The single highest-yield change is to rewrite scoring scales so that each level is anchored to a concrete, verifiable condition rather than a descriptive word. Adjectives invite interpretation. Conditions do not.

Building this takes a working group a few days per scale, and the scales are reusable across every assessment in a domain. The examples should come from your own deviation history, which has two benefits. They are recognizable to your teams, and the exercise of mapping real events onto scale levels usually exposes disagreements about severity that were already present but never surfaced.

2. Score independently before you discuss

Have each participant assign scores privately before any group conversation. Collect the results. Then discuss only the items where the spread is wide.

This one change does three things at once. It removes the anchoring effect of the first number spoken aloud. It surfaces genuine disagreement instead of burying it under consensus. And it makes the meeting shorter, because the items everyone already agrees on do not need debate. A wide spread on a single line item is not a problem to be smoothed over. It is a signal that either the scale is ambiguous, the hazard is not well understood, or two people are holding different assumptions about how the process actually runs. All three are worth an extra ten minutes.

3. Document the rationale, not only the number

A risk assessment that records “Severity: 4” and nothing else is unreviewable. Nobody a year from now, including the people who wrote it, can tell whether 4 was right. A risk assessment that records “Severity: 4. The failure mode produces an out-of-specification assay result detectable at release testing. No path to the patient exists because release testing is a required gate. Assumes the release specification remains at the current limit” is reviewable, challengeable, and, critically, updatable when the assumption changes.

Q9(R1) reinforces this in section 4.3, where it notes that revealing assumptions and reasonable sources of uncertainty enhances confidence in the output or helps identify its limitations.¹ The rationale field is where uncertainty becomes visible. If a team cannot articulate why a score was chosen, that is itself information about how much knowledge sits behind the assessment.

4. Calibrate across assessments

Individual assessments can each be internally consistent and still be wildly inconsistent with each other. A severity of 4 in the sterile filling assessment and a severity of 4 in the packaging assessment should mean comparable things. Usually they do not, because different teams built the assessments at different times using their own reading of the same scale.

The remedy is a periodic calibration review. Once or twice a year, take a sample of completed assessments across sites and functions and compare how the scales were applied. Look for the same hazard scored differently in two places, and for scores that cluster suspiciously in the middle of the range, which usually means the team was avoiding commitment rather than exercising judgment. Feed the findings back into the scale definitions and the worked examples. This is slow work, and it is the difference between a quality risk management system and a folder of unrelated spreadsheets.

Formality: Permission to Stop Running a Full FMEA on Everything

Section 5.1 opens by stating that formality in quality risk management is not a binary concept, that varying degrees may be applied, and that formality can be considered a continuum ranging from low to high.¹ For a great many organizations this is the sentence they have been waiting for. Over the past decade, the safe answer to any risk question became “run a full FMEA,” because a full FMEA is defensible and nobody was ever cited for doing too much analysis. The result is quality units that spend substantial effort producing formal risk assessments for changes that carry almost no risk, which leaves less attention for the ones that carry real risk.

The three factors

Q9(R1) names three factors to weigh when deciding how much formality to apply.

A tiering model, and what each tier produces

Q9(R1) describes characteristics of higher and lower formality but stops short of defining tiers, noting only that degrees between the two also exist and may be used. A three-tier model works well in practice, and the important part is not the tier names but the fact that each tier has a fixed, named documentation output. Without that, “commensurate formality” becomes a phrase people write in procedures and ignore in practice.

Two implementation details determine whether this holds up. First, the tiering criteria must be written into the procedure, with examples, and the tier decision itself must be recorded. An inspector asking why a change received Tier 1 treatment needs to see a documented answer, not an argument constructed on the spot. Second, someone independent of the requester should confirm the tier. Left to self-selection, everything drifts toward Tier 1 as workload rises, which is precisely the drift the resource-constraint sentence in 5.1 was written to prevent.

Risk-Based Decision Making: Three Approaches and Where Each Fits

Section 5.2 is the part of Q9(R1) most likely to be skimmed and most useful once absorbed. It states that risk-based decision making is inherent in all quality risk management activities, and that effective risk-based decision making begins with determining the level of effort, formality, and documentation to be applied.¹ It then describes three approaches, tied directly to the formality applied.

Building rule-based decisions that hold up

The rule-based category is where the greatest efficiency gain sits and where the greatest exposure sits if it is done carelessly. A rule-based decision is defensible only when three things are true and documented.

The rule traces to a risk assessment. Somewhere there is an assessment that established why the limit is where it is. If your procedure says a temperature excursion under two degrees for under thirty minutes requires no investigation, there must be a stability and process understanding basis for those numbers, referenced from the procedure. A rule with no traceable origin is not a rule-based decision. It is a habit.

The rule has boundary conditions. Every rule needs a stated scope and an explicit statement of what falls outside it. The failure mode is almost never the rule being applied wrongly inside its scope. It is the rule being stretched to cover a case its originating assessment never contemplated.

The rule is reviewed. Rules encode a snapshot of knowledge. Processes change, suppliers change, product portfolios change. Q9(R1) devotes section 4.6 to risk review and states that once a quality risk management process has been initiated, it should continue to be used for events that might affect the original decision, whether planned or unplanned.¹ A rule that has never been revisited since it was written is a risk assessment that has never been reviewed, wearing a procedure as a disguise.

Accepting Risk: The Record That Survives an Inspection

Here is the part of quality risk management that organizations find hardest, and it is not assessment. It is acceptance. Q9(R1) says that risk control includes decision making to reduce and accept risks, that for some types of harm even the best practices might not entirely eliminate risk, and that in those circumstances it might be agreed that an appropriate strategy has been applied and the risk reduced to a specified acceptable level, decided case by case.¹ The definitions section defines risk acceptance simply as an informed decision to take a particular risk.

In practice most quality organizations will do almost anything rather than write down that they decided to accept a known risk. So the risk gets reduced on paper instead. A score gets adjusted downward on a thin rationale, or a control that nobody expects to be effective gets added so the residual score falls under the threshold. This is worse than acceptance in every respect. It corrupts the assessment, it creates a control nobody maintains, and it leaves no record of the actual reasoning if the risk later materializes.

What an accepted-risk record needs

An acceptance record that holds up under inspection is not long. It is specific. It needs seven elements.

• The risk, stated as a scenario rather than a category. Not “risk of contamination.” Instead: “residual risk that a viable contaminant introduced during the manual connection step is not detected by the current environmental monitoring locations.”
• The residual risk level after all controls, with the rationale. The score plus the reasoning behind the score, so a reviewer can evaluate the judgment rather than only read the output.
• The controls actually in place, named and traceable. Each one linked to the procedure, specification, or qualification record that implements it. A control that cannot be traced to something a person does or a system enforces is not a control.
• The options considered and why they were not taken. This is the element most often missing and the one an inspector will ask about first. If further reduction was technically possible but not pursued, say what it was and why. “Not feasible” is not a reason. “Would require a facility modification with a qualification lead time of eighteen months, during which the current control set holds residual risk at the accepted level” is.
• The decision maker, by role and by name. Q9(R1) defines a decision maker as a person with the competence and authority to make appropriate and timely decisions. Acceptance of a meaningful residual risk should sit with someone whose authority actually covers it, not with the assessment author.
• The monitoring commitment. What signal would tell you the accepted risk is materializing, where that signal is watched, and what happens when it appears. Accepted risk without monitoring is unmanaged risk with paperwork.
• The review trigger and date. Both a calendar date and a set of events that force earlier reconsideration. Acceptance is a decision made against a known state of the world, and it expires when that state changes.

The Assessment Written After the Decision

Every experienced quality professional recognizes this. A decision has already been made, for commercial reasons, schedule reasons, or because a senior leader committed to it in a meeting. The risk assessment is then convened to support it. The team knows what conclusion is expected. The scores arrive at that conclusion. The record is filed.

Q9(R1) does not name this failure mode directly, but it aims at it repeatedly. The statement that risk scores, ratings, and assessments should be based on an appropriate use of evidence, science, and knowledge is aimed at it. The instruction that all participants should acknowledge, anticipate, and address the potential for subjectivity is aimed at it. And the caution in the introduction that quality risk management should not be used in a manner where decisions are made that justify a practice that would otherwise be deemed unacceptable is aimed squarely at it.¹

How to recognize a retrospective assessment

You can usually spot one from the record alone. The tells are consistent.

• No option was ever rejected. A genuine assessment considers alternatives and discards some. If every assessment in a file concludes that the proposed approach is the right one, the assessments are not doing work.
• Scores cluster just under the threshold. Real hazard distributions are lumpy. A distribution where residual scores sit tightly below the acceptance line is a distribution that was engineered.
• The assessment date sits after the commitment date. Compare the risk assessment approval date against the purchase order, the project kickoff, the supplier notification, or the meeting minutes where the direction was set. This is the fastest check available and organizations rarely run it on themselves.
• Controls appear with no implementation trail. A control credited in the assessment for reducing a score, with no corresponding procedure revision, training record, or qualification, was added to move a number.
• There is no uncertainty anywhere in the document. Real assessments contain statements like “the team could not determine the detection probability with confidence.” A document with no acknowledged uncertainty is a document written to close, not to understand.

What makes an assessment genuinely decision-shaping

Four things, and they are all procedural rather than cultural, which is what makes them achievable.

The assessment happens before the commitment, and the sequence is verifiable. Build the gate into the change control and project workflows so the assessment record has to exist and be approved before the commitment step can be completed. If the workflow allows the order to be reversed, it will be.

The assessment has a documented ability to say no. The procedure should state what happens when the assessment concludes that the risk is unacceptable and cannot be reduced. If there is no defined path for that outcome, the assessment has no authority, and everyone involved knows it. The path does not have to be a veto. It can be escalation to a defined level. But it has to exist on paper.

The team includes someone with no stake in the outcome. One participant who does not report into the function that wants the change, and whose performance is not affected by whether it proceeds. This is not about distrust. It is about the fact that people who need an outcome score risk differently from people who do not, and neither group notices they are doing it.

The assessment changes something at least sometimes. Track it. Over a year, what proportion of assessments resulted in an added control, a modified design, a changed timeline, or a rejected option? If the answer is close to zero, the process is producing documents rather than decisions, and no amount of procedural language will fix that until the underlying expectation changes.

Supply Continuity: QRM Beyond Product Quality

Section 6.1 is the addition most likely to be overlooked by quality organizations, because it sits outside the traditional boundary of what a quality risk assessment addresses. It states that quality and manufacturing issues, including non-compliance with GMP, are a significant cause of product availability issues, and that the interests of patients are served by risk-based drug shortage prevention and mitigation activities.¹

The logic that makes this a quality guideline matter rather than a supply chain one is in the definitions. Q9 defines harm as damage to health, and R1 keeps the wording that includes damage that can occur from loss of product quality or availability. If a patient cannot get a medicine because a manufacturing problem stopped supply, that is harm within the meaning of the guideline. The principles section carries a matching note: risk to quality includes situations where product availability may be impacted, leading to potential patient harm.

The FDA’s own analysis of root causes concluded that the market does not adequately recognize or reward manufacturers who invest in mature quality systems, and that quality problems underlie a substantial share of shortages.¹² That is the connective tissue between Q9(R1) section 6.1 and everything else in the guideline. Supply reliability is downstream of manufacturing reliability, and manufacturing reliability is what quality risk management has always been about.

The four factor areas the guideline names

Section 6.1 lists quality and manufacturing factors that can affect supply reliability. They are worth reading as a checklist, because each one maps to a risk assessment your organization either has or does not.

Manufacturing process variability and state of control. Processes that show excessive variability, such as drift or non-uniformity, have capability gaps that produce unpredictable outputs in quality, timeliness, and yield. The guideline notes that quality risk management can help design monitoring systems capable of detecting departures from a state of control so root causes can be addressed. In practice this means your continued process verification program is a supply continuity control, whether or not anyone in the organization describes it that way.

Manufacturing facilities and equipment. The guideline says a reliable facility infrastructure supports reliable supply, and that it is weakened by an aging facility, insufficient maintenance, or an operational design vulnerable to human error. The guideline points to modern technology, including digitalization, automation, and isolation technology, as a way to reduce risk to supply. Note that this makes the deferred maintenance backlog a documented supply risk, not only an engineering budget item.

Oversight of outsourced activities and suppliers. Approval and oversight of outsourced activities and material suppliers is informed by risk assessments, knowledge management, and a monitoring strategy for partner performance. Where substantial variability is identified in supplied materials or services, enhanced review and monitoring is justified, and in some cases it may be necessary to identify a pre-qualified alternative supply chain entity.

Supply chain complexity itself. The guideline observes that while manufacturing and supply chain diversity can support availability, increasingly complex supply chains create interdependencies that introduce systemic risk. Complexity is a double-edged property, and the guideline expects it to be assessed rather than assumed beneficial.

What to actually build

Three concrete changes turn section 6.1 from a paragraph you have read into something that operates.

Add an availability dimension to deviation and change assessments. When a deviation occurs on a product with thin inventory coverage and no qualified alternative source, its priority is different from an identical deviation on a product with nine months of stock. That is a risk-based prioritization, and it belongs in the assessment. It requires the quality organization to have visibility of inventory position and demand, which in most companies means a data connection that does not currently exist.

Build an early warning capability. Q9(R1) says the pharmaceutical quality system, including management responsibilities, uses quality risk management and knowledge management to provide an early warning system supporting oversight and response to evolving quality and manufacturing risks, from the company or its external partners. An early warning system is a defined set of leading indicators with owners and thresholds. Process capability trends, supplier on-time and in-full performance, maintenance backlog on critical equipment, deviation rate by product line, and single-source material exposure are reasonable starting indicators.

Map single points of failure at the product level. For each commercial product, identify every step where exactly one site, one line, one supplier, or one qualified material source stands between you and supply interruption. Score each by importance and complexity using the same criteria as everything else, and take the top of that list into the management review. The guideline notes that the formality applied to shortage prevention and mitigation activities may vary and should be commensurate with the level of risk associated with loss of availability, which means the tiering model from section 5.1 applies here too.

A Twelve-Month Implementation Path

Organizations that treat Q9(R1) as a procedure update finish quickly and change nothing. Organizations that treat it as a rewrite of the whole risk management system stall. The path below sits between those, and assumes an existing Q9-based system that works on paper.

Conclusion

ICH Q9(R1) is a short revision with a long implication. It does not introduce new tools, new documentation formats, or new regulatory requirements, and the guideline says so directly. What it does is name four habits that grew up around the original Q9 and ask organizations to break them: scoring risk without defined criteria, applying uniform formality regardless of what is at stake, treating decision making as an unexamined step at the end of an assessment, and stopping at product quality when availability is also a patient harm. Each of those habits developed because it was safe. None of them is defensible under the revised text.

The organizations that get real value from R1 will be the ones that stop asking what the guideline requires and start asking whether their risk assessments actually influence decisions. That question has a measurable answer, and for most companies the honest answer today is uncomfortable. It is also fixable, and the fixes are concrete: anchored scales with worked examples, independent scoring before discussion, documented rationale rather than bare numbers, calibration across assessments, a written formality model with named outputs per tier, a decision gate that runs in the right order, an acceptance record that says what was actually decided, and a standing connection between quality risk management and supply planning. None of that requires new software. Most of it requires deciding that the risk assessment is a decision instrument rather than a deliverable.

Sakara Digital works with pharma and biotech organizations rebuilding quality risk management so it holds up in practice and under inspection, not only on paper. If you are working through Q9(R1) implementation and want an independent read on where your current system is producing documents rather than decisions, we are happy to have that conversation.

For Further Reading