Current Edition Checked October 24, 2026
The R1 revision of January 2023 added guidance on subjectivity, the formality of risk management, risk-based decision making, and risks to product availability.
What It Covers
A systematic process for assessing, controlling, communicating and reviewing risks to the quality of a medicinal product across its life cycle, with examples of tools and where to apply them.
Who It Applies To
Industry and regulators, for drug substances and drug products, biological and biotechnological products, from development to discontinuation.
Key Requirements
- Risk assessment: identification, analysis and evaluation, scaled to the level of risk.
- Risk control: reduction and acceptance, with decisions documented.
- Risk communication and review, so assessments are revisited as knowledge grows.
- Formality proportionate to uncertainty, importance, and complexity — not every decision needs a full FMEA.
- Awareness of subjectivity in scoring, and of risks to supply and product availability.
What an Auditor Asks to See
- How a risk assessment changed a decision: a validation scope, a sampling plan, a supplier audit frequency.
- The criteria used to decide how formal an assessment needs to be.
- Evidence that assessments were reviewed when new information arrived.
Where Systems Fall Short
- Risk assessments done to justify a decision already made.
- Scoring scales with no definitions, so two teams score the same risk differently.
- Assessments never reopened after deviations or complaints.
Structure at a Glance
| Part | Topic | What It Asks For |
|---|---|---|
| Section 4 | General QRM Process | Initiating, assessing, controlling, communicating, and reviewing risk. |
| Section 5 | Risk Management Methodology | Choosing and applying tools; formality and subjectivity. |
| Section 6 | Integration Into Industry and Regulatory Operations | Where QRM supports the quality system and regulators. |
| Annex I | Methods and Tools | Flowcharts, FMEA, FMECA, FTA, HACCP, HAZOP, PHA, risk ranking, and filtering. |
| Annex II | Potential Applications | Documentation, training, deviations, auditing, facilities, materials, production, laboratory, packaging. |
Requirements Checklist
Work down the list with the evidence in hand. The PDF has a column for noting where each item is evidenced.
- A QRM procedure that defines roles, triggers, and documentation.
- Criteria for the level of formality, based on uncertainty, importance, and complexity.
- Defined scales for severity, occurrence, and detectability where scoring is used.
- Cross-functional teams with the knowledge the question needs.
- Risk assessments linked to the decisions they support.
- Risk control decisions, including acceptance, documented with rationale.
- Risk communication to the people affected by the decision.
- Periodic and event-driven review of assessments.
- Product availability and supply risks considered.
- QRM applied to deviations, change control, supplier management, and validation.
- Training on the tools in use, with competence checked.
- Management review sees the significant risks and the actions on them.
Implementation Roadmap
- 1. Define Write the QRM procedure, the formality criteria, and the scoring scales.
- 2. Apply Start where decisions are frequent: deviations, change control, supplier audits.
- 3. Connect Link each assessment to the decision and the records it changed.
- 4. Review Reopen assessments on new data, and report the main risks to management.
How It Fits with Other Standards
Q9(R1) is one of the two enablers of the pharmaceutical quality system in ICH Q10 (the other is knowledge management). It informs how 21 CFR 211 investigations, EU GMP Annex 1 contamination control strategies and supplier qualification are scoped. For device constituents of combination products, ISO 14971 applies.
Findings We See Most Often
- Assessments with identical scores across very different risks.
- No link between the assessment and the decision taken.
- Teams too narrow to see the risk being assessed.
- Formal tools used for trivial decisions, and none for important ones.
How QES Helps
Risk tools sized to the decision, with scoring scales defined so they mean the same thing to everyone.
Related Standards
Sources. ICH — Quality guidelines (opens in a new tab); ICH — Q9(R1) and Q10 guideline documents (opens in a new tab); IntuitionLabs — ICH Q10 guide (updated August 2026) (opens in a new tab). Status checked October 24, 2026. This page summarizes ICH Q9(R1); it does not reproduce or replace it. Buy the standard from its publisher, or read the regulation in its official text, before relying on a detail. Not legal advice.