Glossary · ICH guidelines
ICH Q9(R1) (quality risk management)
Also known as: ICH Q9, Q9(R1), Quality risk management (QRM)
ICH Q9(R1) is the ICH guideline on quality risk management for medicines, first revision adopted in January 2023. It describes a systematic process to assess, control, communicate and review risks to product quality across the product lifecycle, with the protection of the patient as the ultimate aim.
- ICH
- Pharma
- GxP
In one sentence
ICH Q9(R1) sets out quality risk management for medicines: assess, control, communicate and review quality risks, scaled to their significance.
Example
A sterile manufacturer uses an FMEA under ICH Q9(R1) to rank contamination risks on a filling line, adds environmental monitoring points for the highest risks and records the assessment in its contamination control strategy.
How it applies
- Process: Risk assessment (identification, analysis, evaluation), risk control (reduction, acceptance), risk communication and risk review, with the effort, formality and documentation proportionate to the level of risk.
- Revision R1: The 2023 revision addresses high levels of subjectivity in risk assessments, the degree of formality, risk-based decision-making, hazard identification and risks to product availability, including supply shortages linked to quality problems.
- Tools: The guideline names methods such as FMEA, FMECA, fault tree analysis, HACCP, HAZOP and preliminary hazard analysis, and lets companies choose the one that fits the question.
- Use in GMP: Quality risk management underpins qualification, validation scope, change control, deviation handling and the contamination control strategy of Annex 1. In the EU, ICH Q9 is published in Part III of EU GMP.
- Technical documentation: Keep risk assessments as controlled documents with scope, team, method, rationale and date, and update them when the process, product or knowledge changes.
ICH Q9(R1) vs. ISO 14971
Both describe a risk management process, but for different products and harms. ICH Q9(R1) addresses risks to the quality of medicines and, through quality, to patients. ISO 14971 addresses the safety of medical devices, including use-related and technical hazards, and requires an overall residual risk evaluation against the benefits. Drug-device combination manufacturers often need both.