ICH Q9: what it is, who needs it, and how quality risk management works

What is ICH Q9?

ICH Q9 is the International Council for Harmonisation's guideline on quality risk management for drug substances and drug products across the product lifecycle. It sets out a process for assessing, controlling, communicating and reviewing risks to quality, with the effort and formality in proportion to the risk. Inspectors read risk-based decisions against it. There is no Q9 certificate.

The current version is Q9(R1), which reached ICH Step 4 in January 2023. The revision kept the process and the annex of tools and added guidance on formality, on managing subjectivity, on risk-based decision making and on risks to product availability. The FDA published it as guidance in May 2023, and in the EU it sits in Eudralex Volume 4 Part III.

Who needs ICH Q9?

Manufacturers of drug products and active pharmaceutical ingredients under cGMP or EU GMP, since both regulators expect a risk assessment behind a control, a deviation classification or a supplier audit frequency

Quality teams at CDMOs and the sponsors who use them, since R1 reaches into product availability and asks that the risk of a supply or manufacturing failure be assessed like any other risk to quality

The guideline becomes urgent when an inspector asks by what method each deviation last year was classed as minor, when a change control's impact assessment is one line with no rationale, or when a single-source supplier fails and the risk to supply was never written down.

ICH Q9 IN QUALIO

Qualio links each risk assessment to the deviation, change control or CAPA that raised it, so the inspector reads the reasoning behind a decision from the same records

Qualio holds your risks as one register across quality and product, assessed against the same criteria and reviewed together. Each risk assessment is a controlled record, approved and signed by the people your procedure names. Qualio maps ICH Q9 to that procedure beside ICH Q10 and cGMP in the same library, reassesses the mapping when a record changes and recommends a fix for any gap.

The risk assessment opened from the deviation, change control or CAPA that raised it, so the risk-based decision in section 5.2 and the event it decided are read together

Each assessment approved and signed, so the level of formality section 5.1 asks for is shown by who signed it and when

The risk procedure held as a controlled document, with training assigned on the effective date of each revision, for the responsibilities in section 4.1

ICH Q9 in the same library as ICH Q10 and cGMP, so the risk management Q10 names as an enabler is assessed once beside the regulation it serves, for the integration in section 6

Standards that apply alongside ICH Q9

Pharma manufacturingICH Q10: The pharmaceutical quality system model that names quality risk management as one of its two enablers, so Q9 is the method behind Q10's CAPA, change management and monitoring
Pharma manufacturingcGMP (21 CFR 210 and 211): The FDA regulation whose investigators expect a risk assessment behind the controls on a process, the scope of a deviation investigation and the frequency of a supplier audit
Pharma manufacturingEU GMP, Eudralex Volume 4: Chapter 1 requires quality risk management and Part III carries Q9 itself, so an EU inspector reads risk-based decisions against the guideline as part of GMP
Pharma manufacturingICH Q8: Pharmaceutical development, where the risk assessment links the critical quality attributes to the process parameters that control them

Sentec

An enterprise medical device team reduced audit prep from one week to one day and gained 360° visibility across their QMS

Read the Sentec story

“Qualio gives us a 360-degree view of our compliance posture and automatically surfaces the gaps. We resolve issues faster, our team is more productive, and our risk is lower.”

Christophe DohrSite Quality Manager, Sentec

Guides and webinars for ICH Q9

Guide

How to prepare for ICH Q9 compliance

Guide

Taking risks: ICH Q9 quality risk management

Guide

Quality risk management (ICH Q9): advanced practical applications

Questions about ICH Q9

What is ICH Q9?

ICH Q9 is the International Council for Harmonisation's guideline on quality risk management for drug substances and drug products, from development to discontinuation. It describes a process for assessing, controlling, communicating and reviewing risks to quality, with an annex of tools, and asks that the effort match the risk. The FDA and the EMA adopted it as guidance.

What changed in ICH Q9 (R1)?

The 2023 revision kept the process and added what inspectors and industry had found missing. It explains how to choose the level of formality for a risk assessment, how to recognise and reduce subjectivity in scoring, how risk-based decisions should be made and recorded, and it extends quality risk management to the risk of a product becoming unavailable.

What are the steps in the ICH Q9 process?

Initiation defines the question and the team. Assessment identifies the hazards, analyses the probability and severity of harm and evaluates the result against the criteria. Control reduces the risk or accepts it, communication takes the outcome to the people who act on it, and review reopens it as new information arrives. Annex I lists the tools, FMEA among them.

Is ICH Q9 mandatory?

No. Q9 is a guideline and GMP is the law. Chapter 1 of the EU GMP guide requires quality risk management and Q9 is published with it in Eudralex Volume 4 Part III, so an EU inspector expects the method. The FDA adopted it as guidance and its investigators expect the same. No body certifies or accredits against it.

Can we add ICH Q9 to the standards we already run in Qualio?

Yes. Add it from the library and Qualio assesses your risk procedure and the risk assessments you already hold against the guideline, beside ICH Q10 and cGMP if you run those too. The first assessment lists what is covered and what is new, and the risks in your register are read as they are.

Where is the risk assessment behind your last change control?

Bring it and your risk procedure. We will show you ICH Q9 assessed against both, the register across quality and product and each assessment opened from the event that raised it.

Book a demo Get the ICH Q9 guide

Less time on audit prep. More time on quality.