ICH Q9(R1) Quality Risk Management: Implementation Working Group Concept Paper
What the 2023 concept paper proposed, why older QRM training materials needed alignment, and what the changes mean for risk-based pharmaceutical decisions.
What is the ICH Q9(R1) concept paper about?
The ICH Q9(R1) Implementation Working Group (IWG) concept paper proposed reviewing and updating older ICH quality risk management training materials so they would align with the revised ICH Q9(R1) guideline and the new 2023 training materials. The work focused on subjectivity, product availability risks, formality in QRM, risk-based decision-making, hazard identification, risk review, human factors, and detection controls.
Introduction
Why the ICH Q9(R1) quality risk management update mattered
Quality Risk Management (QRM) is a foundation of modern pharmaceutical quality systems. ICH Q9 introduced a structured way to identify hazards, evaluate risk, select controls, and support decisions throughout the product lifecycle. Over time, however, training materials developed between 2006 and 2010 no longer fully reflected the revised ICH Q9(R1) guideline or the new materials developed in 2022 and 2023.
The concept paper dated 24 March 2023 proposed a dedicated Implementation Working Group to reconcile those materials. Its purpose was not to discard the earlier educational content. Much of the older material remained valuable because it contained examples, case studies, and practical explanations that were not repeated in the newer training package. The proposed work was therefore a harmonization exercise: retain useful content, revise conflicts, modernize presentation, and create one consistent training set.
For industry and regulators, the practical message is important. QRM is not just a scoring exercise. It should be scientifically justified, proportionate to risk, clear about uncertainty, connected to patient protection, and capable of supporting decisions that protect both product quality and product availability.
Document purpose
Purpose and type of harmonization action
The paper proposed establishing an IWG to review and update the existing QRM training materials hosted on the ICH website. The materials included the ICH Q9 Briefing Pack and ICH Q8/Q9/Q10 Training Material, comprising 36 PowerPoint presentations and one Q&A document developed mainly from 2006 to 2010.
Resolve technical inconsistencies
Revise or remove content that conflicts with ICH Q9(R1), including outdated language about formality, risk identification, residual-risk decisions, and product availability.
Keep useful training content
Retain valuable examples, methods, and case studies where they remain consistent with the revised guideline and help learners apply QRM in practice.
Update visual presentation
Bring older materials into the official ICH training format with consistent structures, styles, visual features, and branding.
Improve implementation
Provide a harmonized training package that helps industry and regulators interpret and apply the revised QRM concepts consistently.
Perceived problem
Why older QRM training materials required revision
The revised ICH Q9(R1) guideline, published as a Step 4 document in January 2023, introduced or clarified important ideas. The paper identified four central areas requiring better alignment:
Reduce unsupported judgment
Risk assessments can become subjective when ratings, assumptions, or conclusions are not anchored in evidence, knowledge, uncertainty, and clearly defined criteria.
Recognize supply-related patient risk
Quality risk includes situations in which quality problems or controls affect product availability and create potential harm for patients.
Use a proportionate level of rigor
Formality is not a binary formal/informal choice. It exists on a continuum, from low to high, and should reflect risk, uncertainty, complexity, and decision impact.
Make risk-based decisions explicit
Decision-makers should show how knowledge, uncertainty, options, controls, and residual risk support the selected outcome.
Other changes included replacing "risk identification" with "hazard identification," clarifying the distinction between hazards, harms, and risks, and recognizing that detection controls may reduce the probability that harm occurs in some situations.
Background
How ICH Q9 training evolved
ICH Q9 was instrumental in introducing QRM approaches to industry and regulators in 2005. Training materials developed between 2006 and 2010 explained core concepts, presented risk tools, and used examples and case studies to show practical application.
The 2020 concept paper that supported revision of the guideline identified four areas where the full benefits of QRM had not been realized: high subjectivity, insufficient treatment of product availability risk, uncertainty about the meaning of formality, and a lack of clarity about risk-based decision-making.
During 2022 and 2023, the ICH Q9(R1) Expert Working Group developed new training materials on those four areas and on two additional topics: hazard identification and risk review. The concept paper explained that the older material was still valuable, but in places it conflicted with the revised guideline or the new training content. The proposed IWG would therefore harmonize the entire QRM training set.
Key technical changes
Six ICH Q9(R1) concepts every QRM practitioner should understand
Subjectivity in QRM
Risk ratings and conclusions should be supported by scientific knowledge, relevant data, transparent assumptions, and documented uncertainty. Two teams should not produce materially different results solely because rating criteria are vague.
Product availability risks
Risk to quality can include scenarios where a failure, control strategy, or supply disruption reduces availability and creates potential patient harm. Availability should be considered alongside the direct quality impact.
Formality as a continuum
QRM formality ranges from low to high. A simple, low-risk decision may need a concise documented rationale; a complex, high-impact decision may require a multidisciplinary team, detailed data, formal tools, and independent review.
Risk-based decision-making
Decisions should reflect the seriousness of potential harm, uncertainty, available knowledge, control options, and the consequences of action or inaction.
Hazard identification
The revised terminology helps separate a potential source of harm from the harm itself and from the associated risk. This improves the quality of problem statements and risk controls.
Risk review
Risk management does not end when a control is implemented. New knowledge, events, trends, changes, and control performance should trigger review and, where appropriate, reassessment.
Clear language
Hazard, harm, risk, and control: practical definitions
| Term | Meaning in QRM | Pharmaceutical example |
|---|---|---|
| Hazard | A potential source of harm. | Microbial contamination of a sterile product pathway. |
| Harm | Damage to a patient, product, process, or other protected outcome. | Patient infection caused by contaminated injectable product. |
| Risk | The combination of the probability of harm and the severity of that harm. | The likelihood and consequence of contamination reaching the patient. |
| Control | A measure that prevents, reduces, detects, or responds to a hazard or its consequences. | Validated sterilization, environmental monitoring, and investigation triggers. |
| Residual risk | Risk remaining after selected controls are implemented. | Remaining contamination risk after the validated control strategy is applied. |
Clear terminology matters because a risk assessment can become confused when hazards, harms, controls, and outcomes are treated as interchangeable. Use the terms consistently in your SOP, risk register, investigation, and approval record.
Proportionate rigor
Formality in QRM is a spectrum, not a binary choice
Older training materials described "formal" and "informal" risk management as two categories. ICH Q9(R1) instead presents formality as a continuum. The appropriate level depends on the complexity and uncertainty of the issue, the possible severity of harm, the number of stakeholders, the reversibility of the decision, and the value of the decision to product quality or availability.
Routine, low-complexity decision
Use a concise rationale, existing knowledge, a defined owner, and a proportionate review. Keep the decision traceable.
Meaningful uncertainty
Use a cross-functional review, documented assumptions, evidence review, a suitable tool, and defined approval criteria.
High-impact or complex decision
Use a multidisciplinary team, robust data, structured analysis, sensitivity to uncertainty, independent challenge, and management or Quality approval.
Formality is not the same as paperwork volume. A long document can still be weak if it does not explain the decision. Conversely, a concise record can be appropriate when it contains sufficient evidence, reasoning, approvals, and follow-up.
Patient access
Why product availability belongs in quality risk decisions
Product quality and product availability are connected to patient protection. A quality failure can directly harm a patient, but a control strategy or supply disruption can also reduce access to an essential medicine. ICH Q9(R1) clarified that risk to quality can include situations in which product availability is affected and potential patient harm follows.
Availability does not justify lowering quality standards. It means that decisions should recognize the complete patient-impact picture and use science, risk controls, and escalation to balance competing consequences.
From assessment to action
Risk-based decision-making in pharmaceutical quality
A risk assessment is useful only when it informs a decision. The decision record should make the reasoning visible and show why the selected option is justified in light of the evidence and uncertainty.
- Define the decision: state what must be decided, by whom, and by when.
- Describe the hazard and possible harm: avoid vague problem statements and distinguish facts from hypotheses.
- Gather knowledge: use process understanding, historical data, validation evidence, technical expertise, and relevant regulatory requirements.
- Evaluate options: compare preventive, detective, corrective, containment, supply, and monitoring controls.
- Address uncertainty: document assumptions, data limitations, confidence, and what would trigger reassessment.
- Approve and communicate: assign owners, define follow-up, and communicate the decision to affected functions.
- Review: check whether the controls work and whether new knowledge changes the risk.
This approach can be connected to equipment qualification and lifecycle controls. For example, a risk-based decision may define the appropriate scope of URS, DQ, IQ, OQ, and PQ.
Control strategy
The role of detection controls
The concept paper identified detection controls as an issue to address in the updated training material. Detection does not always eliminate a hazard, but in some situations it can reduce the probability that harm will reach the patient by identifying a problem early enough for an effective response.
Prevention
Stops a hazard from arising or reduces its likelihood before it occurs, such as equipment design, validated cleaning, supplier controls, or procedural barriers.
Detection and response
Identifies a hazard or failure before harm occurs and triggers a reliable response, such as alarms, environmental monitoring, in-process checks, or reject mechanisms.
Detection should not be used as a substitute for prevention when prevention is reasonably practicable. Assess the speed, sensitivity, reliability, coverage, and response pathway of the detection control before crediting it in a risk assessment.
Root causes and real work
Human and other causal factors in QRM
The updated training work was intended to incorporate human and other causal factors when older materials discussed the root causes of hazards and risks. Human factors do not mean blaming an individual. They include task design, workload, interfaces, labeling, environment, communication, staffing, training quality, fatigue, and organizational decisions.
When a QRM conclusion identifies a human or organizational contributor, the response may need process redesign, engineering controls, clearer information, or workload changes rather than training alone.
Keep the assessment alive
Risk review and continual improvement
Risk management is not finished when a risk score is calculated or a control is approved. Review should occur when new evidence, trends, deviations, complaints, audit findings, process changes, supplier events, validation results, or product-availability signals change the knowledge base.
Set review triggers
Define events and time-based reviews that require reassessment.
Trend the evidence
Use complaints, deviations, OOS results, environmental data, audit findings, and supply information.
Confirm control performance
Check whether controls operate as designed and whether detection and response remain reliable.
Update and escalate
Revise the risk assessment, communicate changes, and initiate CAPA where a systemic improvement is needed.
Working group proposal
How the proposed ICH Q9(R1) IWG would work
The concept paper recommended using the expertise of the current ICH Q9(R1) Expert Working Group. Subgroups would address different parts of the older training package, while the full IWG would review outputs through discussion, email, teleconferences, and occasional in-person meetings.
| Proposed element | Purpose | Practical implication |
|---|---|---|
| Membership | Use experts already familiar with QRM and ICH Q9(R1). | Maintain technical continuity between the revised guideline and updated training. |
| Subgroups | Divide the 36 presentations and one Q&A document into manageable review areas. | Allow detailed technical, terminology, and formatting review. |
| Full IWG input | Discuss subgroup work through the broader group. | Reduce new inconsistencies between revised modules. |
| Training proposal | Consider training activities after material updates. | Support consistent implementation by industry and regulators. |
Appendix analysis
Examples of discrepancies identified in the concept paper
| Older training approach | Issue identified | Alignment direction |
|---|---|---|
| Formal versus informal QRM as a binary decision. | Conflicts with the revised view that formality is a continuum from low to high. | Teach proportionate formality and risk-based rigor. |
| Use of "risk identification." | Does not clearly distinguish a hazard from the harm and risk associated with it. | Use "hazard identification" and consistent terminology. |
| QRM described as not mandatory. | Too broad for current regulatory environments where risk-based requirements are established in many GMP areas. | Explain that ICH Q9 is a guideline while risk-based expectations may arise from applicable GMP requirements. |
| Quality risk discussed without product availability. | Does not reflect the revised clarification that availability impacts may create potential patient harm. | Include product availability in relevant risk decisions. |
| Passive decisions for residual-risk acceptance. | Removed from the revised approach to formality and risk-based decision-making. | Document the decision, rationale, controls, uncertainty, and review expectations. |
The paper also listed additional updates: incorporate the four revised concepts where needed, add human and other causal factors, address the role of detection controls, and propose training activities after the materials were updated.
Implementation for companies
How pharmaceutical companies can apply the updated QRM concepts
Check local materials
Compare QRM training, decision trees, templates, and examples with current ICH Q9(R1) terminology and principles.
Examine real decisions
Sample deviations, changes, validation decisions, supplier assessments, complaints, and shortage-related decisions for evidence of risk-based reasoning.
Make reasoning traceable
Use controlled records to show evidence, assumptions, uncertainty, options, residual risk, approvals, and review triggers.
Connect QRM to qualification
Use risk knowledge to shape URS, DQ, IQ, OQ, and PQ scope and acceptance criteria.
Protect data integrity
Apply ALCOA+ principles to risk records, source data, approvals, and evidence.
Escalate systemic weaknesses
Link significant, recurring, or systemic weaknesses to investigation, change control, and the approved CAPA process.
Practical self-check
ICH Q9(R1) QRM readiness checklist
- Does the QRM procedure distinguish hazards, harms, risks, controls, and residual risk?
- Are risk ratings supported by evidence, criteria, scientific knowledge, and uncertainty?
- Is formality selected on a continuum according to risk and complexity?
- Are product availability and potential patient harm considered when relevant?
- Are human factors and other causal contributors assessed without blame?
- Are detection controls credited only when their performance and response are reliable?
- Do decision records explain options, rationale, approvals, and follow-up?
- Are risk review triggers linked to changes, trends, incidents, and new knowledge?
- Are QRM templates, training, and decision trees consistent with ICH Q9(R1)?
- Are risk records attributable, complete, consistent, enduring, and available?
- Are significant weaknesses linked to change control, investigation, and CAPA where appropriate?
- Does management review QRM performance, recurring risk, and resource needs?
Key takeaways
What readers should remember
Alignment was the goal
The proposed IWG was intended to harmonize valuable older training with ICH Q9(R1), not remove useful examples and case studies.
Formality is proportionate
QRM is not divided into only formal and informal activities. The level of rigor should match risk, uncertainty, complexity, and decision impact.
Availability can affect patient risk
Quality risk decisions may need to consider whether controls or supply problems affect access to medicines and create potential harm.
Risk decisions need review
New knowledge, trends, events, changes, and control performance should feed continual risk review.
Clear answers to common questions
Frequently asked questions about ICH Q9(R1)
What is ICH Q9(R1)?
ICH Q9(R1) is the revised ICH guideline on Quality Risk Management. It clarifies how organizations should apply QRM, including subjectivity, product availability risk, formality, risk-based decision-making, hazard identification, and risk review.
What was the purpose of the 2023 IWG concept paper?
It proposed an Implementation Working Group to review and update older ICH QRM training materials so they aligned with ICH Q9(R1) and the new 2023 training materials.
What materials were included in the proposed review?
The paper identified 36 PowerPoint presentations and one Q&A document from the ICH Q9 Briefing Pack and ICH Q8/Q9/Q10 Training Material developed between 2006 and 2010.
Is formality in QRM formal or informal?
ICH Q9(R1) treats formality as a continuum or spectrum from low to high. The appropriate level depends on risk, uncertainty, complexity, and the importance of the decision.
Why did ICH change risk identification to hazard identification?
The terminology helps distinguish a hazard, the harm it may cause, and the risk associated with that harm. This makes risk statements and controls clearer.
How can product availability be part of quality risk?
A quality problem, control decision, or supply disruption may reduce medicine availability and create potential patient harm. Relevant QRM should consider that impact along with direct product-quality risk.
Are detection controls acceptable in QRM?
Detection controls may reduce the probability that harm occurs when they can identify a problem reliably and trigger an effective response. They should not automatically replace reasonably practicable preventive controls.
Does ICH Q9 make QRM legally mandatory?
ICH Q9 is a guideline, but risk-based expectations may be established through applicable GMP regulations, guidelines, and regulatory practice. Companies should assess the requirements that apply to their activities and jurisdictions.
How should companies update their QRM training?
Review local training, decision trees, templates, terminology, and case studies against current ICH Q9(R1) concepts. Keep useful content, correct conflicts, and retrain affected personnel.
How does QRM connect with CAPA and qualification?
QRM informs the scope and rigor of CAPA, change control, and qualification decisions. Risk knowledge can help define URS, DQ, IQ, OQ, and PQ expectations and determine when systemic corrective action is needed.
Conclusion
ICH Q9(R1) quality risk management is a decision framework
The ICH Q9(R1) quality risk management update is best understood as a move toward clearer, more proportionate, and more evidence-based decisions. The concept paper recognized that earlier training materials contained valuable knowledge, but needed alignment with revised terminology and expectations. For pharmaceutical organizations, the practical priorities are to reduce unsupported subjectivity, treat formality as a spectrum, consider product availability where patient access may be affected, distinguish hazards from harms and risks, evaluate detection controls realistically, and review risk as knowledge changes.
Strong QRM records should make the reasoning visible: what was known, what was uncertain, which options were considered, why controls were selected, who approved the decision, and when the risk will be reviewed again. That approach supports a resilient ICH Quality Guidelines implementation and a practical pharmaceutical quality system.
Primary source and further reading
Official references and related pharmaceutical resources
The primary source for this article is the user-provided ICH Q9(R1) IWG Final Concept Paper dated 24 March 2023. Apply current official guidelines, national requirements, and approved site procedures for regulated decisions.
Educational overview based on the supplied ICH concept paper. Always use the current official ICH text, applicable regulations, and approved local procedures.
.webp)
