ICH Q9(R1): Getting the Subjectivity Out of Quality Risk Management

When ICH adopted Q9(R1) in January 2023, it did something guidelines rarely do: it named the failure modes of its own first edition. Twenty years of quality risk management practice had produced risk registers, FMEAs, and heat maps in industrial quantities — and, too often, assessments that existed to justify decisions already made. The revision's four themes — subjectivity, formality, risk-based decision-making, and product availability — are a regulator's description of what has been going wrong.

What the revision actually changed

Structurally, little moved: the QRM process diagram, the principles, and the tools annex survive. What changed is the standard of practice the guideline describes. Q9(R1) states plainly that risk assessments are shaped by the assumptions, framing, and biases of the people who run them — and that firms are expected to manage that, through good process design, better use of data, and behaviors that surface disagreement instead of averaging it away. For programs built on risk management systems that treat a completed template as the deliverable, that is not a small edit.

Subjectivity: the problem scoring scales were hiding

The most consequential passage in the revision is the acknowledgment that subjectivity affects every risk assessment — in how hazards are framed, how severities are scored, and how thresholds are set. A 1-to-5 scale does not remove judgment; it disguises it as arithmetic. An RPN cutoff nobody can defend is not a control — it is a place where a subjective call was made once, years ago, and never examined again. The guideline's answer is not more math. It is process: explicit assumptions, structured facilitation, diverse teams, challenge built into the review, and data where data exists.

A risk assessment that exists to justify a decision already made is not risk management. Q9(R1) says so in a regulator's voice. The practical shift

Formality is a dial, not a default

The revision's second correction is to the one-size ritual: every question, no matter the stakes, answered with the same cross-functional FMEA. Q9(R1) frames formality as a spectrum — the effort and documentation applied should be proportionate to the uncertainty, importance, and complexity of the question. A well-understood like-for-like change moving through change control does not need what a novel contamination-control strategy needs. The discipline is in writing down why a level of formality was chosen, so the choice itself survives inspection. The same proportionality logic underpins ICH Q12's established conditions — the two guidelines reward the same organizational maturity.

Decisions and availability: where QRM meets the business

The remaining two themes push QRM out of the quality office. Risk-based decision-making asks for governance: who decided, on what evidence, accepting what residual risk — a record that connects the assessment to the action, the thing inspectors increasingly ask to see and the thing a CAPA program cannot reconstruct after the fact. Product availability makes quality-driven supply disruption an explicit QRM subject: a manufacturing risk that ends in a shortage is a patient-impact risk, and regulators now expect it assessed as one. Both land in the same place — risk management as a way the company makes decisions, embedded in the quality system's operating model, not a binder maintained beside it.

The gap between a compliant-looking QRM program and a Q9(R1) program is organizational, not documentary. It is the difference between producing assessments and governing decisions. Firms that close it get something better than inspection comfort: risk work that actually changes what the company does — which was the point of Q9 all along.