Home › Guides › ICH Q9 quality risk management, explained
ICH Q9 quality risk management, explained
ICH Q9 is the international guideline on quality risk management for medicines. It tells a pharmaceutical company how to find, judge and control the risks to product quality, and so to the patient, in a structured and written way. It has two principles: decisions about risk rest on science and link back to the patient, and the effort and paperwork are commensurate with the level of risk. Regulators in Europe, the United States and Japan apply it, and the current text is ICH Q9(R1), adopted in January 2023.
- 4 related courses
- 42 hours of audio across them
- certificate and training record
- delivered in 72 hours
What are the ICH Q9 guidelines in one page?
ICH Q9 sets out a process, not a form. The process has four parts: risk assessment, risk control, risk communication and risk review.
- Risk assessment: identify the hazard, analyse how likely and how severe the harm is, and evaluate the result against agreed criteria.
- Risk control: decide whether to reduce the risk or accept it, and record the decision.
- Risk communication: share the outcome with the people who need it, inside the company and, where required, with regulators.
- Risk review: look at the risk again when new knowledge arrives, for example after a deviation or a complaint.
ICH Q9 quality risk management in daily practice
The guideline was first adopted in 2005, and for years many companies used it mainly to fill in a scoring table before an audit. Inspectors noticed. A risk assessment written after the decision, with numbers chosen to justify it, is the opposite of what Q9 asks. The revision in ICH Q9(R1) says plainly that the level of formality should match the risk and the complexity, and that subjective scoring needs to be controlled.
In daily work, Q9 shows up in four places: change control, where each change gets a risk assessment before approval; deviations, where the risk decides how deep the investigation goes; validation, where risk decides what to test and how much; and supplier qualification, where risk decides how often you audit.
Which ICH Q9 tool should a small company use?
Use the simplest tool that answers the question. A checklist or a short risk ranking is enough for a minor change. FMEA suits a new process or a piece of equipment where failure modes can be listed one by one. HACCP suits contamination control. What an inspector wants to see is that the tool fits the risk and that the conclusion changed what you did.
What does a European inspector check?
They pick a change control or a deviation and ask who assessed the risk, with what knowledge, and what was done because of it. Training records for those people are part of the answer. The courses below teach Q9 by role and end each module with a recorded questionnaire.
This guide belongs to Training for Quality assurance and Qualified Person in pharma: 257 audio courses, 257 courses.
Courses that teach this, priced per learner per year
Each course is audio modules in three lengths, with workbook, transcript, a recorded questionnaire per module, a certificate and the training record. Prices are the list price per learner for a year; the price falls with more learners.
- Change control and ICH Q9 risk management: doing it daily, not just for the audit8 modules · 8 hours of audio · QA, production · 72 EUR per learner per year
- ICH Q10 for a company that is not Pfizer: a Pharmaceutical Quality System built from scratch12 modules · 12 hours of audio · QA, management · 108 EUR per learner per year
- Deviation, CAPA, root cause: the investigation a European inspector actually believes10 modules · 10 hours of audio · QA, production · 90 EUR per learner per year
- Proving the process: process validation, cleaning validation and continued process verification12 modules · 12 hours of audio · Production, QA, engineering · 108 EUR per learner per year
Questions about ICH Q9
What changed in ICH Q9(R1)?
The revision kept the structure and added guidance on four weak spots: subjectivity in risk scoring, how formal a risk assessment needs to be, risk-based decision making, and risks to product availability, including shortages caused by quality problems.
Is ICH Q9 a law?
It is a guideline, but the regulators that adopted it expect it to be followed. In the EU it is part of the GMP guide, and inspectors check whether risk assessments behind change controls, deviations and validation decisions are real and proportionate.
Which risk tools does ICH Q9 list?
Its annex describes basic methods such as flowcharts and checklists, and formal tools including FMEA, FMECA, fault tree analysis, HACCP, HAZOP, preliminary hazard analysis, and risk ranking and filtering. It does not require any one tool.
How do ICH Q9 and ICH Q10 fit together?
ICH Q10 describes the pharmaceutical quality system; ICH Q9 supplies the risk thinking that system runs on. Change management, CAPA and management review in Q10 all use the risk process from Q9.
Who needs ICH Q9 training?
Quality assurance first, then anyone who writes or approves change controls, deviations and validation protocols: production, engineering, quality control and regulatory affairs.
Is the course certificate an ICH Q9 certification?
The certificate records that a named person completed the course and its questionnaires, with hours, guideline version and date. It is evidence of training for your auditor. It is not a professional qualification or an accreditation.
Other guides
- ALCOA plus: data integrity in pharma, explained
- eCTD modules explained: the five-module structure
- EMA training: how the European Medicines Agency works
- GMP inspection checklist: what EU and FDA inspectors check
- Good clinical practice certification: what GCP training proves
- ICH Q10 pharmaceutical quality system, explained
- Lead auditor certification for GMP: what auditors really need
- Market access training for pharmaceutical teams: pricing, HTA and tenders
- OOS investigation in pharma: phases, flowchart and report
- Pharmaceutical sales certification: CNPR and B2B supplier sales
- Regulatory affairs certification: RAC, courses and what employers check
- Training in pharmacovigilance: course fee, certificate and what to learn
- What is a qualified person in the pharmaceutical industry?
- What is CAPA certification? Meaning and what CAPA training covers
- What is GMP certification? Meaning, EU certificate and written confirmation