Quality risk management has been a GMP expectation since 2006, but the revised ICH Q9(R1) — effective in the EU since 26 July 2023 — changed what doing it properly means. The revision added no new tools. It addressed the ways companies were misapplying the ones they already had. With the European Commission now revising Chapter 1 of the EU GMP Guide to align with it, those expectations are moving from guidance into the text inspectors cite.
The four weaknesses the revision targets
ICH reopened Q9 because regulators kept seeing the same failure patterns. The revision addresses four:
- Subjectivity in risk assessments and in the decisions that follow them
- Product availability risks arising from quality and manufacturing problems
- Lack of understanding of formality — how much process a given risk question actually warrants
- Lack of clarity on risk-based decision-making
The substantive changes sit in Chapter 5 on risk management methodology, Chapter 6 on integration into industry and regulatory operations, and Annex II.9 on quality risk management as part of supply chain control. The underlying cycle — assess, control, communicate, review — is untouched.
Formality is a continuum, not a switch
The most practically useful addition is the statement that formality is not binary. It runs from low to high, and the degree applied should be proportionate to three factors: the uncertainty surrounding the issue, its importance, and its complexity.
That cuts both ways. A low-uncertainty, low-complexity decision does not need a cross-functional FMEA workshop and a thirty-page report; documented reasoning in the change control record may be enough. Equally, a novel process with genuine scientific uncertainty is not adequately covered by a risk matrix filled in during a single meeting. Most quality systems we review err in one direction consistently — heavy formality applied uniformly, which exhausts the organisation and produces assessments nobody reads.
Subjectivity is managed, not removed
Q9(R1) is candid that subjectivity affects every stage of the process, particularly hazard identification and the estimation of probability and severity. It cannot be eliminated. It can be minimised by recognising bias and testing the assumptions behind scores.
In practice this means naming the assumptions in the assessment itself, involving people who will disagree, and avoiding scoring scales so coarse that every risk lands in the same band. An assessment whose conclusion was evident before the exercise began is not a control.
Availability of medicines is now a quality risk
The revision explicitly links quality failures to supply disruption. Facility and equipment problems, manufacturing variability and control strategy weaknesses are framed as risks to patients precisely because they interrupt supply. For companies supplying the Greek market, where shortages and parallel export pressures are closely watched, that framing aligns quality decisions with obligations already being tracked by national authorities.
Chapter 1 is where this becomes enforceable
The European Commission, working with the EMA GMDP Inspectors Working Group and PIC/S, consulted on a revised Chapter 1 of EudraLex Volume 4, with comments closing on 3 December 2025. The draft reflects Q9(R1) directly: stronger knowledge management, risk-based decision-making embedded in the pharmaceutical quality system, and proactive identification of risks to supply. Publication is expected to be followed by a transition period. Sites that treat Q9(R1) as a document already filed will find the gap surfacing at their next inspection.
How PQRA helps
- Gap assessment of your QRM procedures and templates against Q9(R1) and the revised Chapter 1 draft
- Designing proportionate formality tiers so effort matches uncertainty, importance and complexity
- Rebuilding risk assessments that state assumptions, address bias and survive challenge
- Linking quality risk management to supply continuity planning and shortage obligations
- Training quality and operations teams in risk-based decision-making that holds up under inspection
If your quality risk management still looks the way it did in 2022, now is the moment to revisit it. Contact PQRA to discuss a review of your QRM framework ahead of the Chapter 1 transition.
No responses yet