ICH Q9 on quality risk management was revised in 2023. The revision is short, and it is easy to read it and conclude nothing much changed. That would be a mistake. It responds directly to how risk management had been practised badly, and inspectors use it to challenge exactly those habits.
Why it was revised
The original Q9, from 2005, was sound. The problem was how it was used. Risk assessments became paperwork: scores chosen to reach a conclusion already decided, tools applied mechanically, and risk management used to justify doing less rather than to understand what mattered. The revision targets four areas where practice had drifted.
Subjectivity
Risk scores depend on judgement, and judgement can be biased. Q9(R1) asks organisations to recognise and reduce subjectivity, through better use of data, involving the right expertise, defining scales clearly and challenging assumptions.
In practice this means an FMEA where every severity score is three and every likelihood is two should raise questions. So should a risk assessment where the scores happen to land just below the action threshold. Our piece on the four factors for judging AI risk discusses the same problem in AI risk scoring.
Formality
Not every risk decision needs a full formal assessment. The revision makes clear that the level of formality should match the uncertainty, importance and complexity of the question. A simple, well-understood decision can be handled with a short documented rationale. A complex, uncertain one needs a structured method and a team.
This cuts both ways. It allows less paperwork for simple decisions, and it makes a thin assessment of a complex risk harder to defend.
Risk-based decision making
The revision adds guidance on how risk information should actually inform decisions, not just be documented alongside them. The question an inspector asks is: what did the risk assessment change? If the answer is nothing, because it was written after the decision was made, it was not risk management.
Product availability
The fourth change links quality risk management to supply. Quality problems that cause shortages are a risk to patients, and the revision expects that to be considered, for example in decisions about manufacturing changes, supplier choices and how deviations are handled.
Applying it to computerised systems
Q9(R1) applies to all quality risk management, including the risk assessments behind computer system validation. The same problems show up there: every function rated medium, scores chosen to justify a test strategy already decided, and assessments that never get revisited.
The fix is the same too. Use data where you have it, such as incident history or vendor defect rates. Keep simple decisions simple. And make the risk assessment visibly drive the testing: high-risk functions tested more deeply, low-risk ones less, with the reasoning written down. That is also the core of the CSA approach.
What to do about it
Look at a handful of recent risk assessments and ask honestly: were the scores supported by data, was the level of formality right for the question, and did the assessment change anything? Then update the risk management procedure to say how you address subjectivity and formality. Our guide to GxP risk assessment and our CSA services page cover how this applies to computerised systems.
Where to go next
Explore GxP Copilot for AI-native validation, TraceDraft for source-traceable clinical documentation, or book a demo to see either on your own data.