The 2023 revision of ICH Q9 on quality risk management — what changed, what the formality requirements mean in practice, and how to apply QRM principles effectively to pharmaceutical cannabis manufacturing.
ICH Q9 on Quality Risk Management was first published in 2005 and became the foundation for risk-based approaches to pharmaceutical quality across the industry. The 2023 revision — ICH Q9(R1) — introduced several important clarifications and a new emphasis on the appropriate formality of risk management activities.
The most significant addition in ICH Q9(R1) is the concept of "appropriate formality" — the principle that the degree of formality, documentation and rigour applied to a risk management activity should be proportionate to the level of risk involved. Not all risk management activities require a full FMEA.
ICH Q9(R1) establishes the framework for quality risk management across pharmaceutical development, manufacturing and distribution. It does not mandate specific risk management tools but provides a process: risk identification, risk analysis, risk evaluation, risk control, risk communication and risk review.
The guideline applies to all activities that affect product quality and patient safety — including cannabis manufacturing. It is referenced throughout EU GMP Part I and in specific annexes including Annex 1 (contamination control), Annex 11 (computerised systems) and Annex 15 (qualification and validation).
The most important conceptual change in R1 is the explicit statement that risk management activities should be conducted at a level of formality appropriate to the risk involved. The original Q9 guideline was sometimes interpreted as requiring full FMEA-style documentation for every risk management decision — an interpretation that led to burdensome processes without corresponding benefit.
R1 clarifies that routine, well-understood risks may be managed through established procedures without formal risk assessment documentation. Complex, novel or high-impact risks warrant more formal assessment. The level of documentation should reflect the significance of the decision.
R1 adds explicit guidance on the management of subjectivity and bias in risk assessment — recognising that risk scores can be influenced by organisational pressure, individual experience and cognitive biases. Recommendations include using multidisciplinary teams for significant risk assessments, documenting the basis for risk scores and seeking input from individuals outside the immediate project team.
R1 strengthens the requirements for risk communication — ensuring that risk management outputs are communicated to relevant stakeholders and that risk management decisions are made by individuals with appropriate authority and expertise.
Failure Mode and Effects Analysis (FMEA) is the most commonly used quantitative risk assessment tool in pharmaceutical manufacturing. It assigns numerical scores to Severity (S), Probability (P) and Detectability (D) of each failure mode, producing a Risk Priority Number (RPN = S × P × D) that prioritises risks for control.
In pharmaceutical cannabis manufacturing, FMEA is required in several specific contexts:
The RPN scoring approach has well-documented limitations — in particular, different combinations of S, P and D can produce the same RPN with very different actual risk profiles. R1 acknowledges this limitation and encourages organisations to consider S, P and D individually rather than relying solely on RPN as a ranking criterion.
Subscribe for new publications monthly.