ICH Q9 Training: Quality Risk Management to ICH Q9(R1)

Opens with a self-check: what is a hazard, how is it different from a risk, and who decides a risk is acceptable and how is that recorded? Presents three recent FDA cases: an August 2025 letter to Amneal Pharmaceuticals, whose risk assessment played down the severity of particles in an epidural injection to justify releasing batches; a November 2025 letter to Catalent Indiana, a sterile filling site where risk conclusions were not followed; and a September 2026 letter to Fresenius Kabi about a sterile injectables site in Illinois where decisions rested on test results alone. Explains quality risk management as a systematic, science-based process with effort matched to risk. Introduces LMN Pharma GmbH in Frankfurt, which makes sterile injectables by aseptic processing. Ends with the course structure, the filled-in documents you will see, and a recap.

What you will be able to do

• Explain what quality risk management is and why effort follows risk
• Describe how biased or ignored risk work led to FDA warning letters
• Tell a hazard apart from a risk

Why it matters

None of these cases was about a missing form; seeing how risk work failed shows what makes your own risk decisions defensible.

Practice: Practice: Welcome: why quality risk management matters · 3 questions

Starts with how FDA described the revision when it published the final guidance in May 2023: a targeted revision addressing product availability risks, the meaning of formality, risk-based decision-making and subjectivity. Explains the guideline's history and that Q9(R1) was adopted in January 2023. Covers its two principles, science linked to protecting the patient and effort in proportion to risk, and the key words hazard, harm, risk and severity, with glass fragments forming in antibiotic vials during filling as an example. Then shows where QRM sits as an enabler of the quality system in Q10 and how it is built into EU GMP, including Annex 1 for sterile products. Shows the outline of LMN Pharma's QRM procedure, the common mistake of filling in QRM after a decision is made, a simple test and a recap.

What you will be able to do

• Describe what the 2023 revision of ICH Q9 added
• Apply the two principles of quality risk management
• Define hazard, harm, risk and severity correctly

Why it matters

QRM done after a decision is already made protects nobody; the principles show how to make it shape the decision.

Practice: Practice: ICH Q9(R1) at a glance · 3 questions

Opens with the September 2026 letter to the sterile injectables site in Illinois, where investigations lacked data-supported root causes and relied on acceptable final test results, and batches released this way were later recalled. Explains the QRM model, from initiation through assessment, control and review, with communication throughout and decisions at any point. Covers responsibilities: teams bring the knowledge, and decision makers bring the competence and authority and manage subjectivity. Then shows how LMN Pharma applies section 4.2 to start a process well: a risk question and its assumptions, background data, a leader and resources, and a timeline with a decision level, contrasting a vague question with a precise one. Includes an eye-drop maker in Tokyo changing its preservative supplier. Ends with a simple test you can run today and a recap.

What you will be able to do

• Write a clear risk question with its assumptions
• Assign the team, leader, resources and decision level for a QRM process
• Explain the responsibilities of teams and decision makers

Why it matters

Asking the right question before answering it stops a risk assessment from proving whatever the team already believed.

Practice: Practice: Starting well: roles and initiating QRM · 3 questions

Starts with another finding from the September 2026 letter: routine filling-line interventions, such as adding stoppers and loading vials, were not documented, so their risks were not properly assessed. Explains the three fundamental questions: what might go wrong, how likely is it, and how bad would it be. Covers the three steps of risk assessment: hazard identification, risk analysis, and evaluation against criteria set in advance. Shows how LMN Pharma applies this with scales whose every level is defined in words, why detectability needs careful thought in a sterile plant, and how to state assumptions and show uncertainty from gaps in knowledge and process understanding. Includes a tablet maker in Toronto assessing strength mix-ups on its packaging line. Ends with a situation at LMN Pharma, a recap and a practice exercise assessing the risks of shipping chilled syringes.

What you will be able to do

• Apply hazard identification, risk analysis and risk evaluation
• Write scoring scales with every level defined in words
• Record assumptions and uncertainty behind each score

Why it matters

The output is only as good as the data; showing where every score comes from makes your assessment hold up to an inspector.

Practice: Practice: Risk assessment, step by step · 3 questions

Opens with two letters already met: at the Indiana filling site in November 2025, an atypical intervention of a kind the firm's own risk assessments advised against was linked to contamination, and FDA asked for high-risk interventions to be eliminated or redesigned. Explains risk control: reducing risk to an acceptable level, checking controls for new risks, and recording any acceptance as an informed decision. Shows how LMN Pharma applies this to its filling Line 2. Covers risk communication at any stage, with the output communicated and documented so it reaches the people who act. Then covers risk review after planned and unplanned events, at a frequency based on the risk, with a vaccine filler in Singapore replacing a manual loading step with a robot. Ends with a situation at LMN Pharma, a simple test and a recap.

What you will be able to do

• Reduce a risk and check the controls for new risks
• Record risk acceptance as an informed decision
• Plan risk review after planned and unplanned events

Why it matters

Decide, tell and look again; risk conclusions that never reach the filling line are what FDA cited at the Indiana site.

Practice: Practice: Risk control, communication and review · 3 questions

Starts with what FDA asked for when formality was missing: investigations without formal documentation at the Illinois site, and full, independent risk assessments of all contamination hazards requested in the 2025 and 2026 letters. Explains formality as a spectrum from low to high, not a choice between formal and informal, and the three factors that decide it: uncertainty, importance and complexity. Shows how LMN Pharma applies section 5.1, with four examples, and why lower formality means the same care in a lighter form. Covers writing the approach into the quality system, scores resting on evidence, and why resource limits never justify lower formality. Contrasts a tablet maker in Toronto handling routine changes with low formality and a biotech start-up in Boston using a facilitated FMEA. Ends with a situation at LMN Pharma, a quick check and a recap.

What you will be able to do

• Place a risk question on the formality spectrum
• Use uncertainty, importance and complexity to set formality
• Write a formality approach into your QRM procedure

Why it matters

Less formal never means less robust; matching formality to the question puts effort where it counts and saves it elsewhere.

Practice: Practice: How much formality? · 3 questions

Returns to the August 2025 letter about particles in an injection, where the firm's risk assessment, and later its health hazard assessment, minimised the severity of particles in a product that can be given into the epidural space. Explains where subjectivity comes from: bias, perception, and poorly defined questions and scales. Shows how LMN Pharma applies section 5.3, including its safeguard that everyone scores alone, in writing, before anyone speaks. Covers controlling subjectivity by addressing bias and assumptions, using tools properly and maximising data and knowledge. Then explains the three ways to structure a risk-based decision, highly structured, less structured or rule-based, shown in a highly structured decision on whether to restart Line 2 and an API maker in Mumbai deciding by rule. Ends with a situation at LMN Pharma, a simple test and a recap.

What you will be able to do

• Recognise bias and perception in risk scoring
• Apply safeguards such as independent scoring before discussion
• Choose a highly structured, less structured or rule-based decision

Why it matters

Show the evidence, not just the verdict; controlling subjectivity is how you avoid playing down a severe patient harm.

Practice: Practice: Subjectivity and risk-based decisions · 3 questions

Opens with a request in the September 2026 letter: an updated plan to move production from certain aseptic filling lines without creating drug shortages, and a list of backup contract manufacturers. Explains that the revised guideline treats availability as part of risk to quality, since harm includes damage from loss of availability. Covers the three named factors that threaten supply: process variability and control, facilities and equipment, and oversight of suppliers and outsourced work. Shows how LMN Pharma applies section 6.1, with part of its availability risk register for an antibiotic, reviewed by management every quarter, and its preventive measures one by one. Then covers the quality system as an early warning system that never trades away safety, with a plasma products firm in Sydney upgrading an ageing line in stages. Ends with a simple test and a recap.

What you will be able to do

• Explain why loss of availability counts as harm in ICH Q9
• Identify the three factors that threaten supply
• Build an availability risk register with preventive measures

Why it matters

Seeing supply risks before patients do lets you plan line changes and supplier gaps without causing a shortage.

Practice: Practice: Product availability and shortage risks · 3 questions

Starts with what FDA asked the Indiana filling site to do in November 2025: a retrospective review of routine and atypical interventions, eliminating high-risk ones and redesigning any with unacceptable contamination risk. Explains the basic facilitation methods, flowcharts, check sheets, process maps and fishbone diagrams, shown as LMN Pharma's team walks the real line with a flowchart and marks every point where a person intervenes. Covers FMEA, which breaks a process into steps and evaluates how each can fail, the effects and causes, relying on product and process knowledge and established specifications. Then covers FMECA, which adds severity, probability and detectability to rank failure modes, and why severity is read first so totals never hide a severe harm. Includes a vaccine filler in Singapore and a situation from LMN Pharma's FMEA. Ends with a recap and a practice exercise.

What you will be able to do

• Use flowcharts and fishbone diagrams to organise risk data
• Build an FMEA for a process step by step
• Rank failure modes with FMECA, reading severity first

Why it matters

Choosing the right tool and reading severity first stops a high total score from hiding the harm that matters most.

Practice: Practice: Tools 1: basic methods, FMEA and FMECA · 3 questions

Opens with the September 2026 letter's investigations that stopped at the first plausible cause and were not expanded to all affected products. Explains fault tree analysis, which works backwards from a failure through AND gates and OR gates to root causes, shown in a fault tree LMN Pharma drew after a retained anticoagulant sample failed an endotoxin test. Covers HACCP, HAZOP and preliminary hazard analysis, which work forwards from hazards using critical control points, guide-words and early ranking, with a contract manufacturer in Chicago running a HAZOP on a solvent transfer line. Then shows risk ranking and filtering, with weighting factors and cut-offs, applied to plan LMN Pharma's supplier audits, ranking a stopper maker, a vial maker in Paris and a carton printer, and supporting statistical tools. Ends with a situation at LMN Pharma, a simple test and a recap.

What you will be able to do

• Draw a fault tree with AND and OR gates to find root causes
• Explain when to use HACCP, HAZOP or preliminary hazard analysis
• Apply risk ranking and filtering to compare unlike risks

Why it matters

The question chooses the tool; a fault tree finds the other paths to a failure that a one-batch investigation misses.

Practice: Practice: Tools 2: FTA, HACCP and risk ranking · 3 questions

Starts with the August 2025 letter: a firm rejected batches of a sterile product after tracing visible fibres to plastic bags, then kept using the bags without corrective and preventive action. Explains that the effort and formality of an investigation should match the risk, as ICH Q10 says in line with Q9, so deviations are classified by risk first. Covers deciding the scope with data, looking for the root cause and human factors, and never closing an investigation on an acceptable final test alone. Shows how LMN Pharma applies this, including a draft deviation report and a tablet maker in Toronto handling an out of specification dissolution result. Then covers CAPA that addresses the cause, effectiveness checked with data, and updating the risk assessment. Ends with a simple test, a recap and a practice exercise writing a risk-based deviation record.

What you will be able to do

• Classify a deviation by risk before investigating
• Set the scope of an investigation using data
• Check CAPA effectiveness with data and update the risk assessment

Why it matters

Close the cause, not just the record; rejecting a batch while keeping the cause in place guarantees the problem returns.

Practice: Practice: QRM in deviations, investigations and CAPA · 3 questions

Opens with the August 2025 letter, where a firm relaxed its visual inspection defect limits to keep using poor-quality bags from one supplier, which FDA called unacceptable. Explains how QRM evaluates every proposed change, including its impact on quality and availability, and evaluates it again after implementation. Shows LMN Pharma's assessment for a new stopper feed on Line 2, covering a two-week stop planned with stock built in advance and confirmation that no filing change is needed. Covers QRM setting the scope and extent of validation and separating critical from non-critical steps, risk-based supplier oversight with events that trigger more oversight, and facility decisions tied together by the contamination control strategy on a sterile site, with a vaccine filler in Singapore changing its cleaning agent. Ends with a simple test, a recap and a practice exercise assessing a second API supplier.

What you will be able to do

• Assess a proposed change for quality and availability before approval
• Use QRM to set the scope of validation
• Adjust supplier oversight when risk signals change

Why it matters

Ask before you act, and check after; raising limits to fit a poor supplier is exactly the risk decision FDA rejects.

Practice: Practice: QRM in change, validation, suppliers, facilities · 3 questions

Starts with how regulators use quality risk management, as the guideline's second annex describes: to plan inspections, set their frequency and intensity, and judge the significance of quality defects, potential recalls and findings. Brings back the warning letters and the pattern they share: risk work that was biased, ignored or too narrow. Then walks through a worked review at LMN Pharma that follows one event from deviation to change control, finding missing formality records and an older change request form with no question about supply as system gaps. Gives a checklist of questions, such as whether scales are defined in words for the route and patients, and a road map that fixes what could affect patients first, with an owner and a date for each action, plus roles for production, engineering and quality control. Ends with a recap and the final exam.

What you will be able to do

• Explain how regulators use QRM to plan inspections and judge findings
• Run a QRM review from deviation to change control
• Apply the checklist and road map to your own site

Why it matters

Honest, used and complete risk work gives regulators greater assurance, and the worked review shows where to start.

Practice: Practice: Putting it together and the final exam · 3 questions