What did the ICH Q9(R1) revision change about formality and subjectivity in risk management?

Why

The original 2005 Q9 told companies to use risk management, but in practice many filled in FMEA scores that justified decisions already made. The revision tackled that. It keeps the two principles that risk evaluation rests on science and links to patient protection, and that effort, formality and documentation should match the level of risk.

It adds that formality varies along a continuum. Higher uncertainty, importance or complexity call for more formal work, such as a cross-functional team, a recognized tool and a documented report. Lower levels can rely on existing knowledge or rule-based decisions in SOPs.

It adds a section on subjectivity, which enters through bias, poorly defined risk questions and badly designed scoring scales. The fix is to address assumptions, use tools properly and use real data. It also notes that risk includes product availability, so supply disruption that harms patients counts as a quality risk.

For example, scoring a new cleaning agent as low risk because the team likes the vendor is subjectivity. Scoring it after looking at residue data from three sites is managed subjectivity. The revision does not provide a formula for how formal to be, so the judgement still sits with people, and low formality cannot be used to justify ignoring evidence.