ICH Q9 quality risk management now shapes a USFDA inspection twice. First, CDER decides which drug sites to inspect with a risk-based Site Selection Model, as FD&C Act section 510(h) requires.[1] Then, on site, investigators judge whether your quality decisions follow a working QRM system. The current text is ICH Q9(R1), which FDA issued as guidance in May 2023.[2]
For Indian plants there is a second driver. Revised Schedule M (G.S.R. 922(E), 28 Dec 2023) made a pharmaceutical quality system and QRM a legal requirement.[3] FDA is also widening unannounced inspections of foreign sites, building on its India and China pilot.[4]
The FDA has moved from inspecting every site on a fixed routine to choosing sites, and inspection depth, by risk. That shift began with the agency’s Pharmaceutical CGMPs for the 21st Century initiative, launched in 2002 with its final report in September 2004.[5] This guide explains how sites are picked, what ICH Q9(R1) changed, and what an investigator expects to see. It ends with what this means for Indian manufacturers now under Revised Schedule M.
How USFDA chooses which drug sites to inspect
The legal basis is section 510(h) of the FD&C Act. After the 2012 FDASIA amendments, it requires drug establishments to be inspected on a risk-based schedule, not at a fixed interval.[1] CDER puts this into practice through its Site Selection Model (SSM), described in MAPP 5014.1 (Rev. 1, effective 26 June 2023). The model ranks sites for routine surveillance inspection and produces a prioritised Site Surveillance Inspection List.[1]
| SSM risk factor | What it captures |
|---|---|
| Site type | The kind of operation, such as finished-dosage manufacture, API, or testing |
| Time since last surveillance inspection | Sites not seen for longer move up the list |
| FDA compliance history | Outcomes of previous FDA inspections and regulatory actions |
| Country or region compliance history | Compliance record of the country or region where the site sits |
| Foreign regulator inspection history | Inspections by other trusted authorities |
| Patient exposure | How much product from the site reaches US patients |
| Hazard signals | Field Alert Reports, MedWatch reports and recalls |
| Inherent product risk | Dosage form, route, sterility, API load, biologic status, therapeutic class and index, emergency-use status |
Scroll the table sideways to see both columns.
Source for all eight factors: MAPP 5014.1 Rev. 1, section 2.2.[1]
What changed in 2025. On 6 May 2025 FDA announced wider use of unannounced inspections at foreign sites making medicines for the US market. Until then, foreign sites usually had weeks of notice. FDA also said it can act against firms that delay, deny or limit an inspection.[4] For an Indian site, this means risk files must be current every day, not cleaned up before a scheduled visit.
For the inspection itself, see our USFDA pre-approval inspection (PAI) checklist.
ICH Q9 quality risk management: the four components
ICH Q9 defines QRM as a systematic process for the assessment, control, communication and review of risks to quality across the product lifecycle. It begins with an initiation step, then runs through those four components.[2] The guideline names example tools in Annex I, including FMEA, FMECA, FTA, HACCP, HAZOP and PHA. It mandates none of them, and it says no single tool fits every situation.[2]
| QRM component | What ICH Q9(R1) asks for | What an investigator typically looks for |
|---|---|---|
| 1. Risk assessment | Risk identification, analysis and evaluation against defined criteria | A scientific basis for the hazards listed, and data behind the scores |
| 2. Risk control | Risk reduction to an acceptable level, or a documented decision to accept residual risk | Controls that match the size of the risk and actually work in practice |
| 3. Risk communication | Sharing risk information and decisions among stakeholders, including regulators where needed | A traceable rationale for decisions such as batch disposition or validation scope |
| 4. Risk review | Reviewing outputs as new knowledge and experience arrive | Assessments that are reopened after deviations, OOS results, CAPAs and major changes |
Scroll the table sideways to see all three columns.
The third column reflects practitioner experience of inspections. It is not FDA text.
What ICH Q9(R1) changed, and when
- 2005Original ICH Q9 reaches Step 4.
- 18 Jan 2023Q9(R1) endorsed by the ICH regulatory members (Step 4).[6]
- 4 May 2023FDA announces the final Q9(R1) guidance in the Federal Register; the guidance is dated May 2023.[6]
- 26 Jul 2023Q9(R1) comes into effect in the EU (EMA/CHMP/ICH/24235/2006).[7]
There has been no further revision since. A “2025 update” of ICH Q9 does not exist. The revision addressed six topics: subjectivity, formality, risk-based decision-making, product availability, hazard identification and risk review.[8] Three of them change day-to-day inspection readiness most.
A. Degree of formality is a spectrum, not two boxes
Q9(R1) states plainly that formality in QRM is not a binary formal/informal choice. It runs from low to high, and three factors set where an activity should sit: uncertainty, importance and complexity.[2] The guidance also says resource constraints should not be used to justify a lower level of formality.[2]
| Factor | Pushes toward higher formality | Allows lower formality |
|---|---|---|
| Uncertainty | Little knowledge about hazards, such as a new dosage form or an unexplained OOS | Well understood; the team can readily say what can go wrong |
| Importance | High impact on product quality, such as a critical deviation or major change | Low impact, such as a minor change with no quality effect |
| Complexity | Complex process or system, such as a new manufacturing line | Simple, well-characterised process |
Scroll the table sideways to see all three columns.
Practical step: write a QRM procedure that sets out how your site decides the level of formality. It should define team make-up, tool choice and documentation for each level. The typical failure is the same heavy FMEA for every change, or a short note for a sterile-process change.
B. Subjectivity in risk scoring
Q9(R1) accepts that subjectivity cannot be removed entirely. It asks firms to control it by addressing bias and assumptions, using tools properly and basing estimates on relevant data.[2]
Many sites score risk with the FMEA Risk Priority Number (Severity × Occurrence × Detectability). Note that the RPN is a convention of the FMEA tool, not an ICH Q9 requirement. Whichever method you use, keep defined, written rating scales applied the same way across departments. Use cross-functional teams, and tie each probability score to real failure or trend data.
C. Product availability and supply risk
The revision states that quality and manufacturing problems, including GMP non-compliance, are a significant cause of product availability issues.[2] It points to three areas that affect supply reliability: process variability and state of control, facilities and equipment, and oversight of outsourced activities and suppliers.[2] In practice, include single-source critical materials and bottleneck equipment in your risk assessments. Treat a supply interruption as a real severity outcome.
Knowledge management: what makes QRM objective
ICH Q10 names knowledge management and QRM as the two enablers of a pharmaceutical quality system.[9] O’Donnell and Kartoglu, reviewing 15 years of QRM practice, argue that QRM is only as good as the knowledge fed into it.[10]
| Knowledge input | How it feeds QRM |
|---|---|
| Product quality review trends | Sets probability scores from actual failure and trend data |
| Post-approval change history | Flags processes that have changed often and need a fresh assessment |
| Deviation and CAPA effectiveness data | Shows, at risk review, whether controls reduced risk as predicted |
| Development studies (QbD) | Gives the scientific basis for severity and for CQAs and CPPs |
Scroll the table sideways to see both columns.
Using QRM to drive inspection outcomes
| Use | How QRM shapes it | What to be able to show |
|---|---|---|
| CAPA prioritisation | CAPAs tied to the highest-rated risks are resourced and closed first | A documented link from each CAPA to the risk assessment that set its priority |
| Response to a Form 483 or Warning Letter | Risk assessment sets the scope and timeline of remediation | Each commitment traced back to the risk it reduces, and the residual risk after it |
| Process validation scope | Risk decides which steps are critical and need the most sampling and testing | Validation effort that matches the CQAs and CPPs your assessment identified |
Scroll the table sideways to see all three columns.
If you are already responding to an inspection, see our 15-business-day Form 483 response checklist. For an escalated case, see the Warning Letter response and close-out plan.
Common QRM pitfalls seen in practice
These four patterns come from audit and inspection experience. They are not ranked by any FDA statistic.
- Assessments filed and forgotten. A risk assessment is written once and never reopened. Fix: make risk review a required step in change control, deviation closure and CAPA effectiveness checks.
- Scores without data. “Medium” is assigned because it feels right. Fix: back every probability and severity rating with complaint, failure or trend data.
- Formality that does not match the risk. A short brainstorm is used to assess a high-risk system, such as electronic records. Fix: apply your formality criteria; see our 21 CFR Part 11 clause-by-clause guide for electronic records.
- Residual risk accepted silently. High residual risk is accepted with no written rationale or sign-off. Fix: set acceptance criteria and an escalation path to senior management.
For the observations FDA cites most often, see the 10 most-cited USFDA 483 observations.
Revised Schedule M makes QRM a legal requirement in India
Revised Schedule M was notified as G.S.R. 922(E) on 28 December 2023. Among its new elements are a pharmaceutical quality system, quality risk management and product quality review.[3]
- Large manufacturers (turnover above Rs 250 crore) had six months, to 28 June 2024.[3]
- MSMEs (turnover up to Rs 250 crore) that applied with an upgrade plan had until 31 December 2025.[11]
- On 7 November 2025 the DCGI asked all state and UT drug controllers to inspect units for compliance, starting immediately for MSMEs that had not applied. States must report inspection findings monthly.[12]
Revised Schedule M is therefore in the enforcement phase; this is not a future deadline. A site that exports to the US now answers to two inspectorates. Both expect the same thing: one QRM system that sets formality by risk, scores from data, and reopens assessments when knowledge changes. Build it once, to the ICH Q9(R1) standard, and it serves the state drug inspector and the FDA investigator alike.
For what else the revised schedule requires, read our deep dive into Revised Schedule M.
Check where your plant stands on Revised Schedule M
Use the 12-area readiness self-check, deadline table and enforcement updates on the Laafon compliance dashboard.
Frequently asked questions
Not from one QRM document. Investigators follow real decisions, such as a batch release after a deviation, a change control or a CAPA, and check whether a documented, data-based risk rationale drove each one. Risk assessments that were reopened when new information arrived are strong evidence. So is management that resources formal QRM where risk is high.
It can support the case, using knowledge-management data and process verification data that show consistent control. It cannot replace the regulatory route. For an approved US application, a change to specifications or testing is a post-approval change under 21 CFR 314.70. The reporting category depends on the change, from prior-approval supplement to annual report.[13]
FDA does not publish a ranking of QRM deficiencies, so treat this as practitioner experience. A frequent weakness is broken risk review. A CAPA is implemented, but the original assessment is never updated. If the CAPA then fails, the recorded risk is wrong and nobody sees it.
Related on laafon.com
References
- U.S. Food and Drug Administration, Center for Drug Evaluation and Research. MAPP 5014.1 Rev. 1: Understanding CDER’s Risk-Based Site Selection Model. Silver Spring (MD): FDA; 2023 (effective 26 Jun 2023). Available from: https://www.fda.gov/media/116004/download. Accessed October 2026.
- U.S. Food and Drug Administration. Q9(R1) Quality Risk Management: Guidance for Industry. Silver Spring (MD): FDA; May 2023. Available from: https://www.fda.gov/media/167721/download. Accessed October 2026.
- Central Drugs Standard Control Organisation (Joint Drugs Controller, India). Regulatory Reforms in India [presentation]. Mumbai: Indian Pharmaceutical Alliance; 2024. Available from: ipa-india.org (PDF). Accessed October 2026.
- U.S. Food and Drug Administration. FDA Announces Expanded Use of Unannounced Inspections at Foreign Manufacturing Facilities [press release]. Silver Spring (MD): FDA; 6 May 2025. Available from: fda.gov press announcement. Accessed October 2026.
- U.S. Food and Drug Administration. Pharmaceutical Quality for the 21st Century: A Risk-Based Approach. Progress Report. Silver Spring (MD): FDA; May 2007. Available from: fda.gov progress report. Accessed October 2026.
- Food and Drug Administration. International Council for Harmonisation; Q9(R1) Quality Risk Management; Guidance for Industry; Availability. Federal Register. 2023 May 4;88(86). Docket No. FDA-2022-D-0705. Available from: govinfo.gov. Accessed October 2026.
- European Medicines Agency. ICH guideline Q9 (R1) on quality risk management. EMA/CHMP/ICH/24235/2006 Corr.2. Amsterdam: EMA; 2023 (in effect 26 Jul 2023). Available from: ema.europa.eu (PDF). Accessed October 2026.
- Mahoney S. Overview of Changes: ICH Q9(R1) Quality Risk Management [presentation]. SBIA Joint US FDA – Health Canada ICH Public Meeting; 22 Feb 2024. Available from: https://www.fda.gov/media/177720/download. Accessed October 2026.
- U.S. Food and Drug Administration. Q10 Pharmaceutical Quality System: Guidance for Industry. Silver Spring (MD): FDA; April 2009. Available from: fda.gov guidance page. Accessed October 2026.
- O’Donnell K, Kartoglu U. QRM, Knowledge Management, and the Importance of ICH Q9(R1). Pharmaceutical Technology. 2024;48(7):20-31. Available from: pharmtech.com. Accessed October 2026.
- CliniExperts. Extension of timeline for compliance with Revised Schedule M for small and medium drug manufacturers [regulatory update; secondary source]. 2025. Available from: cliniexperts.com. Accessed October 2026.
- Press Trust of India. DCGI orders inspections of pharma units to ensure compliance with revised Schedule M norms [news wire; secondary source]. The Week. 10 Nov 2025. Available from: theweek.in. Accessed October 2026.
- Code of Federal Regulations. Title 21, Section 314.70: Supplements and other changes to an approved NDA. Washington (DC): eCFR. Available from: ecfr.gov. Accessed October 2026.
