Change Country
-or-
By John Lafferty, Life Sciences Programme Director at SQT Training Ltd.
Read time: 5 minutes
The 2023 revision of ICH Q9 (R1) Quality Risk Management guideline brought several clarifications and enhancements to the way the pharmaceutical industry should approach risk management.
In this article, we look at one key change – the requirement for hazard analysis and what this means for risk management in the pharmaceutical industry.
The update to ICH Q9 (R1) formally introduces a new first step in pharmaceutical risk management – hazard identification. By clearly defining;
companies can strengthen their risk management process, improve risk control and enhance patient safety.
Topics
Among the changes to ICH Q9 contained in revision R1, one stands out immediately; the shift from Risk Identification to Hazard Identification. Figure 1 below (source ICH Q9) shows that the first step of Risk Assessment is now Hazard Identification whereas previously this was Risk Identification.
Figure 1: Typical Risk Management Process
This is not simply a linguistic change. It reflects a more fundamental clarification of how we understand and manage risk. Whilst this is just one of several important updates in ICH Q9 (R1), it is foundational — because if hazards and their importance are not clearly understood, then deficiencies in risk management may occur which in turn could lead to increased patient risk.
ICH Q9 defines a hazard as a potential source of harm, this definition is taken from ISO/IEC Guide 51. A hazard is always a noun, a thing, that can cause harm, harm to our patients’ health and wellbeing, in this case.
Examples of Hazards are chemicals, impurities, sharp edges, pathogens, viruses etc. Our product could be a hazard; if a patient receives too much of our drug, that could cause a deterioration of their health or wellbeing.
Software is not a hazard; software cannot harm directly; however, software could cause a situation where our product is not manufactured correctly, in that case it is the adulterated product that is the hazard, not the software. Wear and tear of our equipment is not a hazard, but metallic particulate that results from that wear is most certainly a hazard. In this case, equipment wear is what is known as a failure mode. Likewise, the hazard should not be confused with the harm; the harm is the injury or deterioration in health, the hazard is the thing that caused that injury or health deterioration.
In everyday life, we do not really need to be very clear about these distinctions, but in order to carry out rigorous risk management, having clarity around the different elements of risk is quite important.
Pharmaceutical Quality Risk Management and ICH Q9 Training Course with SQT Training
A fundamental principle of risk management is that harm can only occur if there is exposure to a hazard.
Therefore, we need to identify the hazards that the patient could potentially be exposed to and take whatever measures are necessary to prevent such exposure taking place. Any situation that leads to a human being potentially exposed to a hazard is known as a hazardous situation. The relationship between the hazard, the hazardous situation, and the harm is shown in Figure 2 below.
Figure 2: Relationship between the Hazard and the Harm
The change to the hazard, hazardous situation and harm risk model brings ICH Q9 into line with other risk management guidance and standards such as ISO 14971:2019 Risk Management for Medical Devices. Using this model has proven to make risk management more effective by ensuring that all potential hazards are identified and that multiple means are employed to break the relationship between the hazard and the harm. This can be done in a number of different ways, for example by;
Hazard identification focuses on documenting the things that inherently have potential to cause harm. This forms the starting point of Risk Analysis. Techniques that can be used for hazard identification include;
Traditional risk identification involves identifying failure modes as the starting point for risk analysis, using techniques such as brainstorming and Failure Modes and Effects Analysis (FMEA), which we will continue to do under ICH Q9 (R1) but with the additional first step of hazard identification.
Why is this a better way to conduct risk management?
In addition to the reasons outlined above, beginning with hazard identification promotes critical thinking about risk, and brings greater focus to the risk management goal which is to prevent humans being exposed to hazards and suffering harm as a consequence.
To comply with ICH Q9 (R1), pharmaceutical companies must:
Our highly interactive one-day ICH Q9 training course takes you through the entire risk management process with particular focus on the latest requirements of ICH Q9 (R1). The training also takes you through risk management techniques such as Preliminary Hazard Analysis (PHA) and Hazard and Operability (HazOp) and Failure Modes and Effects Analysis (FMEA) using real industry examples.
Places are still available on our upcoming public training course on 14th May 2026.
This training is also available on an In-Company basis and can be tailored to meet your specific training needs and requirements. The In-Company training can be tailored to align with your internal procedures and processes and examples from your workplace can be incorporated into the training. We can also offer you feedback on your risk management procedure during the training, if required.
About John Lafferty
Categories
ArchiveSign up to receive the latest industry and company news direct to your inbox.
2026