ICH Q9 Revision 1 and the end of risk management theater

ICH Q9 has required a quality risk management system in every regulated organization since 2005. The system isn't new, the training decks aren't new, and the language is familiar to anyone who has sat through a risk assessment review. And still, between 30 and 40% of repeat inspection findings trace back to risk management done wrong, not missing, just done in a way that satisfies the requirement without producing anything defensible.

ICH Q9 Revision 1 names the failure mode directly. The industry had fallen into a pattern of over-complex FMEAs, inconsistent scoring, and risk classifications that settle on medium regardless of input. A scoring model that produces the same output regardless of the input has stopped functioning as an assessment and started functioning as a formality.

What "everything is medium" actually costs

A medium-risk classification is supposed to mean something specific: enough concern to warrant attention, not enough to demand it immediately. When most findings settle there anyway, the classification stops carrying information. It tells an auditor nothing about how the organization actually thinks about risk, and it tells the practitioner even less. There's no indication of where to spend the next hour of attention, no defensible logic for why one risk was controlled and another was accepted, and no way to tell a genuine near-miss from routine noise.

This is precisely the pattern ICH Q9 Revision 1 was written to correct. The revision doesn't introduce new obligations so much as make explicit what effective risk management already required: proportionality, consistency, and a documented rationale that someone outside the room could follow.

What risk management done correctly produces

Done properly, quality risk management delivers three things that a documentation-only exercise never does.

It concentrates effort on what affects patient safety, instead of spreading equal attention across risks that carry unequal consequences. It creates a defensible audit trail for every scope decision and test strategy choice, so the reasoning survives contact with a second reviewer, a new hire, or an inspector. And it builds institutional decision quality capability: each subsequent assessment gets faster, more consistent, and easier to defend across the portfolio, because the organization has practiced making the distinction that counts instead of filling in the same form every time.

None of this requires new tooling. It requires treating the assessment as an input to a decision rather than a deliverable in its own right.

Risk management as a working language, not a one-time checkpoint

Good risk management practice treats communication and review as ongoing obligations, not steps that end once the initial score is assigned. Findings need to travel between quality, operations, and the people with the authority to act on them, through the formal channels and the informal ones. And the review doesn't stop at sign-off: new information, a process change, or a change in operating conditions should trigger a fresh look at whether a previously accepted risk is still acceptable.

An organization running "everything is medium" scoring can't do any of this well, because there's nothing specific enough in the record to revisit. A defensible assessment can be reopened on purpose, with a documented reason, by someone who wasn't in the original room. A form filled in to satisfy a requirement can only be refiled.

The corrective discipline, not the beginner one

There's a tendency to treat risk management fundamentals as material a practitioner learns once, early, and moves past. In practice, the fundamentals are where the correction has to happen. An organization that has scaled a validation program, a change control process, and a CAPA system on top of "everything is medium" scoring hasn't built a mature risk program. It has built a large one, sitting on a foundation that was never load-bearing.

That's a harder fix than it sounds, because the shaky version still technically passes. A risk assessment with a medium score in every cell doesn't fail an audit on its own. It fails later, in the repeat finding eighteen months on that traces back to a decision nobody can now reconstruct.

Fixing the fundamentals means being willing to slow down a process that appears to be working, in order to make sure the assessments underneath it are doing what they're supposed to do: giving someone with the authority to decide a defensible basis for a decision, not just a form for the file.

Where this shows up first

The pattern is visible before the next inspection ever happens. Three symptoms surface earliest, and most reliably. Risk registers where the same three or four scores account for nearly every line, regardless of how different the underlying hazards are. CAPAs that reference "the risk assessment" as justification without anyone being able to explain, on request, why a specific score was assigned. And repeat findings that cite the same root cause across unrelated systems, which points to the scoring model itself, not the systems, as the common factor.

None of these require a new audit to surface. They show up the first time someone asks a risk owner to walk through the logic behind a specific score, in real time, without the original document in front of them. If the answer is fluent, the assessment was probably built to be used. If the answer is a restatement of the form, it wasn't.

What would your organization's risk assessments show if someone pulled the file and asked why, not what?