236: ICH Q9: Quality Risk Management (QRM) + ISO 14971 Differences

ICH Q9 is one of the most referenced guidelines in pharma and one of the most misunderstood.

In this video, I break down what Quality Risk Management (QRM) actually is, how the process works, and how it’s different from ISO 14971.

We cover:

What “risk” means in ICH Q9 (probability × severity)

The full QRM process (initiation → assessment → control → communication → review)

How to actually think through risk (not just document it)

Why supply disruption is a patient risk

Key differences vs ISO 14971 (planning, traceability, verification)

If you work in pharma, devices, or combination products, this is foundational.

TIMESTAMPS

00:00 Welcome to ICH Q9

00:48 What is Risk in ICH Q9

01:44 Scope and Core Principles

03:21 Initiating QRM

05:09 Risk Assessment (Hazards, Likelihood, Severity)

07:27 Risk Control (Reduction and Acceptance)

08:46 Risk Communication and Review

10:04 ICH Q9 vs ISO 14971

11:51 Wrap Up

ICH Q9(R1) Final Guideline: https://database.ich.org/sites/default/files/ICH_Q9-R1_Guideline_Step4_2023_0118.pdf

ICH Q9 Briefing Pack: https://ich.org/page/q9r1-briefing-pack

Subhi Saadeh is the Founder and Principal at Let’s Combinate, where he helps teams develop and control drug-device combination products by aligning quality systems, development, and regulatory expectations across drug and device domains. He is a consultant, auditor, trainer, and speaker with experience across companies including Pfizer, Gilead, and Baxter, supporting the development and launch of combination products across vaccines, biologics, and generics, including leading and supporting combination product transformations across large organizations.