Does quality risk management add value?

It is becoming evident that quality risk management within regulated, life sciences environments is a valuable component of an effective quality management system (QMS). A QMS provides a proactive and systematic means to identify, analyse, evaluate and control potential process and product quality issues during development, manufacturing, distribution and marketing throughout the entire product life cycle.

Medicinal products are required to be safe for patient use, but safety does not mean zero risk. There are only a few examples of the integrated and systematic use of quality risk management systems in manufacturing facilities, whereas the use of principles is effectively utilized in pharmacovigilance and by regulating agencies.

To further exemplify this obsolescent situation, GMP environments have lagged behind related industries in adopting risk management standards and guidance. For instance, industries manufacturing medical devices have deployed ISO 14971:200x, while food industries implement Hazard Analysis and Critical Control Points (HACCP). It is commonly agreed amongst pharmaceutical practitioners and industry stakeholders that risk management can appear both impractical and complicated; it may fail to generate value and even fail to mitigate risks. These opinions are supported by a lack of practical, harmonized guidance, and again it's an overall trade-off between reasonable risk, benefits and alternative options. When embarking on quality risk management within GMP environments, such as traditional pharma, there are useful lessons to be learned from the medical devices sector.

Before illustrating best concepts and practices from the medical devices sector using business-specific examples from the multinational company Coloplast A/S (which has an extensive product range within ostomy, urology and continence, and wound and skin care), it is worthwhile to address the question: 'Why quality risk management?' The answer:

• Huge amounts of data — data availability.

• Research/clinical data in separate, diverse systems

• Huge amounts of documentation.

• QMS

• Production records

• Documentation to support submissions

• Support of compliance.

Risk management advantages

Advantages of a risk-based QMS include:

• Scientific and data-driven processes that reduce subjectivity.

• The ability to prioritize risks according to fundamental patient safety and efficacy criteria.

• Improved, consistent and traceable decisions with a focus on high–medium risk areas.

• Improved transparency that builds reliability and trust with regulators and other stake holders.

With reference to the advantages mentioned above, ICH has stated the two primary principles of quality risk management as:

• The evaluation of the risk to quality should be based on scientific knowledge and, ultimately, link to the protection of the patient.

• The level of effort, formality and documentation of the quality risk management process should be commensurate with the level of risk.

Overall, it complies with the FDA 21st century GMP initiative, which seeks to integrate quality systems and risk management approaches into existing programs to ensure that risk-based scrutiny is related to the level of scientific understanding and the capability of process control strategies to prevent or mitigate the risk of producing a poor quality product.

Consistent interpretation and terminology

Interpretation and operational difficulties exist because of different life sciences verticals, as well as different standards and guidelines. A fundamental and first instance should be to use unambiguous, consistent terminology to ensure practical risk management, and risk management should also be the starting point of every project (change request, deviation). A well-defined, consistent approach to quality risk management (i.e., assessment, control and evaluation) is essential when defining practical and justifiable options in GMP environments.

Table 1 Risk assessment.

To be able to effectively use quality risk management as a practical (and value-adding) business tool, pharmaceutical professionals must become familiar with assessing harm to patients and acting accordingly. Experience from a large number of IT projects demonstrates that a relative assessment of risk is a better approach than a qualitative or quantitative assessment. Tables 1 and 2 list the relative concept and subsequent company-specific interpretation.

Table 2 Example of company-specific definitions and abbreviations of risk assessment.

Integration challenges

A quality risk management system should be integrated into existing operations and documented appropriately. A scientific and risk-based, case-by-case (scalable) approach should be encouraged within GMP environments, including the derivation of scientific-based acceptance criteria. An example of a risk assessment protocol from an IT project covering the user requirement specifications (URSs) is illustrated in Table 2, and Table 3 uses a qualified analysis of potential hazards to the final product.

Table 3 Example of company-specific risk assessment of requirements.

Recommendations

Quality risk management should not be used to over-complicate validation and documentation efforts; for instance, by deploying unnecessary complex and detailed risk assessments. Reducing the amount of validation by using mature, standard technology and a risk-based QMS means that the life sciences actor should:

• Rely on vendor audits.

• Use vendor standard documentation.

• Use vendor standard validation/qualification.

It is also necessary to:

• Ensure expert knowledge of products, processes and procedures are present (operational level, site, department).

• Encourage an open, risk-aware culture.

Conclusions

Pharmaceutical quality risk management is worth the effort, and best practices and experiences clearly state that a low, pragmatic approach towards a rather academic concept is worthwhile, both in terms of compliancy and return of investment. Spin-off risk management means that the company clearly identifies, manages and controls risk, rather then focusing solely on trivial areas of good documentation disciplines. The focus is de facto on critical areas that could potentially compromise products, processes and even patient safety. Lessons are clearly to be learned from the medical devices sector.

Bibliography

1. FDA, Risk related guidance. www.fda.gov

2. ISPE, GAMP 4 Guide for Validation of Automated Systems, Appendix M3, 2001. www.ispe.org

3. International Conference on Harmonisation of Technical Requirements for Registration of Pharmaceuticals for Human Use, ICH Harmonised Tripartite Guideline, Q9: Quality Risk Management, Version 4, 2005. www.ich.org

4. ISO 14971:2000 Application of Risk Management to Medical Devices, 2007. www.iso.org

Henrik Johanning is director and executive advisor at QAtor A/S (Denmark), and a member of Pharmaceutical Technology Europe's editorial advisory board.

Asger Dahlgaard is corporate quality development manager at Coloplast A/S (Denmark).