Editor’s Note:
This article was peer reviewed by a member of Pharmaceutical Technology®’s Editorial Advisory Board.
Submitted: April 24, 2023
Accepted: June 14, 2023
Recent research and perspectives shed light on an opportunity to better connect risk and knowledge through improved integration of systems.
The current International Council for Harmonisation (ICH) Q9(R1) Quality Risk Management (QRM) guideline is a targeted revision of the initial guidance issued in 2005, intended to address subjectivity, formality, risk-based decision-making, and other specific areas for improvement. While not a formally defined area for improvement, the revised guidance invokes many new references to “knowledge” and “knowledge management (KM)” in supporting improvement in QRM practice and, by extension, to the goals of an effective pharmaceutical quality system.
This article was peer reviewed by a member of Pharmaceutical Technology®’s Editorial Advisory Board.
Submitted: April 24, 2023
Accepted: June 14, 2023
Recognizing that QRM and risk-based decision-making (RBDM) both depend on knowledge to be effective, it could be suggested that knowledge is the currency of managing risk. This paper presents research and perspectives on the opportunity to better connect risk and knowledge through improved integration of QRM and KM, including presenting several potential benefits of such integration. A framework is proposed, the Risk-Knowledge Infinity Cycle (RKI Cycle), which could be used to improve the connectivity of risk and knowledge along with preliminary and practical recommendations to operationalize the RKI Cycle. In addition, the paper invokes concepts of systems thinking in connecting QRM and KM as well as the opportunity to consider the role of knowledge and KM more holistically across the pharmaceutical business through application of a process classification framework.
There has been a bolus of activity associated with ICH Q9(R1) (1) finalized in January 2023, as the long-awaited update to the 2005 guidance, ICH Q9 Quality Risk Management (2). This activity included scrutiny of the concept paper (3), comments on the draft revision, and revision of the guideline itself. In addition, there has been a focus on the development of supporting training material by the ICH Expert Working Group (EWG) and to interpreting what it all means to industry and to organizations on an individual level as the deployment and adoption process begins.
Concurrent to this activity surrounding ICH Q9(R1), the Pharmaceutical Regulatory Science Team (PRST) at Technological University Dublin have continued their ongoing research into related topics, including QRM, KM, and RBDM. In particular, the PRST are exploring the relationships and interconnectivity between these practices, applying through “systems thinking” mindset and aspects of complexity theory where appropriate, which provide a more holistic approach to analysis and how the parts of a system interact over time (4).
One of the key areas of focus for the PRST is regarding the practice of KM, including:
The purpose of this paper is to compile and synthesize this KM-related research describing how it supports the intent of the ICH Q9(R1) revision and, ultimately, the objectives of the PQS itself as outlined by ICH Q10 Pharmaceutical Quality System (5), which are to achieve product realization, establish and maintain a state of control, and facilitate continual improvement.
To start with, however, it is important to demystify the relationship between the terms “knowledge” and KM. Authoritative definitions are presented in the next section of this paper, and the authors have discussed these concepts in more detail in a 2022 paper (6). Consider the following pragmatic descriptions by the authors.
In a pharmaceutical context, “knowledge” is an asset that includes what is collectively known (e.g., scientific understanding and insight) about products, processes, and platforms (e.g., technology transfer documents, regulatory filings, process experience, etc.) inclusive of both documented (explicit) knowledge and know-how, experience, and other tacit knowledge. To further break it down:
Whereas, KM is a set of practices and associated mindsets and behaviors that determine how knowledge is managed (e.g., captured and made available in the future) in an intentional, repeatable, and systematic manner.Common KM practices include content management processes, lessons learned, knowledge transfer activities, among others. KM as a discipline is most successful when certain enabling practices are in place, such as standard processes, dedicated roles (e.g., community stewards, lessons learned facilitators), communications, and training (9) as well as foundational practices of effective data management (e.g., data strategy, standards, and stewardship).
Essentially, if “knowledge” is considered a noun, then “KM” can be considered a verb. This is perhaps a seemingly obvious but important distinction—as in the authors’ experience—these terms of “knowledge” and “KM” are often used loosely, almost interchangeably. It is crucial that the reader is mindful of the difference and—as the authors will make the case—knowledge is the currency of managing risk, and the smart investment is to ensure that the best possible knowledge is available when and where it is needed—via KM—to inform QRM and risk-based decision making, and to support the PQS objectives.
When one looks holistically across the ICH quality guidelines (10), the expectations for managing knowledge are implied through the repeated references to the availability and application of knowledge in support of risk management, science and risk-based decision-making, product and process understanding, and, ultimately, ensuring availability of a safe and efficacious product to the patient. While these references are not each overtly stated as “knowledge” or “knowledge management,” they do repeatedly invoke the availability and application of “knowledge” under the guise of many synonyms, including prior knowledge, platform knowledge, scientific knowledge, science, evidence, product knowledge, process knowledge, experience, product development history, expertise, know-how, product understanding, process understanding, and lessons learned (6).
Knowledge and KM across ICH and other regulatory guidance. While ICH Q10 does not define the term “knowledge,” the 2018 International Organization for Standardization (ISO) standard on KM, ISO 30401:2018, Knowledge Management Systems—Requirements provides a helpful definition of knowledge as:
“Human or organizational asset enabling effective decisions and action in context” (11).
The ISO definition is further clarified as follows:
Regarding the term “knowledge management,” ICH Q10 introduced the concept of KM and provided a definition in 2008 as:
“Knowledge management is a systematic approach to acquiring, analysing, storing and disseminating information related to products, manufacturing processes and components” (5).
It further stated that product and process knowledge should be managed throughout the product lifecycle and includes examples of sources of knowledge:
“Sources of knowledge include, but are not limited to, prior knowledge (public domain or internally documented); pharmaceutical development studies; technology transfer activities; process validation studies over the product lifecycle; manufacturing experience; innovation; continual improvement; and change management activities” (5).
It is in ICH Q10 that QRM and KM were linked as the dual enablers for an effective PQS by “providing the means for science- and risk-based decisions related to product quality” (5). It is worth noting that while ICH Q10 provided a definition of KM, it does this without any references to KM in the literature, or by discussing KM guidance in other industries.
In addition to ICH Q10, there are many other direct and indirect references to knowledge and KM across ICH quality guidelines, including ICH Q8(R2), ICH Q8/Q9/Q10 Questions & Answers, ICH Q11, and ICH Q12, as well as in other regulatory guidance issued by the World Health Organization (WHO), EudraLex in the European Union, and Pharmaceutical Inspection Co-operation Scheme (PIC/S), which have previously been reviewed in detail by the authors in 2020 (12).Furthermore, since the 2020 review, references to the role of knowledge and KM are also included in ICH Q13, Continuous Processing of Drug Substances and Drug Products (13), ICH Q14, Analytical Procedure Development (14), and further in FDA’s pharmaceutical quality initiative, known as knowledge-aided assessment and structured applications (KASA) (15).
Considering regulatory guidance taken in aggregate, while it is ICH Q10 that defined KM in 2008, it is heartening to see the concepts of knowledge and KM emerging and repeatedly reinforced in the interceding 15 years. Indeed, a closer look at the recent ICH Q9(R1) extends this theme and provides an opportunity for risk and knowledge to be intentionally connected.
A closer look: the emergence of knowledge management in ICH Q9(R1). The concept paper for ICH Q9(R1) (3) identified four primary areas for improvement in the practice of QRM, for both pharma companies and regulatory authorities as follows:
Furthermore, two additional points were raised in the concept paper to be addressed, namely:
Collectively these six areas of focus are referred to as the “revision topics.”
While knowledge-related or KM-related areas for improvement were not identified in the concept paper directly (i.e., as one of the six revision topics), a closer look at the revised ICH Q9(R1) guideline reveals that the concepts of both “knowledge” and “knowledge management” have a significant presence. This is demonstrated by an evaluation carried out by the authors, presented in Table I as a summary of the frequency of the use of each team in the original ICH Q9 guideline, and in the revised ICH Q9(R1) guideline.
While the term “knowledge management” is not as prevalent as “knowledge” there is a significant change in the recognition of the centrality and importance of knowledge to support QRM. This is welcomed by the authors, given the nature of ICH Q9(R1) as a “targeted revision” with “limited and specific adjustments” (1).
In fact, a review of the six revision topics could indeed suggest a dependency of each of these six revision topics on knowledge and/or knowledge management, as summarized in Table II.
Knowledge as an invaluable commodity for risk management and decision making. A further literature review by the authors in 2020 (12,16) explored the relationship between knowledge and risk—and knowledge management and risk management—in pharmaceutical regulatory guidance and in other industries and organizations, including the National Aeronautics and Space Administration (NASA). A key assertion resulting from this review is that knowledge is both an input to and an output from QRM, thus highlighting the opportunity for QRM and KM to be thoughtfully and intentionally connected.
Arguably, the authors suggest that emergence of the importance of knowledge and KM in ICH Q9(R1) is a logical evolution of the recognition of the foundational role each play in informing risk and improving risk-based decision-making, as is evident through a holistic review of the document as shown in Tables I and II.
At the end of the day, the pharmaceutical industry is a knowledge industry (17) and, on a daily basis, formally and informally assesses risk and makes countless decisions—each of which should seek to ensure quality products and to protect the patient. Knowledge is an indispensable commodity necessary to make this happen effectively. With greater knowledge comes greater understanding. Greater understanding leads to reduced uncertainty. Reduced uncertainty in turn informs risk management activities and ultimately risk-based decision-making. Knowledge, indeed, is the currency for managing risk—and managing such knowledge is a smart investment for benefitting patients.
Exploring the practical connection between knowledge and risk
The authors, having recognized the disconnect between QRM and KM in practice, turned to systems-thinking principles to explore the connections between risk and knowledge, and between QRM and KM, starting with an assessment of practice at the time.
Current state connectivity of quality risk management and knowledge management. In 2021, the authors collected data through a survey (18), which reported that, while 96% of survey respondents believe QRM and KM are highly interdependent as concepts supporting the PQS (i.e., how connected should they be), no one believes they are fully integrated in practice today (0%), with 4% responding they are intentionally but not optimally connected, and 85% reporting they are only partially connected. These data are summarized in Figure 1.
Furthermore, when asked about the potential benefits of improved QRM–KM integration, a variety of important benefits associated with better connectivity between risk and knowledge were identified, including:
Notably, these anticipated benefits reflect the role of knowledge as a commodity—or currency—in delivering improved risk assessments, control strategies, decision making, and quality outcomes.
These 2021 results depicted in Figure 1 coupled with anticipated benefits identified by survey responses clearly suggest that QRM and KM were not well-connected, nor as connected as they should be, and that important benefits are possible if QRM and KM are better integrated in the future. The authors are hopeful that this connection between risk and knowledge will be more prevalent with the adoption of ICH Q9(R1) which clearly recognizes the role knowledge plays in quality risk management and risk-based decision-making.
A framework to connect risk and knowledge. As one potential means to address this need to connect risk and knowledge, a framework was developed by the authors in partnership with Kevin O’Donnell, PhD, market compliance manager, Health Products Regulatory Authority. This framework, the RKI Cycle (19), was proposed based on the previously referenced literature review of pharmaceutical regulatory guidance, input from industry and regulatory agency experts, practices in other industries (e.g., aerospace), and fundamental principles of knowledge management (e.g., enabling knowledge to “flow”). Figure 2 provides a summary of key RKI Cycle features, including:
Given this summary of the RKI Cycle and supporting concepts and principles, the following sections will explore its application and contribution to ICH Q9(R1).
Practical application of the RKI Cycle framework. The authors propose the RKI Cycle can be applied in different ways to help address the disconnect between risk and knowledge. In the simplest manner, the RKI Cycle can readily be applied as a conceptual model for organizations to reflect on whether risk and knowledge are intentionally connected via a connectivity between an organization’s QRM and KM practices. The six guiding principles (Figure 2b) provide “target conditions” throughout the cycle, which can be qualitatively assessed for alignment of an organization’s practices.
The RKI Cycle can also be applied as a detailed process model to operationalize the RKI Cycle via deeper assessment of QRM and KM practices and their interdependency, resulting in the identification of gaps and recommended deployment actions to better connect QRM and KM, and thus risk and knowledge. Efforts by the authors are ongoing to develop detailed RKI Cycle operationalization guidance. Several preliminary recommendations include the following:
The role of knowledge in enhancing realization of ICH Q9(R1). Considering the six revision topics of ICH Q9(R1) and how each invokes a dependency on knowledge availability and application (Table I), ICH Q9(R1) further reinforces this relationship between knowledge and risk. It is perhaps obvious to say each of the six topics—subjectivity, product availability risks, formality, risk-based decision-making, risk review, and hazard identification—would each benefit by having the “maximum and collective knowledge of the organization available on demand,” as is the intent of the RKI Cycle.
The authors anticipate further evolution of KM practices (and, therefore, improved knowledge access and availability) can benefit several of these targeted revision topics.For example:
Knowledge is a fundamental enabler to pharmaceutical quality. QRM should strive to apply the collective knowledge of the organization to recognize and understand risk and, in turn, to inform risk-based decisions that can have direct impact to patient safety and product availability. Said differently, knowledge is the currency of managing risk. Investing in the practice of knowledge management can provide an intentional, standard, and repeatable “how” for knowledge to be more effectively managed.
Enhancing knowledge via KM practices:a smart investment. Indeed, the opportunity is that knowledge is central to managing risk, making decisions, and ensuring product quality. Ensuring that knowledge is effectively managed (e.g., on-demand access and availability) via KM practices is a smart investment in the interest of patients. Further connecting QRM and KM with a framework such as the RKI Cycle can help the “system” perform as intended while further improving the outcomes of each QRM and KM practices.
Ask oneself: “What would I expect as a patient?”Would you not expect the best possible knowledge to be available to support risk assessments, risk control, risk review, and risk communication if you were waiting on a pharmaceutical company to deliver you a new lifesaving therapy? Would you not expect that pharmaceutical organizations “know what they know” and “can find and apply what they know” to deliver the best possible outcomes to you as a customer?
Beyond the framework: opportunities for biopharma as a knowledge industry. It is easy for organizations and the people employed by them to become consumed with day-to-day business and lose sight of the broader system to which their functional work contributes.Organizational structures, differing priorities, divergent governance processes, and countless other factors can contribute to “silos” in the business where people become narrowly focused. Systems thinking is a means to counter this trend, where one can “zoom out” to understand how the system works as a whole and how the major elements interrelate. It was such an opportunity the authors recognized in proposing the RKI Cycle—that QRM and KM generally were focused on excellence in their respective domains—but little attention was paid to how they worked together to enable the PQS.
When one expands that aperture even further, it is possible to see a broad-knowledge “ecosystem,” where knowledge is connected and enables a great many processes in pharmaceutical organizations, including technology transfer, change management, deviation management and investigations, process validation, and others. In fact, if one were to zoom out to see the entire business unit or enterprise mapped at a process level, one could envision the relationships between these processes and the knowledge generated and consumed by each, and how that knowledge must flow between these various processes.
Multiple such frameworks exist, including the Process Classification Framework (PCF) tailored for the pharmaceutical industry, developed by the American Productivity & Quality Center (APQC) and IBM (24), which provides a detailed breakdown of processes and activities to run a business. At the highest level, this consists of process categories such as operating processes (e.g., develop vision and strategy, deliver products) and support processes (e.g., develop and manage human capital, manage information technology). One can then drill down into deeper levels of the PCF to reveal process groups, processes, and activities. The current version of the APQC PCF for the pharmaceutical industry in fact contains over 1200 rows across the four-tier structure to fully define the activities associated with operating a pharmaceutical business. With such an understanding of the business, one can envision developing and deploying holistic KM practices to enable the business at large (notably, such a foundational capability is called out by the APQC PCF as a support process).
Yet a further opportunity is to recognize and exploit the strengths and synergies of related practices in supporting the overall mission of the business, including the practices of knowledge management, operational excellence, organizational change management, learning, and development, digital, and human performance, at a minimum. Each of these aims to drive improvements of some sort in how business is conducted and can be co-deployed for enhanced impact and benefit.
KM practice is still highly variable within pharmaceutical organizations, many of which treat KM as discretionary even though it is called out as a key enabler to an effective PQS in ICH Q10 (5). Yet, expectations for managing knowledge appear throughout regulatory guidance (and also in industry guidance which was not discussed in this paper) and can be directly linked to effectiveness in risk management and risk-based decision-making. ICH Q9(R1) provides a renewed opportunity for the industry to recognize the foundational role knowledge and KM must play in support of risk management and risk-based decision making. Devoting energy and resources toward managing knowledge can clearly deliver worthwhile results.
Beyond the ICH Q9(R1) driver to recognize KM practice, as a society, we face a time of rapid and unprecedented change. Considering product complexity (e.g., advanced therapy medicinal products) cost pressure, continued realignment of supply chains, societal expectation for accelerated development, advancement of new technologies, continued pressure on innovation, and a constantly evolving regulatory and economic landscape, never before has it been more important to integrate risk and knowledge to benefit patients and, indeed, our businesses and other stakeholders.
The views expressed in this article are those of the authors and are not necessarily those of any organizations with which the authors are affiliated.
1. ICH, Q9(R1) Quality Risk Management, Final version (2023).
2. ICH, Q9 Quality Risk Management, Step 4 version (2005).
3. ICH, Q9(R1) Quality Risk Management, Final concept paper (2020).
4. TechTarget, What is Systems Thinking? www.techtarget.com/searchcio/definition/systems-thinking (accessed April 23, 2023).
5. ICH, Q10 Pharmaceutical Quality System, Step 4 version (2008).
6. Greene, A.; Lipa, M. J. Steps Towards Digital Transformation in the Pharma Manufacturing Landscape—Knowledge-Enabled Technology Transfer. Level 3 2022, 17 (2) 1.
7. Cambridge Dictionary, Explicit Knowledge. dictionary.cambridge.org/ (accessed April 23, 2023).
8. APQC, Knowledge Management Glossary; APQC, 2022.
9. Kane, P. E.; Lipa, M. J. The House of Knowledge Excellence—A Framework for Success. In A Lifecycle Approach to Knowledge Excellence in the Biopharmaceutical Industry, 1st ed.; Calnan, N.; Lipa, M. J.; Kane, P.; Menezes, J. C., Eds.; Taylor & Francis, 2018; pp. 181–224. DOI: 10.1201/9781315368337
10. ICH, Quality Guidelines. www.ich.org/page/quality-guidelines (accessed April 23, 2023).
11. ISO, Knowledge Management Systems—Requirements; ISO 30401:2018; ISO: Geneva, Switzerland, 2018. https://www.iso.org/standard/68683.html(accessed April 23, 2023).
12. Lipa, M. J.; O’Donnell, K.; Greene, A. Managing Knowledge and Risk—A Literature Review on the Interdependency of QRM and KM as ICH Q10 Enablers. Level 3 2020, 15 (2), 3. DOI: 10.21427/2jdq-jq09
13. ICH, Q13 Continuous Manufacturing of Drug Substances and Drug Products, Final version (2022).
14. ICH, Q14 Analytical Procedure Development, Draft version (2022).
15. Yu, L. X.; Raw, A.; Wu, L.; et al. FDA’s New Pharmaceutical Quality Initiative: Knowledge-Aided Assessment & Structured Applications. Int. J. Pharm.: X 2019, 1, 100010. DOI: 10.1016/j.ijpx.2019.100010.
16. Lipa, M. J. Unlocking Knowledge to Benefit the Patient: How Connecting KM and QRM Can Strengthen Science and Risk-Based Decision Making. Ph.D. Thesis, Technological University Dublin, Dublin, Ireland, 2021.
17. Wikipedia, Knowledge Industries. en.wikipedia.org/wiki/Knowledge_industries (accessed June 04, 2022).
18. Lipa, M. J.; O’Donnell, K.; Greene, A. A Survey Report on the Current State of Quality Risk Management (QRM) and Knowledge Management (KM) Integration. Level 3 2021, 15 (3), 5. DOI: 10.21427/rpc7-sp95
19. Lipa, M. J.; O’Donnell, K.; Greene, A. Knowledge as the Currency of Managing Risk: A Novel Framework to Unite Quality Risk Management and Knowledge Management. Level 3 2020, 15 (2), 4. DOI: 10.21427/4mzp-vn67
20. Lipa, M. J.; Mulholland, V.; Greene, A. Integrating Knowledge Management and Quality Risk Management. ISPE Pharmaceutical Engineering 2022, 42 (4), 14–23.
21. APQC, Knowledge Management Capability Assessment Tool. www.apqc.org (accessed April 23, 2023).
22. Browning, T. R.; Ramasesh, R. V. Reducing Unwelcome Surprises in Project Management. MIT Sloan Manag Rev 2015, 56 (3), 53–62.
23. Mulholland, V.; Greene, A.; Lipa, M. J. Steps Beyond Risk Assessment in QRM: RBDM, the Next Horizon. Level 3 2021, 16 (1), 2.
24. APQC, The Pharmaceutical Process Classification Framework; APQC: Houston, Texas, 2008. https://www.apqc.org/system/files/PCF_Pharm_Ver_5.0.1.pdf.
Martin J. Lipa*, PhD, martin.lipa@prst.ie, is senior research fellow, Pharmaceutical Regulatory Science Team. Anne Greene, PhD, is professor, Technological University Dublin, and director, Pharmaceutical Regulatory Science Team.
*To whom all correspondences should be addressed.
Pharmaceutical Technology
Vol. 47, No. 9
September 2023
Pages: 36–45
When referring to this article, please cite it as Lipa, M. J.; Greene, A. Knowledge as the Currency of Managing Risk: A Smart Investment for Patients. Pharmaceutical Technology 2023, 47 (9) 36–45.