implementing qrm as a new quality system an asia & international perspective richard o’keeffe...

Implementing QRM as aNew Quality System

An Asia & International Perspective

Richard O’KeeffeEmail: rokeeffe@amgen,com

2012 ISPE CHINA ANNUAL CONFERENCE

Scope of Quality Risk Management

Pharmaceutical companies must deal with general risks and product-specific risks

General risks Product-specific risks


Sources of Quality Risks

People

Proce

sses

Environment

Time

Mat

eria

ls

Met

hods

RISK

Oth

er

• Quality risks can come from many sources:

• QRM primarily manages the risks associated with the quality attributes of product

• Ultimately QRM should link to patient safety


What is Quality Risk Management

QRM is: Systematic Process

Objective & transparent

Data-driven

Multidisciplinary

Focused on product quality & patient safety

Applicable throughout product lifecycles

QRM is not: Hiding risks

A “box-checking exercise”

A way of getting out of required GMP

activities

A means to justify a predetermined conclusion

Total elimination of product quality risks

Management of business or non- quality risks

“Appropriate use of quality risk management can facilitate but does not obviate industry’s obligation to comply with regulatory requirements.”

- ICHQ9


Patient & Consumer Protection

“… the protection of the patient by managing the risk to quality should be considered of prime importance.”

- ICHQ9

• For risks that are closer to the patient– The impact of risks to patient safety may be easier to identify

• The risks that are further removed from the patient– Risk assessments should focus on risks to product quality as a

means of ultimately ensuring patient safety


Scope of Quality Risk ManagementThe principles and tools of QRM can be applied throughout

the product lifecycle

Pharmaceutical Quality System (ICHQ10)QRM identified as one of the two key enablers of effective quality systems

Pharmaceutical Development (ICHQ8) QRM and scientific approaches combine to enhance process knowledge

Process

Materials

Design

Manufacturing

DistributionPatient

Facilities

Quality Risk Management (ICHQ9) Opportunities to impact risk using quality risk management

Pharmaceutical Development

Technology Transfer

Commercial Manufacturing

Product Discontinuation

Credit: G.Claycamp, FDA, June 2006


ICH Q9 Quality Risk Management Process

InitiateQuality Risk Management Process

Risk Identification

Risk Analysis

Risk Evaluation

Risk Assessment

Risk Reduction

Risk Acceptance

Risk Control

Output / Result of theQuality Risk Management Process

Review Events

Risk Review

Ris

k M

anag

emen

t Too

ls

Ris

k C

omm

unic

atio

n

Unacceptable


Why do we need a QRM Process?

“The manufacturing and use of a drug product, including its components, necessarily entail some degree of risk. The risk to its quality is just one component of the overall risk. “

- ICH Q9

“Effective quality risk management can facilitate better and more informed decisions, can provide regulators with greater assurance of a company’s ability to deal with potential risks, and can beneficially affect the extent and level of direct regulatory oversight.”

-ICH Q9

Risk is inherent in the drug manufacturing process.


Build Confidence in QRM within your Organization

Elements needed to establish confidence:

• Risk Management Program and Guidance• Initiating and Planning QRM Activities• Risk Assessment• Risk Control• Risk Communication• Risk Review• The Human Side of QRM• Integration in the Quality System


QRM Program & Governance

What elements can an inspector expect to see in a company’s QRM program?

Policy

Requirements

Procedures Templates Tools


QRM Policy & Requirements

Initiate

Assess

Control

Review

Policy and Requirements documents provide program objectives

QRM activities should be well-planned and properly resourced.

The Q9 Process

Risks will be identified, analyzed & evaluated against thresholds to determine if additional actions are needed.

Action will be taken to reduce risks with scores above thresholds to acceptable levels. Action will be tracked.

Risks will be reviewed at defined intervals or upon defined events.

A Quality Risk Management policy structured in accordance with ICH Q9 will satisfy most risk management needs


QRM Procedures

Initiate

Assess

Control

Review

Procedures establish process flow

Risk assessment prerequisites and preparation activities are delineated. Roles & responsibilities are included.

The Q9 Process

Risk rating guidance provided. Results documented in a risk assessment summary report or other controlled document.

Guidance for setting thresholds provided. Actions will be tracked.

Frequency and/or triggers for review are defined. Risks may be reviewed at development gates, annual product reviews, or other management reviews.

Procedures explain how policy objectives and requirements will be met


QRM Training, Templates & Tools

Initiate

Assess

Control

Review

Training, Templates and Tools provide consistency and completeness

Plan templates may be provided. Stakeholders trained on how to prepare for an assessment.

The Q9 Process

Templates for risk assessment worksheets and reports. Software tool may be provided.

Tracking risk controls for licensed products may require systems such as CAPA, Change Control or Work Order Systems

Train stakeholders on how to use risk reviews to keep risk assessments living

Training, templates and tools provide the detailed elements to deliver on requirements.


QRM Tools

2 1

3a

7

3b3c3d

89

1011

12

13

19 14

1516

1718

20

Ris

k le

vel (

seve

rity

vs.

lik

elih

ood

)

Graphic representation of risk profile is an effective means of communicating results.

Policy

Integrated database of risk assessment results

Stand-alone assessment software

Excel files,hard-copy

• Level of detail and complexity can vary by company size, but some basic program should be in place


Initiating & Planning QRM ActivitiesInitiate

Quality Risk Management Process

Risk Identification

Risk Analysis

Risk Evaluation

Risk Assessment

Risk Reduction

Risk Acceptance

Risk Control

Output / Result of theQuality Risk Management Process

Review Events

Risk Review

Ris

k M

anag

emen

t Too

ls

Ris

k C

omm

unic

atio

n

• Plan how each of the remaining risk management activities are to be performed

• Despite careful planning, risk assessments may still be required on an ad hoc basis, triggered by unexpected needs or events

• Planning should be commensurate with the impact of the risk to product quality


Initiating the QRM Process• Plan risk management activities for each product, site,

function etc.• Include:

• problem statement and objectives• scope statement• roles & responsibilities, leader and other critical resources• timeline & deliverables

• Gather background information and data to enable data-driven analysis

• Planning can cover broad scope (entire risk management process) or narrow scope (only risk assessment)

Conduct Risk Assessment


Some Brief Cautions on Risk Assessments

It’s important to understand Risk Assessment is not an exact scienceThe outcomes of risk assessments are highly dependent on The outcomes of risk assessments are highly dependent on

technical knowledge, standard practices/tools & trainingtechnical knowledge, standard practices/tools & training

QRM Standards (guidelines for scoring definitions and thresholds for Risk

Control decisions)

Role based QRM training program

QRM facilitator (trained in QRM methodology)

Role of decision makers/ management (competence & authority)

Consistent QRM Application


When is a Risk Assessment not Appropriate

• A risk assessment is a valuable tool that enables robust decision making and prioritization of efforts• Sometimes a risk based rationale based on experience,

data, scientific information is sufficient

• Risk assessments should not be used:• To justify or support practices that are inadequate or

non-compliant with cGMP requirements and regulatory expectations

• As a substitute for science and data• When issues are clearly obvious and must be fixed• As a means to delay making certain decisions• To justify a ‘pet’ project• To justify a predetermined conclusion


Formality of Risk Assessments

Detailed risk assessment (e.g. PHA, FMEA, FTA)

Simple risk assessment (e.g. risk ranking, checklist, decision tree)

Informal Risk based approach vs. formal risk assessment

Technical/ scientific rationale

Level of rigor/effort of risk assessment should be commensurate with criticality and the value derived.


Risk Assessment Formality Spectrum

The degree of risk management rigor and formality required is influenced by a combination of many factors including (but not limited to):

Criticality of the risk question Complexity of the issue, process, or system Availability of relevant historical data Level of available process knowledge and experience


Identify The Risk Assessment Team

• Effective risk assessment facilitation requires a blend of teaching, presenting and facilitating skills

• Facilitator should be knowledgeable and trained on QRM principles and tools

• Application of formal QRM tools requires a skilled facilitator

• QRM is most effective when undertaken by multidisciplinary teams

• All relevant or potentially impacted areas represented (including Quality)

• SMEs should be thoroughly knowledgeable in the relevant designs, controls, routine operations, and quality systems

• SMEs should be capable of identifying potential risks for the problem statement under evaluation

• Risk assessment team size – typically no more than 10 cross-functional SMEs

Facilitator Risk Assessment Team

Training and experience are key to ensuring consistency in risk assessment execution


Choosing the Right Risk Assessment Tool

• Risk assessment tools should be systematically reviewed using available guidance documents (references listed in ICH Q9)

• Tool(s) selected should be compatible with the risk assessment strategy and ease of input, processing, and output of data

• Not all risk assessments require a formal tool• All tools are not created equal• Risk assessments may require the combination of tools to properly assess the

problem statement

• Inappropriate tool selection• Risk assessment tools have different strengths and limitations• Proper understanding of these strengths and limitations is crucial when selecting

a tool• Some potential risks to a process or product may not be identified if the wrong

risk assessment tool is selected to address the problem statement

Conduct Risk Assessment


Risk Communication

• Systematic, disciplined, methodical, and timely conveyance of information permits rational, factual and science-based decision making • Identify essential elements of risk communication at

different steps in the QRM process

• Risk perception and management of perception bias

Voluntary vs. Involuntary Bias Human Heuristics Expert vs. Lay Bias


Risk Communication

• Mechanisms in place to ensure outputs and results are appropriately documented and communicated

• Bi-directional sharing of information about risk and risk management between the decision makers and others

• Communicate at any stage of the QRM process• Communication need not be carried out for each and every individual risk

acceptance • Utilize existing channels to facilitate risk communication

• Quality System Management Reviews• As specified in regulations and guidance• Submissions

• Risk management conclusions should be consistent with decisions, philosophies, specifications etc. in other areas with similar or identical risks

• Risk assessments with similar scopes and similar risks should come to consistent conclusions

• Replication of risk assessment methodologies across different sites, facilities, products, etc. should be checked for consistencies in their approaches and conclusions. Differences should be readily justifiable.


Risk Communication• Communication of information throughout the risk management process

should be Clear and unambiguous Intuitive enough to avoid misunderstanding (Human Factors) Facilitate unbiased and objective risk analysis and evaluation Convey the appropriate amount of detail and content to facilitate its purpose Possess defined and recognizable originator and recipient Traceable and auditable for formal risk outputs Permit recipients to execute their responsibilities and duties

• Based on the level of formality and rigor, the following elements should be included in the risk management documentation

• Problem Statement• Scope• Tool used (and justification for selection)• Ratings scales and RPN thresholds or other ranking criteria (if used)• Results (either detailed or a summary), including commitments, decisions,

supporting rationale, and description of actions taken (now or in the future)• Assumptions• Team


The Human Side of QRM

Initiate

Assess

Control

Review

The Q9 ProcessRisk Assessment: Identification and analysis results are dependent on the participants:

• Their experiences• Their knowledge• Their opinions and attitudes• Team dynamics

Ways to control this variability include:• Sufficient data gathering prior to

assessment (non-conformances, incident reports, complaints) can help drive objective, data-driven results

• Proper SME representations and a properly blended cross-functional team

• Strong facilitator• Clear scope statement• Proper training



Initiate

Assess

Control

Review

The Q9 Process

ALARP or BAR? Or is it acceptable? Risk tolerance of stakeholders and decision-makers are a factor in this decision

Ways to control this variability include: Definition of acceptable parameters independent of risk assessment, can help drive consistency Align decisions with regulatory

expectations



Challenges:• How does Quality Risk

Management relate to other risk management groups?

• How do they share the same resources to meet different objectives?

Whether QRM is a centralized department or a shared philosophy, QRM is everyone’s responsibility.


Integration with Quality SystemsAt each phase in the product lifecycle, QRM should be applied at a level that is commensurate with the knowledge available

and complexity of the process.

• A comprehensive and effective Pharmaceutical Quality System (PQS) model based on • ISO quality concepts• GMP regulations, and • complements ICH Q8

“Pharmaceutical Development” and ICH Q9 “Quality Risk Management”

• Objectives:• Achieve Product Realization • Establish and Maintain a State of

Control • Facilitate Continual Improvement


Integration with Quality Systems

Quality Risk Management is integral to an effective pharmaceutical quality system

• It can provide a proactive approach to identifying, scientifically evaluating, and controlling potential risks to quality

• It facilitates continual improvement of process performance and product quality throughout the product lifecycle

• It can be applied to different aspects of pharmaceutical quality

Pharmaceutical Development

Technology Transfer

Commercial Manufacturing

Product Discontinuation

Quality Risk Management



Initiate

Assess

Control

Review

Com

mun

icat

e

Annual Product Review

Management Review

Audits

Non-conformances

Complaints

CAPA

Change Control

Full integration of risk management within other Quality processes requires significant effort



Risk-based decisions for

product quality

Establish Control

Strategy based on risk

Identifying the monitoring and control systems

Identify, prioritize areas for continuous improvements

Manage outsourced activities

The design of the Pharmaceutical Quality System may incorporate appropriate Risk Management principles,

such as:


QRM Conclusion• QRM is a difficult subject – communication with stakeholders and

risk owners is key• Roll risks up to a Top Risks list and keep Executive Management

frequently informed• While QRM does not include business risk, establish your QRM

program in conjunction with your Operations and Supply Risk program. Use common tools and processes

• Keep your organization motivated, learn lessons and share best practices

• Balance performance of risk assessments with your organizations ability to track and act on the findings

• No such thing as zero risk – hard data helps• Beware of “crying wolf” – keep risks in perspective; not everything is

equally important

Success is when nothing happens!!!


Supply RisksDrug Shortages Are Increasing, Placing Patients At Risk• A recent study (US FDA) has further highlighted drug and medical

product shortages as a significant public health issue.• Since 2005, drug shortages have tripled in the US

• 80% involve sterile Injectables, including cancer drugs and antibiotics

• 68% are attributed to problems at the manufacturing facility, delays in manufacturing or shipping, or active pharmaceutical ingredient shortages

• The study recognized a number of contributing factors to the current state but one major cause was that most sterile injectables have one manufacturer producing 90% of volume

• Similar issues have also been experienced in the EU • e.g. chemotherapy agents and other injectables (Tirelli et.al.)


Risk Management in China

• Implement the ICHQ9 principles in China GMPs• Proactively support the initiatives of SFDA• Raw Material integrity and quality

– Well known cases

• Supply Chain Integrity – a global problem• Filing only one manufacturing site will create risk

of Single Point of Failure– In case of black swan event or natural disaster– Leading to potential supply shortages


Risk Is A Part Of Our Lives!


?

implementing qrm as a new quality system an asia & international perspective richard o’keeffe...

Documents