quality risk management

Tehran University of Medical Sciences

School of Pharmacy

Quality Risk Management

Risk AnalysisOr in more general terms:

Quality Risk ManagementMarch 2014

Quality Risk ManagementJune 2014

2 of 31Tehran University of Medical

SciencesSchool of Pharmacy

Quality Relationship

Quality Management

Quality Assurance

GMP

Production and Quality Control





GMP

(Good Manufacturing Practices )Is the part of quality assurance that ensures that products are produced and controlled consistently and reliably. It can only come about by having clear descriptions of the way in which the work will be done.GMP specifically addresses risks that cannot be fully controlled by testing of the final product:

•Cross-contamination•Mix-ups

These risks can best be controlled by having a properly managed system of working that takes them into account.

Quality Management

Quality Assurance

Production and Quality Control





Quality Management

ICHQ10:Pharmaceutical Quality System Q7:

GMPQ8:

Pharmaceutical Development

Q9: QRM

Knowledge Management




INTRODUCTION• Risk management is not new – we do it informally all

the time• Risk management principles are effectively utilized in

many areas of business and government.• Military Standard 1629 dated 1974 regarding formal

risk management• Risk management has been used in the medical device,

telecommunications, aerospace and car industries for many years.




INTRODUCTIONISO 31000:2009 Principles (Clause 3) Risk management should….

1.Create value 2.Be an integral part of organizational processes 3.Be part of decision making 4.Explicitly address uncertainty 5.Be systematic and structured 6.Be based on the best available information 7.Be tailored 8.Take into account human factors 9.Be transparent and inclusive 10.Be dynamic, iterative and responsive to change 11.Be capable of continual improvement and enhancement




INTRODUCTION• Managing risk means forward thinking• Managing risk means responsible thinking• Managing risk means balanced thinking• Managing risk is all about maximizing opportunity and minimizing

threats • The risk management process provides a framework to facilitate

more effective decision making

Quality by DesignRisk Management is about making value out of

uncertainty




Risk Management in Pharma. Industry

• From a GMP point of view, we are only concerned with risks associated with quality, safety and efficacy

Quality Risk Management• Organisations use risk approaches in other areas, e.g. to

ensure resources are utilised in the most effective way.

Patient Safety




DEFINITIONS• Harm: Damage to health, including the damage that can occur

from loss of product quality or availability.• Hazard: The potential source of harm• Risk (In Pharmaceutical POV): The combination of the

probability of occurrence of harm and the severity of that harm.• Risk (In General – ISO31000): effect of uncertainty on objectives

– An effect is a deviation from the expected — positive and/or negative.– Objectives can have different aspects (such as financial, health and safety, and

environmental goals)– Uncertainty is the state, even partial, of deficiency of information related to,

understanding or knowledge of, an event, its consequence, or likelihood.– Risk is often expressed in terms of a combination of the consequences of an

event (including changes in circumstances) and the associated likelihood of occurrence.EVENT! EVENT!




Principles• Two primary principles of quality risk

management are: – The evaluation of the risk to quality should be based

on scientific knowledge and ultimately link to the protection of the patient; and

– The level of effort, formality and documentation of the quality risk management process should be commensurate with the level of risk.




QUALITY RISK MANAGEMENT PROCESS

• Quality risk management is a systematic process for the assessment, control, communication and review of risks to the quality of the medicinal product across the product lifecycle.




Responsibilities• Quality risk management activities are usually,

undertaken by interdisciplinary teams.• CFTs may include experts from the appropriate

areas e.g., quality unit, business development, engineering, regulatory affairs, production operations, sales and marketing, legal, statistics and clinical in addition to individuals who are knowledgeable about the quality risk management process.




Risk Assessment• A systematic process of organizing information

to support a risk decision to be made within a risk management process.

• It consists of the identification of hazards and the analysis and evaluation of risks associated with exposure to those hazards.1. What might go wrong (Identification)? 2. What is the likelihood (probability) it will go wrong? 3. What are the consequences (severity)?




Risk Assessment• Risk identification

– Use of information to identify hazards or potential risks– Historical data, theoretical analysis, informed opinions

• Risk analysis– Estimation of risk associated with identified hazards– Qualitative or quantitative– Links probability and severity– In some tools, includes detectability




Risk analysis

Probability Severity Detectability

Likely to occur

High(4)

Serious GMP non-compliancePatient injury possible

Critical(10)

An specific detection System or Indicator exists

Easily Detectable

(0.75)

May occurMedium

(3)

Significant GMP non-complianceImpact on patient possible

Moderate(5)

No specific detection system but can be detected on daily inspections

Moderate Detectability

(1)

Unlikely to occur

Low(2)

Minor GMP non-complianceNo patient impact

Minor(1)

May be detected accidentally Probably

Detectable(1.25)

Very unlikely to occur

Remote(1)

No mentionable Impact None

(0)

Un-detectable Hardly Detectable

(1.5)




Risk Evaluation• Risk evaluation

– Compares identified and analysed risk against criteria– Considers probability, severity and detectability– Output can be qualitative (high, medium or low)– Output can be quantitative (probability x severity x

detectability)– Quantitative provides a relative ranking – prioritises risk

Risk = Probability x Severity x Detectability




Risk Evaluation• Risk definitions:

Based of Quantitative or Qualitative outputs, Risks are categorized as follows: Intolerable – work to eliminate the negative event or

introduce detection controls is required as a priority Unacceptable – work to reduce the risk or control the

risk to an acceptable level is required Acceptable – the risk is acceptable and no risk

reduction or detection controls are required




Risk Control• Risk control includes decision making to reduce

and / or accept risks. • The purpose of risk control is to reduce the risk

to an acceptable level. • The amount of effort used for

risk control should be proportional to the significance of the risk.




Risk Control• Risk control might focus on the following

questions: 1. Is the risk above an acceptable level? 2. What can be done to reduce or eliminate risks? 3. What is the appropriate balance among benefits,

risks and resources? 4. Are new risks introduced as a result of the

identified risks being controlled?




Risk Control• Risk reduction

– Actions taken to lessen the probability of occurrence of harm and the severity of that harm

– Typically CAPA and change control• Risk acceptance

– The decision to accept risk– If risk reduction action taken, follows re-analysis and

evaluation




Change Control Vs. Risk Management

Change Control

RiskManagement

OUTPUT /INPUT

Risk AssessmentRisk Control




Risk Communication• Risk communication is the sharing of

information about risk and risk management between the decision makers and others.

• Parties can communicate at any stage of the risk management process




Risk Review• Risk management should be an ongoing part of the quality

management process. • Review or monitoring of output/results of the risk management

process considering (if appropriate) new knowledge and experience about the risk– Ensures nothing has changed to affect the QRM assumptions,

output and conclusions– Consider during product review

• The frequency of any review should be based upon the level of risk.

• Risk review might include reconsideration of risk acceptance decisions




RISK MANAGEMENT METHODOLOGY

• Quality risk management supports a scientific and practical approach to decision making.

• It provides documented, transparent and reproducible methods to accomplish steps of the quality risk management process.

• Traditionally, risks to quality have been assessed and managed in a variety of informal ways based on, for example, compilation of observations, trends and other information.




Risk Management Tools• Pharmaceutical industry and regulators can assess and manage

risk using recognized risk management tools:– Basic risk management facilitation methods (flowcharts, check sheets etc.)– Failure Mode Effects Analysis (FMEA); – Failure Mode, Effects and Criticality Analysis (FMECA); – Fault Tree Analysis (FTA); – Hazard Analysis and Critical Control Points (HACCP); – Hazard Operability Analysis (HAZOP); – Preliminary Hazard Analysis (PHA); – Risk ranking and filtering; – Supporting statistical tools.




FMEA as an example• Failure Mode and Effects Analysis (FMEA) was one of the first

systematic techniques for failure analysis.FMEA Ref.

Item Potential failure mode

Potential cause(s) / mechanis

m

Mission Phase

Local effects of

failure

Next higher level effect

System Level End

Effect

(P) Probabilit

y (estimate)

(S) Severity

Detection (Indicatio

ns to Operator, Maintaine

r)

(D) Detection Dormancy

Period

Risk Level P*S (+D)

Actions for further Investigati

on / evidence

Mitigation /

Requirements

1.1.1 Brake Manifold Ref. Designator 2b, channel A, O-ring

Internal Leakage from Channel A to B

a) O-ring Compression Set (Creep) failure b) surface damage during assembly

Landing Decreased pressure to main brake hose

No Left Wheel Braking

Severely Reduced Aircraft deceleration on ground and side drift. Partial loss of runway position control. Risk of collision

(C) Occasional

(VI) Catastrophic (this is the worst case)

(1) Flight Computer and Maintenance Computer will indicate "Left Main Brake, Pressure Low"

Built-In Test interval is 1 minute

Unacceptable

Check Dormancy Period and probability of failure

Require redundant independent brake hydraulic channels and/or Require redundant sealing and Classify O-ring as Critical Part Class 1




Implementation• PDCA or Deming cycle• Encourages transparency

– Create baseline for more science-based decisions

• Facilitates communication– Matrix team approach– An aid to convince the stakeholders with trust

• Encourages a preventive approach– Proactive control of risks and uncertainty– Benefit of knowledge transfer by team approach

• Changes behavior– Better understanding of risk-based decisions– Acceptance of residual risks

Benefits of Risk Management Implementation:




Conclusion• Quality risk management is a process that

supports science-based and practical decisions when integrated into quality systems.

• Effective quality risk management can facilitate better and more informed decisions, and can provide regulators with greater assurance of a company’s ability to deal with potential risks.

• In addition, quality risk management can facilitate better use of resources by all parties.

• Quality risk management should be integrated into existing operations and documented appropriately.




References and Further Readings• ICH Q9: Quality Risk Management• ICH Q10: Pharmaceutical Quality System• ICH-Endorsed Guide for ICH Q8/Q9/Q10 Implementation• US FDA Guidance for Industry: Q9 Quality Risk Management• WHO GUIDELINE ON QUALITY RISK MANAGEMENT• ISO 31000:2009, Risk management – Principles and guidelines• ISO Guide 73:2009 Risk management – Vocabulary• ISO 14971:2007 Medical devices -- Application of risk

management to medical devices




“A ship is always safe at the shore but that is NOT what it is built for.”

Albert Einstein

quality risk management

Health & Medicine