risk management through electronic enforcement management through electronic enforcement ... ich q9...

Risk Management through Electronic EnforcementRisk Management through Electronic EnforcementFDA Regulatory and Compliance SymposiumManaging Risks – From Pipeline to Patient

• FDA Regulatory and Compliance Symposium© 2006 Brooks Software2

WHAT WE HAVE:A collection of manufacturing assets, products and technologies, that continue to be insufficient, and are by design, incapable of meeting the new challenges.

“We’ve had a few problems scaling up from the lab”Source: Medical Manufacturing, New Technology Imperative, James Bradburn, IBM Life Sciences

Life Science Manufacturing Realities?Life Science Manufacturing Realities?

Hazard

Risk

Potential source of harmProbability of the

occurrence of harm and theseverity of that harm.

IntroductionIntroduction

Hazard


Process of completing risk analysis and risk evaluation.Risk Assessment

Process through which decisions are reached and protective measures are implemented for reducing or maintaining risks within specified levels.

Risk Control

Risk remaining after protective measures have been taken.Residual Risk

Systematic application of management policies, procedures, and practices toward analyzing, evaluating, and controlling risk.

Risk Management

Based on the risk analysis, a judgment of whether a risk is acceptable based on societal values.

Risk Evaluation

Systematic use of available information to identify hazards and estimate risk.

Risk Analysis

Probability of the occurrence of harm and the severity of that harm

Risk

Potential source of harmHazard

DefinitionsDefinitions


Time to focus on Operational Excellence BasicsTime to focus on Operational Excellence Basics•• The cost of nonconformance extends beyond the direct costs of quThe cost of nonconformance extends beyond the direct costs of quarantining, arantining,

recall and rework, and fines to the destruction of brand equity.recall and rework, and fines to the destruction of brand equity.

•• Compliance strategy needs to be centrally developed and coordinaCompliance strategy needs to be centrally developed and coordinatedted——it it cannot be delegated to individual manufacturing sites.cannot be delegated to individual manufacturing sites.

•• The silos of quality and manufacturing must be broken down, and The silos of quality and manufacturing must be broken down, and a tighter a tighter integration of technology is required to sense, correct, preventintegration of technology is required to sense, correct, prevent, and report , and report effectively on manufacturing nonconformance events.effectively on manufacturing nonconformance events.

•• This problem is endemic to the pharma and life science industry.This problem is endemic to the pharma and life science industry. Disconnects Disconnects exist between different parts of the manufacturing product supplexist between different parts of the manufacturing product supply, regulatory, y, regulatory, and commercial functions.and commercial functions.

•• This is primarily a This is primarily a business process problembusiness process problem, as process requirements and , as process requirements and written procedures are not consistent throughout the organizatiowritten procedures are not consistent throughout the organization. But many n. But many pharma and life science organizations still have not reengineerepharma and life science organizations still have not reengineered their d their processes and organizational structures, relying on inconsistentprocesses and organizational structures, relying on inconsistent and manually and manually enforced compliance processes.enforced compliance processes.

Source: AMR Research, Compliance Trouble at Boston Scientific: An Isolated Incident or Part of a Growing Industry Liability?, February 09, 2006; Hussain Mooraj, Colin Masson, Roddy Martin


Multiple Compliance FrontsMultiple Compliance Fronts

Management of

Regulatory Compliance

Management of

Regulatory Compliance

Sarbanes Oxley

Sarbanes Oxley

HIPAAHIPAA21

CFR Part 11

21 CFR

Part 11

cGMPcGMP

Chief Compliance Officer

Regulatory Affairs

CAPA

Ex Com

QA/QC

CIO / ITFDAFDA

SECSEC

EPAEPA

OIGOIG

Source: AMR Research, Compliance Webinar, Roddy Martin, Joseph Vinhais, May 2004


How do you drive Governance and Compliance into Manufacturing?

Driv

e C

ompl

ianc

e

Time to Market

Share H

older Value

Who are the stake holders?Who are the stake holders?


Synchronizing change, execution, and enforcementSynchronizing change, execution, and enforcement

Compliance and process improvement are both based on following documented processes. Three mechanisms need to be coordinated:

Execute process —Train employees on the process, assess their performance, and, if necessary, take steps to improve their performance and adherence to it by improving training or other actions.

Enforce controls —Compliance adds a duty to control the process actively, perhaps by technical means, such as workflow. Companies must also audit the results to ensure that the controls work and detect any changes in the process, systems, or people that affect compliance. In addition, companies must constantly evaluate the controls to see if they are in fact meeting the desired control objectives.

Change process —For both compliance and business improvement purposes, companies need to evaluate their processes constantly and look for ways to improve them. This starts a new cycle of process design, followed by a project to implement the changed process.

Source: AMR Research, 2003


Medical Devices

ISO 14971, Application of RiskManagement to Medical Devices

Pharmaceuticals

cGMPs for the 21st CenturyA Risked-Based Approach

FDA’s 5 Part Strategic Plan

Quality Systems-based Inspections

1. Quality System2. Facilities & Equipment

system3. Materials System4. Production System5. Packaging & Labeling

System6. Laboratory Control

System

1. Quality System2. Facilities & Equipment

system3. Materials System4. Production System5. Packaging & Labeling

System6. Laboratory Control

System

1. Management Responsibility2. Design Control3. CAPA4. Production and Process

Control5. Records/Document Change

Controls6. Materials Controls7. Facilities & Equipment

Controls

1. Management Responsibility2. Design Control3. CAPA4. Production and Process

Control5. Records/Document Change

Controls6. Materials Controls7. Facilities & Equipment

Controls

1. Efficient Science-Based Risk Management

2. Patient & Consumer Safety

3. Better Informed Customers

4. Counterterrorism5. A Strong FDA

1. Efficient Science-Based Risk Management

2. Patient & Consumer Safety

3. Better Informed Customers

4. Counterterrorism5. A Strong FDA

cGMP CompliancecGMP Compliance


Source: ISO13485:2003 – An Overview (Bangkok, Thailand, June 2005), Gunter Frey, GHTF SG3

Global Medical Devices - Quality System RequirementsGlobal Medical Devices - Quality System Requirements


ICH Q9 Quality Risk ManagementICH Q9 Quality Risk Management


Implementation ofRisk Control

Measures

Culture on RiskCommunication

RMPolicy

An Integrated RiskManagement Process

(for all phases of the life of the product)

TrainingOf

Personnel

PostProductionMonitoring

RiskGraph

ResidualRisk

Risk Hazard

Cause

VerificationOf

Effectiveness

Source: ASQ Biomedical 09 December 2004, Alfred M. Dolan

EU14971:2003 Corporate Risk Management ProgramEU14971:2003 Corporate Risk Management Program


Low impact Medium impact High impact

Select good IT practice

Select generic & specific controls

Select generic controls

Periodic review and evaluationStep 5

Step 4

Identify generic hazards

Assess severity & likelihood

Identify generic & specific hazards

Assess probability of detection

Derive risk priorityConsider risks

Identify the electronic records and signatures

Assess impact of records and signatures

Step 3

Step 2

Step 1

The GAMP 4 Risk Model for Electronic Records and Electronic Signatures (ERES)

Source: FDANews, 2005

GAMP 4 and Part 11GAMP 4 and Part 11


GHTF Risk Management Activities in Design & DevelopmentGHTF Risk Management Activities in Design & Development


Source: GHTF. 2005

How risk management can be integrated into the CAPA processHow risk management can be integrated into the CAPA process


Risk Analysis• Intended Purpose Identification• Hazard Identification• Risk Estimation

Risk Evaluation

• Risk Acceptability Decision

Risk Control• Options analysis• Implementation• Residual Risk Evaluation• Overall Risk Acceptance

Post-production Information• Post-production experience• Systemic Procedures• Identification of new Hazards• Change Control & Feedback Loop

RiskAssessment

RiskManagement

Preliminary Hazard Analysis

Fault Tree AnalysisFunctional Analysis

Tolerability of RiskCost-Benefit AnalysisSocio/Ethical Analysis

FMECAHACCPHAZOPPAT

Six SigmaSPCCAPAComplaint Mgmt.

Aligning Risk Management ToolsAligning Risk Management Tools


Source: GHTF. 2005

Risk Chart for Communicating Internal Risk Management ActivitiesRisk Chart for Communicating Internal Risk Management Activities

Site Risk Potential (SRP) Site Risk Potential (SRP)


Product quality and performance achieved and Product quality and performance achieved and assured by design of assured by design of effective and efficient effective and efficient manufacturing processesmanufacturing processes

Product specifications based on mechanistic Product specifications based on mechanistic understanding of how formulation and process understanding of how formulation and process factors impact product performancefactors impact product performance

Continuous Continuous "real time" assurance of quality"real time" assurance of quality

Source: The Process Analytical Technology Initiative: PAT and the Pharmacopeias, Ajaz S. Hussain, Ph.D. Deputy Director Office of Pharmaceutical Science CDER, FDA

Desired StateDesired State


all critical sources of variability identified and explained

variability managed by the process

product quality attributes can be accurately and reliably predicted

product specifications based on understanding of how formulation and process factors impact product performance

Source: PDA, PAT & Risk Based Initiatives, Implementation Issues: C. Cambell

Know your processes!Know your processes!


Materials

MethodsMan

MediumMachine

Measurement

Input Process OutputManagement

Source: PDA, The Harmonized PAT Solution: Application of Risk-Based Tools & PAT Strategies in Pharmaceutical Product Manufacture: J. Priem

Process Variation - Seven (7) M’sProcess Variation - Seven (7) M’s


INPUTS

(x)

Machine

Methods

Measure System

Prior Ops

Materials

Man

Machine - Equipment

Method - Process

Medium - Environment

Materials

Measurement

Man - People Inputs to the process Inputs to the process control variabilitycontrol variability

of the outputof the output

Output

y = f(x)y

Variability - source of the “Process” risks to the product

Source: Risk Reduction in Pharmaceutical Manufacturing using Process Analytical Technology, Brian Davies, Thermo Electron Corporation

Sources of VariabilitySources of Variability

Example50 Products

X10 Operations

X10 Orders per Year

X10 Lots/Batches/Units per Order

X12 Months (30 days per order)

X10 Transactions per Unit per Operation

=6,000,000 Transactions per year

3.43.499.999799.9997(top companies)(top companies)

+/+/-- 6 sigma (near 6 sigma (near perfect)perfect)

23323399.9767099.97670+/+/-- 5 sigma5 sigma

6,2106,21099.37999.379+/+/-- 4 sigma4 sigma

66,81066,81093.3293.32(most companies)(most companies)

+/+/-- 3 sigma3 sigma

308,700308,70069.1369.13+/+/-- 2 sigma2 sigma

697,700697,70030.2330.23+/+/-- 1 sigma1 sigma

Defects per Defects per OpportunityOpportunity

(traditionally PPM)(traditionally PPM)PercentPercentSpec LimitSpec Limit


Work Processes

AbnormalNormal

Non Value Add

UnnecessaryNecessary

EliminateReduce

Value Add

Flow

eliminate the abnormal and the unnecessary non- value added tasks

reduce the non-value added but necessary, e.g. regulatory

place the value-added processes into a natural sequence

Evaluation of Process StepsEvaluation of Process Steps


Value-creating tasks: Actions necessary for making products, such as welding or drilling.

Incidental work: Actions necessary to make products, but that don’t create value from the customer’s standpoint. Such actions include reaching for a tool or clamping fixture.

Waste: Actions that (a) create no value from the customer’s perspective and (b) can be eliminated from a process; e.g. walking to get tools that can be positioned within reach of a worker.

Value-Creating

Tasks12%

Incidental Work41%

Pure Waste47%

In a typical company, the greatest percentage of time is spent on tasks that are pure waste. Source: Lean Advisors Inc.

Source: Manufactures Get Lean to Trim Waste, William Leventon, Medical Device & Diagnostic Industry, September 2004

Identifying value added and non-value added

Value-Stream MappingValue-Stream Mapping


IncomingMaterials.

SpecificationsRelevant to

“Process-ability”

Incoming material attributesused to predict/adjust

optimal processing parameterswithin established bounds

(more flexible bounds)

PACPACPACPAC

PACPAC

PCCPPCCP

LTLTCMCMITIT

Direct or inferentialassessment of quality

and performance (at/on-line)

Control of process criticalcontrol points (PCCP).

Process end point (PEPs’) rangebased on “performance” attributes.

PEP’s

Chemometrics (CM)and IT Tools

for “real time”control and decisions

At-lineIn/On-Line

Process AnalyticalChemistry Tools Laboratory

or othertests

LTLT

Development/Optimization/Continuous Improvement(DOE, Evolutionary optimization, Improved efficiency)

MultivariateSystems Approach

RiskClassificationand MitigationStrategies

Source: ACPS, Process Analytical Technologies (PAT) Sub-Committee Report: T. Layloff, Ph.D

PAT Conceptual FrameworkPAT Conceptual Framework


Strength

PurityQuality

Identity

Potency

FailureMode

Cause Effect

Ishikawa

P o t e n t i a lF a i l u r e M o d e a n d E f f e c t s A n a l y s i s

( D e s i g n F M E A )_ _ S y s t e m_ _ S u b s y s t e m_ _ C o m p o n e n t

M o d e l Y e a r / V e h i c l e ( s ) :C o r e T e a m :

D e s i g n R e s p o n s i b i l i t yK e y D a t e :

F M E A N u m b e r :P a g e 1 o r 1P r e p a r e d b y : L e e D a w s o nF M E A D a t e ( O r i g . ) :

I t e m

F u n c t i o n

P o t e n t i a lF a i l u r eM o d e

P o t e n t i a lE f f e c t ( s ) o f

F a i l u r e

P o t e n t i a l C a u s e ( s ) /

M e c h a n i s m ( s )O f F a i l u r e

C u r r e n tD e s i g n

C o n t r o l sP r e v e n t i o n


C o n t r o l sD e t e c t i o n

R e c o m m e n d e dA c t i o n ( s )

R e s p o n s i b i l i t y& T a r g e t

C o m p l e t i o nD a t e

A c t i o n sT a k e n

A c t i o n R e s u l t sSEV

CLASS

OCCUR

DETEC

R .P .N .

SEV

OCC

DET

R .P .N .

P o t e n t i a lF a i l u r e M o d e a n d E f f e c t s A n a l y s i s

( D e s i g n F M E A )_ _ S y s t e m_ _ S u b s y s t e m_ _ C o m p o n e n t

M o d e l Y e a r / V e h i c l e ( s ) :C o r e T e a m :

D e s i g n R e s p o n s i b i l i t yK e y D a t e :

F M E A N u m b e r :P a g e 1 o r 1P r e p a r e d b y : L e e D a w s o nF M E A D a t e ( O r i g . ) :

I t e m

F u n c t i o n

P o t e n t i a lF a i l u r eM o d e

P o t e n t i a lE f f e c t ( s ) o f

F a i l u r e

P o t e n t i a l C a u s e ( s ) /

M e c h a n i s m ( s )O f F a i l u r e


C o n t r o l sP r e v e n t i o n


C o n t r o l sD e t e c t i o n

R e c o m m e n d e dA c t i o n ( s )

R e s p o n s i b i l i t y& T a r g e t

C o m p l e t i o nD a t e

A c t i o n sT a k e n

A c t i o n R e s u l t sSEV

CLASS

OCCUR

DETEC

R .P .N .

SEV

OCC

DET

R .P .N .

FMECA

0123456789

10

Qua

ntity

A. Very High B. High C. Moderate D. Low E. Remote

I. CatastrophicII. Critical

III. MarginalIV. Minor

Probability of Occurance

Severi

ty

Criticality Matrix

DOE

Multivariate Analysis

SPC

RawMaterial Dispensing Granulation Drying Milling Mixing Tabletting Coating

Source: ISPE-Boston, Feb. 2005

PAT ExamplePAT Example


Site Risk Potential

Product Process Facility

CD1 CD2 CP1 CP2 CF1 CF1

Top Level Components

Categories ofRisk Factors

Risk Factors(quantitative or qualitativevariables)

Dosage form; intrinsicchemical properties

Poor cGMP compliancehistory

Measuring; mixing; compression; filling

FDA’s SRP Hierarchy (Sept. 04)FDA’s SRP Hierarchy (Sept. 04)


SystemsDirect Indirect Non

gmp

gep gepgep

+

ComponentsCritical Non Critical

comm.

qual.

comm.

+

cGMP Impact Assessments

&


Physical RiskPhysical Risk


Class-I Class-II Class-III

IntolerableRisk cannot be

justified except in

extraordinarycircumstances

UndesirableTolerable only

if risk reduction is impracticable or

the costs are grossly disproportionate

to the improvementgained

TolerableTolerable if the cost of the risk

reductionwould exceed the

improvement gained

NegligibleTolerable if the cost of the risk

reductionwould exceed the

improvement gained

IECFunctional Safety: safety-related systems

Class-IV


Functional RiskFunctional Risk


111122LowLow

112233MediumMedium

223333HighHigh

Low ImpactLow ImpactMediumMediumImpactImpact

High High ImpactImpact

ProbabilityProbability

Risk ClassRisk Class

MMLLLL11

HHMMLL22

HHHHMM33

LowLowDetectionDetection

MediumMediumDetectionDetection

HighHighDetectionDetection

Risk PriorityRisk Priority

Risk ClassRisk Class

Class f (probability, impact) Priority f (class, detection)


Process RiskProcess Risk


PhysicalRisk

C N

FunctionalRisk

IIIIII IV

ProcessRisk

M LH 0

StandardComponents

StandardOperations

StandardParameters

SRPMitigation

Plan


Risk IntegrationRisk Integration


CNIIIIIIHML

IQ OQ PQ PV PAT QADQ

X X X X

FDA

Process Risk

FunctionalRisk

PhysicalRisk

X X X X

X X X X

X

X


Risk DividendRisk Dividend

Electronic EnforcementElectronic Enforcement


Execution Systems Orchestrate ProductionExecution Systems Orchestrate Production

Machine Line Plant Enterprise

Controls

Parameters

Data ReadingsStatus

People

Shop Packet

Work Status

ProductionStatus

ERP

Product & process

data definitions

Product & process data

definitions

ProductionOrders

Execution System

Set points

Equipment

PLM/EDM

Manufacturing Process

Product & process

data definitions

TraceabilityInventory

Picklist

Consumption

PACPACPCCPPCCP

CMCMITIT

PEP’s

PAT

Source: IBM Life Sciences, James Bradburn


PLM CRMERP

Financials BOM OrderFulfillment Inventory

Automation and Data Capture

RawMaterial Machining Cleaning Assembly Testing Packaging

QMS AQP Auditing Training InspectionTest

NCR(CAR, SCARs)

CAPAComplaints

Service Oriented Architecture & Integration Framework

Process & Equipment Optimization Layer

Manufacturing Execution

BatchControl

LineMonitoring

Weigh &Dispense

Material Flow& Lot Tracing

ContainerManagement

Dat

a C

olle

ctio

n,

Rep

ortin

g, M

etric

s/K

PIs

Ala

rms

& E

scal

atio

ns

Stat

istic

al

Proc

ess

Con

trol

WIP

Tra

ckin

g

Equi

pmen

tM

anag

emen

t

Proc

ess

Plan

ning

Work Order Management

MBOM

Work Instructions & Procedures

Operator Tracking

(change, execution, and enforcement)O

pera

tiona

l/Tra

nsac

tiona

l Con

trol

Enterprise M

anufacturing Com

pliance

Risk Management “File”

Align Enterprise ApplicationsAlign Enterprise Applications


Initiate Containment

Action

Initiate Root Cause

Analysis

Initiate CAPA

Process

Request for CAPA Plan

Review CAPA Plan

CAPA Plan Approved?

Initiate Implementation

Implement&

Sign-Off

Verify Effectiveness

Close CAPA

PROCEDURE

REGULATIONClient

ReporterCRM Sys. Paper Trail begins,

Notifications to appropriate parties

Complaint Submission Process

AcknowledgementLetter to Customer

Issue a CAPA to Plant

ReviewEdit/Close

Regulatory Submission( Such as 30 day MDR5 day MDR, Summary)

Complaint Coordinator Process

Complaint Coordinator

Plant Complaint Coordinator

Closure LetterTo Client

SOP

CORPORATEPOLICY

Existing Regulatory Process ControlExisting Regulatory Process Control


Electronic EnforcementElectronic Enforcement


Regulatory/Compliance “Process” ManagementRegulatory/Compliance “Process” Management

• Start jobs based upon:• Web service external event• Web service start job request• Repository updates (filtered) from MES,

MCS or other data sources• Scheduled start

Multiple workflow paths depending on eventRun Rules and Reports for decision supportContext filtering and evaluationSynchronization with multiple start events or wait for events

Multiple responses possible depending on flow pathExecute web service calls to external systems such as MES, ERP, CAPA and othersExecute email, logging, exporting SQL, external applications, and other executions

Manufacturing Compliance Framework


• GHTF, Implementation of risk management principles and activities within a Quality Management System, May 20, 2005

• FDANews, Introduction to GAMP Good Practice Guide: A Risk-Based Approach to E-Record Compliance, Per Olsson

• FDA, A Risk-Based Approach to Pharmaceutical Current Good Manufacturing Practices (cGMP) for the 21st Century

• PAT & Risk-Based Initiatives: Implementation Issues; PDA New England - 08 Dec 2004, Cliff Campbell B.E., C.Eng

• The Harmonized PAT Solution: Application of Risk-Based Tools & PAT Strategies in Pharmaceutical Product Manufacture; PDA New England – 08 Dec 2004, Jeffrey A. Priem

• Process Analytical Technologies (PAT) Sub-Committee Report ACPS Meeting 21 October 2002, Tom Layloff, Ph.D.

• Risk Management, From Basic to Advanced; RAPS – 11 October 2004, Kevin P. Bassett; Matthias M. Buerger; Oliver P. Christ

• Importance and Impact of ISO 13485:2003, RAPS – 13 October 2004, Ed Kimmelman, JD

• Risk Management of Medical Devices: Implementation, ASQ Biomedical 09 December 2004, Alfred M. Dolan

• Implementation of Risk Management Principles within a Quality Management System, 09 December 2004, Kimberly Trautman

• ISO 14971:2000, Essentials 1st Edition, A practical handbook for implementing the ISO 14971 Standards for medical devices, Canadian Standards Association

• IEE Tolerability of Risk Framework hsc36, Health and Safety Briefings - October 2000

• FDA, A perspective on Risk Analysis for the GMP Initiative - April 2003, H. Gregg Claycamp, Ph.D., CHP

• Risk Reduction in Pharmaceutical Manufacturing using Process Analytical Technology, Brian Davies

• Risk-Based Method for Prioritizing cGMP Inspections – September 2004, Department of Health and Human Services U.S. Food and Drug Administration

• Pharmaceutical Manufacturing: New Technology Opportunities – 16 November 2001, G.K.Raju, Ph.D

• PAT Progress Report: 13 April 2004 ACPS Meeting, Ajaz S. Hussain, Ph.D. Deputy Director Office of Pharmaceutical Science CDER, FDA

• Guidance for Industry, PAT - A Framework for Innovative Pharmaceutical Manufacturing and Quality Assurance DRAFT GUIDANCE

• Process Analytical Technology (PAT): What’s in a name? – 09 April 2004, D. Christopher Watts, Ph.D. Office of Pharmaceutical Science, CDER, FDA

SourcesSources

Thank YouThank YouJoseph [email protected]://lifesciences.brookssoftware.com

risk management through electronic enforcement management through electronic enforcement ... ich q9...

Documents