tony gould quality risk management. 2 | pq workshop, abu dhabi | october 2010 introduction risk...

Tony Gould

Quality Risk Management

2 | PQ Workshop, Abu Dhabi | October 2010

IntroductionIntroduction

Risk management is not new – we do it informally all the time

Military Standard 1629 dated 1974 regarding formal risk management

Risk management has been used in the medical device, telecommunications, aerospace and car industries for many years



Risk management has also been part of the pharma industry for many years:

– GMP requirements are designed to address risk. For example, the specific GMP requirements for sterile products are designed to mitigate the risk of sterility failure

– In some cases, GMP specifies a risk based approach. For example, "a risk assessment approach should be used to determine the scope and extent of validation required" (WHO Annex 4, 5.2.10)

– Specifications in pharmacopoeial monographs include tests for known potential contaminants



Greater use of risk management tools in the future We must accept this and prepare From a GMP point of view, we are only concerned

with risks associated with quality, safety and efficacy – quality risk management

Organisations use risk approaches in other areas, e.g. to ensure resources are utilised in the most effective way. Also applicable to inspectorates


GMP requirementGMP requirement

A system for quality risk management should be included in the quality assurance system

Quality risk management is a systematic process for the assessment, control, communication and review of risks to the quality of the medicinal product. It can be applied both proactively and retrospectively.

The quality risk management system should ensure that:– the evaluation of the risk to quality is based on scientific

knowledge, experience with the process and ultimately links to the protection of the patient; and

– the level of effort, formality and documentation of the quality isk management process is commensurate with the level of risk.

1.2 – 1.5


QRM - the dangersQRM - the dangers

There is a desired outcome and risk management is used to justify it

Invalid assumptions – suit the desired outcome Cost reduction (increased profits) is often the real

reason that many risk assessments are done– Cost reduction may be a secondary outcome

Variable tolerance of risk


QRM – from an inspectors point of viewQRM – from an inspectors point of view

Be prepared so that the process is understood Have sufficient knowledge to understand what has

been done and challenge assumptions, omissions etc

Be clear about when QRM is not appropriate Be flexible and accept the outcome of a

scientifically sound QRM exercise If done properly there should be increased

assurance of quality (and possibly cost savings)


What is QRMWhat is QRM

"Quality Risk Management is a systematic process for the assessment, control, communication and review of risks to the quality of the medicinal product across the product lifecycle." (ICH Q9)


Typical QRM processTypical QRM process

What might go wrong or has gone wrong?

What is likelihood or probability?

What are the consequences (severity)?

What is the level of risk? Any mitigating factors?

Risk Review

Ris

k C

om

mu

ni c

atio

n

Risk Assessment

Risk Evaluationunacceptable

Risk Control

Risk Analysis

Risk Reduction

Risk Identification

Review Events

Risk Acceptance

InitiateQuality Risk Management Process

Output / Result of theQuality Risk Management Process

Risk

Ma

nag

em

ent to

ols


Risk assessmentRisk assessment

"A systematic process of organizing information to support a risk decision to be made within a risk management process. It consists of the identification of hazards and the analysis and evaluation of risks associated with exposure to those hazards." (ICH Q9)


Risk assessment termsRisk assessment terms

Risk identification– Use of information to identify hazards or potential risks– Historical data, theoretical analysis, informed opinions

Risk analysis– Estimation of risk associated with identified hazards– Qualitative or quantitative– Links probability and severity– In some tools, includes detectability


Risk analysis - probabilityRisk analysis - probability

A simple qualitative tool:

P – Probability of Occurrence

HighLikely to occur

MediumMay occur

LowUnlikely to occur

RemoteVery unlikely to occur


Risk analysis - severityRisk analysis - severity

A simple qualitative tool:

S – severity level if event occurs

CriticalSerious GMP non-compliancePatient injury possible

ModerateSignificant GMP non-complianceImpact on patient possible

MinorMinor GMP non-complianceNo patient impact


Risk assessment termsRisk assessment terms

Risk evaluation– Compares identified and analysed risk against criteria– Considers probability, severity and detectability– Output can be qualitative (high, medium or low)– Output can be quantitative (probability x severity x

detectability)– Quantitative provides a relative ranking – prioritises

risk


Risk evaluationRisk evaluation

A simple risk table with risk acceptability criteria:

Risk = P x SSeverity

ProbabilityMinorModerateCritical

HighUnacceptable riskIntolerable riskIntolerable risk

MediumAcceptable riskUnacceptable riskIntolerable risk

LowAcceptable riskAcceptable riskUnacceptable risk

RemoteAcceptable riskAcceptable riskAcceptable risk



Modify evaluated risk according to existing detection controls

Detectability:– High – the control is likely to detect the negative event

or its effects– Medium – the control may detect the negative event

or its effects– Low – the control is not likely to detect the negative

event or its effects– Zero – no detection control in place



Risk definitions:

Intolerable – work to eliminate the negative event or introduce detection controls is required as a

priority

Unacceptable – work to reduce the risk or control the risk to an acceptable level is required

Acceptable – the risk is acceptable and no risk reduction or detection controls are required


Risk controlRisk control

"Actions implementing risk management decisions" (ICH Q9)

– Includes risk reduction (if applicable) and risk acceptance


Risk control termsRisk control terms

Risk reduction– Actions taken to lessen the probability of occurrence

of harm and the severity of that harm – Typically CAPA and change control

Risk acceptance– The decision to accept risk– If risk reduction action taken, follows re-analysis and

evaluation


Risk ReviewRisk Review

"Review or monitoring of output/results of the risk management process considering (if appropriate) new knowledge and experience about the risk." (ICH Q9)

– Ensures nothing has changed to affect the QRM assumptions, output and conclusions

– Consider during product review


QRM tools – some of them!QRM tools – some of them!

Basic risk management facilitation methods (flowcharts, check sheets etc.);

Failure Mode Effects Analysis (FMEA); Failure Mode, Effects and Criticality Analysis (FMECA); Fault Tree Analysis (FTA); Hazard Analysis and Critical Control Points (HACCP); Hazard Operability Analysis (HAZOP); Preliminary Hazard Analysis (PHA); Risk ranking and filtering; Supporting statistical tools.


Potential applicationsPotential applications

Quality Management (e.g. self-inspection, training, complaints, deviations, change control)

Development (ICH Q8) Facilities, Equipment and Utilities (e.g. design, qualification,

hygiene, calibration, computers) Materials Management (e.g. supplier assessment, storage) Production (e.g. validation, in-process sampling and testing) Laboratory Control and Stability Studies (e.g. OOS, retest

periods, validation) Packaging and Labelling (e.g. package design, label control)

tony gould quality risk management. 2 | pq workshop, abu dhabi | october 2010 introduction risk...

Documents