Quality Risk Management

Quality Risk management in pharmaceutical Industry. A general Review on Risk analysis and Risk assessment in pharmaceutical Industry as it is prescribed by GMP regulations of WHO, ICH, FDA.

1. Quality Risk Management Risk Analysis Or in more general terms: Quality Risk Management March 2014

2. Quality Relationship Quality Management Quality Assurance GMP Production and Quality Control

3. Quality Relationship GMP (Good Manufacturing Practices ) Is the part of quality assurance that ensures that products are produced and controlled consistently and reliably . It can only come about by having clear descriptions of the way in which the work will be done. GMP specifically addresses risks that cannot be fully controlled by testing of the final product : Cross-contamination Mix-ups These risks can best be controlled by having a properly managed system of working that takes them into account. Quality Management Quality Assurance Production and Quality Control

4. Quality Relationship Quality Management

5. INTRODUCTION Risk management is not new – we do it informally all the time Risk management principles are effectively utilized in many areas of business and government. Military Standard 1629 dated 1974 regarding formal risk management Risk management has been used in the medical device, telecommunications, aerospace and car industries for many years.

6. INTRODUCTION ISO 31000:2009 Principles (Clause 3) Risk management should…. 1. Create value 2.Be an integral part of organizational processes 3.Be part of decision making 4.Explicitly address uncertainty 5.Be systematic and structured 6.Be based on the best available information 7.Be tailored 8.Take into account human factors 9.Be transparent and inclusive 10.Be dynamic , iterative and responsive to change 11.Be capable of continual improvement and enhancement

7. INTRODUCTION Managing risk means forward thinking Managing risk means responsible thinking Managing risk means balanced thinking Managing risk is all about maximizing opportunity and minimizing threats The risk management process provides a framework to facilitate more effective decision making Quality by Design Risk Management is about making value out of uncertainty

8. Risk Management in Pharma . Industry From a GMP point of view, we are only concerned with risks associated with quality , safety and efficacy Quality Risk Management Organisations use risk approaches in other areas, e.g. to ensure resources are utilised in the most effective way. Patient Safety

9. DEFINITIONS Harm : Damage to health, including the damage that can occur from loss of product quality or availability. Hazard: The potential source of harm Risk (In Pharmaceutical POV): The combination of the probability of occurrence of harm and the severity of that harm. Risk (In General – ISO31000): effect of uncertainty on objectives An effect is a deviation from the expected — positive and/or negative. Objectives can have different aspects (such as financial, health and safety, and environmental goals) Uncertainty is the state, even partial, of deficiency of information related to, understanding or knowledge of, an event, its consequence, or likelihood. Risk is often expressed in terms of a combination of the consequences of an event (including changes in circumstances) and the associated likelihood of occurrence. EVENT! EVENT!

10. Principles Two primary principles of quality risk management are: The evaluation of the risk to quality should be based on scientific knowledge and ultimately link to the protection of the patient ; and The level of effort , formality and documentation of the quality risk management process should be commensurate with the level of risk .

11. QUALITY RISK MANAGEMENT PROCESS Quality risk management is a systematic process for the assessment , control , communication and review of risks to the quality of the medicinal product across the product lifecycle .

12. Responsibilities Quality risk management activities are usually, undertaken by interdisciplinary teams . CFTs may include experts from the appropriate areas e.g., quality unit , business development , engineering , regulatory affairs , production operations, sales and marketing , legal , statistics and clinical in addition to individuals who are knowledgeable about the quality risk management process.

13. Risk Assessment A systematic process of organizing information to support a risk decision to be made within a risk management process. It consists of the identification of hazards and the analysis and evaluation of risks associated with exposure to those hazards. What might go wrong ( Identification )? What is the likelihood ( probability ) it will go wrong? What are the consequences ( severity )?

14. Risk Assessment Risk identification Use of information to identify hazards or potential risks Historical data, theoretical analysis, informed opinions Risk analysis Estimation of risk associated with identified hazards Qualitative or quantitative Links probability and severity In some tools, includes detectability

15. Risk analysis Probability Severity Detectability Likely to occur High (4) Serious GMP non-compliance Patient injury possible Critical (10) An specific detection System or Indicator exists Easily Detectable (0.75) May occur Medium (3) Significant GMP non-compliance Impact on patient possible Moderate (5) No specific detection system but can be detected on daily inspections Moderate Detectability (1) Unlikely to occur Low (2) Minor GMP non-compliance No patient impact Minor (1) May be detected accidentally Probably Detectable (1.25) Very unlikely to occur Remote (1) No mentionable Impact None (0) Un -detectable Hardly Detectable (1.5)

16. Risk Evaluation Risk evaluation Compares identified and analysed risk against criteria Considers probability, severity and detectability Output can be qualitative (high, medium or low) Output can be quantitative (probability x severity x detectability ) Quantitative provides a relative ranking – prioritises risk Risk = Probability x Severity x Detectability

17. Risk Evaluation Risk definitions: Based of Quantitative or Qualitative outputs, Risks are categorized as follows:  Intolerable – work to eliminate the negative event or introduce detection controls is required as a priority  Unacceptable – work to reduce the risk or control the risk to an acceptable level is required  Acceptable – the risk is acceptable and no risk reduction or detection controls are required

18. Risk Control Risk control includes decision making to reduce and / or accept risks. The purpose of risk control is to reduce the risk to an acceptable level. The amount of effort used for risk control should be proportional to the significance of the risk.

19. Risk Control Risk control might focus on the following questions: Is the risk above an acceptable level ? What can be done to reduce or eliminate risks? What is the appropriate balance among benefits, risks and resources? Are new risks introduced as a result of the identified risks being controlled?

20. Risk Control Risk reduction Actions taken to lessen the probability of occurrence of harm and the severity of that harm Typically CAPA and change control Risk acceptance The decision to accept risk If risk reduction action taken, follows re-analysis and evaluation

21. Change Control Vs. Risk Management Change Control Risk Management OUTPUT /INPUT Risk Assessment Risk Control

22. Risk Communication Risk communication is the sharing of information about risk and risk management between the decision makers and others. Parties can communicate at any stage of the risk management process

23. Risk Review Risk management should be an ongoing part of the quality management process. Review or monitoring of output/results of the risk management process considering (if appropriate) new knowledge and experience about the risk Ensures nothing has changed to affect the QRM assumptions, output and conclusions Consider during product review The frequency of any review should be based upon the level of risk. Risk review might include reconsideration of risk acceptance decisions

24. RISK MANAGEMENT METHODOLOGY Quality risk management supports a scientific and practical approach to decision making . It provides documented , transparent and reproducible methods to accomplish steps of the quality risk management process. Traditionally, risks to quality have been assessed and managed in a variety of informal ways based on, for example, compilation of observations , trends and other information.

25. Risk Management Tools Pharmaceutical industry and regulators can assess and manage risk using recognized risk management tools : Basic risk management facilitation methods (flowcharts, check sheets etc.) Failure Mode Effects Analysis (FMEA); Failure Mode, Effects and Criticality Analysis (FMECA); Fault Tree Analysis (FTA); Hazard Analysis and Critical Control Points (HACCP); Hazard Operability Analysis (HAZOP); Preliminary Hazard Analysis (PHA); Risk ranking and filtering; Supporting statistical tools.

26. FMEA as an example Failure Mode and Effects Analysis  ( FMEA ) was one of the first systematic techniques for failure analysis. FMEA Ref. Item Potential failure mode Potential cause(s) / mechanism Mission Phase Local effects of failure Next higher level effect System Level End Effect (P) Probability (estimate) (S) Severity Detection (Indications to Operator, Maintainer) (D) Detection Dormancy Period Risk Level P*S (+D) Actions for further Investigation / evidence Mitigation / Requirements 1.1.1 Brake Manifold Ref. Designator 2b, channel A, O-ring Internal Leakage from Channel A to B a) O-ring Compression Set (Creep) failure b) surface damage during assembly Landing Decreased pressure to main brake hose No Left Wheel Braking Severely Reduced Aircraft deceleration on ground and side drift. Partial loss of runway position control. Risk of collision (C) Occasional (VI) Catastrophic (this is the worst case) (1) Flight Computer and Maintenance Computer will indicate "Left Main Brake, Pressure Low" Built-In Test interval is 1 minute Unacceptable Check Dormancy Period and probability of failure Require redundant independent brake hydraulic channels and/or Require redundant sealing and Classify O-ring as Critical Part Class 1

27. Implementation PDCA or Deming cycle Encourages transparency Create baseline for more science-based decisions Facilitates communication Matrix team approach An aid to convince the stakeholders with trust Encourages a preventive approach Proactive control of risks and uncertainty Benefit of knowledge transfer by team approach Changes behavior Better understanding of risk-based decisions Acceptance of residual risks Benefits of Risk Management Implementation:

28. Conclusion Quality risk management is a process that supports science-based and practical decisions when integrated into quality systems. Effective quality risk management can facilitate better and more informed decisions , and can provide regulators with greater assurance of a company’s ability to deal with potential risks. In addition, quality risk management can facilitate better use of resources by all parties. Quality risk management should be integrated into existing operations and documented appropriately.

29. References and Further Readings ICH Q9: Quality Risk Management ICH Q10: Pharmaceutical Quality System ICH-Endorsed Guide for ICH Q8/Q9/Q10 Implementation US FDA Guidance for Industry: Q9 Quality Risk Management WHO GUIDELINE ON QUALITY RISK MANAGEMENT ISO 31000:2009,  Risk management – Principles and guidelines ISO Guide 73:2009 Risk management – Vocabulary ISO 14971:2007 Medical devices -- Application of risk management to medical devices

30. “A ship is always safe at the shore but that is NOT what it is built for.”  Albert Einstein