Quality Risk Management

Below are excerpts from warning letters referencing defiencies related to Quality Risk Management:

You did not provide a risk assessment evaluating the potential effect of your deviations on the quality of API you previously repackaged and released.”
“Your response is inadequate because you did not provide a risk assessment of the lots tested with the unqualified secondary reference standards.”
“Your strategy should include … a comprehensive description of the root causes of your data integrity lapses, including evidence that the scope and depth of the current action plan is commensurate with the findings of the investigation and risk assessment.”
“FDA strongly recommends that your management immediately undertake a comprehensive assessment of your operations, including facility design, procedures, personnel, processes, materials, and systems.”
“Provide an assessment of the cross-contamination risks due to your current practices for the material flow of solvents, and any corrective actions resulting from this assessment. Also, provide an assessment of the contamination risk for batches within expiry.”
“In response to this letter, provide the following: (…) a risk assessment regarding the effects of your supplier changes on the distributed API.”
“In response to this letter, provide a comprehensive assessment of all in-process OOS results for (…), including root causes. Extend this assessment to other batches that might have been affected.”
[In your response provide] “A current risk assessment of the potential effects of the observed failures on the quality of your drugs. Your assessment should include analyses of the risks to patients caused by the release of drugs affected by a lapse of data integrity, and risks posed by ongoing operations.”

What are the above deficiencies telling us? It indicates that companies continue to lack a clear understanding of what a comprehensive Quality Risk Management program should look like. The main reference to Quality Risk Management lies in EU GMP Guidelines, Part 1, Chapter 1 where it states “To achieve the quality objective reliably there must be a comprehensively designed and correctly implemented system of Quality Assurance incorporating Good Manufacturing Practice, Quality Control and Quality Risk Management. It should be documented and its effectiveness monitored”. In Annex 16, Certification by a Qualified Person and Batch Release, the term “risk management” is referenced six times alone and similarly in the new draft of Annex 1 Manufacture of Sterile Medicinal Products “risk management is mentioned four times and “risk assessment” is referenced 25 times! ICH Q9 describes in detail the important tools to use in order to implement respective risk management and assessment principles. Typically, inter-disciplinary teams with experts from each of the given areas undertake the Quality Risk Management activities. So what are the inspectors looking for in reviewing a QRM system? Typically they are reviewing to see:

How the QRM integrates into the overall Quality System
How the company defines “Risk”. The high risk processes can be identified with the following criteria but not limited to:
- Lengthy process with numerous stages
- High risk of failure in the process
- History of failure
- Process that is heavily dependent on human intervention
- Process executed in older facilities
- Process or facility with numerous and frequent changes
How the inter-disciplinary teams are formed ensuring representation from all key areas. The assessment team should have the following capabilities:
- Include subject matter experts
- Be cross functional
- Have a solid understanding of the process being assessed
- Be experienced on the process being assessed
- Be qualified to perform the assessment with strong analytical skills
How decisions are reached ensuring this is appropriately documented. Address the following questions at a minimum during failure mode identification:
- What could fail at this step?
- Why would this failure occur?
- What could happen if failure occurs?
- Where might the failure occur?
How the actions are implemented. Consider for a re-design of the process
- If critical failure mode is identified
- If inadequate controls exist
- If existing process is not considered robust
How the QRM system links into continual improvement processes

Ultimately, applying risk management principles and using the QRM tools, the pharmaceutical industry and regulators can evaluate, control, communicate and review the risks. Effective QRM implementation can facilitate better and well-versed decisions which can provide regulators with greater assurance of a company’s ability to deal with possible risks. We provide advice and assistance on Quality Risk Management – please connect with us +353 1 846 47 42 or contactirl@pharmalex.com.