First Step in QbD: 
How to get it Right 
ISPE 2014 
Sun Kim, PhD
Are You ... 
1. Starting a QbD project & want to skip 
common pitfalls? 
2. Tried QbD but management and colleagues 
were skeptical? 
3. undecided if QbD is for your organization?
QbD in 3 Steps 
1. Risk Assessment: 
Build Relationships from QTPP, CQA to CPP (CMA) 
2. Design Space 
3. Control Strategy
You Are Not Alone. 
17 Likes 
47 Comments
Sampling of LinkedIn Comments 
“It is like a loop I always have to dealt with, 
everytime!” - S of Angelini 
“The first part of your blog literally had me 
laughing out loud. This is so true and relevant.” 
-I of Teva 
“I completely agree with you that FMEA, 
especially in the early development, is not the 
ideal tool” - F of PTM Consulting”
Sampling of LinkedIn Comments 
“How refreshing to see this. Thank you so 
much for noting that the FMEA emperor may be 
missing some clothing.” - D, Statistician 
“The formality of risk assessment should align 
with the level of product and process 
understanding. FMEA definitely has its place, 
but later in the development process.” - S of 
UpsherSmith
Agenda 
0. Story 
1. Why Risk Assessment is Critical to QbD 
2. Why You shouldn’t blindly apply FMEA for 
QbD development projects. 
3. A Smarter Risk Assessment Approach
Why Risk Assessment determines 
success and failure of QbD 
1. 1st step & planning stage of QbD 
2. Output is Control Strategy 
3. Precursor to Design Space studies
Why Risk Assessment determines 
success and failure of QbD 
1. 1st step & planning stage of QbD 
a. Scientists dread these types of meetings 
b. If this doesn’t go well, the momentum fizzles 
c. Links QTPP-CQA-CPP-CS
Why Risk Assessment determines 
success and failure of QbD 
1. 1st step & planning stage of QbD 
a. Scientists hate these types of meetings 
b. If this doesn’t go well, the momentum fizzles 
c. Links QTPP-CQA-CPP-CS 
2. Output: Control Strategy 
a. Prioritized list of projects or experiments
Why Risk Assessment determines 
success and failure of QbD 
1. 1st step & planning stage of QbD 
a. Scientists hate these types of meetings 
b. If this doesn’t go well, the momentum fizzles 
c. Links QTPP-CQA-CPP-CS 
2. Output Control Strategy 
a. Prioritized list of projects 
3. Precursor to Design Space studies 
a. Links to Design Space
FMEA (Failure Mode Effects and Analysis) 
Goal: “Identify all possible failures...prevent…” 
Ref: ASQ
1. Most attributes become “Critical.” 
A. FMEA’s definition: 
RPN (Risk Priority Number) = 
Severity x Occurrence x Detectability( or Controllability) 
B. Classic definition 
Risk Index = 
Severity x P(Occurrence) 
http://plato.stanford.edu/archives/win2012/entries/risk/#DefRis 
W. Gilchrist, ?Modelling Failure Modes and Effects Analysis,? International Journal of Quality and Reliability Management 10 (5), 16-23, 1993. 
S. Kmenta, Scenario-based FMEA Using Expected Cost, A new perspective on evaluatng risk in FMEA, IIE Workshop,January 22, 2002. 
S. Kmenta and K. Ishill, Scenario-Based Failure Modes and Effects Analysis using Expected Costs, Journal of Mechanical Design 126, 1027-1036, 
2004. 
D. Wheeler, ?Problems with Risk Priority Numbers,Quality Digest, 2011 Available at: 
http://www.qualitydigest.com/inside/quality-insider-article/problems-risk-priority-numbers.html
2. Inappropriate ordinal scale 
At the development stage where scale-up details are not 
available, scientist do not yet understand the manufacturing 
process well enough to list realistic failure modes. 
Recommendation: 
Use Low-Med-High or better yet, 0-1-3-9 scale 
http://plato.stanford.edu/archives/win2012/entries/risk/#DefRis 
W. Gilchrist, ?Modelling Failure Modes and Effects Analysis,? International Journal of Quality and Reliability Management 10 (5), 16-23, 1993. 
S. Kmenta, Scenario-based FMEA Using Expected Cost, A new perspective on evaluatng risk in FMEA, IIE Workshop,January 22, 2002. 
S. Kmenta and K. Ishill, Scenario-Based Failure Modes and Effects Analysis using Expected Costs, Journal of Mechanical Design 126, 1027-1036, 
2004. 
D. Wheeler, ?Problems with Risk Priority Numbers,Quality Digest, 2011 Available at: 
http://www.qualitydigest.com/inside/quality-insider-article/problems-risk-priority-numbers.html
3. Mediocre Control Strategy 
Typical Examples: 
equipment maintenance, training or monitoring 
- feed control valves, steam traps, tank, flange, piping leaks 
- pH, DO, backpressure monitoring 
Ref: Pharmaceutical Engineering, May/June 2010, Vol. 30, No. 3, P.1-11
Smarter Approach 
1. Scientist-driven: Y=f(X), QFD=C&E + FMEA 
2. Process Map: TRD (Technical Requirements Document), IMPD 
(Investigational medicinal product dossier) 
3. Link how a CPP matters to the Patient 
(QTPP) 
4. Risk = Impact x P(Occurrence) 
Yoji Akao, Quality Function Deployment: Integrating 
Customer Requirements Into Product Design, 
Productivity Press, 1990.
How will a Process Parameter 
affect a Patient? 
Linking QTPP-CQA-CPP/CMA
Linear Approach 
QTPP (C)QA 
(C)QA (C)PP 
(C)PP Occurrence
Link: from QTPP to (C)QA 
QTPP 
(C)QA 
Impact
Link: from (C)QA to (C)PP 
(C)QA 
(C)PP 
Impact
Occurrence 
(C)PP 
Probability 
Occurrence
Linking it Together 
QTPP (C)QA 
(C)QA (C)PP 
(C)PP Occurrence 
Control 
Strategy
Control Strategy: CQA Pareto
Control Strategy: CPP Pareto
(HD) Control Strategy: Impact x Occurrence
Lean QbD Software Demo 
LeanQbD.com
The First Step in QbD 
1. Risk Assessment is the Blueprint of QbD. 
2. Focus on building Y=f(x) for QTPP-CQA-CPP/CPP 
3. Save time by using Templates and a simple rating system 
Recommendation: 
● Use LeanQbD approach - Get it at LeanQbD.com 
● More Tips from QbDWorks.com
More Tips from QbD Practitioners 
QbDWorks.com

First Step in QbD - How to Get it Right

  • 1.
    First Step inQbD: How to get it Right ISPE 2014 Sun Kim, PhD
  • 2.
    Are You ... 1. Starting a QbD project & want to skip common pitfalls? 2. Tried QbD but management and colleagues were skeptical? 3. undecided if QbD is for your organization?
  • 3.
    QbD in 3Steps 1. Risk Assessment: Build Relationships from QTPP, CQA to CPP (CMA) 2. Design Space 3. Control Strategy
  • 8.
    You Are NotAlone. 17 Likes 47 Comments
  • 9.
    Sampling of LinkedInComments “It is like a loop I always have to dealt with, everytime!” - S of Angelini “The first part of your blog literally had me laughing out loud. This is so true and relevant.” -I of Teva “I completely agree with you that FMEA, especially in the early development, is not the ideal tool” - F of PTM Consulting”
  • 10.
    Sampling of LinkedInComments “How refreshing to see this. Thank you so much for noting that the FMEA emperor may be missing some clothing.” - D, Statistician “The formality of risk assessment should align with the level of product and process understanding. FMEA definitely has its place, but later in the development process.” - S of UpsherSmith
  • 11.
    Agenda 0. Story 1. Why Risk Assessment is Critical to QbD 2. Why You shouldn’t blindly apply FMEA for QbD development projects. 3. A Smarter Risk Assessment Approach
  • 12.
    Why Risk Assessmentdetermines success and failure of QbD 1. 1st step & planning stage of QbD 2. Output is Control Strategy 3. Precursor to Design Space studies
  • 13.
    Why Risk Assessmentdetermines success and failure of QbD 1. 1st step & planning stage of QbD a. Scientists dread these types of meetings b. If this doesn’t go well, the momentum fizzles c. Links QTPP-CQA-CPP-CS
  • 14.
    Why Risk Assessmentdetermines success and failure of QbD 1. 1st step & planning stage of QbD a. Scientists hate these types of meetings b. If this doesn’t go well, the momentum fizzles c. Links QTPP-CQA-CPP-CS 2. Output: Control Strategy a. Prioritized list of projects or experiments
  • 15.
    Why Risk Assessmentdetermines success and failure of QbD 1. 1st step & planning stage of QbD a. Scientists hate these types of meetings b. If this doesn’t go well, the momentum fizzles c. Links QTPP-CQA-CPP-CS 2. Output Control Strategy a. Prioritized list of projects 3. Precursor to Design Space studies a. Links to Design Space
  • 16.
    FMEA (Failure ModeEffects and Analysis) Goal: “Identify all possible failures...prevent…” Ref: ASQ
  • 17.
    1. Most attributesbecome “Critical.” A. FMEA’s definition: RPN (Risk Priority Number) = Severity x Occurrence x Detectability( or Controllability) B. Classic definition Risk Index = Severity x P(Occurrence) http://plato.stanford.edu/archives/win2012/entries/risk/#DefRis W. Gilchrist, ?Modelling Failure Modes and Effects Analysis,? International Journal of Quality and Reliability Management 10 (5), 16-23, 1993. S. Kmenta, Scenario-based FMEA Using Expected Cost, A new perspective on evaluatng risk in FMEA, IIE Workshop,January 22, 2002. S. Kmenta and K. Ishill, Scenario-Based Failure Modes and Effects Analysis using Expected Costs, Journal of Mechanical Design 126, 1027-1036, 2004. D. Wheeler, ?Problems with Risk Priority Numbers,Quality Digest, 2011 Available at: http://www.qualitydigest.com/inside/quality-insider-article/problems-risk-priority-numbers.html
  • 18.
    2. Inappropriate ordinalscale At the development stage where scale-up details are not available, scientist do not yet understand the manufacturing process well enough to list realistic failure modes. Recommendation: Use Low-Med-High or better yet, 0-1-3-9 scale http://plato.stanford.edu/archives/win2012/entries/risk/#DefRis W. Gilchrist, ?Modelling Failure Modes and Effects Analysis,? International Journal of Quality and Reliability Management 10 (5), 16-23, 1993. S. Kmenta, Scenario-based FMEA Using Expected Cost, A new perspective on evaluatng risk in FMEA, IIE Workshop,January 22, 2002. S. Kmenta and K. Ishill, Scenario-Based Failure Modes and Effects Analysis using Expected Costs, Journal of Mechanical Design 126, 1027-1036, 2004. D. Wheeler, ?Problems with Risk Priority Numbers,Quality Digest, 2011 Available at: http://www.qualitydigest.com/inside/quality-insider-article/problems-risk-priority-numbers.html
  • 19.
    3. Mediocre ControlStrategy Typical Examples: equipment maintenance, training or monitoring - feed control valves, steam traps, tank, flange, piping leaks - pH, DO, backpressure monitoring Ref: Pharmaceutical Engineering, May/June 2010, Vol. 30, No. 3, P.1-11
  • 20.
    Smarter Approach 1.Scientist-driven: Y=f(X), QFD=C&E + FMEA 2. Process Map: TRD (Technical Requirements Document), IMPD (Investigational medicinal product dossier) 3. Link how a CPP matters to the Patient (QTPP) 4. Risk = Impact x P(Occurrence) Yoji Akao, Quality Function Deployment: Integrating Customer Requirements Into Product Design, Productivity Press, 1990.
  • 21.
    How will aProcess Parameter affect a Patient? Linking QTPP-CQA-CPP/CMA
  • 22.
    Linear Approach QTPP(C)QA (C)QA (C)PP (C)PP Occurrence
  • 23.
    Link: from QTPPto (C)QA QTPP (C)QA Impact
  • 24.
    Link: from (C)QAto (C)PP (C)QA (C)PP Impact
  • 25.
  • 26.
    Linking it Together QTPP (C)QA (C)QA (C)PP (C)PP Occurrence Control Strategy
  • 27.
  • 28.
  • 29.
    (HD) Control Strategy:Impact x Occurrence
  • 30.
    Lean QbD SoftwareDemo LeanQbD.com
  • 31.
    The First Stepin QbD 1. Risk Assessment is the Blueprint of QbD. 2. Focus on building Y=f(x) for QTPP-CQA-CPP/CPP 3. Save time by using Templates and a simple rating system Recommendation: ● Use LeanQbD approach - Get it at LeanQbD.com ● More Tips from QbDWorks.com
  • 32.
    More Tips fromQbD Practitioners QbDWorks.com

Editor's Notes

  • #2 Who particiated in a Risk Assessment? Who has facilitated a Risk Assessment? Who used FMEA-based approach? Since most of us are tired, I’ll just gossip rather than a formal presentation. Controversial.
  • #3 Who is implementing QbD now? Ok who fits in category 1, now 2, now 3?
  • #4 What are the 3 steps in QbD?
  • #8 Have you experienced this situation? Maybe it was a little exaggerated to emphasize the point. If you have done a Risk Assessment using FMEA, the chances are that you have. After spending 3 months in risk assessment meetings, too many attributes become critical. This defeats the purpose of conducting risk assessment. FMEA is not at fault. FMEA sessions become productive when the participants have gained some experience in the product or process. Let’s take a step back. What is the main purpose of Risk Assessment? To identify the top critical attributes and devise a control strategy around the high risk items so that we don’t miss the obvious ones. What it is not: list all possible things that could go wrong. The chances are that the length of the list depends on our imagination and time.
  • #9 LinkedIn QbD group
  • #13 Think of QbD as your child Another uneasy feeling for QA comes from pressure to remove or ignore intermediate controls prematurely, or what could be called QbB, Quality by Blindfold.
  • #14 Think of QbD as your child
  • #15  This is what the development will work on for the next months and years. starting with high-risk items
  • #16 Think of QbD as your child
  • #18 Multiplication is not defined for ordinal metrics. It is well known in the literature that RPN does not preserve rank order. So why not use probability and cost metrics instead of ranks? risk = the statistical expectation value of an unwanted event which may or may not occur. Risk calculation is inflated due to detectability. FMEA’s Risk calculation uses the equation below: Risk Priority Number = Severity x Occurrence x Detectability( or Controllability) Three factors: 1. Severity 2. Occurrence 3. Detectability (or Controllability) Let’s compare this with the classic definition of risk. Risk Index = Impact of Risk event x Probability of Occurrence Two factors: 1. Impact 2. Probability Notice how FMEA’s (http://en.wikipedia.org/wiki/Failure_mode_and_effects_analysis) risk priority number (RPN) has an extra factor -- Detectability (or Controllability). According to the classic definition, (Ref: http://plato.stanford.edu/archives/win2012/entries/risk/, http://en.wikipedia.org/wiki/Risk_management) controllability or detectability are already included in the Occurrence factor. For example, drug potency is a quality attribute and let’s say the manufacturer has a good control strategy or detectability with sensors, then the occurrence will be low. The same goes for the opposite condition. If the manufacturing process has low detectability or controllability for potency, then occurrence of potency going out of specification will be high. As you can see, detectability (or controllability) is a sub-factor of Occurrence. In other words, by adding detectability, FMEA’s formula inflates the Risk number. This is why much of the Quality Attributes end up in the red zone. Recommendation: Stick with the classic risk definition: Impact x Occurrence.
  • #19 Fighting over the ordinal rating of 3 versus 4 is meaningless at this stage. I’ve seen hours of disagreement over severity, occurrence, controllability and detectability. If you have an ordinal scale from 0 to 10, you will be wasting much time. Recommendation: Go with Low-Med-High or better yet, 0-1-3-9 scale (will discuss in the next article)
  • #20 After finishing FMEA, you will get a list of “high risk” or Critical Quality Attributes (CQA). But how can we control those CQA’s? Remember, the purpose of risk assessment is to devise a control strategy to prevent major failures. However, CQA’s are just symptoms or results. We can not directly control them. What we can control are CPP’s (Critical Process Parameters). Control strategy or plan should be on how to contorl the CPP’s. In order to do this, scientists must understand the relationship between CQA’s and CPP’s. If we mathematically model the manufacturing processes in a transfer function of Y=f(X), CQA’s are Y’s (output) and CPP’s are X’s (input). With FMEA, control plan remains at the trivial level such as equipment maintenance or monitoring plans. At the development stage, where the process itself still can be changed and equipment details are unavailable, information on the Transfer Function, Y=f(X), is of more value -- how process parameters affect the quality attributes. With this knowledge, scientists can design or order equipments around the appropriate range of these parameters.
  • #32 Most importantly, your organization will have missed out on the opportunity to understand the process. FMEA sessions are productive when the team has some mature knowledge of the process. Some folks may argue the author doesn’t understand FMEA. During my PhD at Stanford University, I’ve researched, practiced, taught, and published peer-reviewed journal articles on FMEA. There is no doubt I highly appreciate the tool. However a tool is a tool — works great for the right application–may not for the wrong ones.