Implementing Risk Management

Implementing Risk Management
in
The Validation Process

Gamal Amer, Ph. D.
Principal
Premier Compliance Services, Inc.

© All rights reserved. Do not copy without permission. 1

Why Risk Management
in
Drug Manufacturing

FDA Initiative August 2002
Pharmaceutical CGMP for the 21st Century:
A Risk-based Approach

A science and risk-based approach to product quality
regulation incorporating an integrated quality system
approach


Its Objectives
•  Allows Early adoption of new technology.
•  Adoption of modern quality management
techniques and implementation of the quality
system approach.
•  Focus on understanding the science &
technology associated with what you are
making.
•  Priority to mitigating the highest risk elements of
the manufacturing operation.

•  Take home:
–  You must understand what you are doing.
–  You must focus on critical areas (highest risk
to product quality) of your operation.
–  You should utilize automation and data
collection to reduce risk associated with the
operation and allow for continuous
improvement.
–  You must build the quality into your operation.

Risk

What Is Risk?
What Causes It?
Risk to Whom?
Risk Manifestation?
Risk Level?


What Is Risk?

The combination of the probability of
occurrence of harm and the severity of
that harm.*

*ICH Consensus Guideline; Q9 Quality Risk Management; June 2006


Risk
•  Risk is always present in every endeavor .
•  We as humans learn about it, recognize it
subconsciously, and accept a certain level
of risk on a daily basis.
•  We always take steps in daily life to
mitigate the risk associated with our
activities.


Risk in Drug Product
Development & Manufacturing


Quality Events Which May
Cause Increased Risk
•  A problem occurs during clinical trials (patient
complains/suffers)
•  Un-controllable or un-expected process
variability
•  A deviation occurs during the manufacturing
•  Analytical result is not what was expected
•  A piece of equipment is identified as
malfunctioning after the operation is complete.

These Events Increase:

•  Risk to the patient/public
•  Risk to the product
•  Risk to the personnel
•  Risk to the company


Risk to whom?
•  We are concerned here with the risk to the
quality of the product and hence to the
patient.
•  We will focus on the risk in the product
lifecycle in general and in the manufacture
lifecycle in particular.
•  We will focus on validation, GMP and
quality systems as used to mitigate risk.


Higher Risk Manufacturing
Operations
•  Aseptic Processing (Contamination of
product)
•  Dealing with potent compounds (danger
to patient from incorrect formulation and
to workers from potential exposure)
•  Solid dosage (Cross contamination)
•  Labeling (Incorrect labeling)


ICH Q9
Quality Risk Management
•  Outlines Quality Risk Management Principles for
Product Lifecycle.
•  Phases of QRM include risk assessment, risk
control, risk review, risk communication.
•  Defines Risk and How to Measure it.
•  Outlines the principle of focusing on the critical
aspects of the drug manufacturing based on the
level of risk.
•  Use of change management to reduce risk.


ICH Q9
Quality Risk Management
•  The evaluation of the risk to quality should be
based on scientific knowledge and ultimately link
to the protection of the patient.
•  The level and extent of actions to be taken to
eliminate or minimize actual or potential risk
must be appropriate to the magnitude of the
problem and commensurate with the level of risk
anticipated. (ICH Q9)


Defining Level of Risk
Function of:
–  Severity
–  Frequency
–  Detectability

•  These three factors determine the numerical
Risk Priority Number (RPN)
•  Qualitative risk (low, medium, and high)


Risk Level Factors: Severity

•  What are the consequences of the quality event
(non-conformance or deviation)?
•  How deleterious is that potential variability,
failure, or deviation?
•  How high is the risk to the patient’s well being?
Would it affect or delay his/her treatment?


Risk Level Factors: Frequency

•  What are the probability of the occurrence
of the failure/deviation?
•  Were attempts made to reduce such
frequency in the past? How successful?
•  Review process/operation/design history.


Risk Level Factors: Detectability

•  What is the probability of the variability, failure,
or deviation being detected?
•  Can the effect/result of the failure/deviation be
readily measured/seen?


Developing Risk Priority Number RPN

•  Severity:
–  Could result in the manufacture of a product, which
may cause death or serious harm requiring
intervention(3)
–  ……product that may cause or contribute to a patient
discomfort or an insignificant delay or interruption in
treatment. (2)
–  ….. product that will NOT cause injury or discomfort,
or delay/interruption in treatment. (1)



•  Frequency:
–  Would definitely occur, is known to have
occurred in the past, expected to reoccur if no
action is taken to correct or prevent the
problem. (3)
–  Unlikely to occur or not expected to reoccur,
but it is possible. (2)
–  Will not occur or is highly unlikely to.(1)



•  Detactability:
–  Consequences of the events are not
detectable or readily obvious (3)
–  Consequences of the event are not obvious
but, there is a good possibility that, it will be
detected.(2)
–  Consequences of the event are detectable (1)



Risk Priority Number (RPN)=
Severity X Frequency X Detectability

RPN= 1-4 Low Risk
RPN= 5-11 Medium Risk
RPN= 12-27 High Risk
These ranges could vary based on experience


Mitigating Risk

The level and extent of actions to be taken
to eliminate or minimize actual or potential
risk must be appropriate to the magnitude
of the problem and commensurate with the
level of risk anticipated. (ICH Q9)


Risk Assessment
Tylenol scare of the early 1980s:

Several death due to tampering with
product capsules. The event happened
twice. Consumer unable to recognized
capsules were tampered with.


Using The Risk Assessment Form
Severity: Highest –Result in death (3)

Frequency: happened twice, does not
happen often, will surely happen again (3)

Detactability: Difficult to detect a capsule
that was tampered with (3)

RPN: 27


Using The Risk Assessment Form
Corrective Action: Immediate recall

Investigation: Unable to protect
capsules
Preventive action: - Eliminate the use of
capsules.
- Develop Tamper
evident packages

Interactive Exercise


Risk Causing Scenarios:
If any of the attendees has an example of a risk causing scenario we can address it as a group.

1. In a drug release test, the HPLC instrument has a complete
failure while analyzing the drug sample for the impurities
profile. The drug has a limited shelf life and
must be released within one day of production. The test itself
requires 20 hours to perform (sample prep and analysis). The
impurities profile is the most critical release test.

2. In the coating of an over the counter analgesic, the color of
the coating material was affected by the temperature of the
coating pan and was several shades darker. The coating is
sugar based food coloring. It is well understood that the food
coloring does not have toxic effects/degradents. (Should
overheating occur; did it affect the drug substance?).

Risk Causing Scenarios:

3. In the manufacture of an API at the completion of a
campaign, consisting of 6 batches, the catalyst bed was
opened to introduce fresh material in preparation for the next
campaign. Upon opening the catalyst bed it was determined
that the bed is contaminated with an unknown solid material.
Further investigation indicated that the contaminant is inert
and insoluble.

4. Patients suffer from heart problem due to over dosage of
active in product tablets ingested (tablets contain larger
amount of active than indicated). This is reported by doctors
as an adverse event.


Process Validation: General
Principles and Practices
•  Guidance to industry issued by the FDA in
January 24, 2011.
•  Outlines a life cycle approach to validation.
•  Inline with the principles advanced in ICH Q8,
ICH Q9, ICH Q10 and in ASTM E2500.
•  Defines PROCESS VALIDATION as the
collection and evaluation of data, from the
process design stage throughout commercial
production, which establishes scientific evidence
that a process is capable of consistently
delivering quality products.

FDA Guidance:
Process Validation: General
Principles and Practices
•  Replaces the guidance issued in 1987
•  “Quality of the product cannot be assured by
simply inspecting or testing in-process and
finished products.” It must be built into the
product-process a-priori.
•  “Focusing exclusively on the qualification effort
without understanding the process and ensuring
the process is maintained in a state of control
may not lead to adequate assurance of quality.”


FDA Guidance To Industry
January 2011
•  Three Stages of Process Validation
–  Process Design Stage (process is defined
based on development and scale-up)
–  Process Qualification Stage (Design is
confirmed as being capable of reproducible
production)
–  Continued Verification and improvement
(Continuously gaining assurance the process
remains in a state of control)

Stage 1: Process Design

•  Understanding the science
•  Understanding the risk
•  Building Quality into the process
•  Establishing Control Strategy


Stage 2: Implementation and
Process Qualification

•  Implement the process and Facility
•  Qualification of utilities and equipment
•  The Process Performance Qualification
(PPQ) protocol
•  Protocol execution and report


Stage 3: Continued Process
Verification
•  Monitoring appropriate parameters to
ensure process in a validated state of
control.
•  Use CAPA, PAT and Change control as
well as data collected in monitoring to
continually improve the process.
•  Proper maintenance of the facility, utilities,
and process equipment

Risk Assessment in
Process Validation
•  Risk analysis is used in all three stages of
Process Validation.
•  Always use risk-based approaches to
justify decisions. However such use
should be scientifically sound with the goal
of achieving and maintaining a high level
of product quality.


Risk Assessment
in
Process Validation
•  In stage 1 risk analysis is used in conjunction
with QbD to develop a robust design and reduce
variability.
•  In stage 2 risk analysis is used to prioritize your
activities and focus the effort on critical systems.
•  In stage 3 it is used in conjunction with a CAPA
program to ensure the process remains in a
state of control.

Stage 2 Process Qualification

Goal: Evaluate the design developed in stage
1 to determine if it is capable of reproducible
commercial manufacturing and performs as
expected.

Must follow CGMP-Compliant procedures

© All rights reserved. Do not copy without permission.

Stage 2 of Guidance Stipulates
•  Facility Design and Utilities & Equipment
Qualification:
–  Must properly design and commission facility prior to
the PPQ (Process Performance Qualification)
–  Qualification of utilities and equipment (activities to
demonstrate equipment are suitable for intended use)
•  Demonstrate proper selection of material and design
•  Demonstrate proper construction and installation
•  Demonstrate that equipment and utilities operate in
accordance with the process requirements (include
appropriate challenges to represent normal operation)
–  Qualification activity must be documented and
summarized in a report with appropriate conclusions


•  Qualification Plan For Utilities
–  Qualification of utilities and equipment can be covered under
individual plans or under an overall plan.
–  Plan should consider requirements of use and risk management
used to prioritize and define extent of activities.
–  Plan should define:
•  Studies and tests to be conducted
•  The criteria to assess outcome of studies
•  Timing for qualification
•  Responsibilities for conducting the effort
•  Procedure for documenting and approving the qualification
–  Outline firm’s criteria for evaluating changes


•  Process Performance Qualification Approach:
–  PPQ should combine qualified facility, utilities, and equipment
with trained personnel to confirm the commercial manufacturing
performs as expected.
–  PPQ must be completed before commercial distribution of drug.
–  PPQ should be based on science and technical understanding.
–  Employ statistical metrics to achieve adequate assurance
through data analysis.
–  PPQ should have additional (when compared to normal
production) sampling, monitoring, and analysis
–  The concept of ongoing PPQ to determine usable lifetime of
resin columns and the like.
–  If using PAT, a different approach to PQ maybe warranted:
•  Qualification to focus on measurement and control loop.
•  Establish that the process is reproducible and will deliver quality
product.


•  Process Performance Qualification Protocol:
–  Written Protocol delineating manufacturing conditions,
controls, sampling, testing, and expected outcome.
–  PQ should discuss manufacturing conditions,
operating parameters, limits, and components.
–  PQ should discuss the data to be collected and when
and how it will be evaluated.
–  PQ establishes the tests to be performed and
acceptance criteria.
–  PQ should detail the sampling plan (e.g. Number of
samples and frequency of sampling).


•  Process Performance Qualification Protocol
(cont):
–  Description of statistical methods to be used and how
to address deviations and non-conforming data.
–  Confirm that facility and utility qualification have been
successfully completed.
–  Confirm personnel training and qualifications.
–  Verification of material sources (components and
container/closures)
–  Discuss status of analytical methods validation.
–  Should be reviewed and approved by appropriate
departments and Quality Unit.


•  Protocol Execution and Report:
–  Only execute approved protocol.
–  Departures from the approved protocol to be justified and
approved.
–  Follow expected routine procedures for commercial process
using personnel who will be responsible for manufacture.
–  Report to be prepared in a timely manner, should include:
•  Summary and analysis of data.
•  Evaluation of unexpected results.
•  Evaluate manufacturing non-conformances (deviations, OOS
results, etc.).
•  Description of corrective actions taken.
•  A clear statement as to the process being fit for the intended use.
•  Review and approval by appropriate departments and quality unit.


What it all means?
•  PPQ to confirm process design
•  PPQ to confirm manufacturing process
•  PPQ To be completed before manufacture
and distribution
•  Previous credible experience with similar
products & processes can be considered
•  Entire operating range need not be
verified, only normal operation.

Managing Risk Through
Validation is Achieved By:
•  Qualification of high risk portions of the facility
and utilities.
•  Qualification and verification of high risk portions
within the process.
•  Qualification of source of variability in the
process.
•  Focusing on portions of the process that have
the greatest risk to product quality.


Risk Assessment
•  Based on forward looking analysis (what
happens if this unit operation fails?).
•  Based on the knowledge of the science
associated with the operation/process.
•  Defining the focus of the risk assessment, e.g.
product quality vs. environmental spills (potential issues
that cause environmental spills excluded).

•  Divide the process into manageable
subsystems.
•  Historic information.

Risk Assessment Form
•  Page one:
–  Product information
–  Information regarding potential Risk
associated with the system
–  Description of the issue
–  Description of the findings of any investigation
–  Description of relevant historical information


•  Page two:
–  Analysis of Severity
–  Analysis of Frequency
–  Analysis of Detectability
•  Page three:
–  Calculation of RPN
–  Definition of action to be taken (commissioning,
Installation and Operation qualification only,
IOQ and Performance Qualification)

•  Actions to be taken:
–  High RPN - Intolerable
•  Understand causes and reason for risk
•  Reduce or eliminate risk of further occurrence (re-design) if
possible
•  Complete qualification IOQ and PQ
–  Medium RPN – Tolerable
•  Evaluate event
•  Determine if additional investigation is warranted
•  Conduct reasonable and practical qualification (IOQ)
–  Low RPN – Negligible
•  No additional investigation
•  Monitor through trend analysis for further occurrences
•  Commissioning maybe sufficient.

Use of Risk Assessment in
Process Qualification


Prioritizing the Qualification
Effort
•  Which systems should be included as part
of the formal qualification effort and which
does not have to be.
•  Use of appropriate tools for risk analysis to
list causes and effect (e.g. Failure Mode
and Effect Analysis FMEA, Fault Tree
Analysis, HAZOP, HACCP)


Interactive
What to do for the following?


Qualification of Facility/Utility
Systems
1.  HVAC in sterile processing facility.
2.  Electric system in common production
space.
3.  Generator and Un-interruptable power
supply in fermentation facility
4.  Steam generation for power plant.
5.  HVAC in for general laboratory


Systems
1.  Full qualification of HVAC system (issue
contamination of sterile product, severity=
3, frequency =3, detectability=3,
RPN=27)
2.  Commissioning is sufficient based on
severity due to malfunction(issue electric
malfunction, Severity=?, Frequency=3,
detectability=1 RPN=3-?)


Systems
3. IOQ and possibly PQ if fermentation is very
expensive (Issue: Power interruption in
fermenter for aerobic fermentation can result in
fermentation failure (severity=2-3 depending on
cost, Frequency=3, detectability=1, RPN=6-9)
4. Commissioning sufficient (issue power loss if
steam generation fails, important components
have back-up, severity=1, frequency=3,
detectability=1 RPN=3)


Systems
5. Commissioning sufficient (issue failure
HVAC resulting in discomfort, severity=1,
detectability=1, frequency=3 RPN=3)


Qualification of Processing
Equipment
•  All equipment used in the process should
be qualified (IOQ) at a minimum to:
•  Demonstrate proper selection of material of construction and
design
•  Demonstrate proper construction and installation
•  Demonstrate that equipment and utilities operate in
accordance with the process requirements (include
appropriate challenges to represent normal operation)

•  Processing subsystems that can
compromise the quality of the product
must be fully qualified.

Qualification of High-risk
Subsystems
•  Components of the process which could lead to
variability should be tested to a higher level (PQ)
•  Critical utility systems representing high risk, are
to be full qualified (PQ);
–  HVAC, WFI, Purified Water, Clean compressed air,
etc.
•  Critical utility/process systems must be fully
qualified, e.g.:
–  Autoclave, Incubators, Stability Chambers,
Refrigerators and freezers, etc.

Subsystems
•  Fermenter: poor cell growth, poor cell viability and
contamination would result in low product titer and poor
quality (S=3, F=3, D=2 RPN=12), Complete validation to
show ability to provide reproducible results and
adequacy of controls.

•  UF Membrane installation: Leakage of product and
product loss. Due to damaged unit installed or damaging
the unit during installation. Test integrity after installation
(S=2, F=2, D=1 RPN=4). No need to fully qualify, maybe
referenced in fermenter protocol. Can be controlled
procedurally during operation.

Subsystems
•  What to do in cases where RPN suggest no need for full
qualification?
•  Perform secondary evaluation
–  Regulatory commitments may necessitate qualification
–  Industry expectations
–  Experience with previous inspections
–  Procedural requirements
•  Example: Buffer preparation system; incorrect composition
and incorrect conditions of preparation result in incorrect
buffer pH and conductivity and possible chemical breakdown
of components (S=2, F=2, D=1; RPN=4) Managed
procedurally, but still qualified per industry practice.


Process Performance
Qualification
•  The entire process is tested using,
qualified and non-qualified systems,
trained personnel and procedures based
on a well designed protocols.
•  Data is collected in larger amounts when
compared to normal operation and
statistically analyzed to ensure the
process is fit for the intended use.


Process Performance
Qualification
•  Parts of the process which are known to
cause variability are monitored for
variations within the batch and from batch
to batch.
•  You do not need to test the process limits,
instead testing should of the expected
normal operating range.
•  Three runs and done is no longer the way
to do it.

Advantages of Applying Risk
Based Validation
•  Better understanding of the science of your
operation and the risks associated with it.
•  Only address necessary systems thus
optimizing the effort.
•  Focusing your resources on critical systems
realizing considerable savings.
•  Ensure that no critical system is missed
during and after the qualification effort is
complete.(through doing a formal risk analysis of the entire operation)


Interactive
•  Why?
–  Full qualification for, stability chamber,
autoclave, WFI, What else?
–  Only IOQ for Dust collection systems,
Transfer conveyor, distribution system for
purchased gas, What else?
–  Only commissioning for processing pumps,
potable water system, What else?


Implementing Risk Management

More Related Content

What's hot

Similar to Implementing Risk Management

More from Institute of Validation Technology

Implementing Risk Management