Implementing a formalized quality risk management (QRM) program offers many benefits to industry and regulators. QRM allows a systematic approach to risk assessment (RA), incorporating it directly into a quality system, and provides the infrastructure (policies, standards, tools, and so on) to create a meaningful and sustainable program. ICH Q9 provides the framework for implementing QRM as a holistic program throughout a product's lifecycle (1).

Risk management is not synonymous with risk assessment. Per ICH Q9, risk management is “the systematic application of quality management policies, procedures, and practices to the tasks of assessing, controlling, communicating, and reviewing risk.” QRM is a living process and must be managed throughout the lifecycle of product, process, or system. Risk management involves four steps: risk assessment, risk control, risk review and monitoring, and risk communication.

The focus of the July 2009 CMC Strategy Forum was the RA step. ICH Q9 defines risk assessment as “a systematic process of organizing information to support a risk decision to be made within a risk management process. It consists of the identification of hazards and the analysis and evaluation of risks associated with exposure to those hazards.” For several years the biopharmaceutical industry and several regulatory agencies have actively worked with qualitative and/or semiquantitative RA methods (e.g., failure modes and effects analysis, FMEA, and preliminary hazard analysis, PHA). This CMC Strategy Forum was designed to provide attendees with a greater understanding of how RA is applied throughout biopharmaceutical development and manufacturing — and also how risk management results are used both internal to a company and in its communications with regulatory agencies. This was accomplished with presentations and case-studies from regulators and industry as well as hands-on exercises illustrating key concepts.

Section 1: Current Industry RA Practices

The morning of 27 July 2009 featured presentations by Richard O'Keeffe (“Quality Risk Management: Industry and Regulatory Pulse Survey Results”) and Dan Weese (“Overview of Risk Assessment Methods and Applications”) of Amgen; and by Keith Webber (“Quality Risk Management from Concept to Practical Strategies”), Terrance Ocheltree (“The Role of Quality Risk Management in New Drug Development and Manufacturing: Findings from the ONDQA Pilot Program”), and Patrick Swann of FDA's Center for Drug Evaluation and Research (“The Role of Quality Risk Management in New Drug Development and Manufacturing: Biotechnology Products”).

Current Industry and Regulatory Trends: To get a pulse on QRM trends within the industry and regulatory agencies, the CMC Strategy Forum planning committee designed and sponsored a survey before the conference. The 80 survey respondents represented 29 companies and regulatory agencies. O'Keeffe opened the conference by reporting on the survey results. His key theme was that industry and regulatory knowledge and understanding of QRM is evolving. Four in ten of company respondents said their organizations were in the development stages of a formalized QRM program; only 9% hadn't started ICH Q9 implementation. Responses also indicated that the industry would like more information about which tools to use in different situations, and that alignment among guidance from different regulatory agencies is important.

From Concepts to Practical Strategies: Webber presented for Gregg Claycamp on “risk-scientific” implementation of QRM concepts. Although risk is intuitive to everyone, application of that intuition to complex problems is not easy. Several RA tools provide a risk score; however, that does not equate to the actual “risk” and should not be represented as measuring it. Risk scoring methods are mostly about prioritization under a consistent process and do not constitute a “quantitative” assessment. They also drive consistent decisions within a quality management system. Webber discussed the importance of expert judgment during scoring and how “group think” can contribute to risk assessment outcomes.

Types of RA Tools: Because the focus of the forum was practical application of risk assessment, Weese presented an overview of available RA tools, including their strengths and limitations. Risk assessments are not easy to perform; appropriate training and expertise are needed for their execution. In choosing a tool, it is important first to thoroughly understand the purpose and desired outcomes of a risk assessment.

RA tools vary in their approach and level of rigor. A tool must be appropriate to the objectives of the assessment and the criticality of what is being assessed. It was noted that risk assessments can be both formal and informal; they may also take the form of a narrative or be performed using scoring tools. Typically RA starts with a top-down, broader-scope tool (e.g., PHA or risk ranking and filtering). Next, more focused and sophisticated assessments may be performed as needed using detailed tools (e.g., FMEA and hazards analysis and critical control points, HACCP).

Some more familiar RA tools include risk ranking, HACCP, hazard operability analysis (HAZOP), FMEA, PHA, and fault tree analysis (FTA). Most tools are intended to be prospective and use predefined ranking/scoring criteria and risk acceptance thresholds. Most also use impact/consequences and probability as their main considerations in risk scoring. The score for each risk identified using a qualitative or semiquantitative tool is typically a simple multiplication of its scores for impact/consequence, probability of occurrence, and sometimes likelihood of detection. It was also noted that tools are often customized to fit specific needs. For example, depending on the level of information available, a PHA may or may not include the detection score.

THE CMC STRATEGY FORUM SERIES