The State of Quality Risk Management in the Pharmaceutical Industry: Commentary on the Draft ICH Q9 Revision

The International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) released a long-awaited draft revision of its Q9 guidance on quality risk management (QRM) for public consultation in December 2021 (1). First published in 2005, ICH Q9 has been instrumental in highlighting the importance of QRM in both the small- and large-molecule pharmaceutical industries. It was the first comprehensive guidance to explain how QRM could be used to identify, assess, and control risks to drug-product quality throughout a pharmaceutical’s life cycle, effectively allowing drug makers to prioritize their resources in specific areas while still maintaining compliance. The document was intended to provide guidance on the application of a level of effort commensurate with the level of risk, and it gave the industry several tools to assist companies on their QRM journeys.

However, implementation of QRM across the pharmaceutical industry over the past 17 years has been difficult, and companies that were early adopters of QRM are still struggling to make it work in an efficient and worthwhile way. The main challenge is that QRM has been applied as an additional compliance tool, creating more work and sometimes even new departments but often without providing significant benefits. Considering the release of the draft ICH Q9(R1) and the closure of the US commenting period in July 2022, we must ask ourselves whether we are as mature in QRM as we believe we are or whether we have more “growing up” to do.

Promising Proposals
Before we dive into how the new guidance is designed to assist us, let’s identify what has changed in this revamp of ICH Q9. The first few paragraphs of the revision hold much promise. They emphasize the diversity of stakeholders who often are involved in QRM and acknowledge how such diversity could lead to subjectivity in risk assessment (RA) execution, if not appropriately managed. Stakeholders have different biases and priorities. Recognition of that fact at the start of an RA will be beneficial for assessment teams.

The draft guideline also clarifies that protecting patients is the primary goal of QRM and that drug makers do that through assurance of product quality and availability. This new emphasis hints at the difference between risk management (RM) and quality risk management. RM is concerned with multiple types of risks to many different factors, including employee safety and health, business viability, cost-effectiveness, and yield. QRM focuses only on risks to product quality and availability of treatment, both of which ultimately have an impact on patient safety. That is a key distinction to note when building a QRM program.

Medicinal-product availability is a new element in the draft ICH Q9(R1). The criterion’s inclusion is important because it identifies medicinal-product shortage as a patient risk. That is especially pertinent to the modern biopharmaceutical industry, in which diagnostic advances and innovative therapies are increasingly complex to manufacture, raising the risk of interruptions to patient supply. Of note is that the new criterion relates to products for which a shortage would cause patients significant harm. The guidance is not intended to allow prioritization of market supply for business purposes when a shortages could be addressed with alternative but comparable brands of medicine — generic medicinal products.

The draft proceeds to describe how product quality is assured through application of appropriate risk-based decision-making throughout a product’s life cycle. The document adds that drug makers must maintain attributes that are important to product quality, also known as critical quality attributes (CQAs). This phrasing is a welcome addition because it makes it clear that when implementing QRM, we must first understand a product’s CQAs and identify risks across the product life cycle that would diminish those attributes. The concept also aligns with requirements for commissioning, qualification, and validation (CQV) programs, in which system risk assessments (SRAs) should be used to establish risks to product or system CQAs, enabling identification of critical process parameters (CPPs) for equipment, systems, and processes.

The draft guidance characterizes QRM as a “proactive approach” that facilitates continual improvement and provides a basis for risk-based decision-making. When implemented appropriately, such an approach could reduce the requisite level of regulatory oversight. This clarification highlights the importance of treating QRM as a tool for continuous improvement and increased compliance. Therefore, the aim of a QRM program should be to prevent risks — that is, to implement risk-mitigation actions before risk realization and thus to reap the benefits of reduced resources spent on investigating deviations and implementing corrective/preventive actions (CAPAs) after an incident occurs.

The definition of QRM as a proactive strategy will be critical in the remediation of current QRM programs. Many companies erroneously believe that their QRM programs are already mature based on the number of RAs in their quality management systems and the number of resources in place to manage them. In some cases, companies consider their RAs only after a risk has been realized, using QRM to guide themselves out of the difficult terrain associated with potential patient impacts. Often, drug makers perform risk-based impact assessment after a deviation has occurred rather than asking why the deviation occurred in the first place. Focusing on QRM as a proactive strategy should drive the pharmaceutical industry in the direction it needs to go, using existing proactive RAs to assess changes and ultimately reach a stage at which process deviations are rare occurrences. At that point, when a deviation happens, we should be forced to question whether our RA predicted it or whether our controls were ineffective.

The industry’s definition of a mature QRM program needs to change to a new model in which there are fewer individual quality risk assessments that are mostly proactive and are reviewed and revised (if necessary) each time a change control, deviation, or investigation occurs. CAPAs must be suitable as current controls, and reliance on detection should be minimal, considered only as “icing on the cake.”

It should be noted that the basic principles of QRM have not changed. Risk evaluation still must be based on scientific knowledge and linked to patient protection. The formality and level of effort devoted to mitigation also should be commensurate with the level of risk. The fundamentals of the ICH Q9 guideline remain unchanged, but the draft revision emphasizes that patient safety and product quality should be placed at the heart of any QRM program.

The topic of bias and subjectivity in QRM is addressed appropriately throughout the draft. The requirements for defining a risk question, documenting assumptions, and acknowledging bias/subjectivity all align with my company’s experiences in helping drug companies to improve established QRM programs. The same is true for the Q9 document’s identification of poorly defined risk-scoring scales as a source of subjectivity.

Many QRM practitioners start the process by picking an RA template and brainstorming everything that could go wrong. Because this draft revision highlights the correct planning mechanisms, my hope is that RAs will not begin until an appropriate scope has been defined, a risk question or problem statement has been established and documented, scoring scales have been reviewed (and altered, if necessary), and assumptions have been documented. Such elements are critical for putting a boundary around RAs, keeping them objective and clear and ultimately enabling them to be used as repositories of knowledge to be revisited often. Upfront planning and clear understanding of each RA’s purpose generally accelerates the process and reduces the risk of “going down rabbit holes.”

Lingering Concerns
The draft ICH Q9(R1) is a welcome improvement over the original version. However, several topics could have been explored in further detail. One such area is the link between prospective-RA maturity and deviation reduction. If a QRM program is mature, prospective identification and mitigation of risk should almost eliminate process deviations. If deviation numbers increase, it is a sign of immaturity in a QRM program and a failure to see and prevent risks from coming down the tracks.

Another topic that could have been expanded relates to the importance of revising existing assessments instead of continually generating new documents. For example, revision of an existing process failure modes and effects analysis (FMEA) will provide more information on the impact of a major change than the development of a new, change-control–specific RA.

Methods for defining scoring scales could be addressed in more detail than they are, and a prompt for the industry to move away from a “one size fits all” approach would have been useful. Standard scoring scales generally lead to a lack of understanding and clarity in QRM, and that problem should be addressed. For example, setting a low likelihood of occurrence at a standard of 1 in 10 batches means nothing when the risk is microbial contamination in a sterile product. In the pharmaceutical industry, likelihood of occurrence is based on the strength of our controls, which we have designed and validated to ensure that the risks we identify do not occur. This fact is not highlighted or detailed in the ICH Q9(R1) draft.

The guidance could place greater emphasis on development of comprehensive process flows than it does. Many regulatory observations have called attention to the failures of companies to assess all risks in their operations. Based on experience, the only way to ensure that all risks have been captured, particularly by tools such as FMEA, is to ask the risk question at each process step and to document the response. To do that exercise adequately and objectively, you need to know and document a process flow before using it as the backbone of an RA. Any action performed in our industry has a process flow, even if the item being assessed for risk isn’t a manufacturing process.

The guidance regarding risk-based decision-making also is a welcome addition that highlights the importance of discussing risk in a decision-making process. It would have been helpful for the document to identify risk-based decision-making as something based in human nature rather than a process unique to our industry. As affirmed during the COVID-19 pandemic, risk-based decision-making is an inherent component of every person’s thought processes. Consideration of risk ensures that our decisions will keep us safe. The only difference when we move into the work environment is that risk-based decisions protect our businesses — and patients — rather than ourselves.

An Opportunity for Growth
Ultimately, the draft revision of ICH Q9 is intended to provide clarity and to help the pharmaceutical industry apply QRM for the protection of patients. In many ways, the draft has achieved that goal, but it remains to be seen whether the revision has gone far enough to change the direction taken by many companies in their QRM strategies. In reality, QRM is not used prospectively, and RAs are written to satisfy regulatory inspectors rather than to identify process-related risks proactively and help prevent them.

As many companies get busier than ever, increasing manufacturing capacities and expanding their product portfolios, the number of deviations has risen in an upward trend, thus highlighting the failure to take prospective and proactive action to prevent risks from occurring. This is an unusual trend and one that would be unacceptable in other industries that have adopted risk-management concepts. For example, risk management for occupational safety is implemented in all pharmaceutical plants to prevent employee injury. If we replicated common pharmaceutical QRM strategies to occupational safety, it would be akin to bandaging up wounds rather than foreseeing and preventing injuries. Luckily for us as employees, that isn’t acceptable, nor should it be acceptable for patients. Therefore, considering the end of the commenting period on the draft ICH Q9(R1) and the finalized guidance that will result, we should take the opportunity to ensure that we are applying QRM principles in their simplest form. Doing so will help to identify risks to patients, prioritize resources to prevent them, and implement proactive processes that benefit our patients and our industry over the long term.

Reference
1 ICH Q9(R1). Quality Risk Management: Draft. International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use: Geneva, Switzerland, 2021; https://www.ema.europa.eu/en/documents/scientific-guideline/draft-international-conference-harmonisation-technical-requirements-registration-pharmaceuticals_en-1.pdf.

Kate Coleman is senior director/principal consultant at PharmaLex, Suite 2, Stafford House, Strand Road, Portmarnock, County Dublin D13 H525, Ireland; https://pharmalex.com.