Building a Solid Foundation for a Pharmaceutical Quality System: Presenting QRM and KM As United Enablers

Risk, knowledge, uncertainty, decision-making: They are among the building blocks at the center of the biopharmaceutical industry that guide the daily operations of biopharmaceutical organizations, from the work of scientists during discovery to technicians manufacturing each batch. Indeed, the biopharmaceutical industry is a knowledge-based industry in which organizations satisfy patient needs while gaining competitive advantage by their ability to grow, transfer, and apply knowledge rapidly and effectively.

Many people who read the word knowledge have a certain implicit interpretation of the term such as explicit knowledge in the form of process data, methods, and specifications. But many synonyms used throughout regulatory and industry guidance alike invoke the concept of knowledge. Terms include prior knowledge, scientific knowledge, science, product and/or process knowledge, experience, product development history, expertise, know-how, product and/or process understanding, lessons learned, and so on. Knowledge includes not only explicit knowledge (codified, as in a document), but also tacit knowledge (knowledge in people’s heads, such as know-how, experience, insights, rationale, and lessons learned).

Biopharmaceutical Knowledge and Quality Risk Management
A holistic review of types of knowledge described in regulatory and industry guidance documents reveals a consistent and recurring theme: the expectation that knowledge management (KM) and risk management (RM) (specifically quality risk management (QRM)) will support science and risk-based decisions to ensure product quality (1). Indeed, ICH Q10 positions KM and QRM as dual enablers of an effective pharmaceutical quality system (PQS) (Figure 1).

Figure 1: Knowledge management and quality risk management positioned as enablers of a pharmaceutical quality system (PQS).

Furthermore, similar references emphasizing the need to apply KM and QRM in decision-making can be found throughout quality guidelines from the International Council for Harmonisation (ICH) as well as in guidance by the World Health Organization (WHO), EudraLex, the Pharmaceutical Inspection Co-operation Scheme (PIC/S), and the International Organization for Standardization (ISO) (2). Other industries, such as aerospace, information technology and finance also have published literature recognizing the relationship between knowledge and risk — and KM and QRM.

However, although the biopharmaceutical industry’s journey in QRM maturity presents some opportunity for improvement, it is no secret that its adoption of KM remains in its infancy (3). The often-cited reason for this is that QRM benefits from its own regulatory guidance from ICH, WHO, and other organizations, but no such guidance exists for KM. Digging a little deeper reveals additional, perhaps more fundamental reasons, including that RM as a recognized practice has had a 40-year head start over KM, that there is a well-established body of literature and standards on RM, and that, comparatively speaking, RM is more discrete, less complex, and better understood than KM (4).

Recent studies suggest that recognition of the need to improve KM adoption, capability, and competency in the industry is perhaps in a period of renaissance. This is evident from many sources, including efforts by a number of industry groups (e.g., BioPhorum, ISPE, and PDA) on progressing KM guidance. The first ISO standard on KM was released in 2018 (5). The important positioning of KM in regulatory guidance also is gaining new momentum, with explicit references to KM in ICH Q12, Technical and Regulatory Considerations for Pharmaceutical Product Lifecycle Management (6), the draft ICH Q14, Analytical Procedure Development (7), and perhaps most prominently, in the draft ICH Q9(R1) (8). Indeed, the draft ICH Q9(R1) guideline contains 23 references to the word knowledge and another three references to knowledge management. Compare that with the initial version of ICH Q9 released in 2005, in which there are only 11 mentions of knowledge and none of knowledge management. This increased frequency of reference to those terms in the draft ICH Q9(R1) guideline suggests a greater understanding and awareness of their importance by key stakeholders.

Given that KM and QRM are positioned as dual enablers of an effective PQS, each is important and contributes uniquely to the PQS goals of establishing a state of control, achieving product realization, and serving as the basis for continual improvement. A 2021 survey of both regulatory and industry stakeholders explored the level of integration between the two enablers (9). A majority (96%) of stakeholders believed that both are highly interdependent as theoretical concepts (as defined and positioned in guidance). However, none of the respondents reported that KM and QRM are fully integrated in practice, and only a small minority (4%) of them said they were intentionally integrated (but not optimally) (Figure 2).

Figure 2: Knowledge management and quality risk management interdependence (survey results).

The survey also included questions about anticipated benefits that could ensue from integrating KM and QRM. Results suggested several inspiring and powerful potential outcomes by integrating the two enablers, including

∙ more data-driven risk assessments
∙ better risk-based decisions
∙ increased ability to leverage prior knowledge
∙ improved PQS effectiveness
∙ improved protection and value for patients
∙ improved control strategies.

The expectations to apply knowledge to manage risk and ensure a high-quality product are clear. But adoption of KM in the biopharmaceutical industry is lacking, with a gap between the expectation and reality of how KM and QRM are connected, revealing a potential opportunity for improvement.

Exploring Knowledge As the Currency of Managing Risk
Drawing inspiration from a familiar quote from the financial sector, “risk varies inversely with knowledge” (10), the beginnings of a framework to unite QRM and KM emerged. First came recognition that to realize benefit, knowledge cannot just exist, but also must be applied. Knowledge has to be findable, relatable, and accessible — aspects that often are not easy to achieve in today’s complex global environment and often confounded across many different information technology solutions. Second was the recognition that knowledge reduces risk by increasing understanding and therefore reducing uncertainty. Figure 3 illustrates this conceptual relationship (2).

Figure 3: Risk as a knowledge application.

As conveyed by the equation, risk is a function of knowledge (risk is dependent on knowledge and its application). In a manner of speaking, knowledge is the currency of managing risk.

Figure 4: The risk-knowledge infinity (RKI) cycle.

A Suggested Path to Unite KM and QRM
A framework to integrate KM and QRM — the risk–knowledge infinity (RKI) cycle (11) — is based on the expectations established above, that KM and QRM should be used together to enable the best decisions, using and optimizing the aforementioned relationship between knowledge and risk. Furthermore, the RKI cycle also recognizes that knowledge is both an input to and an output from the QRM process, and KM is not just about managing knowledge, but enabling knowledge flow of both explicit and tacit knowledge. Knowledge must flow through an organization — to inform several steps in risk management (e.g., risk analysis, risk estimation, risk control, and risk review) as well as to support other activities including technology transfer, change management, and investigations. Figure 4 depicts the RKI cycle.

Key features of the RKI cycle include the following (11):

The Interwoven Relationship Between Knowledge and Risk: Knowledge feeds in to inform risk management, and risk informs what is known, including the need to acquire new knowledge. Knowledge and risk inform each other.

The Inverse Relationship Previously Established: Increasing knowledge lowers uncertainty and risk. Figure 5 provides a visualization of this concept over time for a product. In the early stages of a product’s lifecycle, risk is high because knowledge is low. Risk can be reduced immediately through the application of prior knowledge. Risk is reduced further through increasing and applying knowledge gained by other means, including development activities, manufacturing experience, and risk review, which all build understanding and reduce uncertainty. A well-characterized product for which an abundance of knowledge has been collected will incur lower risk. Knowledge should flow effortlessly to inform risk, and likewise, risk seamlessly informs knowledge and gaps in knowledge (“known-unknowns”).

Figure 5: RKI over the product lifecycle; risk should decrease as knowledge increases.

The RKI Cycle — Continuous and Perpetual: As suggested by the use of the infinity symbol and infinity appearing in the framework label, knowledge always is evolving and should be applied to inform risk (even if it merely reaffirms what is already known to grow confidence in risk controls). An organization always learns about new risks and the performance of risk controls, thus generating both new knowledge and the need for new knowledge.

Applying the RKI Cycle Across Each Stage of a Product’s Lifecycle: For example, during pharmaceutical development, effective KM can help provide access to prior knowledge to inform risk and to capture new knowledge effectively as it is generated. And during commercial manufacturing, KM can support ongoing reflection and lessons learned as well as enable effective problem solving and sharing of best practices.

Although the RKI cycle can be applied to all types of risk management — not just quality risk management — a set of principles was developed for applying the RKI cycle to ICH Q10, specific to QRM. These principles (Figure 6) establish a set of “target conditions” at different points on the RKI cycle to help guide understanding and application of it (12). Figure 6 depicts the principles superimposed onto the cycle at each appropriate node.

Figure 6: The risk–knowledge infinity cycle as applied to ICH Q10.

The key concepts of the RKI cycle framework applied to ICH Q10 include recognition of QRM and KM as separate, distinct disciplines yet interdependent on each other to inform good decisions and reduce risk to patients. This cycle can repeat for each step of the QRM process (risk assessment, risk control, and risk review), including when new knowledge is acquired. With each pass through the cycle, knowledge increases while risk decreases. Consistent with the underlying framework of interwoven relationships, each element is relevant to the goals of a PQS.

A Closer Look at the RKI Cycle Application
With the six nodes highlighted in Figure 6, the RKI cycle is a helpful, high-level model, with principles suggesting target conditions at various points around it. However, the RKI cycle also can be applied quite practically.

In reality, multiple interconnected storylines are encompassed by the scope of the RKI cycle. The first storyline is the continuous improvement journey QRM is on, as marked by the work on ICH Q9(R1). The second storyline is of KM in the biopharmaceutical industry, and that KM is still in a fairly primitive state. The third is the weaving of KM and QRM together in pursuit of the aforementioned benefits, including improved risk-based decision making to ensure product quality. This uniting of KM and QRM may help some organizations catalyze improvements in the enabling practices of both concepts.

A high-level walk through of the RKI cycle is beneficial to better describe the key activities (Table 1), suggesting potential actions to take for each principle (or node) on the cycle.

Table 1: A high-level walk through of the RKI cycle.

Suggested Actions to Get Started
To achieve the big-picture vision and fully operationalize the RKI cycle takes time and effort. However, as the saying goes “every journey starts with the first step,” and you can take some steps immediately, knowing what to look for. Recall the three storylines, or topics, mentioned above: improving QRM, defining and improving KM for the biopharmaceutical industry, and uniting the two enablers. Following are suggested opportunities for action.

Topic 1, Improving QRM — Potential Actions: The November 2020 concept paper for ICH Q9(R1) (14) identifies four primary areas for improvement (nodes 1–4 in Table 1), and two additional points to be addressed (nodes 5 and 6), for a total of six revision topics. A detailed discussion of these and associated improvements is the focus of ICH Q9(R1) and thus outside the scope of this article.

However, when we apply a knowledge lens to QRM (with deep consideration for its optimal state), it becomes clear that all six revision topics in some way are dependent on knowledge (e.g., knowledge availability, prior knowledge, access to expertise, and other know-how); therefore, KM has a role to play in the improvement of each topic. By recognizing this connection and reflecting on your organization’s QRM process, you can begin to understand how the ICH Q9(R1) changes, once official, could trigger an opportunity to enhance how KM can make QRM more successful in a number of areas. Table 2 contains illustrative citations from the ICH Q9(R1) draft document highlighting this interdependence with KM (12).

Table 2: The interdependence between the six ICH Q9(R1) revision topics and effective knowledge management.

Topic 2, Defining and Improving KM for the Biopharmaceutical Industry — Potential Actions: Looking specifically at RKI cycle nodes 4, 5, and 6 (Table 1) that emphasize defining and improving KM reveals many opportunities to get started in defining and improving KM.

For example, if an organization has known pain points or anecdotal evidence of a problem with knowledge gaps in an area of the business (e.g., wasted time and effort seeking knowledge in the organization, failed technology transfers, or challenges in commissioning, qualification, and validation (CQV), that company could consider starting with a focus on KM (node 5), and embedding KM in the flow of those processes (nodes 4 and 6).

Other opportunistic triggers to get started on KM include the following:

∙ When designing or redesigning a business process, take that opportunity to get started on KM by building it into the flow of the new process.
∙ KM can support the most important product or other priorities at an organization (e.g., a product licensure or merger).
∙ In grass-roots efforts, KM can help you leverage existing practices and energy and support expanding and scaling localized activities.

Once you find an area of focus for starting with KM, be sure to prioritize. Do not take on too much (too big or complex of a process, too large of a global scope, and so on). And in the sage advice of the American Productivity and Quality Center (APQC), design, experiment, and improve in rapid cycles with no more than three-months’ worth of analysis and design and no more than three months to demonstrate impact.

Simple strategies to get started with defining and improving KM are as follows:

Conduct a knowledge map or create a knowledge inventory for a department or a product, and assess how well each item “flows” — is it easily findable and accessible? Be sure to include tacit knowledge too, such as expertise and lessons learned.

Implement a simple KM solution (e.g., after-action review, community of practice (CoP), expertise locator, standard repository, or pre-job brief).

Invest in someone to upskill on KM, including learning and benchmarking opportunities, and seek ideas from how others with similar challenges have made progress.

Provide basic KM awareness training as part of employee training curricula (and henceforth during on-boarding).

Look closely at the “flow” of tacit knowledge in your organization. Sometimes creating simple lists can make a big difference, such as using decision logs, expert listings, and document trackers.

Provide guidance about where people should store information.

Figure 7: Knowledge management process model (adapted).

Figure 7 shows a KM Process Model that illustrates key steps in a KM process (15).

Topic 3, Uniting KM and QRM — Potential Actions: The RKI cycle nodes (Table 1) that provide the connection between QRM and KM are nodes 1, 3, 4, and 6. Nodes 4 and 6 are addressed above with topic 2 (“defining and improving KM”) and are about embedding KM “in the flow” of business processes that create the knowledge, used during QRM and elsewhere (e.g., change management). Considering that nodes 1 and 3 provide additional steps for uniting KM and QRM, conduct a knowledge mapping exercise (16, 17) with a well-defined scope. Ensure a holistic consideration of applicable knowledge included (e.g., regulatory and guidance documents, such as those on technology transfer that often provide lists of typical knowledge involved). Be sure to consider tacit knowledge. Use the knowledge map to prioritize how to address gaps in knowledge flow.

Look critically at the knowledge captured during QRM to determine how well newly surfaced knowledge is captured. For example, is sufficient tacit knowledge captured so that a decision can be understood in the future during risk review or in other contexts (similar processes)? Such tacit knowledge might include expertise shared during the risk assessment, decisions and supporting rationale, alternatives considered, and acknowledgment of what was known at a specific time.

Maximizing the Impact of Knowledge Management
Although full realization of the benefits of effective QRM is still a work in progress, implementation of KM lags behind QRM and is in need of focused attention. Although the linkage between QRM and KM is in its infancy (Figure 8) (9), small but tangible and meaningful steps can enable progress now.

Figure 8: QRM and KM integration in theory and reality.

This is especially important for the biopharmaceutical industry considering the current environment. With advanced therapeutic medicinal products (ATMPs) becoming a reality, a heightened expectation of accelerated development from stakeholders on all sides, geopolitical forces realigning supply chains, significant investment from new technologies, and an evolving landscape of competition, the industry faces a time of rapid and unprecedented change. Its ability to maximize the impact of knowledge to minimize risk and help ensure product quality and product availability is clearly an area worth focused attention.

References
1 ICH. Harmonised Tripartite Guideline: Pharmaceutical Quality System Q10. Geneva, 2008; https://database.ich.org/sites/default/files/Q10 Guideline.pdf.

2 Lipa MJ, O’Donnell K, Greene A. Managing Knowledge and Risk: A Literature Review on the Interdependency of QRM and KM As ICH Q10 Enablers. Level 3. 15(2); https://doi.org/10.21427/2jdq-jq09.

3 Kane P. A Blueprint for Knowledge Management in the Biopharmaceutical Sector. Dublin Institute of Technology, 2018: Doctoral thesis, 2018; https://doi.org/10.21427/aex5-5p19.

4 Lipa MJ. Unlocking Knowledge to Benefit the Patient: How Connecting KM and QRM Can Strengthen Science and Risk-Based Decision Making. Doctoral thesis. Dublin Institute of Technology, 2021: https://doi/org/:10.21427/02bz-ge70.

5 ISO 30401. Knowledge Management Systems: Requirements. Geneva, 2018; https://www.iso.org/standard/68683.html.

6 ICH. Technical and Regulatory Considerations for Pharmaceutical Product Lifecycle Management Q12. Geneva, 2019; https://database.ich.org/sites/default/files/Q12_Guideline_Step4_2019_1119.pdf.

7 ICH. Analytical Procedure Development Q14 (draft); https://database.ich.org/sites/default/files/ICH_Q14_Document_Step2_Guideline_2022_0324.pdf.

8 ICH. Quality Risk Management: ICH Q9(R1), Step 2. November, 2021; https://www.fda.gov/media/159218/download.

9 Lipa MJ, O’Donnell K, Greene A. A Survey Report on the Current State of Quality Risk Management (QRM) and Knowledge Management (KM) Integration. Level 3. 15(3) 2021; https://arrow.tudublin.ie/level3/vol15/iss3/5.

10 Fisher I. The Rate of Interest: Its Nature, Determination and Relation to Economic Phenomena. New York: Macmillan, 1907.

11 Lipa MJ, O’Donnell K, Greene A. Knowledge As the Currency of Managing Risk: a Novel Framework to Unite Quality Risk Management and Knowledge Management. Level 3. 15(2): https://doi.org/10.21427/4mzp-vn67.

12 Lipa M, Mulholland V, Greene A. Improving Risk-Based Decision Making (RBDM) Effectiveness Through a Framework Which Integrates Knowledge and Risk. Level 3 16(2) 2022: 0–25; https://arrow.tudublin.ie/level3/vol16/iss2/2.

13 Macmillan I, Ihrig M. Managing Your Mission-Critical Knowledge. Harvard Business Review. January–February 2015; https://hbr.org/2015/01/managing-your-mission-critical-knowledge.

14 ICH. Final Concept Paper ICH Q9(R1): Quality Risk Management. November 2020; https://database.ich.org/sites/default/files/Q9-R1_Concept%20Paper_2020_1113.pdf.

15 ISPE. Good Practice Guide: Knowledge Management in the Pharmaceutical Industry. ISPE: Tampa, FL, 2021; https://ispe.org/publications/guidance-documents/good-practice-guide-knowledge-management-pharmaceutical-industry.

16 APQC. 4-Step Guide to Knowledge Mapping, 16 June 2018; https://www.apqc.org/blog/4-step-guide-knowledge-mapping.

17 Kane PE, Smalley C. Identification of Critical Knowledge: Demystifying Knowledge Mapping. A Lifecycle Approach to Knowledge Excellence in the Biopharmaceutical Industry. Taylor and Francis Group (CRC Press) 2017: 421–442; https://doi/org/10.1201/9781315368337-31.

Martin Lipa, PhD, is a member of the Pharmaceutical Regulatory Science team at TU Dublin (prst.ie) and executive director of knowledge management at Merck & Co., Inc., 126 East Lincoln Drive, Rahway, New Jersey 07065; [email protected].

Figures 2, 3, 6–8 are adapted here with permission from Martin Lipa (© 2020–2022). Figures 4 and 5 are adapted with permission from Martin Lipa and Kevin O’Donnell (© 2020).