Regardless of whether you are a member of a Quality Assurance department in the pharmaceutical industry or not, the term Quality Risk Management (QRM) is likely familiar to you. This is because QRM, a systematic process that assesses risk to the quality of a drug product across its lifecycle (quality risk assessment), is also often used by a wide range of manufacturing industries when investigating defects during the product development process. Using QRM gives a company the ability to maintain compliance while also identifying product issues that could be harmful to the consumers, some being susceptible patients. These issues are ones that, without intervention, could easily translate into adverse events, as well as lost product, costs, and even business.

However, while some situations may necessitate more intense reviews, this is not true for all. This is a point stressed throughout the ICH Q9, an FDA guidance document for the application of quality risk management. As one of the primary principles of QRM states, “the degree of rigor and formality of quality risk management should reflect available knowledge and be commensurate with the complexity and/or criticality of the issue to be addressed.” Therefore, a QRM framework can be applied to all levels of potential risk to the safety of a product, and it does not have to be done in a long, arduous process. With this in mind, quality risk management can and should be integrated into the daily operations of any company that wants to maintain a focus on product integrity and patient safety. Assessing, reviewing, and rating risks can then become a natural reaction to product and operation issues.

Applying QRM to Daily Decision Making

As ICH Q9 lays out in its Risk Management Methods and Tools section, there are a number of ways QRM can be applied. These include:

• Basic risk management facilitation methods, such as flowcharts, check sheets, etc.
• Failure Mode Effects Analysis (FMEA)
• Fault Tree Analysis
• Hazard Analysis and Critical Control Points (HACCP)
• Hazard Operability Analysis (HAZOP)
• Preliminary Hazard Analysis (PHA)
• Risk Ranking and Filtering
• Supporting Statistical Tools

ICH Q9 outlines four steps to initiating a quality risk management process:

1. Define the problem and/or risk questions, including pertinent assumptions identifying the potential for risk.

2. Assemble background information and/or data on the potential hazard, harm or human health impact relevant to the risk assessment.

3. Identify a leader and critical resources.

4. Specify a timeline, deliverables, and appropriate level of decision making for the risk management process.

The most widely used QRM method is FMEA. For this method, scores are assigned to risks based upon the severity of each risk and the probability of them occurring. Each deviation is given its own line, and using the knowledge base of everybody in the room, a score is assigned based on potential failure mechanisms, failure modes, and their impact on system operation. The scale on which these scores are set as well as the ranges that indicate whether a risk is low, medium, or high is also decided by the group. Low risks would not require action, medium risks need further consideration, and high risks need to be addressed immediately.

Creating this mindset across the company helps maintain compliance and allows the ability to identify any product issues before a public adverse event. ICH Q9 stresses the importance of training personnel on QRM as it “provides for greater understanding of decision-making processes and builds confidence in quality risk management outcomes.” Using this process also makes it easier to identify what deviations are non-critical more quickly. In fact, most have to do with minor issues that may not have any effect whatsoever on the quality of the product. Nonetheless, the severity of a risk should never be assumed, which makes the need for a risk assessment even greater.

QRM is Not Your Enemy

Most often, when it is suggested that a risk assessment be completed for a deviation, not everyone is thrilled about the prospect of sitting down and hashing out each and every detail. However, not every situation requires a formal assessment, nor does the FDA expect it. In ICH Q9, it states, “It is neither always appropriate nor always necessary to use a formal risk management process (using recognized tools and/or internal procedures, e.g., standard operating procedures). The use of informal risk management processes (using empirical tools and/or internal procedures) can also be considered acceptable.”

And when a formal assessment is completed, it does not require hours of a person’s time. Simply gathering a cross-functional group of the right people in the same room and discussing the potential impacts of a deviation using a FMEA matrix is enough. This risk communication portion of the process gives you an opportunity to collaborate with various subject matter experts and decision makers who all have specific scientific and/or technical knowledge, giving you a chance to obtain a deeper understanding of the risks to the product. Many facts could also come out during these conversations that others may not have known or considered.

Before this can occur though, you have to ensure the group making these decisions is representative of any department in the company that could be impacted by that change. This is so decisions aren’t made with a siloed point of view. Each department involved should be represented by at least one member of management as well as those with boots on the ground, who may have a point of view management may not consider.

Building a Culture of Quality

Beyond the fact that the FDA expects the application of quality risk management for risk assessment, it is, as already established, a significant benefit to the company. And this is not limited to the cost savings from saved batches or the man hours required for problem resolution. QRM can improve the relationships between departments as well as the problem-solving skills of the employees. It translates into a common expectation that the impact of a risk and its effect on quality is a primary consideration when decisions need to be made.

Without these group evaluations, stakeholders across the company can have a different perception of the impact of a particular risk as well as the probability of it occurring. Developing a shared understanding of risk through QRM demonstrates to regulators that a company and its employees have the ability to work through potential risks to a product, allowing product quality to be maintained throughout the product lifecycle. The majority of risk assessments can then become just a matter of having a conversation, but it is one using a calculated process as opposed to just having a discussion of opinions.

In a recent article by the Harvard Business Review (HBR), a “true culture of quality” is one that is defined as “an environment in which employees not only follow quality guidelines but also consistently see others taking quality-focused actions, hear others talking about quality, and feel quality all around them.” Utilizing a QRM framework for day-to-day decisions ultimately results in a stronger culture of quality as well as consistency in quality-related decisions. When a problem arises, employees are equipped with better and more efficient decision-making skills.

One factor authors of the HBR article point to as something that plays a critical role in driving quality as a culture value is increasing employee ownership and empowerment. Through the use of QRM, employees can have the confidence of both understanding the impacts of a risk across the company as well as applying a solution that delivers the outcomes for not just their goal but also the overall goal of the company. And as evidenced by the long list of potential applications for quality risk management outlined in Annex II of ICH Q9, it is clear that a successful application of QRM principles and tools could have a positive effect at every level of drug development.

Article by: CHERYL ABERNATHY