Essentials in Quality Risk Management

Quality risk management (QRM), as defined in International Conference on Harmonization's (ICH) Q9 document (1), is designed to ensure that drug critical quality attributes (CQAs) are defined and maintained from phase to phase during drug development and manufacturing and changes in drug-product formulation, definition, analytical method, and associated process changes are understood and managed to ensure patient safety and drug efficacy. An effective QRM process can further ensure the high quality of the drug product to the patient by providing a proactive means to identify and control potential risks to quality during development and manufacturing.

Risk can be defined two ways. First, as the combination of the probability of occurrence of harm and the severity of that harm, or second, as the potential influence of product and process factors on CQAs and the uncertainty of that influence. The first definition is traditional and takes into account potential failures and adverse events. The second takes into account influence of factors relative to CQAs and how well we understand or know the influence of those factors on the CQAs of the drug product. In modern drug development, it is often the second definition that is a problem in that we don't know what we don't know. As we complete development activities, the risk goes down because our knowledge and understanding of the factors associated with unit operations and analytical methods go up relative to product acceptance and all associated CQAs.

There are two key principles in QRM. First, risk assessment should be based on scientific knowledge associated with product and process understanding, and second, the level of effort associated with risk assessment/management should be commensurate with the level of risk being identified and evaluated. Science and data help to minimize and control risk. A common criticism of risk assessments is they are just opinions and not backed by science. The higher the focus and dependence on scientific principles, thought experiments, literature/research, prior experimental results, and understanding of historical performance, the better the science brought into the QRM process. The major benefits of QRM and risk assessments are to improve the ability to develop drug products and drug substance and answer the question, "When, what, how much, and where do we need additional development?" Development activities reduce potential risks to safety and efficacy and help to achieve the benefits of the drug for the targeted indication.

Figure 1: Quality risk management and systematic drug development. (ALL FIGURES ARE COURTESY OF THE AUTHOR.)

Systematic drug development and QRM (see Figure 1) ensure that we maintain line of site from the target product profile, to the quality target product profile (QTTP), through CQA generation to analytical method selection, unit operation characterization, specification and acceptance criteria limit generation, critical process parameters and control selection, and finally, method and process validation (see Figure 2). ICH Q6, Q8, Q9, Q10, and Q11 detail the pharmaceutical development process and how to set limits (1-5). The QRM process is linked to product and process CQAs because they are the quality attributes of the drug.

Figure 2: QTTP and critical quality attribute (CQA) identification and line of sight.

QUALITY RISK MANAGEMENT PROCESS

QRM is a process with a series of operations, inputs, and outputs (see Figure 3). All unit operations, formulations, analytical methods, excipients, cell banks, working cell banks, equipment, reagents, chemistry, facilities, and materials are evaluated for the potential influence they may have on drug CQAs and product requirements. Any time a change event is being recommended, a risk assessment should be initiated. Any time an analytical method is being developed and/or a process is being characterized, a risk assessment should be generated prior to study design.

Figure 3: Quality risk management (QRM) process (Q9).

Risk assessment

The QRM process is linked to product and process CQAs because they are the quality attributes of the drug to be assessed. Risk assessment includes risk identification, risk analysis, and evaluation. This process is generally a team effort to work through the product/process step-by-step to identify and evaluate each potential risk. Outcome from the assessment should be a set of identified and prioritized risks that either require action or are considered acceptable with an associated rationale. Risk assessments should generally be done in advance of development or change control rather than as a justification of changes after the fact.

Figure 4: QRM template, high-level risk assessment.

All risk assessments begin with a clear risk question. The risk question focuses the risk assessment team on to the risk area to be assessed. It is recommended that a list of CQAs be identified until there is line of sight determined from CQAs to unit operation and/or other drug attributes. Two types of risk assessment templates are commonly used: QRM high-level risk assessment (e.g., failure mode and effects analysis [FMEA]) and a low-level detailed design of experiment (DOE) factor response matrix (see Figures 4 and 5).

Figure 5: Design of experiment (DOE) factor response matrix, low-level risk assessment.

Risk control

Risk control has two potential outcomes: either action is taken to minimize and control risks, and/or the risks are considered acceptable and there is a scientific rationale as to why the risks are acceptable. There are many potential activities that can control risk. In general, the severity is reduced, the probability is lowered, and/or detectability to lower risk is improved. Adding redundancy and/or increasing robustness are also key considerations to design out and control risk. Process analyical technology (PAT), statistical process control (SPC), and the associated control logic design are also important concepts in designing out risk and designing in input and output control loops. Figure 6 is associated with risk control and is used to either accept risk or to reduce the risk.

Figure 6: Risk control.

Risk communication and review

Once the risk assessment and the control actions have been determined, it is crucial in the QRM process to communicate the actions to process owners and key stakeholders (see Figure 7). CMC team leaders, key managers, and development teams, who will need to know the actions required to minimize the identified risks. Clear action owners, implementation timelines, and an effective documentation and review process are needed to make the needed and identified changes happen.

Figure 7: Risk communication.

QRM TOOLS

QRM tools are typically used in risk identification, risk analysis, evaluation, and control. There are two types of tools: risk assessment and control and statistical/analytical tools. Risk assessment and control tools aid in risk identification, risk control, and risk communication. Statistical/analytical tools aid in variation analysis, identification of risk areas, and determining the probability and frequency of potential risks. Analytical and quality tools further help to identify and prioritize risk. Knowing the right tool for the right job is fundamental to proper risk identification and control.

Risk-assessment tools include:

• FMEA

• Fault tree analysis (FTA)

• Hazard analysis and critical control points (HACCP)

• Hazard operability analysis (HAZOP)

• Preliminary hazard analysis (PHA)

Statistical/analytical tools include:

• Pareto and risk-weighted Pareto analysis

• Process flow and risk priority numbers (RPN)

• Super Fishbone (Cause and effect diagram with RPN) (see Figure 8)

• Histograms and process capability

• Control charts

• Sniper plots

• ANOVA and hypothesis testing

• DOE (product and process)

• Variation studies, partition of variation (POV), and residual expected maximum likelihood (REML).

Figure 8: Super fishbone diagram.

QRM IMPLEMENTATION

Every company that is involved in drug development needs to take QRM seriously. An implementation plan with tools, training, and standard operating procedures are needed to build a low-risk development and manufacturing platform. Management involvement is needed to trigger risk-assessment generation, form teams, communicate risk reduction or acceptance actions, and establish a formal review process to measure results and progress. Clarification of roles and responsibilities for QRM within a company also will need to be formalized.

Thomas A. Little, PhD, is president of Thomas A. Little Consulting in Highland, UT, drlittle@dr-tom.com.

REFERENCES

1. ICH, Q9 Quality Risk Management (ICH, 2006).

2. ICH, Q6 Specifications: Test Procedures and Acceptance Criteria for New Drug Substances and New Drug Products: Chemical Substances (ICH, 2000).

3. ICH, Q8 Pharmaceutical Development (ICH, 2009).

4. ICH, Q10 Pharmaceutical Quality System (ICH, 2009).

5. ICH, Q11 Development and Manufacture of Drug Substances (ICH, May 2012).

6. FDA, PAT—A Framework for Innovative Pharmaceutical Development, Manufacturing, and Quality Assurance (Rockville, MD, 2004).