Development & Deployment of a Risk Based Compliance Turnaround … · 2005-08-24 · The FDA Regulatory & Compliance Symposium Page 2 Development & Deployment of a Risk Based Compliance

Development & Deployment of a Development & Deployment of a Risk Based Compliance Risk Based Compliance

Turnaround StrategyTurnaround Strategy

John R. Pinion IIJohn R. Pinion IIGenentech, Inc.Genentech, Inc.

The FDA Regulatory and Compliance The FDA Regulatory and Compliance SymposiumSymposium

August 24 August 24 –– 26, 200526, 2005

The FDA Regulatory & Compliance Symposium Page 2

Development & Deployment of a Risk Based Compliance Turnaround Strategy

AgendaAgenda1. Objectives2. Keys to Success3. Risk Triggers4. Getting Started / Expectations5. Business Assessment6. Risk Assessment7. Risk Control / Mitigation8. Communication and Timing9. Execution10. Measurement / Effectiveness Review11. Questions



ObjectivesObjectives• Reduce Overall Patient Risk• Reduce Compliance Risk• Improve Overall Business Performance• Focus Resources• Improve Customer Satisfaction• Improve Operating Mechanisms & Management

Visibility• Reset Performance Expectations



Keys to SuccessKeys to Success1. Senior Management Recognition/Understanding of Issues2. Comprehensive Evaluation / Assessment of Business3. Effective Analysis of the Results of the Business Evaluation

(risk / gaps)4. Review of Organization and Talent5. Development of a Risk Analysis / Risk Management6. Creation of a Progress Measurement Approach7. Senior Management Acceptance of Approach8. Broad Communication of Need for Change and Action Plan9. Adequate Resources to Execute Strategy10. Implementation of Routine Senior Management Review Process11. Effectiveness Review of Mitigation Actions



Risk TriggersRisk Triggers• Change in CEO & Other Senior Management

Changes• Restructuring / Mergers• Products

– New Area– New Molecular Entity

• RIF – Process Support Staff

• Regulatory Agency Quality Indicators– FCAs– Complaint Trends or Product Field Performance– Lack of Procedure Maintenance to Current cGMP's



Getting Started / ExpectationsGetting Started / Expectations• Define

– Inputs to Be Included in the Business Assessment– Risk Analysis / Management Model (ISO 14971)– Cross Functional Risk Management Team– Outputs of Process

• Develop and Deploy Measurement System• Identify

– Risks– Mitigation Actions

• Verify Effectiveness of Mitigations• Establish / Initiate Communication with Appropriate

Agencies



Getting Started / ExpectationsGetting Started / Expectations

• Product Performance– FCAs– CAPAs– Complaints– Process Performance

• Quality Systems– 8 Key Systems

• Business Processes• Facility Design / Performance• Infrastructure• Talent / Organization• Culture• Resources

– Personnel– Capital

• Product Performance– FCAs– CAPAs– Complaints– Process Performance

• Quality Systems– 8 Key Systems

• Business Processes• Facility Design / Performance• Infrastructure• Talent / Organization• Culture• Resources

– Personnel– Capital

• Product Decisions• Process Improvement Review• Quality System Performance• Business Process

Performance• Facility / Capital Decisions• Organization / Talent Review

Results / Decisions• Legacy Issue CA/PA• Operating Mechanism

Decisions• Progress (Score Card)

Measurement• Results of Effectiveness

Review

• Product Decisions• Process Improvement Review• Quality System Performance• Business Process

Performance• Facility / Capital Decisions• Organization / Talent Review

Results / Decisions• Legacy Issue CA/PA• Operating Mechanism

Decisions• Progress (Score Card)

Measurement• Results of Effectiveness

Review

InputsInputs OutputsOutputsInput Process Output Model (Example) Input Process Output Model (Example)

Risk Analysis Process

Risk Analysis Process



Stop

Decision

No

Yes

ID of all known andforeseeable gaps

Estimate risk associatedwith each gap

Implement actions

Verify effectiveness ofactions

Re-assess risk

Determine if postmitigation risk is

acceptable

Verify documentation iscomplete

Yes

Yes

Determine if mitigationis necessary

Identify Products, Systems, Facilities etc. to be included in process

No

Prioritize mitigation actions

Determine ifmitigation is feasible

No


Getting Started/ ExpectationsOverview –Risk ManagementProcess

Getting Started/ ExpectationsOverview –Risk ManagementProcess



Getting Started / ExpectationsResource CommitmentGetting Started / ExpectationsResource Commitment

Time

Res

ourc

e C

omm

ittm

ent

Time

Res

ourc

e C

omm

ittm

ent

Long Term EfficiencyGain Following Implementation of Mitigations

Resources Required Short Term to Execute Mitigations



Business AssessmentElements to ConsiderBusiness AssessmentElements to Consider

• Compliance History / Regulatory Commitments• License Status• Product Performance• Facility Condition / Performance (Manufacturing)• Business Infrastructure• Quality Systems• Capital / Resource Commitment• Leadership / Management Responsibility• Organization Structure• Talent• Internal Improvement Processes• Documentation Status



Risk AssessmentRisk Assessment Matrix (example)Risk AssessmentRisk Assessment Matrix (example)

Overall Risk Post

Mitigation

Mitigation Verification

Mitigation or Decision

Overall Risk

Probability of

Occurrence

Severity of Impact

Impact On

Impact of Gap

Gap Identified

Product, Process,

System, etc.

Define Rating / Scoring Criteria to Help Prioritize Mitigation ActionsDefine Rating / Scoring Criteria to Help Prioritize Mitigation Actions



Risk Control / MitigationsDecisions / Actions to be ConsideredRisk Control / MitigationsDecisions / Actions to be Considered

• System Redesign• Management Changes• Organization Changes• FCAs• Process Improvements• Facility Capital Improvements• Retirement of Product• Facility Closure /

Simplification

• Validation• Improved Documentation• Improved Operating

Mechanisms• Employee Education• CAPA• Labeling Enhancements • Product Improvements• Regulatory Submission

Updates



Communication / TimingCommunication / Timing

Meet Fiscal RequirementsAs Necessary

(Material Decisions)Business Stakeholders

Ensure Patient SafetyAs Necessary Based on DecisionsCustomers / Patients

Update on Progress, Gain Feedback

Establish in Conjunction With AgencyRegulatory Agencies

AwarenessMonthlyBroad Organization

Process / Progress / Issue ReviewWeeklyQuality Organization

Process / Progress / Issue ReviewWeeklyRisk Management Team

Review / Discuss Overall Level of Risk, Key DecisionsMonthlySenior Management

ObjectiveFrequencyAudience



Communication / TimingCommunication / Timing

Time (days - example)Time (days - example)

Defin

e In

puts

to B

e

Inclu

ded

As a

Par

t of t

he

Busin

ess

Asse

ssm

ent

Con

duct

/ C

ompl

ete

Initi

al

Busi

ness

Ass

essm

ent

Dev

elop

Mea

sure

men

t

Syst

em

Com

plet

e R

isk

Anal

ysis

Prio

ritize

Miti

gatio

n

Actio

ns

Impl

emen

t Act

ions

Verif

y Ef

fect

iven

ess

Rea

sses

smen

t

Start 30 90 180 730(Dependant of Gaps and Mitigations Needed)

CommunicationCommunication




ExecutionKey ConsiderationsExecutionKey Considerations

• Well Developed Plan• Communication / Alignment of Organization• Objective / Fact Based Measurement• Employee Training & Development• Prioritization• Visible Management Commitment• Dedicated Resources• Third Party Review of Approach / Progress• Forecast of Activity• Commitment to Make the Difficult Decisions• Verification of Effectiveness



MeasurementMeasurement

Confirm Effectiveness of Mitigation ActionsAD Hoc ReviewThird Party Assessment

Results

Confirm Effectiveness of Mitigation ActionsManagement ReviewInternal Assessment Trends

Confirm Effectiveness of Mitigation ActionsManagement ReviewProduct / Process Trend Data

Ensure Timely Implementation of Mitigation ActionsScore CardMitigation Action Progress

Tracking

Verify Reduction of RiskRisk Analysis DocumentRisk Reduction Tracking

ObjectiveApproachMeasurement



MeasurementMitigation Action Score CardMeasurementMitigation Action Score Card

ForecastVerification of Effectiveness

Current Status

Mitigation 2Action 1

Action 2

Action 3

Mitigation 1Action 1

Action 2

Action 3

Initial StatusPerson ResponsibleMitigation



•• Business AssessmentBusiness Assessment•• Risk AnalysisRisk Analysis•• Mitigation PlanMitigation Plan•• Effectiveness ReviewEffectiveness Review

•• Business DecisionsBusiness Decisions•• Measurement Feedback Measurement Feedback •• 33rdrd Party FeedbackParty Feedback•• Prioritization Prioritization •• Compliance EventsCompliance Events

•• Risk Management TeamRisk Management Team•• Dedicated ResourcesDedicated Resources•• CommunicationCommunication•• Execution and ReviewExecution and Review

•• Risk Reduction TrackingRisk Reduction Tracking•• Mitigation Score CardMitigation Score Card•• Management Review (Trend Data)Management Review (Trend Data)•• Assessment TrendsAssessment Trends•• Third Party Assessment ReviewThird Party Assessment Review

StrategyStrategy

DeploymentDeployment

MeasurementMeasurement

AdjustmentAdjustment

CCRREEAATTIIVVEEDDGGEEPPRREESSEENNTTAATTIIOONNSS

SSIIMMII VVAALLLLEEYY,, CCAALLIIFFOORRNNIIAA

WWOORRLLDD--CCLLAASSSS PPRREESSEENNTTAATTIIOONNSSCCOOSSTT--EEFFFFEECCTTIIVVEE SSOOLLUUTTIIOONNSS

RRAAPPIIDD TTUURRNNAARROOUUNNDDCCOONNSSIISSTTEENNTT && RREELLIIAABBLLEE SSEERRVVIICCEE

PPRROOFFEESSSSIIOONNAALL && TTAALLEENNTTEEDD SSUUPPPPOORRTT

880055--229977--99110055

CCRREEAATTIIVVEEDDGGEE0055@@AAOOLL..CCOOMM

imaginationimaginationimaginationimaginationimaginationimagination

originalityoriginalityoriginalityoriginalityoriginalityoriginality

inspirationinspirationinspirationinspirationinspirationinspiration

creativenesscreativenesscreativenesscreativenesscreativenesscreativeness

presentationspresentationspresentationspresentationspresentationspresentations

Questions??Questions??

Documents

Development & Deployment of a Risk Based Compliance Turnaround … · 2005-08-24 · The FDA Regulatory & Compliance Symposium Page 2 Development & Deployment of a Risk Based Compliance