ICH Q9 Quality Risk Management - Drug Information Association 1/parallel... · ICH Q9 Quality Risk Management DIA China Annual Meeting, May 2010 Joseph C. Famulare Head of External

ICH Q9 Quality Risk ManagementDIA China Annual Meeting, May 2010

Joseph C. FamulareHead of External Relations and Collaboration

Pharma Global Technical Operations Global Quality, F. Hoffmann-La Roche Ltd

© J. Famulare slide 2 May, 2010

Agenda

Background

Overview of Q9

It’s use in relation to Q 8 and Q10

Value to both Industry and Regulators

- Use of finite resources

- Identifying risks that have the most impact with respect to quality

- Industry Examples highlighting use for Site Transfer

- Quality Risk Management application throughout the product

lifecycle

- Integration of Quality Risk Management and Change Management


ICH Q9 Definition of Risk

It is commonly understood that risk is defined as

the combination of the probability of occurrence

of harm and the severity of that harm

• A conceptual, general purpose definition!

• Backed by a “fit for purpose” concept from quality management theory.

• Follows generally device industry concepts, but has foundations in

NAS(1983).

• Pharmaceutical Life Cycle coverage


Plainly speaking...

1. What can go wrong?

2. What is the likelihood (probability) it will go wrong?

3. What are the consequences (severity)?

si = scenario

pi = probability

xi = severity


What’s in ICHQ9? The Risk Management Process

Risk Review

Risk Assessment

Risk Evaluationunacceptable

Risk Control

Risk Analysis

Risk Reduction

Risk Identification

Review Events

Risk Acceptance

InitiateQuality Risk Management Process

Output / Result of theQuality Risk Management Process

Ris

k M

an

ag

em

en

t To

ols

Ris

k C

om

mu

nic

ati

on

Decision making!!


“Risk Management” is Ubiquitous

Company

Strategic Risks Operational Risks Financial RisksQuality and

Compliance Risks

Competitor

Advantage

Company

Viability

Shareholder

Harm Patient Harm

ICH Q9 Scope


What’s in ICH Q9: Principles & Methodologies for QRM

Intended Use, Purpose Analysis,

HHM, SFN etc.

Functional Analysis, Process Map, Cause & Effect Analysis, Risk

Ranking & Filtering etc.

Hazard Analysis & Critical Control Point,

Failure Modes & Effects Analysis etc.

Preliminary Hazard Analysis, Decision

Trees

Probabilistic Risk Analysis, Fault

Trees, Event Trees

High level, top-down tools (identify

all possible hazards)

Detailed, bottom-up tools

(explore specific hazards or failure modes)


Value of Risk Rankings?

• To focus experts on risk, as defined in a useful context

• To focus experts on prioritizing work based on risk

- Risk score should not be interpretive as an actual measure of risk… These are simply relative rankings


Purpose of the Assessment...

Risk scoring methods (including PHA, FMEA etc.) are generally qualitative or semi-quantitative; they are mostly about prioritization under a consistent process, rather than an accurate quantification of risks

0 0.05 0.1 0.15 0.2 0.25 0.3

Sealer/capper

Filter

Inert ingredients container

Sealer/capper

Active ingredients container

Bottle supply

Mixer 1

Criticality


A Consistent Process Results in Consistent Decisions –

PQS Concepts

Public Health Priority

Recalls

Difficult Processes

Products of

Concern

Facility History

SchedulingAdverse Drug

Experience

Ranking

Sample illustration, only!

“A defined, consistent process”

Ad Hoc Ranking

Recalls

Programs

Public Health Priority

Difficult Processes

Products of

Concern

Facility History

Scheduling

Adverse Drug ExperienceKnowledge

Base


Fundamental Objective of Risk Management

Risk to Pharmaceutical

Quality

Risks from Products

Risks from Manufacturing

Facilities

Risks from Manufacturing

Processes

• Even fundamental objectives - the purpose for the system -represent probability space for scenarios.

“To control...”

pprodpprod pfac

pfac pprocpproc


Expert Judgments - Most Common Implementation Strategy

How is Expert Judgment of Probability Used?

Creates new uncertainties in risk models...

• Consensus vs. Majority?

• Average values of individual judgments; or single group-based judgment?

• Quantitative methods?

• Group dynamics important! (e.g. “group think”)

Individuals to Groups


Common Errors in Risk Management

• Objectives and scope not clearly identified i.e. working on the wrong problem

• Using risk management to justify inadequate practices or non-compliance with regulatory expectations

• Work towards a predefined outcome

• Disregarding uncertainty

• Failing to

- Account for risk acceptance level

- Link present decisions with future impact

- Select the appropriate risk assessment methodology

- Involve the right group of experts in performing the risk assessment

- Involve a qualified risk management facilitator


Example: Understanding The Priors - FMECA

• “Risk” ranking methodologies are contextually defined - results from one site should not be compared with another on an absolute scale unless the context of the two applications are comparable.

• Even within one site, changing input and context of the risk assessment might result in different risk assessment scores and risk control decisions .

• Simulation (for illustration) follows


Integration of Quality Risk Management and

Change Management

What data needs to be

developed?

What is the

potential impact?

How it will be

measured?

Estimate risk (severity, probability,

detectability)

posed by a

proposed

change Documents the

change, the results, and QU

approvalImplementation of

risk control

actions identified


Integration of Quality Risk Management and

Change Management

• During evaluation of a change in manufacturing consider results from development

• It should be fully transparent and easy to implement and inspect- What changed? When? Why?

- Rationale for the change

- Approval of the change by Quality Unit

- Review of effectiveness

• Implementing QRM = making decisions backed by systematic assessment of the risk

- Assess if the change might introduce a new risk or impact the level of an existing

risk or risk control mechanism

- The effectiveness of the change is demonstrated by a number of things including:

• Annual Product Review (APR)

• Process Validation activities


Role of Quality Risk Management in

the product life cycle

Patientneeds

Business needs

Quality

Target Product

Profile (QTPP)

Critical

Quality Attribute

(CQA)

Critical Process &

Material Attributes

(CPP/CMA)

Productdesign

Manu-facturing

Process

design

Control Strategy

Technical

regulatory

Filing & Review

Performance

Review &

Change Control

Co

mm

erc

ial

Man

ufa

ctu

ring

Researc

h a

nd

clin

ical

stu

die

s

Opportunities to apply Quality Risk Managements

Process understanding

PAI Inspections

GMP Inspections

Knowledge managementTechnicalTransfer

approx.life cycle time

1/4 3/4

can be 7 years


The Desired State

• Barriers to continual improvement reduced or removed

- Improved manufacturing efficiency

- Sustained or improved product quality

• Specifications based on factors (e.g. parameters) that truly impact product quality

• Both, industry and authorities focus on areas of greatest risk and understanding of residual risks

• Common understanding and language on risk


An Example of QRM Application at Roche

• Part of FDA’s QbD Pilot Program from the Office of Biologics Products and the Office of Compliance

• Application of Quality Risk Management along with leveraging site transfer, process, and comparability experience

- Enables use of a scientific risk based approach to facilitate robust

decision making for site transfers both internally by Roche and can be used by the regulators if the choose

• Allows for a lower regulatory burden based on risk e.g. pre-approval inspection waived


Site Transfer

Expanded Change Protocols (eCPs) Strategy and Overview


Risk Scoring Example on a Risk Priority Number (RPN)

• Increase the % of RPN in green zone, decrease the % of RPN in the red zone

Probability of Detection

2 4 6 8 10

100 200 400 600 800 1000

80 160 320 480 640 800

64 128 256 384 512 640

60 120 240 360 480 600

48 96 192 288 384 480

40

High Risk

80 160 240 320 400

36 72 144 216 288 360

32 64 128 192 256 320

24 48 96 144 192 240

20 40 80 120 160 200

16

Moderate Risk

32 64 96 128 160

12 24 48 72 96 120

8 16 32 48 64 80

Primary Risk

Number (PRN)

4

Low Risk

8 16 24 32 40

Risk Priority Number (RPN):

192–1000 High: Risk control action(s) required. Risks with RPN values ≥ 360 (indicated in

boldface italic type) require immediate notification of appropriate management and decision makers.

72–160 ALARP: Reduce risk to As Low As Reasonably Practicable

8–64 AC: Acceptable

Note: The RPN is the product of the PRN and the score for probability of detection. Due to the standardized scoring criteria, 30 different RPNs are mathematically possible.

Probability of Detection

2 4 6 8 10

100 200 400 600 800 1000

80 160 320 480 640 800

64 128 256 384 512 640

60

High Risk

120 240 360 480 600

48 96 192 288 384 480

40 80 160 240 320 400

36 72 144 216 288 360

32

Moderate Risk

64 128 192 256 320

24 48 96 144 192 240

20 40 80 120 160 200

16 32 64 96 128 160

12 24 48 72 96 120

8 16 32 48 64 80

Primary Risk

Number (PRN)

4

Low Risk

8 16 24 32 40

Risk Priority Number (RPN):

320–1000 High: Risk control action(s) required. Risks with RPN values ≥480 (indicated in

boldface italic type) require immediate notification of appropriate management and

decision makers.

120–288 ALARP: Reduce risk to As Low As Reasonably Practicable

8–96 AC: Acceptable

Note: The RPN is the product of the PRN and the score for probability of detection. Due to the

standardized scoring criteria, 30 different RPNs are mathematically possible.


Facility and cGMP Compliance Aspects of Site Transfer

Site Transfer

Quality Risk Management

Scope and Limitations

Product-specific Comparability Criteria

SiteInspection


Advantages of QRM Application for Site Transfers

• Allows for robust and effective multi site transfers to enable production of critical drugs to ensure global supply to patients

• Fosters better understanding of the risks to the product and process based on the site history, complexity etc.

• Provides a better understanding of risks to the regulator to determine the best use of their resources i.e. type of filing and need for and type of inspection


Overall Conclusions

• Quality Risk Management should be implemented throughout the product and process lifecycle

• As we move toward implementation from the principle-driven, “launching platform” of ICH Q9, now is the time to “check in” and ensure that risk management application is based on a scientificand data driven foundation

• Uncertainty and probabilities are unavoidable. Risk management is a process of explicitly confronting uncertainties in decisions


ICH Q9: Briefing Pack Slides

• How to access ICH Q9 briefing pack?

- On http://www.ICH.org website

- Go to Q9: Quality Risk Management, Q9 Briefing Pack

- Table of Contents - you may download chapters or the entire 423-slide set for review (also available in Japanese)

• Questions and Answers on ICH Q8, Q9 & Q10

- On http://www.ICH.org website

- Go to Q8 or Q9 or Q10

- On in ICH Website from the Implementation Working Group (IWG) http://www.ich.org/cache/html/5050-272-1.html


Acknowledgement

Thanks to:

Gregg Claycamp, FDA

Stephan Roenninger, Roche

Emma Ramnarine, Roche

for their contributions