ICH Q9 Quality Risk ManagementDIA China Annual Meeting, May 2010
Joseph C. FamulareHead of External Relations and Collaboration
Pharma Global Technical Operations Global Quality, F. Hoffmann-La Roche Ltd
© J. Famulare slide 2 May, 2010
Agenda
Background
Overview of Q9
It’s use in relation to Q 8 and Q10
Value to both Industry and Regulators
- Use of finite resources
- Identifying risks that have the most impact with respect to quality
- Industry Examples highlighting use for Site Transfer
- Quality Risk Management application throughout the product
lifecycle
- Integration of Quality Risk Management and Change Management
© J. Famulare slide 3 May, 2010
ICH Q9 Definition of Risk
It is commonly understood that risk is defined as
the combination of the probability of occurrence
of harm and the severity of that harm
• A conceptual, general purpose definition!
• Backed by a “fit for purpose” concept from quality management theory.
• Follows generally device industry concepts, but has foundations in
NAS(1983).
• Pharmaceutical Life Cycle coverage
© J. Famulare slide 4 May, 2010
Plainly speaking...
1. What can go wrong?
2. What is the likelihood (probability) it will go wrong?
3. What are the consequences (severity)?
si = scenario
pi = probability
xi = severity
© J. Famulare slide 5 May, 2010
What’s in ICHQ9? The Risk Management Process
Risk Review
Risk Assessment
Risk Evaluationunacceptable
Risk Control
Risk Analysis
Risk Reduction
Risk Identification
Review Events
Risk Acceptance
InitiateQuality Risk Management Process
Output / Result of theQuality Risk Management Process
Ris
k M
an
ag
em
en
t To
ols
Ris
k C
om
mu
nic
ati
on
Decision making!!
© J. Famulare slide 6 May, 2010
“Risk Management” is Ubiquitous
Company
Strategic Risks Operational Risks Financial RisksQuality and
Compliance Risks
Competitor
Advantage
Company
Viability
Shareholder
Harm Patient Harm
ICH Q9 Scope
© J. Famulare slide 7 May, 2010
What’s in ICH Q9: Principles & Methodologies for QRM
Intended Use, Purpose Analysis,
HHM, SFN etc.
Functional Analysis, Process Map, Cause & Effect Analysis, Risk
Ranking & Filtering etc.
Hazard Analysis & Critical Control Point,
Failure Modes & Effects Analysis etc.
Preliminary Hazard Analysis, Decision
Trees
Probabilistic Risk Analysis, Fault
Trees, Event Trees
High level, top-down tools (identify
all possible hazards)
Detailed, bottom-up tools
(explore specific hazards or failure modes)
© J. Famulare slide 8 May, 2010
Value of Risk Rankings?
• To focus experts on risk, as defined in a useful context
• To focus experts on prioritizing work based on risk
- Risk score should not be interpretive as an actual measure of risk… These are simply relative rankings
© J. Famulare slide 9 May, 2010
Purpose of the Assessment...
Risk scoring methods (including PHA, FMEA etc.) are generally qualitative or semi-quantitative; they are mostly about prioritization under a consistent process, rather than an accurate quantification of risks
0 0.05 0.1 0.15 0.2 0.25 0.3
Sealer/capper
Filter
Inert ingredients container
Sealer/capper
Active ingredients container
Bottle supply
Mixer 1
Criticality
© J. Famulare slide 10 May, 2010
A Consistent Process Results in Consistent Decisions –
PQS Concepts
Public Health Priority
Recalls
Difficult Processes
Products of
Concern
Facility History
SchedulingAdverse Drug
Experience
Ranking
Sample illustration, only!
“A defined, consistent process”
Ad Hoc Ranking
Recalls
Programs
Public Health Priority
Difficult Processes
Products of
Concern
Facility History
Scheduling
Adverse Drug ExperienceKnowledge
Base
© J. Famulare slide 11 May, 2010
Fundamental Objective of Risk Management
Risk to Pharmaceutical
Quality
Risks from Products
Risks from Manufacturing
Facilities
Risks from Manufacturing
Processes
• Even fundamental objectives - the purpose for the system -represent probability space for scenarios.
“To control...”
pprodpprod pfac
pfac pprocpproc
© J. Famulare slide 12 May, 2010
Expert Judgments - Most Common Implementation Strategy
How is Expert Judgment of Probability Used?
Creates new uncertainties in risk models...
• Consensus vs. Majority?
• Average values of individual judgments; or single group-based judgment?
• Quantitative methods?
• Group dynamics important! (e.g. “group think”)
Individuals to Groups
© J. Famulare slide 13 May, 2010
Common Errors in Risk Management
• Objectives and scope not clearly identified i.e. working on the wrong problem
• Using risk management to justify inadequate practices or non-compliance with regulatory expectations
• Work towards a predefined outcome
• Disregarding uncertainty
• Failing to
- Account for risk acceptance level
- Link present decisions with future impact
- Select the appropriate risk assessment methodology
- Involve the right group of experts in performing the risk assessment
- Involve a qualified risk management facilitator
© J. Famulare slide 14 May, 2010
Example: Understanding The Priors - FMECA
• “Risk” ranking methodologies are contextually defined - results from one site should not be compared with another on an absolute scale unless the context of the two applications are comparable.
• Even within one site, changing input and context of the risk assessment might result in different risk assessment scores and risk control decisions .
• Simulation (for illustration) follows
© J. Famulare slide 15 May, 2010
Integration of Quality Risk Management and
Change Management
What data needs to be
developed?
What is the
potential impact?
How it will be
measured?
Estimate risk (severity, probability,
detectability)
posed by a
proposed
change Documents the
change, the results, and QU
approvalImplementation of
risk control
actions identified
© J. Famulare slide 16 May, 2010
Integration of Quality Risk Management and
Change Management
• During evaluation of a change in manufacturing consider results from development
• It should be fully transparent and easy to implement and inspect- What changed? When? Why?
- Rationale for the change
- Approval of the change by Quality Unit
- Review of effectiveness
• Implementing QRM = making decisions backed by systematic assessment of the risk
- Assess if the change might introduce a new risk or impact the level of an existing
risk or risk control mechanism
- The effectiveness of the change is demonstrated by a number of things including:
• Annual Product Review (APR)
• Process Validation activities
© J. Famulare slide 17 May, 2010
Role of Quality Risk Management in
the product life cycle
Patientneeds
Business needs
Quality
Target Product
Profile (QTPP)
Critical
Quality Attribute
(CQA)
Critical Process &
Material Attributes
(CPP/CMA)
Productdesign
Manu-facturing
Process
design
Control Strategy
Technical
regulatory
Filing & Review
Performance
Review &
Change Control
Co
mm
erc
ial
Man
ufa
ctu
ring
Researc
h a
nd
clin
ical
stu
die
s
Opportunities to apply Quality Risk Managements
Process understanding
PAI Inspections
GMP Inspections
Knowledge managementTechnicalTransfer
approx.life cycle time
1/4 3/4
can be 7 years
© J. Famulare slide 18 May, 2010
The Desired State
• Barriers to continual improvement reduced or removed
- Improved manufacturing efficiency
- Sustained or improved product quality
• Specifications based on factors (e.g. parameters) that truly impact product quality
• Both, industry and authorities focus on areas of greatest risk and understanding of residual risks
• Common understanding and language on risk
© J. Famulare slide 19 May, 2010
An Example of QRM Application at Roche
• Part of FDA’s QbD Pilot Program from the Office of Biologics Products and the Office of Compliance
• Application of Quality Risk Management along with leveraging site transfer, process, and comparability experience
- Enables use of a scientific risk based approach to facilitate robust
decision making for site transfers both internally by Roche and can be used by the regulators if the choose
• Allows for a lower regulatory burden based on risk e.g. pre-approval inspection waived
© J. Famulare slide 20 May, 2010
Site Transfer
Expanded Change Protocols (eCPs) Strategy and Overview
© J. Famulare slide 21 May, 2010
Risk Scoring Example on a Risk Priority Number (RPN)
• Increase the % of RPN in green zone, decrease the % of RPN in the red zone
Probability of Detection
2 4 6 8 10
100 200 400 600 800 1000
80 160 320 480 640 800
64 128 256 384 512 640
60 120 240 360 480 600
48 96 192 288 384 480
40
High Risk
80 160 240 320 400
36 72 144 216 288 360
32 64 128 192 256 320
24 48 96 144 192 240
20 40 80 120 160 200
16
Moderate Risk
32 64 96 128 160
12 24 48 72 96 120
8 16 32 48 64 80
Primary Risk
Number (PRN)
4
Low Risk
8 16 24 32 40
Risk Priority Number (RPN):
192–1000 High: Risk control action(s) required. Risks with RPN values ≥ 360 (indicated in
boldface italic type) require immediate notification of appropriate management and decision makers.
72–160 ALARP: Reduce risk to As Low As Reasonably Practicable
8–64 AC: Acceptable
Note: The RPN is the product of the PRN and the score for probability of detection. Due to the standardized scoring criteria, 30 different RPNs are mathematically possible.
Probability of Detection
2 4 6 8 10
100 200 400 600 800 1000
80 160 320 480 640 800
64 128 256 384 512 640
60
High Risk
120 240 360 480 600
48 96 192 288 384 480
40 80 160 240 320 400
36 72 144 216 288 360
32
Moderate Risk
64 128 192 256 320
24 48 96 144 192 240
20 40 80 120 160 200
16 32 64 96 128 160
12 24 48 72 96 120
8 16 32 48 64 80
Primary Risk
Number (PRN)
4
Low Risk
8 16 24 32 40
Risk Priority Number (RPN):
320–1000 High: Risk control action(s) required. Risks with RPN values ≥480 (indicated in
boldface italic type) require immediate notification of appropriate management and
decision makers.
120–288 ALARP: Reduce risk to As Low As Reasonably Practicable
8–96 AC: Acceptable
Note: The RPN is the product of the PRN and the score for probability of detection. Due to the
standardized scoring criteria, 30 different RPNs are mathematically possible.
© J. Famulare slide 22 May, 2010
Facility and cGMP Compliance Aspects of Site Transfer
Site Transfer
Quality Risk Management
Scope and Limitations
Product-specific Comparability Criteria
SiteInspection
© J. Famulare slide 23 May, 2010
Advantages of QRM Application for Site Transfers
• Allows for robust and effective multi site transfers to enable production of critical drugs to ensure global supply to patients
• Fosters better understanding of the risks to the product and process based on the site history, complexity etc.
• Provides a better understanding of risks to the regulator to determine the best use of their resources i.e. type of filing and need for and type of inspection
© J. Famulare slide 24 May, 2010
Overall Conclusions
• Quality Risk Management should be implemented throughout the product and process lifecycle
• As we move toward implementation from the principle-driven, “launching platform” of ICH Q9, now is the time to “check in” and ensure that risk management application is based on a scientificand data driven foundation
• Uncertainty and probabilities are unavoidable. Risk management is a process of explicitly confronting uncertainties in decisions
© J. Famulare slide 25 May, 2010
ICH Q9: Briefing Pack Slides
• How to access ICH Q9 briefing pack?
- On http://www.ICH.org website
- Go to Q9: Quality Risk Management, Q9 Briefing Pack
- Table of Contents - you may download chapters or the entire 423-slide set for review (also available in Japanese)
• Questions and Answers on ICH Q8, Q9 & Q10
- On http://www.ICH.org website
- Go to Q8 or Q9 or Q10
- On in ICH Website from the Implementation Working Group (IWG) http://www.ich.org/cache/html/5050-272-1.html
© J. Famulare slide 26 May, 2010
Acknowledgement
Thanks to:
Gregg Claycamp, FDA
Stephan Roenninger, Roche
Emma Ramnarine, Roche
for their contributions