Implementing risk management

© All rights reserved. Do not copy without permission.

1

Implementing Risk Management in

The Validation Process

Gamal Amer, Ph. D. Principal

Premier Compliance Services, Inc.


2

Why Risk Management in

Drug Manufacturing

FDA Initiative August 2002

Pharmaceutical CGMP for the 21st Century: A Risk-based Approach

A science and risk-based approach to product quality

regulation incorporating an integrated quality system approach


3

FDA Initiative August 2002 Its Objectives

•  Allows Early adoption of new technology. •  Adoption of modern quality management

techniques and implementation of the quality system approach.

•  Focus on understanding the science & technology associated with what you are making.

•  Priority to mitigating the highest risk elements of the manufacturing operation.


4

FDA Initiative August 2002

•  Take home: – You must understand what you are doing. – You must focus on critical areas (highest risk

to product quality) of your operation. – You should utilize automation and data

collection to reduce risk associated with the operation and allow for continuous improvement.

– You must build the quality into your operation.


5

Risk

What Is Risk? What Causes It? Risk to Whom?

Risk Manifestation? Risk Level?


6

What Is Risk?

The combination of the probability of occurrence of harm and the severity of that harm.*

*ICH Consensus Guideline; Q9 Quality Risk Management; June 2006


7

Risk

•  Risk is always present in every endeavor . •  We as humans learn about it, recognize it

subconsciously, and accept a certain level of risk on a daily basis.

•  We always take steps in daily life to mitigate the risk associated with our activities.


8

Risk in Drug Product Development & Manufacturing


9

Quality Events Which May Cause Increased Risk

•  A problem occurs during clinical trials (patient complains/suffers)

•  Un-controllable or un-expected process variability

•  A deviation occurs during the manufacturing •  Analytical result is not what was expected •  A piece of equipment is identified as

malfunctioning after the operation is complete.


10

These Events Increase:

•  Risk to the patient/public •  Risk to the product •  Risk to the personnel •  Risk to the company


11

Risk to whom?

•  We are concerned here with the risk to the quality of the product and hence to the patient.

•  We will focus on the risk in the product lifecycle in general and in the manufacture lifecycle in particular.

•  We will focus on validation, GMP and quality systems as used to mitigate risk.


12

Higher Risk Manufacturing Operations

•  Aseptic Processing (Contamination of product)

•  Dealing with potent compounds (danger to patient from incorrect formulation and to workers from potential exposure)

•  Solid dosage (Cross contamination) •  Labeling (Incorrect labeling)


13

ICH Q9 Quality Risk Management

•  Outlines Quality Risk Management Principles for Product Lifecycle.

•  Phases of QRM include risk assessment, risk control, risk review, risk communication.

•  Defines Risk and How to Measure it. •  Outlines the principle of focusing on the critical

aspects of the drug manufacturing based on the level of risk.

•  Use of change management to reduce risk.


ICH Q9 Quality Risk Management

•  The evaluation of the risk to quality should be based on scientific knowledge and ultimately link to the protection of the patient.

•  The level and extent of actions to be taken to eliminate or minimize actual or potential risk must be appropriate to the magnitude of the problem and commensurate with the level of risk anticipated. (ICH Q9)

14


15

Defining Level of Risk

Function of:

– Severity – Frequency – Detectability

•  These three factors determine the numerical Risk Priority Number (RPN)

•  Qualitative risk (low, medium, and high)


16

Risk Level Factors: Severity

•  What are the consequences of the quality event (non-conformance or deviation)?

•  How deleterious is that potential variability, failure, or deviation?

•  How high is the risk to the patient’s well being? Would it affect or delay his/her treatment?


17

Risk Level Factors: Frequency

•  What are the probability of the occurrence of the failure/deviation?

•  Were attempts made to reduce such frequency in the past? How successful?

•  Review process/operation/design history.


18

Risk Level Factors: Detectability

•  What is the probability of the variability, failure, or deviation being detected?

•  Can the effect/result of the failure/deviation be readily measured/seen?


19

Developing Risk Priority Number RPN

•  Severity: –  Could result in the manufacture of a product, which

may cause death or serious harm requiring intervention(3)

– ……product that may cause or contribute to a patient discomfort or an insignificant delay or interruption in treatment. (2)

– ….. product that will NOT cause injury or discomfort, or delay/interruption in treatment. (1)


20


•  Frequency: – Would definitely occur, is known to have

occurred in the past, expected to reoccur if no action is taken to correct or prevent the problem. (3)

– Unlikely to occur or not expected to reoccur, but it is possible. (2)

– Will not occur or is highly unlikely to.(1)


21


• Detactability: – Consequences of the events are not

detectable or readily obvious (3) – Consequences of the event are not obvious

but, there is a good possibility that, it will be detected.(2)

– Consequences of the event are detectable (1)


22


Risk Priority Number (RPN)=

Severity X Frequency X Detectability RPN= 1-4 Low Risk RPN= 5-11 Medium Risk RPN= 12-27 High Risk These ranges could vary based on experience


23

Mitigating Risk

The level and extent of actions to be taken to eliminate or minimize actual or potential risk must be appropriate to the magnitude of the problem and commensurate with the level of risk anticipated. (ICH Q9)


24

Risk Assessment

Tylenol scare of the early 1980s:

Several death due to tampering with product capsules. The event happened twice. Consumer unable to recognized capsules were tampered with.


25

Using The Risk Assessment Form

Severity: Highest –Result in death (3)

Frequency: happened twice, does not happen often, will surely happen again (3)

Detactability: Difficult to detect a capsule that was tampered with (3)

RPN: 27


26

Using The Risk Assessment Form

Corrective Action: Immediate recall

Investigation: Unable to protect capsules

Preventive action: - Eliminate the use of capsules.

- Develop Tamper evident packages


Interactive Exercise

27


28

Risk Causing Scenarios: If any of the attendees has an example of a risk causing scenario we can address it as a group. 1. In a drug release test, the HPLC instrument has a complete failure while analyzing the drug sample for the impurities profile. The drug has a limited shelf life and must be released within one day of production. The test itself requires 20 hours to perform (sample prep and analysis). The impurities profile is the most critical release test. 2. In the coating of an over the counter analgesic, the color of the coating material was affected by the temperature of the coating pan and was several shades darker. The coating is sugar based food coloring. It is well understood that the food coloring does not have toxic effects/degradents. (Should overheating occur; did it affect the drug substance?).


29

Risk Causing Scenarios: 3. In the manufacture of an API at the completion of a campaign, consisting of 6 batches, the catalyst bed was opened to introduce fresh material in preparation for the next campaign. Upon opening the catalyst bed it was determined that the bed is contaminated with an unknown solid material. Further investigation indicated that the contaminant is inert and insoluble. 4. Patients suffer from heart problem due to over dosage of active in product tablets ingested (tablets contain larger amount of active than indicated). This is reported by doctors as an adverse event.


30

Process Validation: General Principles and Practices

•  Guidance to industry issued by the FDA in January 24, 2011.

•  Outlines a life cycle approach to validation. •  Inline with the principles advanced in ICH Q8,

ICH Q9, ICH Q10 and in ASTM E2500. •  Defines PROCESS VALIDATION as the

collection and evaluation of data, from the process design stage throughout commercial production, which establishes scientific evidence that a process is capable of consistently delivering quality products.


31

FDA Guidance: Process Validation: General

Principles and Practices •  Replaces the guidance issued in 1987 •  “Quality of the product cannot be assured by

simply inspecting or testing in-process and finished products.” It must be built into the product-process a-priori.

•  “Focusing exclusively on the qualification effort without understanding the process and ensuring the process is maintained in a state of control may not lead to adequate assurance of quality.”


32

FDA Guidance To Industry January 2011

•  Three Stages of Process Validation – Process Design Stage (process is defined

based on development and scale-up) – Process Qualification Stage (Design is

confirmed as being capable of reproducible production)

– Continued Verification and improvement (Continuously gaining assurance the process remains in a state of control)


33

Stage 1: Process Design

•  Understanding the science •  Understanding the risk •  Building Quality into the process •  Establishing Control Strategy


34

Stage 2: Implementation and Process Qualification

•  Implement the process and Facility •  Qualification of utilities and equipment •  The Process Performance Qualification

(PPQ) protocol •  Protocol execution and report


35

Stage 3: Continued Process Verification

•  Monitoring appropriate parameters to ensure process in a validated state of control.

•  Use CAPA, PAT and Change control as well as data collected in monitoring to continually improve the process.

•  Proper maintenance of the facility, utilities, and process equipment


Risk Assessment in Process Validation

•  Risk analysis is used in all three stages of Process Validation.

•  Always use risk-based approaches to justify decisions. However such use should be scientifically sound with the goal of achieving and maintaining a high level of product quality.

36


Risk Assessment in

Process Validation •  In stage 1 risk analysis is used in conjunction

with QbD to develop a robust design and reduce variability.

•  In stage 2 risk analysis is used to prioritize your activities and focus the effort on critical systems.

•  In stage 3 it is used in conjunction with a CAPA program to ensure the process remains in a state of control.

37


Stage 2 Process Qualification

Goal: Evaluate the design developed in stage 1 to determine if it is capable of reproducible commercial manufacturing and performs as

expected.

Must follow CGMP-Compliant procedures


39

Stage 2 of Guidance Stipulates •  Facility Design and Utilities & Equipment

Qualification: –  Must properly design and commission facility prior to

the PPQ (Process Performance Qualification) –  Qualification of utilities and equipment (activities to

demonstrate equipment are suitable for intended use) •  Demonstrate proper selection of material and design •  Demonstrate proper construction and installation •  Demonstrate that equipment and utilities operate in

accordance with the process requirements (include appropriate challenges to represent normal operation)

–  Qualification activity must be documented and summarized in a report with appropriate conclusions


40

Stage 2 of Guidance Stipulates •  Qualification Plan For Utilities

–  Qualification of utilities and equipment can be covered under individual plans or under an overall plan.

–  Plan should consider requirements of use and risk management used to prioritize and define extent of activities.

–  Plan should define: •  Studies and tests to be conducted •  The criteria to assess outcome of studies •  Timing for qualification •  Responsibilities for conducting the effort •  Procedure for documenting and approving the qualification

–  Outline firm’s criteria for evaluating changes


41

Stage 2 of Guidance Stipulates •  Process Performance Qualification Approach:

–  PPQ should combine qualified facility, utilities, and equipment with trained personnel to confirm the commercial manufacturing performs as expected.

–  PPQ must be completed before commercial distribution of drug. –  PPQ should be based on science and technical understanding. –  Employ statistical metrics to achieve adequate assurance

through data analysis. –  PPQ should have additional (when compared to normal

production) sampling, monitoring, and analysis –  The concept of ongoing PPQ to determine usable lifetime of

resin columns and the like. –  If using PAT, a different approach to PQ maybe warranted:

•  Qualification to focus on measurement and control loop. •  Establish that the process is reproducible and will deliver quality

product.


42

Stage 2 of Guidance Stipulates •  Process Performance Qualification Protocol:

–  Written Protocol delineating manufacturing conditions, controls, sampling, testing, and expected outcome.

–  PQ should discuss manufacturing conditions, operating parameters, limits, and components.

–  PQ should discuss the data to be collected and when and how it will be evaluated.

–  PQ establishes the tests to be performed and acceptance criteria.

–  PQ should detail the sampling plan (e.g. Number of samples and frequency of sampling).


43

Stage 2 of Guidance Stipulates •  Process Performance Qualification Protocol

(cont): –  Description of statistical methods to be used and how

to address deviations and non-conforming data. –  Confirm that facility and utility qualification have been

successfully completed. –  Confirm personnel training and qualifications. –  Verification of material sources (components and

container/closures) –  Discuss status of analytical methods validation. –  Should be reviewed and approved by appropriate

departments and Quality Unit.


44

Stage 2 of Guidance Stipulates •  Protocol Execution and Report:

–  Only execute approved protocol. –  Departures from the approved protocol to be justified and

approved. –  Follow expected routine procedures for commercial process

using personnel who will be responsible for manufacture. –  Report to be prepared in a timely manner, should include:

•  Summary and analysis of data. •  Evaluation of unexpected results. •  Evaluate manufacturing non-conformances (deviations, OOS

results, etc.). •  Description of corrective actions taken. •  A clear statement as to the process being fit for the intended use. •  Review and approval by appropriate departments and quality unit.


45

What it all means?

•  PPQ to confirm process design •  PPQ to confirm manufacturing process •  PPQ To be completed before manufacture

and distribution •  Previous credible experience with similar

products & processes can be considered •  Entire operating range need not be

verified, only normal operation.


46

Managing Risk Through Validation is Achieved By:

•  Qualification of high risk portions of the facility and utilities.

•  Qualification and verification of high risk portions within the process.

•  Qualification of source of variability in the process.

•  Focusing on portions of the process that have the greatest risk to product quality.


Risk Assessment

•  Based on forward looking analysis (what happens if this unit operation fails?).

•  Based on the knowledge of the science associated with the operation/process.

•  Defining the focus of the risk assessment, e.g. product quality vs. environmental spills (potential issues that cause environmental spills excluded).

•  Divide the process into manageable subsystems.

•  Historic information. 47


48

Risk Assessment Form

•  Page one: – Product information –  Information regarding potential Risk

associated with the system – Description of the issue – Description of the findings of any investigation – Description of relevant historical information


49

Risk Assessment Form •  Page two:

– Analysis of Severity – Analysis of Frequency – Analysis of Detectability

•  Page three: – Calculation of RPN – Definition of action to be taken (commissioning,

Installation and Operation qualification only, IOQ and Performance Qualification)


50

Risk Assessment Form •  Actions to be taken:

–  High RPN - Intolerable •  Understand causes and reason for risk •  Reduce or eliminate risk of further occurrence (re-design) if

possible •  Complete qualification IOQ and PQ

–  Medium RPN – Tolerable •  Evaluate event •  Determine if additional investigation is warranted •  Conduct reasonable and practical qualification (IOQ)

–  Low RPN – Negligible •  No additional investigation •  Monitor through trend analysis for further occurrences •  Commissioning maybe sufficient.


Use of Risk Assessment in Process Qualification

51


Prioritizing the Qualification Effort

•  Which systems should be included as part of the formal qualification effort and which does not have to be.

•  Use of appropriate tools for risk analysis to list causes and effect (e.g. Failure Mode and Effect Analysis FMEA, Fault Tree Analysis, HAZOP, HACCP)

52


Interactive What to do for the following?

53


Qualification of Facility/Utility Systems

1.  HVAC in sterile processing facility. 2.  Electric system in common production

space. 3.  Generator and Un-interruptable power

supply in fermentation facility 4.  Steam generation for power plant. 5.  HVAC in for general laboratory

54



1.  Full qualification of HVAC system (issue contamination of sterile product, severity= 3, frequency =3, detectability=3, RPN=27)

2.  Commissioning is sufficient based on severity due to malfunction(issue electric malfunction, Severity=?, Frequency=3, detectability=1 RPN=3-?)

55



3. IOQ and possibly PQ if fermentation is very expensive (Issue: Power interruption in fermenter for aerobic fermentation can result in fermentation failure (severity=2-3 depending on cost, Frequency=3, detectability=1, RPN=6-9)

4. Commissioning sufficient (issue power loss if steam generation fails, important components have back-up, severity=1, frequency=3, detectability=1 RPN=3)

56



5. Commissioning sufficient (issue failure HVAC resulting in discomfort, severity=1, detectability=1, frequency=3 RPN=3)

57


Qualification of Processing Equipment

•  All equipment used in the process should be qualified (IOQ) at a minimum to:

•  Demonstrate proper selection of material of construction and design

•  Demonstrate proper construction and installation •  Demonstrate that equipment and utilities operate in

accordance with the process requirements (include appropriate challenges to represent normal operation)

•  Processing subsystems that can compromise the quality of the product must be fully qualified.

58


Qualification of High-risk Subsystems

•  Components of the process which could lead to variability should be tested to a higher level (PQ)

•  Critical utility systems representing high risk, are to be full qualified (PQ); –  HVAC, WFI, Purified Water, Clean compressed air,

etc. •  Critical utility/process systems must be fully

qualified, e.g.: –  Autoclave, Incubators, Stability Chambers,

Refrigerators and freezers, etc.

59



•  Fermenter: poor cell growth, poor cell viability and contamination would result in low product titer and poor quality (S=3, F=3, D=2 RPN=12), Complete validation to show ability to provide reproducible results and adequacy of controls.

•  UF Membrane installation: Leakage of product and product loss. Due to damaged unit installed or damaging the unit during installation. Test integrity after installation (S=2, F=2, D=1 RPN=4). No need to fully qualify, maybe referenced in fermenter protocol. Can be controlled procedurally during operation.

60



•  What to do in cases where RPN suggest no need for full qualification?

•  Perform secondary evaluation –  Regulatory commitments may necessitate qualification –  Industry expectations –  Experience with previous inspections –  Procedural requirements

•  Example: Buffer preparation system; incorrect composition and incorrect conditions of preparation result in incorrect buffer pH and conductivity and possible chemical breakdown of components (S=2, F=2, D=1; RPN=4) Managed procedurally, but still qualified per industry practice.

61


Process Performance Qualification

•  The entire process is tested using, qualified and non-qualified systems, trained personnel and procedures based on a well designed protocols.

•  Data is collected in larger amounts when compared to normal operation and statistically analyzed to ensure the process is fit for the intended use.

62


Process Performance Qualification

•  Parts of the process which are known to cause variability are monitored for variations within the batch and from batch to batch.

•  You do not need to test the process limits, instead testing should of the expected normal operating range.

•  Three runs and done is no longer the way to do it.

63


Advantages of Applying Risk Based Validation

•  Better understanding of the science of your operation and the risks associated with it.

•  Only address necessary systems thus optimizing the effort.

•  Focusing your resources on critical systems realizing considerable savings.

•  Ensure that no critical system is missed during and after the qualification effort is complete. (through doing a formal risk analysis of the entire operation)

64


Interactive

•  Why? – Full qualification for, stability chamber,

autoclave, WFI, What else? – Only IOQ for Dust collection systems,

Transfer conveyor, distribution system for purchased gas, What else?

– Only commissioning for processing pumps, potable water system, What else?

65

Health & Medicine

Implementing risk management