Essentials in Quality Risk Management

BioPharm International Magazine

Thomas A. Little, PhD

Quality risk management is an essential element of every aspect of drug development and manufacturing throughout the product lifecycle.

Quality risk management (QRM), as defined in International Conference on Harmonization’s (ICH) Q9 document (1), is designed to ensure that drug critical quality attributes (CQAs) are defined and maintained from phase to phase during drug development and manufacturing and changes in drug-product formulation, definition, analytical method, and associated process changes are understood and managed to ensure patient safety and drug efficacy. An effective QRM process can further ensure the high quality of the drug product to the patient by providing a proactive means to identify and control potential risks to quality during development and manufacturing.

Risk can be defined two ways. First, as the combination of the probability of occurrence of harm and the severity of that harm, or second, as the potential influence of product and process factors on CQAs and the uncertainty of that influence. The first definition is traditional and takes into account potential failures and adverse events. The second takes into account influence of factors relative to CQAs and how well we understand or know the influence of those factors on the CQAs of the drug product. In modern drug development, it is often the second definition that is a problem in that we don’t know what we don’t know. As we complete development activities, the risk goes down because our knowledge and understanding of the factors associated with unit operations and analytical methods go up relative to product acceptance and all associated CQAs.

There are two key principles in QRM. First, risk assessment should be based on scientific knowledge associated with product and process understanding, and second, the level of effort associated with risk assessment/management should be commensurate with the level of risk being identified and evaluated. Science and data help to minimize and control risk. A common criticism of risk assessments is they are just opinions and not backed by science. The higher the focus and dependence on scientific principles, thought experiments, literature/research, prior experimental results, and understanding of historical performance, the better the science brought into the QRM process. The major benefits of QRM and risk assessments are to improve the ability to develop drug products and drug substance and answer the question, “When, what, how much, and where do we need additional development?” Development activities reduce potential risks to safety and efficacy and help to achieve the benefits of the drug for the targeted indication.

Systematic drug development and QRM (see Figure 1) ensure that we maintain line of site from the target product profile, to the quality target product profile (QTTP), through CQA generation to analytical method selection, unit operation characterization, specification and acceptance criteria limit generation, critical process parameters and control selection, and finally, method and process validation (see Figure 2). ICH Q6, Q8, Q9, Q10, and Q11 detail the pharmaceutical development process and how to set limits (1-5). The QRM process is linked to product and process CQAs because they are the quality attributes of the drug.

Quality Risk Management Process

QRM is a process with a series of operations, inputs, and outputs (see Figure 3). All unit operations, formulations, analytical methods, excipients, cell banks, working cell banks, equipment, reagents, chemistry, facilities, and materials are evaluated for the potential influence they may have on drug CQAs and product requirements. Any time a change event is being recommended, a risk assessment should be initiated. Any time an analytical method is being developed and/or a process is being characterized, a risk assessment should be generated prior to study design.

Risk assessment

The QRM process is linked to product and process CQAs because they are the quality attributes of the drug to be assessed. Risk assessment includes risk identification, risk analysis, and evaluation. This process is generally a team effort to work through the product/process step-by-step to identify and evaluate each potential risk. Outcome from the assessment should be a set of identified and prioritized risks that either require action or are considered acceptable with an associated rationale. Risk assessments should generally be done in advance of development or change control rather than as a justification of changes after the fact.

All risk assessments begin with a clear risk question. The risk question focuses the risk assessment team on to the risk area to be assessed. It is recommended that a list of CQAs be identified until there is line of sight determined from CQAs to unit operation and/or other drug attributes. Two types of risk assessment templates are commonly used: QRM high-level risk assessment (e.g., failure mode and effects analysis [FMEA]) and a low-level detailed design of experiment (DOE) factor response matrix (see Figures 4 and 5).

Risk control

Risk control has two potential outcomes: either action is taken to minimize and control risks, and/or the risks are considered acceptable and there is a scientific rationale as to why the risks are acceptable. There are many potential activities that can control risk. In general, the severity is reduced, the probability is lowered, and/or detectability to lower risk is improved. Adding redundancy and/or increasing robustness are also key considerations to design out and control risk. Process analyical technology (PAT), statistical process control (SPC), and the associated control logic design are also important concepts in designing out risk and designing in input and output control loops. Figure 6 is associated with risk control and is used to either accept risk or to reduce the risk.

Risk communication and review

Once the risk assessment and the control actions have been determined, it is crucial in the QRM process to communicate the actions to process owners and key stakeholders (see Figure 7). CMC team leaders, key managers, and development teams, who will need to know the actions required to minimize the identified risks. Clear action owners, implementation timelines, and an effective documentation and review process are needed to make the needed and identified changes happen.