ICH Q9 – Quality Risk Management

The purpose of Q9 is to serve as a foundational or resource document that is independent yet supports other ICH Quality documents and complements existing quality practices, requirements, standards, and guidelines. Different from other ICH guidelines and Provides a process and tools, not requirements.

Risk as per

ICH Q9 – The combination of the probability of occurrence of harm and the severity of that harm (ISO/IEC Guide 51)

ISO 14971 – Risk is commonly described as having two principle components: Severity ( if the harm occurs) & Probability (of the harm occurring)

ICH Q9 -Definitions :

•Harm: Damage to health, including the damage that can occur from loss of product quality or availability.

•Hazard: The potential source of harm (ISO/IEC Guide 51).

•Detectability: The ability to discover or determine the existence, presence, or fact of a hazard.

Quality risk management :

As per ICH Q9 it is a systematic process for the assessment, control, communication and review of risks to the quality of the drug (medicinal) product across the product lifecycle.

The advantages of risk management are

It reduces subjectivity as it is systematic, scientific & data driven
Allows risk prioritization due to ranking of risks
Improves decision making by allowing to identify what gives most benefits to the patient
enhances quality
improves communication as it is documented.

Risk management is all about

knowing our processes (manufacturing and business),
identifying what’s truly important,
focusing our money, time, energy, and people on the things that are really important; i.e., things which have potential to impact patients
not spending time on a low risk items BECAUSE IT JUST DOESN’T MATTER!

ICH Q9 – Scope :

This guideline provides a framework that may be applied to all aspects of pharmaceutical quality, including development, manufacturing, distribution, inspection and submission/review processes throughout the lifecycle of drug substances and drug products, biological and biotechnological products, and the use of raw materials, solvents, excipients, packaging and labeling materials.

ICH Q9 – Principles :

The evaluation of the quality risk should ultimately link back to the potential harm to the
patient.
The level of effort, formality and documentation of the quality risk management process should be commensurate with the level of risk.

ICH Q9 Linkage to Patient Risk

ICH Q9 – Quality Risk Management Process :

Quality risk management is a systematic process containing 4 steps

(A )Risk assessment:

- Risk identification
  - “What can go wrong?”: identifying consequences
  - A systematic use of Information to identify hazards and referring to risk question or problem from historical data, theoretical analysis, informed opinions & concerns of stakeholders

- Risk analysis
  - The estimation of the risk associated with the identified hazards
  - Seeking the likelihood that it might “go wrong”. A qualitative or quantitative process of linking the likelihood of occurrence and severity of harm.
  - Considering the detectability of risk if applicable

Use Statistics when applicable for example – For predicting shelf-life of drug substance or drug product or Sampling plan for validation or Sampling Plan for inspection

Maintain a reliable and accessible robust data sets

Trend and use appropriate statistics (e.g. conventional analysis of covariance (ANCOVA)) model for shelf-life

- Risk evaluation
  - Compares the identified and analyzed risks against given risk criteria
  - Assign the probability and severity of a risk
  - Qualitative or quantitative process might be used. Consider the strength of evidence for all three of the fundamental questions : What might go wrong? What is the likelihood (probability) it will go wrong? What are the consequences (severity)?

(B) Risk control : is about

- Finding out risk estimation whether it is above acceptable level or below
- what can be done to reduce or eliminate risk
- what is the appropriate balance between benefits, risks & resources
- are there new risks being introduced due to controlling activity of identified risks
- Risk Priority number
  RPN = Severity (S) x Probability of Occurrence (P) x Detection (D)
  How bad is it? How often does it happen? How well is it detected?
  (Future) (Past) (Today)
  The higher the RPN, the higher the potential risk.
  D = Difficulty of detection in advance

Sample Risk Map & Risk response Framework :

- Risk reduction
  - Focuses on mitigation and avoidance
  - Elimination of risks, where appropriate
  - Mitigate the severity
  - Reduce probability of harm
  - Increase process of detectability of hazards & quality risks
  - Take care not to introduce new risks. It might be appropriate to revisit the risk assessment during the life cycle for new risks or increased significance of existing risks

- Risk acceptance
  - Formal decision to accept remaining/residual risk or previously accepted non specified residual risk
  - Might not entirely eliminate risk
  - Case-by-case basis identify acceptable level of risk
  - Supported by (senior) management
  - Who has to accept the risk ?
    - Decision Maker(s) : Person(s) with the competence and authority to make appropriate and timely quality risk management decisions
    - Stakeholder : Any individual, group or organization that can …be affected by a risk. Decision makers might also be stakeholders and the primary stakeholders are the patient, healthcare professional, regulatory authority, and industry

(C) Risk communication : Exchange or sharing of information about risk and its management between the decision makers and others.

- It relate the existence, nature, form, probability, severity, detectability, acceptability, etc. of the risk
- It can be formal or informal and also it can be with internal stakeholders or external suppliers
- It needs to be bi-directional sharing of information about risk and risk management
  between the decision makers and others
- Communicate at any stage of the QRM process
- Communicate and document the output/result of the QRM process appropriately
- Communication need not be carried out for each and every individual risk acceptance
- Use existing channels as specified in regulations, guidance and SOP’s

(D) Risk review:

- Review of output and results of QRM process
  - By taking in to account of new knowledge and experience
  - Utilized for planned or unplanned events
  - Perform periodically and the frequency needs to depend on the level of risk
- Risk acceptance
  - Provides for a review of the prior risk acceptance considering any additional information

Risk Management Tools :

Failure Mode Effects Analysis (FMEA)
- Provides for an evaluation of potential failure modes for design, processes and their likely effect on outcomes and/or product performance.
- FMEA relies on product and process understanding.
- FMEA methodically breaks down the analysis of large complex processes into manageable steps.
- It is powerful tool for summarizing the important modes of failure, factors causing these failures and the likely effects of these failures.
- FMEA can be used to prioritize risks and monitor the effectiveness of risk control activities.
- FMEA can be applied to equipment and facilities and might be used to analyze a manufacturing operation and its effect on product or process.
- It identifies elements/operations within the system that render it vulnerable.
- The output/results of FMEA can be used as a basis for design or further analysis or to guide resource deployment.
Failure Mode Effects & Criticality Analysis (FMCEA)
Fault tree analysis (FTA)
Hazard Analysis of Critical Control Points (HACCP)
Hazard Operability Analysis (HAZOP)
Risk Ranking and Filtering
Preliminary Hazard Analysis (PHA)
Supporting statistical tools

Quality Risk Management provides a useful process that enables both industry and regulators to focus
on what is important for patients. Integration of Quality Risk Management into existing systems and regulatory process will take time. ICH Q8, Q9 & Q10 together will enable the pharmaceutical community to move towards the desired state for 21st century quality management.