What is quality risk management in pharmaceutical?

  • Published on: Mar 05, 2023

If you are scared by the phrase “Quality Risk Management”, you are not alone. This term still makes me uneasy after working for decades in several pharmaceutical organizations.

Quality risk management in the pharmaceutical industry is a buzzword.

You have come to the right place if you are unfamiliar with this philosophy. I will outline this topic I have learned over the past few years.

This effort is an overview, only like touching the tip of an iceberg. Quality risk management, of its credit, warrants a tertiary degree followed by many years of relevant industry experience before we can call ourselves an expert.

Like many other industries nowadays, quality risk management is a critical concept to practice in pharmaceutical operations. And that is for all the right reasons.

Why quality risk management is important?

Quality risk management has become integral to the quality assurance and control system.

When you start practicing risk management philosophy, tools, and techniques, your decision-making process will significantly improve. So does your level of compliance.

Risk management will provide you with a tool for a systematic approach to making prudent risk-based decisions in the following areas of activities:

– During the validation approach and testing

– Qualification of equipment, facilities, and utilities

– Impact assessment of new computerized systems

– During the determination of external suppliers & procurement of materials

– Efficient deviation investigation, change management, and customer complaint handling

– Determination of external & internal audit frequency

– Critical instrument calibration frequency

– Risk-based environment, health, and safety management

– Distinguishing deviations from events

– Improving overall regulatory compliance, etc.

Quality risk management involves the art and science of identifying, analyzing, assessing, and managing uncertain events. 

Events that can impact product quality or compliance with registered dossier throughout a product’s life. 

It requires a balanced approach, weighing the costs of avoiding threats or enhancing opportunities and the benefits to product quality that can be gained. 

It supports more effective and consistent risk-based decisions and makes the decision-making process more transparent.

240 SOPs, 197 GMP Manuals, 64 Templates, 30 Training modules, 167 Forms. Additional documents included each month. All written and updated by GMP experts. Checkout sample previews. Access to exclusive content for an affordable fee.

What is the relationship between risk management and quality management?

There are some confusions between quality management system and quality risk management used in pharmaceutical industries.

These two systems are closely related and interdependent.

The quality management system ensures that pharmaceutical products meet regulatory requirements and customer expectations consistently.

Quality management system is primarily involved in ensuring good manufacturing practice (cGMP), good laboratory practice (GLP), good documentation practice (GDP), good automated manufacturing practice (GAMP) etc.

On the other hand, quality risk management is concerned with identifying, assessing, and managing risks that could impact pharmaceutical products’ safety, efficacy, and quality.

Effective risk management is essential for achieving high-quality pharmaceutical products, and quality management is necessary to ensure that risk management processes are effective.

The two processes are complementary and work together to ensure your manufacturing processes are robust and you make decisions supported by risk assessments.

Ultimately, these two systems in combination make your product safe and effective.

What is quality risk management in pharmaceutical?

According to FDA Guidance for Industry – Q9 Quality Risk Management, “Quality risk management is a systematic process for the assessment, control, communication, and review of risks to the quality of the drug product across the product lifecycle.

With product lifecycle, we can include the impact on the quality, safety, or efficacy of pharmaceutical products.

Put simply, any action, environment, process, system, personnel, facilities, and equipment involved in making pharmaceutical products can introduce risk to product quality.

Quality risk management is the only proven way to identify those risks early and control them effectively so that the potential impact on product quality would be minimal.

The essence of quality management is risk management.

All activities that are undertaken during quality assurance in pharmaceutical operations are to minimize risks.

So that you can deliver your promise to supply medicinal products that are safe, pure, and effective for human use.

Risks are also called hazards that may arise from every aspect of a process.

Once you can identify a risk, you should analyze that against the attributes such as likelihood and consequence.

You ask the question to your audience in case the failure of a risk what would the consequence be on product quality? And also, what would be the likelihood of such failure to occur?

Don’t be fooled by different risk management terminologies.

Some organizations will call consequence as severity and likelihood as probability. These terms are interchangeable without the loss of any meaning.

You should also consider what control mechanisms are in place to prevent such failure in the future.

If the control is inadequate to mitigate the risk, you must consider implementing new controls. In most cases, these questions must be asked before a risk event could occur. Not after.   

A quality risk assessment is a team effort where the subject matter experts are gathered to brainstorm every possible risk question at length.

Together, the team assigns a rating on the consequence if failure of risk would occur and the probability of such an incident to occur.

The ratings could be qualitative such as high, medium or low. Sometimes, ratings are quantitative. We will discuss the ratings more broadly in the later part of the post.

By the end of a quality risk management exercise, each risk area is assigned a risk profile between high, medium, and low.

Existing controls are also identified and recorded during this process.

If the team finds the existing controls are inadequate to minimize the risk, a proportionate risk treatment plan must be created to mitigate, eliminate, or transfer the residual risk.

A risk treatment plan lists a group of additional actions to be taken to control the risks.

If the risks appear to be an opportunity instead, you will make every effort to take the most benefit out of it.

Try our FREE online GMP Skill Booster tests. It’s challanging, it’s refreshing and it’s FREE. Try now!

What are quality risk management examples?

How do some risk questions sound at this time? Let me give some basic examples:

1. If one of my raw material suppliers is located overseas, what would be the potential supply risk in case of a global pandemic? How likely is this failure to happen?

2. If one of my environment monitoring tests fails, what would the consequence be on my product quality? What is the probability that my environmental monitoring campaign will fail?

3. If my personnel are not adequately trained on GMP, how likely they would contribute to a process or product failure? And how large the consequence would become if such a failure would occur?

4. If my warehouse Operators are not following the safety protocols, what would be the consequence on their health? How likely would an incident occur in my facility? Do I have enough controls in place?

5. If my laboratory instruments are not qualified or calibrated regularly, what would impact the reliability of the test results?

6. If my cleaning methods are not validated, would they cause contamination of my products? What is the probability my cleaning methods weren’t validated? Do I have adequate control in place? Should I implement a more robust cleaning method validation to mitigate such risk?

I hope these examples give you an idea of risk questions and risk assessment mindset. The risk possibility in the pharmaceutical industry is limitless.

What is quality risk management framework?

The quality risk management framework is ingrained in its definition.

Remember the definition? Quality risk management is a systematic process for assessing, controlling, communicating, and reviewing risks to the quality of the drug product across the product lifecycle.

So, there are four steps in the quality risk management framework. But the risk assessment needs to be breakdown into three more components to make it work.

According to the ICH Q9 guideline, the risk assessment process itself includes the identification of hazards (risk events), analysis of those hazards by throwing every possible risk question to dissect completely, and evaluation of hazards by rating the potential consequences (severity) and likelihood (probability) of failure.

Risk controlling also has decision-making components such as what do you do with those risks? Would you be able to take mitigation activities? Or you might have the appetite or reason to accept the risk like business as usual.

A generic quality risk management process flow looks like the following image:

Quality Risk Management framework - ICH Q9
Quality Risk Management framework - ICH Q9

240 SOPs, 197 GMP Manuals, 64 Templates, 30 Training modules, 167 Forms. Additional documents included each month. All written and updated by GMP experts. Checkout sample previews. Access to exclusive content for an affordable fee.

A. How do you conduct a quality risk assessment?

As we already know, risk assessment is a three-step process involving identifying, analyzing, and evaluating a risk event.

After a successful risk assessment, each identified risk can be marked with a high, medium, and low-risk profile.

Depending on the intensity of the profile, it will be easier for you to design a mitigation plan. Sometimes also called a risk treatment plan.

Step 1. How do you Identify risk?

During risk Identification, the assessment team will systematically use available information to answer questions like, what can or did go wrong? Typically, the following questions are asked in a risk identification process.

– What might go wrong?

– What is the likelihood (probability) it will go wrong?

– What are the consequences if the risk goes wrong?

– Will the failure be detected readily? If that is the case, then how?

Risks to be considered include, but are not limited to:

– Patient safety

– Product non-conformance

– Fitness for use

– Specification and Product Registration

– Adulteration (i.e., non-conformance to GMP).

– Contamination

– Employee health and safety

– Company reputation, loss of trust, etc.

Information used to identify risk can include historical data, theoretical analysis, informed opinions, and the concerns of those impacted by the decision.

The quality risk management process must also identify opportunities to improve processes.

The decision to accept an opportunity is generally based on an analysis of the costs, benefits, and values.

Step 2. How do you analyse risk?

During risk analysis, the consequence (severity) and likelihood (probability) questions are thrown at the team who would dissect the risk event from all possible angles to comprehend the gravity of the risk.

The assessment team also considers the controls in place and their ability to detect failure.

Following are some examples of risk questions to understand the severity of the risks:

i. How severe would the impact be if the identified risk were to occur during the manufacturing process?

ii. What would be the impact on the quality or safety of the product if the risk would occur?

iii. Would the failure lead to a product recall or other regulatory action? Would it result in negative publicity or damage to the company’s reputation? Will it result in legal action or litigation?

iv. How severely would it impact patient or consumer safety?

v. What would be the severity of the risk that will impact the efficacy or performance of the product?

vi. If the identified risk fails, how severely will it impact the environment or community?

vii. How severe would the impact be if the identified risk results in the loss of critical data or intellectual property?

Following are some examples of risk questions to understand the likelihood of the risks:

i. How likely is it that the identified risk will impact the quality or safety of the product?

ii. What is the probability that we can successfully detect the failure during routine quality control testing?

iii. How likely will the risk lead to a product recall or other regulatory action? Or would the company suffer from significant financial loss?

iv. How likely will the risk impact patient or consumer safety?

v. Will it result in lower efficacy or performance of the product?

vi. Would the risk likely be mitigated by current risk control or preventative measures?

vii. What is the probability that the company’s reputation or public perception would be questionable?

Step 3. How to evaluate risk?

After you analyze the risk areas by brainstorming their impacts on consequences (severity) and likelihood (probability), the assessment team will be well-placed to rate those risks. This phase is called risk evaluation.

Risk evaluation consists of determining the gravity of the consequence of the issue (risk) that needs to be addressed.

At the same time, determination of the likelihood of risk to occur.

The risk team will then compare the risks against pre-defined acceptance criteria.

A qualitative or quantitative process can be used to assign the consequence and likelihood of a risk.

Risk evaluations must consider the strength of the information used to complete the three phases of the risk assessment.

Typically, evaluating risk by multiplying the consequence and likelihood ratings is acceptable.

Risk profile = Consequence score x likelihood score.

The completed risk assessment shall result in an overall risk value expressed as either:

– A quantitative estimate of risk, expressed numerically, such as a probability scale from 0 to 1 (0 percent to 100 percent), or

– A qualitative description of a range of risk, using qualitative descriptors, such as (high), (medium) or (low). The qualitative descriptors shall be defined with as much detail as possible.

240 SOPs, 197 GMP Manuals, 64 Templates, 30 Training modules, 167 Forms. Additional documents included each month. All written and updated by GMP experts. Checkout sample previews. Access to exclusive content for an affordable fee.

B. What is the risk control process?

By the time you finish the evaluation, you have effectively completed the risk assessment process. By now, you will know the exact risk profiles of each identified risk area.

Now, you will control those risks, especially the ones with high and medium risk profiles.

The risk control process documents the actions to deal with the identified quality risks and the acceptance of any residual quality risks.

Risk control must address the following questions:

– Is the risk acceptable without further action?

– What can be done to reduce, eliminate, transfer, or accept the risks?

– What is the appropriate balance among benefits, risks, and resources?

– Are new risks introduced due to the identified risks being controlled?

How do you mitigate risk?

During risk mitigation, you will focus on processes that treat the risks from higher to lower profile.

For example, providing training to your staff could reduce some high-risk areas to medium. Or adding a few more testing points during the stability campaign may generate stronger support for your product’s shelf life etc.

You can also avoid or accept risk when the risk profile is low or under an acceptable level.

i. Risk mitigation

Risk mitigation includes:

– Actions were taken to mitigate the severity and probability of risk; or

– Processes or methods that improve the ability to detect risk

Please be aware that implementing risk reduction measures may introduce new risks into the system or increase the significance of other existing risks.

Therefore, the risk assessment must be repeated to identify and evaluate any possible change in the risk profile.

ii. Risk Acceptance:

Risk acceptance is a decision to accept risk. The risk acceptance decision shall be:

– A decision to accept known residual risk;

– A decision to accept residual risks, which are partially assessed, based upon limited information; or

– A combination of these circumstances.

An optimal quality risk management strategy is designed to reduce risk to an agreed-upon acceptable level.

This acceptable level will depend on many parameters, which should be decided on a case-by-case basis and managed through mitigation tasks.

C. How to communicate risk?

As you conclude the risks, the results must be communicated to the relevant stakeholders, including the management and those operating the process or system who may be affected by those results.

This communication requires that each risk management process be documented appropriately for you. The purpose of the output from the risk management process is:

– To share and communicate information about the risks and how they are controlled.

– To obtain the appropriate approval from management on the outcome.

– To demonstrate to stakeholders that the determination process involves a systematic approach with supporting rationales. 

– To provide a record of the risks that enable decisions to be reviewed and the process to be audited.

– To facilitate ongoing monitoring and review and to sustain the process.

The outcome from the risk assessment must specify a risk owner i.e. a person responsible for ensuring that any actions are implemented and the risk is managed.

D. What is risk review?

After communicating the risk outcome, you should implement an ongoing review at each stage of the risk management process. For example, checking data, assumptions, and understanding.

You should monitor and track the risk outcome and implement controls to ensure they effectively mitigate risks over time.

A risk assessment only assesses the current situation. The nature of quality risks may change with time.

Improved knowledge may result in different views of the risks and may lead to a challenge of the original assumptions.

Therefore, a process must be in place to assess the impact to quality risk if changes or deviations occur over time.

What is quality risk assessment matrix?

The quality risk assessment matrix is arguably the most important segment of the risk evaluation process.

The risk matrix is very useful for visually expressing the position of a risk with its profile within a set range or benchmark. The risk matrix defines the range.

As you can identify, analyze and evaluate risk with relevant rating or score, you can place both scores for consequence and likelihood into the risk matrix. The matrix will help you to visualize the position of the risk profile.

A risk matrix can be depicted in the following diagram.

Quality risk assessment matrix
Quality risk assessment matrix
Try our FREE online GMP Skill Booster tests. It’s challanging, it’s refreshing and it’s FREE. Try now!

Quality risk management tools

There are many tools and techniques that can be used to help identify risks from hazards and assess the risks.

No single tool or technique will meet all requirements. Following are four commonly used risk assessment tools and possible areas of application.

Adaptation or combination of these methods and other statistical tools may apply to specific events or circumstances.

Case Study 1 - risk assessment in deviation investigation

Consider a single incident that has taken place at your workplace, such as an unplanned deviation.

You are about to perform a risk assessment to classify whether the incident is critical, major, or minor.

Below is the way you might do it.

After an initial investigation of the deviation, the risk assessment team agreed to assign

– 2, as the score for Consequence (severity of product quality and GMP) and

– 3, for Likelihood (probability that the deviation will occur again).

Now multiply the ratings for both variables.

The result 3 x 2 = 6 will indicate the deviation has a medium risk risk profile.

Sometimes, risk can be presented in the format of a questionnaire like the image below.

This format is particularly helpful when there are multiple risk events to assess, and all risk questions have to be analyzed and evaluated independently.

Quality risk assessment matrix - questionnaire format
Quality risk assessment matrix - questionnaire format

240 SOPs, 197 GMP Manuals, 64 Templates, 30 Training modules, 167 Forms. Additional documents included each month. All written and updated by GMP experts. Checkout sample previews. Access to exclusive content for an affordable fee.

Case Study 2 - risk assessment in instrument calibration

Consider you have hundreds of instruments that require periodic calibration.

However, you know not every instrument has equal weight in criticality or impact on operations.

For instance, instruments like laboratory precision scales directly impact quality control test results more than rough scales used in the warehouse for weighing bulk raw materials.

Both instruments need to be calibrated.  But their calibration frequency should differ from one another.

Some laboratory precision scales must be calibrated at the start of every day, while the rough scales can be calibrated quarterly. 

We have prepared a risk calculator for you to determine the calibration frequency of different instruments.

The calculator will derive a calibration frequency for you based on your inputs of risk questions.

Try the free calibration risk calculator.

240 SOPs, 197 GMP Manuals, 64 Templates, 30 Training modules, 167 Forms. Additional documents included each month. All written and updated by GMP experts. Checkout sample previews. Access to exclusive content for an affordable fee.

How often should a risk assessment be conducted?

1. Quality Risk management application in validation

The quality risk management process has been applied to validation in several ways for many years. 

Risk management in validation can be used proactively to define validation strategy and scope, or it can be used reactively to assess the impact of a failure or deviation during validation.

Quality risk management can be used throughout the validation lifecycle. However, some examples of key areas where the application of a risk assessment process brings significant benefits are:

i. Defining priorities for validation activities

ii. Defining validation strategy for a process/system, including:

a. Identification of critical process parameters (e.g. manufacturing, cleaning, sterilization, depyrogenation etc.)

b. Identifying direct impact systems and critical components (e.g. System Validation – System and Component Level Impact Assessments) to determine scope of qualification.

iii. Assessing validation failures/deviations

iv. Assessing the impact of changes to a process/system

The use of quality risk management and the methodology to be used should be documented in the relevant validation plan or change management procedure.

2. Risk management application in Environmental, Health, and Safety

You can effectively apply the principle of quality risk management in EH&S processes and situations:

i. Before conducting any maintenance or installation work

ii. In the design of new plants, equipment, and processes

iii. Before making changes to processes and equipment

iv. During EHS workplace inspections

v. When conducting safety audits of new plant and equipment

vi. Organising job rotation/changes to job design

vii. Housekeeping audits

viii. Post-incident/accident analysis

ix. Before purchasing new plant, equipment and chemical substances.

3. Quality Risk management application in critical instrument calibration

You can use quality risk management to determine the calibration requirements of critical instruments, including the calibration frequency.

Risk assessment tool such as Failure Mode and Effects Analysis (FMEA) is the tool of choice that is recommended for calibration interval change analysis.

Its use enables the identification of potential failure modes and assignment of numerical ranking using probability, severity, and detectability of the risk.

The probability (or likelihood) of instrument failure may be attributed to:

a) Design and construction,

b) The environment it is exposed to and

c) How it is used.

Knowledge of the effects of design and construction can be gained through a review of the maintenance history of the instrument, comparing it to similarly designed instruments, and knowing the instrument’s age (period of time in use).

For each of these parameters, if the data and relevant information are unknown, the risk should be assumed to be high.

4. Computerised system risk management

A risk-managed approach to a computerized system life cycle is necessary to qualify the system efficiently and effectively.

Utilizing risk management methodologies allows validation activities to be appropriately scaled to meet business and regulatory needs without creating unnecessary work. 

Risk management approach in Computerized system also benefits the change control process because regulatory impact and risk areas will have been identified before initiating the change.

Thus, the impact of a change can be more easily identified and appropriately handled.

5. Quality risk management is determination of external audit frequency

Risk management approach can be utilized in determining external audit frequency in pharmaceutical business.

The quality risk management process is guided by establishing a risk question that identifies the scope, sought outcome, and areas of focus (risk factors) for the assessment.

For example:

i. How should supplier audits be prioritized and scheduled as a function of their risks to product safety, quality and, market share (business)?

ii. What are the patients, product quality, and business risks associated with materials, components, and services used in the production of medicinal products in relation to their supplier’s audits and

iii. How could these audits be prioritized and scheduled to minimize such risks?

6. Risk management application to identify deviation vs events.

Oftentimes, deviations that occur during the handling, manufacturing, testing or distribution of materials/products have little or no impact on product quality or registration filing.

Quality risk management tools can successfully assess if a deviation does or does not impact product quality.

A deviation with no impact on product quality is classified as an event and thus does not require investigation, while those that impact product quality or regulatory filings are classified as deviations.

7. Quality risk management application in periodic review of SOPs

Each pharmaceutical business defines the responsibilities and the processes for preparing, approving, maintaining, and archiving GMP-related documents and records.

According to this requirement, many businesses employ a default frequency for periodic reviews of SOPs.

Since processes and procedures have varying impacts on products, this practice may unnecessarily consume resources in an attempt to maintain compliance with the policy.

Quality risk management application to periodic review of SOPs is intended to provide a tool for determining the optimal review frequency.

The decision will ensure those SOPs related to GMP systems or processes and therefore bear the greatest potential for impact on product quality are reviewed/revised in a timely and possibly more frequent manner than those determined to be less critical or reflect stable processes.

Try our FREE online GMP Skill Booster tests. It’s challanging, it’s refreshing and it’s FREE. Try now!

Conclusion

Quality risk management in pharmaceutical is a systematic process for assessing, controlling, communicating and reviewing risks to the quality of the drug product across the product lifecycle.

Quality risk management has become an integral part of the pharmaceutical industry’s quality assurance and control system.

When you start practicing risk management philosophy, tools and techniques you will find your decision-making process has significantly improved. So does your level of compliance.

Risk management processes have diverse applications across the pharmaceutical industry, which is rewarding.

It can be used successfully to determine validation approaches, computerized system impact assessments, qualifying new suppliers and raw materials, meaningful audit frequency, calibration frequency, change management, quality investigations, environment health and safety of workers, or even periodic review of standard Operating procedures.

According to ICH Q9, the quality risk management framework involves risk assessment, which includes steps like risk identification, analysis, and evaluation.

Risk controls follow the risk assessment process. This can be done by either mitigating, eliminating, accepting, or transferring the risk.

Risk control requires implementing new systems and processes that can manage the risks to an acceptable level.

The outcomes of risk assessment must be communicated to relevant stakeholders. There should be periodic follow-ups and risk review processes to check the efficacy of risk controls over time.

The products of successful quality risk management is risk matrix and risk register. The risk matrix is useful for visually expressing the risk profile within a set range or benchmark.

The risk register keeps the log of all risks, corective and preventive actions and completion dates.

Pharmaceutical businesses use a diverse range of quality risk assessment tools and techniques. Methods include risk ranking and filtering, failure mode & effect analysis (FMEA), and hazard analysis critical control point (HACCP).

Implementing quality risk management processes in the workplace takes a culture shift. Creating a risk-based decision-making culture takes time, effort, training, and continuous nurturing.

However, when the momentum is built, the effort is highly rewarding.

240 SOPs, 197 GMP Manuals, 64 Templates, 30 Training modules, 167 Forms. Additional documents included each month. All written and updated by GMP experts. Checkout sample previews. Access to exclusive content for an affordable fee.

Picture of Author: Kazi Hasan

Author: Kazi Hasan

Kazi is a seasoned pharmaceutical industry professional with over 20 years of experience specializing in production operations, quality management, and process validation.

Kazi has worked with several global pharmaceutical companies to streamline production processes, ensure product quality, and validate operations complying with international regulatory standards and best practices.

Kazi holds several pharmaceutical industry certifications including post-graduate degrees in Engineering Management and Business Administration.

Leave a Reply

Your email address will not be published. Required fields are marked *