Quality risk management (QRM) should be maintained throughout the product lifecycle. That is what the ICH Q9 Guideline calls for, as does the EU-GMP Guide. So much for theory. But what about practice? Why is it that in many companies QRM engenders more dread than enthusiasm? Is QRM at all worthwhile? A large turnout at the GMP Symposium organized by Maas & Peither – GMP Publishing discussed these and other questions with specialists from the publishing house’s pool of contributing authors. The following experts were available to respond to the participants' questions: Ruven Brandes, WDT; Martin Eßmann, Planttech GmbH; Ralf Gengenbach, gempex; Martin Mayer, Fresenius Kabi GmbH, and Dr. Petra Rempe, GMP-Inspector.
The experts started out by clarifying a widely held misconception: Even if individual processes such as change control or deviation management include risk-based approaches within a company, this does not automatically mean that a QRM process has been implemented. In a nutshell: Simply working off one risk analysis after the other is not the same as carrying out risk management. Martin Mayer: “The EU-GMP Guide and the ICH Q9 Guideline indicate which processes call for QRM. This means it is not enough to treat risk analyses merely as insular solutions anchored in the individual processes of a QMS. The objective is rather to establish a comprehensive, universally applied QRM system that is embedded in the overall QMS and ties together the results of all individual risk-based approaches."
The experts unanimously agreed that it is by no means impossible to establish QRM in day-to-day business - provided that a structured and confident approach is taken. All of us make risk-based decisions in our daily lives. Crossing the street is one example. A risk-based approach is also a firmly established part of many individual routine processes in the pharmaceutical industry. In spite of this, according to Ralf Gengenbach, in practice, QRM is often misconstrued: “The meaning and purpose of this tool often get lost in daily routine. Instead of utilizing it to reduce workloads, people stubbornly follow supposed rules and instructions for the sole purpose of having something to show during an inspection.” QRM pursued as an “add-on”, purely as an end in itself will not bring results. Petra Rempe adds: “Many companies have failed to see what advantages can be gained from QRM. No matter how many employees a company has, resources will always be limited. You have to set priorities. A working QRM process is an extremely valuable aid to differentiating between more and less urgent tasks.”
The EU-GMP Guide states that risks must be assessed, evaluated and controlled for all processes that affect the quality of a medicinal product. When QRM is being implemented it is advisable to take a step-by-step approach. True to the motto “Forewarned is forearmed,” the first step is to identify the risks involved in procedures and products. Of course, aside from financial and human resources, this task requires sound knowledge of the products and processes in question.
Risk analyses nowadays are already common practice in many processes such as the qualification of technical facilities, deviations, change control, etc. However, such approaches are also rapidly gaining acceptance in organisational processes that are focussed on assigning responsibilities and have nothing to do with pure production. In this connection, Petra Rempe cites the qualification of suppliers as an example. One of the new aspects mentioned in the draft EU-GMP Guide is that of patient care in connection with complaints or product recalls.
It is always necessary to consider that there is no such thing as ready-made QRM; quality risk management is always specific to any given company. Nor do the authorities require or even suggest using any specific method. There are many such methods to choose from: FMEA, HACCP, HAZOP, statistical and informal methods are only a few examples. Martin Mayer: “Not a single one of these methods is absolutely mandatory in our company; they can be combined or modified. However, the employees are required to describe the problem situation and to clearly justify the choice of methods. This procedure calls for common sense as well as professional know-how in pharmaceutical technology; it motivates employees and encourages risk awareness.” Ruven Brandes reports similar experiences: “We initially encountered a lot of resistance in our company, because we had proceeded much too rigidly in terms of when to apply an FMEA and when to use an HACCP, for example. When we left it up to the individual specialised departments, we were able to implement the QRM much more effectively.”
During the discussion opinions varied on the different methods of considering risks, especially as far as FMEA was concerned. Undeservedly so, according to Martin Eßmann: “FMEA is a fine instrument for setting up risk-based approaches, especially in engineering. Once you have an FMEA system in place, together with the evaluation criteria that go along with it, you will also have a practicable and flexible but lean instrument for similar situations, one that can be used to evaluate risks and subsequently make them comparable. This is hard to do if different methods of risk evaluation are used. However, Eßmann made it clear that an FMEA is not appropriate in every situation. In the areas of friction between quantitative and qualitative methods, according to Ruven Brandes, the question is whether or not the available data would even allow this “mercilessly quantitative method” at all. The FMEA was originally developed for systems used in the aerospace industry and not to assure the quality of pharmaceutical products. That is why an FMEA may perhaps be well suited to qualify systems, because here the necessary data resources on failure rates or the like are usually available. Martin Mayer: “But without a solid data foundation I can also overtax an FMEA and force-feed it with numbers that ultimately do yield a risk-priority number but have little substance.” Unanimous conclusion: You should always keep the data resources in mind that serve as a foundation for an FMEA. Otherwise, the numbers are likely to imply an objectivity that does not exist.
The lively discussion at the GMP Symposium showed that there are still practical problems to be solved for successful and realistic implementation of the QRM called for in the EU-GMP Guide. The experts therefore took advantage of the final round to call attention once more to the merits and benefits of quality risk management. Ralf Gengenbach: “Grasp the opportunity offered by QRM and the multitude of different methods it encompasses. A working QRM helps you to set priorities and concentrate on essentials. The result is often a reduction in effort and expenditure, as in the case of deviations or qualifications.” Aside from the financial aspect, a comprehensive QRM also enhances process and product reliability. For example, when deviations occur, risk analyses allow for appropriate actions to be selected and monitored for success. Therefore, it is also crucial according to Petra Rempe that risk-based approaches and hence QRM not be allowed to become a rigid system that is developed only once, has fixed SOPs and is concluded as soon as a first version of the risk evaluation is completed. QRM is dynamic and has to continue developing. New findings gathered from CAPA or deviations must be added continually.
Susanne Sailer, Maas & Peither AG, GMP Publishing