Evaluating possible risks is a basic activity of any commercial enterprise. Every business operator balances risks against opportunities before making investments, beginning a new project or entering into a customer relationship. The concept of risk management was first applied in the financial and insurance sectors. This concept was systematically transferred and applied to the pharmaceutical environment in 2005 with the International Conference on Harmonisation (ICH) and its publication of the ICH Guideline Q9 on Quality Risk Management. The European Commission added this guideline as Annex 20 to the EU GMP Guide in March 2008. In January 2011, due to its advisory character, the document was then integrated into the newly created, non-binding Part III, GMP related Documents.
The risk-based approach is also a basic element of the revised EU GDP Guidelines. Section 1.5 Quality Risk Management reads as follows: “Quality risk management should ensure that the evaluation of risk to quality is based on scientific knowledge and experience with the process […].” This approach is also applicable to planning transport routes. What exactly is meant by “risk”? In general it is acknowledged that risk is defined as a combination of the probability that damage will occur and the extent of that damage. Risk management that relates to the quality of medicinal products, also referred to as quality risk management, has the unwavering objective of making a substantial contribution to medicinal product safety by reducing the risks to patients that are posed by medicinal products.
In the course of time, systematic consideration of risks has also been projected – and rightly so – onto pharmaceutical processes such as those in the transport sector that are not included in the core areas of GMP-regulated processes. This step is logical because as processes become farther removed from the pharmaceutical operator, that operator’s influence on the quality of the processes diminishes while at the same time work is being delegated to service providers from areas that are remote from GMP. The pharmaceutical contract giver of logistic services then assumes a controlling and regulating function.
Risk analysis is subdivided into the following process steps (1):
Figure 1: Risk management process acc. to ICH Q9
Risk assessment includes identifying hazards and analysing and evaluating risks resulting from these hazards. No specific method is required in order to conduct a risk assessment. Whether or not the risks are determined on the basis of an FMEA, by a fishbone diagram or following an individual approach depends on the complexity of the process to be assessed and on the analytical depth that is necessary for this purpose. However, the chosen approach should be understood, practiced, documented and ultimately complied with.
Risk control includes making a decision on whether to lower risks by taking appropriate actions or to accept them. A prerequisite for this is quantifying and prioritizing within the framework of the risk assessment. Risks are usually mitigated by risk-reducing actions as long as necessary until any residual risk is acceptable. A prerequisite for that in turn is that a tolerance limit be determined.
Just as in the case of other quality management processes, risk management is also an on-going process. Risk review is necessary for this. For example, as part of risk review the efficiency of risk reduction measures is tested and the effectiveness of the risk assessment is reviewed against the background of new situations.
As mentioned above, the first step of risk assessment involves identifying potential hazards. A selection of possible risks that can occur during transport is illustrated in Figure 2 and explained below.
Figure 2: Potential risks during transport
For example, the medicinal product quality can be adversely affected by excursions below or above acceptable temperatures. Deviations from specified transport conditions can be caused by factors such as delays in customs clearance or unforeseen incidents during the transport. The packaging can be damaged by jarring or jolting, medicinal products can be lost through theft, get mixed up or counterfeit medicinal products can be smuggled into the supply chain.
The circles with three symbolic dots stand for additional hazards that also play a part. The following scenarios represent a few examples:
When temperature sensitive medicinal products are involved, additional potential risks can be added to this list:
The last item in particular has caused repeated discourse about measured results gathered during transport. Even inside small-volume passive containers the temperature is not uniformly distributed. For this reason it is all the more important to always place the data logger that accompanies the shipment in a clearly specified position.
After potential risks have been identified, in the second step of the risk assessment an analysis is made. FMEA is often used for this, as it enables risks to be quantified and hence prioritized.
The following aspects are evaluated for this:
Every potential risk is evaluated with regard to these three aspects and characterized by a numeric value. In the risk assessment it has proven useful in practice to work with very narrowly defined classifications, such as a 3-step system in which the numeral 3 stands for high, numeral 2 for the medium and numeral 1 for low.
Multiplication of the numeric values yields the risk priority number (RPN) (2). A tolerance limit can be defined on the basis of the RPN. At values below this limit the risk involved can be classified as acceptable. However, at values above the tolerance limit, actions to reduce the risk must be taken. This can be done either by reducing the probability of occurrence or increasing the probability of detection. The extent of the damage itself is unchangeable. After the risk-reducing actions have been taken (risk control) a repeat risk analysis is necessary.
If the RPN resulting from the actions taken falls below the tolerance limits, the remaining residual risk can be accepted. Otherwise, additional risk-reducing actions are required.
This process was carried out here as an example on two partial steps of the “Pick & Pack” segment and is mapped in the table shown in Figure 3.
Figure 3: Risk assessment in detail
The aspect of “severity” is directly related to a basic principle of ICH Q9 – the appropriateness of the means: “The degree of rigor and formality of quality risk management should reflect available knowledge and be commensurate with the complexity and/ or criticality of the issue to be addressed.”
This principle serves the purpose of appropriately using available resources and it forms the foundation of efficient project management.
Finally, another crucial aspect for risk assessment is the detection of the failure that has occurred. What good is the best analysis if the risks cannot be detected with the available means? Not only the relevant technical prerequisites, but also accompanying quality assurance actions are necessary here, in order to increase awareness of these and other aspects by all those who participate in the process. This should be the subject of appropriate employee training.
The immense volume and depth of detail associated with a transport can only be represented by a finely structured segmentation of the transport chain. It then becomes clear that with regard to occurrence, severity and perhaps also detection, potential risks change from segment to segment, i.e. from one transport section to the next.
A risk-based approach of the individual segments of the transport chain can be performed from various perspectives such as:
Accordingly, different actions may be required; their effectiveness within the scope of risk monitoring must be reviewed.
Under the aspect of medicinal product quality, a risk-based approach can be used to determine the scope and depth of the necessary qualification of transport packaging (passive and active systems). On this basis, additional actions for validating and monitoring the transport process can be determined.
As processes become farther removed from the pharmaceutical operator, that operator’s influence on the quality of the processes diminishes while at the same time work is being delegated to service providers from areas that are remote from GMP. The pharmaceutical contract giver of logistic services then assumes a controlling and regulating function. Methods of risk management can be beneficially employed to identify, assess and control risks. The immense volume of detail associated with a transport can only be represented using a finely structured segmentation of the transport chain. It then becomes clear that potential risks change from one transport section to the next. The results of a risk analysis can serve as the basis for qualification of transport vehicles and transport packaging; they can supply important starting points for the qualification of transport service providers or they can form the foundation of a monitoring concept.
(1) ICH Q9 Quality Risk Management, see Chapter E.9 and Chapter C.8.2.
(2) Example of an RPN: Occurrence 2, severity 2, detection 2, RPN = 2 × 2 × 2 = 8.
Dr. Nicola Spiggelkoetter
Knowledge & Support