Color and Risk Evaluation

These experiments show some preliminary evidence that the color assignment in risk matrices might influence people’s perception of risk gravity, and therefore their decisionmaking with regards to risk mitigation. We found that individuals might be tempted to cross color boundaries when reducing risks even if this option is not advantageous (i.e., the boundary crossing effect). However, this effect was not consistently found when we included exploratory analyses of
risk mitigations at different impact levels.

Pending future research replicating these results, the cautious recommendation is that the potential biasing effects of color should be considered alongside the goal of communication. If the purpose of communication is informing individuals in an unbiased way, these findings suggest it might be worth eliminating colors from risk matrices in order to reduce the risk of the boundary-crossing effect. On the other hand, if the goal of communication is to persuade individuals to implement certain risk mitigation actions, it might be that assigning colors so as to elicit the boundary-crossing effect would facilitate this. This could be the case, for example, when designing risk matrices that communicate action standards (i.e., severity level at which risk mitigation should be implemented) (Keller et al., 2009). This advice might be particularly relevant in the case of semiqualitative risk matrices, where color assignment might be arbitrary due to the absence of clear numeric cut-off points separating risk severity categories, and to situations where the users of the risk matrix are expected to be of higher numeracy and not have prior training in the design and use of risk matrices.
Proto, R., Recchia, G., Dryhurst, S., & Freeman, A. L. J. (2023). Do colored cells in risk matrices affect decision-making and risk perception? Insights from randomized controlled studies. Risk Analysis, 43, 2114–2128. https://doi.org/10.1111/risa.14091

Well, that is thought-provoking. I guess I need to start evaluating the removal of a lot of color from SOPs, work instructions, and templates.

The Validation Discrepancy

I don’t like the term validation deviation, preferring to use discrepancy to cover the errors or failures that occur during qualification/validation, such as when the actual results of a test step in a protocol do not match the expected results. These discrepancies can arise for various reasons, including errors in the protocol, execution issues, or external factors.

I don’t like using the term deviation as I try to avoid terms becoming too overused in too many ways. By choosing discrepancy it serves to move them to a lower order of problem so they can be addressed holistically.

Validation discrepancies really get to the heart of deciding whether the given system/process is fit-for-purpose and fit-for-use. As such, they require being addressed in a timely and pragmatic way.

And, like anything else, having an effective procedure to manage is critical.

Validation discrepancies are a great example of building problem-solving into a process.

The Mistake I See in Most Quality Risk Management SOPs

I have a little trick when reviewing a Quality Risk Management SOP. I go to the process/procedure map section, and if I see only the illustration from ICH Q9, I know I am looking at an organization that hasn’t actually thought about risk management.

A risk management process needs more than the methodology behind individual risk management (assess, control, review). It needs to include the following:

Risk Plan: How do you manage risk management holistically? Which systems/processes have living risk assessments? What are your planned reviews? What significant initiatives around quality risk management are included?
Risk Register: How do you manage your entire portfolio of risks? Link to quality management review.
Selection of tools, and even more importantly, development of tools.
Mechanisms and tools for risk treatment
Improvement strategy for the quality risk management program. How do we know if the program is working as intended?
How to define, select, and train risk owners
How to engage the appropriate stakeholders in the risk process

Too many quality risk management SOPs do not read like process or procedure. They read like a regurgitation of ICH Q9 or the ISO31000 documents. Neither is a good thing. You must go deeper and create an executable process to govern the system.

Acountable People

We tend to jumble forms of accountability in an organization, often confusing between a people manager and a technical manager. I think its very important to differentiate between the two.

People managers deal with human resources and team dynamics, while technical managers deal with managing design, execution, and improvement. They can be the same person, but we need to recognize the differences and resource appropriately. Too often we blur the two roles and as a result neither is done well.

I’ve talked on this blog about a few of the technical manager types: Process Owners, the ASTM E2500 SME/Molecule Steward, and Knowledge Owners. There are certainly others out there. In the table below I added two more for comparison:

a qualified person from OSHA, because I think this is a great generic look at the concept
The EU Qualifed Person. Industry relevant and one that often gets confused in execution.

Aspect	Qualified Person (OSHA Definition)	Qualified Person (EU)	Knowledge Owner	ASTM E2500 SME	Process Owner
Primary Focus	Ensuring compliance with safety standards and solving technical problems	Certifying that each batch of a medicinal product meets all required provisions	Managing and maintaining knowledge within a specific domain	Ensuring manufacturing systems meet quality and safety standards	Managing and optimizing a specific business process
Key Responsibilities	Solve or resolve problems related to the subject matter, work, or project	Certify batches meet GMP and regulatory standards	Maintain and update knowledge base	Define system needs and identify critical aspects	Define process goals, purpose, and KPIs
	Design and install systems to improve safety	Ensure compliance with market authorization requirements	Validate and broadcast new knowledge	Develop and execute verification strategies	Communicate with key players and stakeholders
	Ensure compliance with laws and standards	Oversee quality control and assurance processes	Provide training and support	Review system designs and manage risks	Analyze process performance and identify improvements
	May not have the authority to stop work	Conduct audits and inspections	Monitor and update knowledge assets	Lead quality risk management efforts	Ensure process compliance with regulations and standards
Skills Required	Technical expertise in the area	Degree in pharmacy, biology, chemistry, or related field	Subject matter expertise in specific knowledge domain	Technical understanding of manufacturing systems and equipment	Leadership and communication skills
	Certification, degree, or other professional recognition	Several years of experience in pharmaceutical manufacturing	Analytical and validation skills	Risk management and verification skills	Analytical and problem-solving skills
	Ability to solve technical problems	Registered with the competent authority in the EU member state	Training and support skills	Continuous improvement and change management skills	Ability to define and monitor KPIs
Authority	Authority to design and install safety systems	Authority to certify batches and ensure compliance	Authority over knowledge management processes and content	Authority to define and verify critical aspects of systems	Authority to make decisions and implement changes in the process
Interaction with Others	Collaborates with production and quality control teams	Works with quality control, assurance, and regulatory teams	Works with various departments to ensure knowledge is shared and utilized	Collaborates with project stakeholders and engineering teams	Communicates with project leaders, process users, and other stakeholders
Examples of Activities	Reviewing batch documentation and certifying products	Certifying each batch of medicinal products before release	Validating new knowledge submissions	Conducting quality risk analyses and verification tests	Defining process objectives and mission statements
	Ensuring compliance with GMP and regulatory standards	Ensuring compliance with GMP and regulatory standards	Providing training on knowledge management systems	Reviewing system designs and managing changes	Monitoring process performance and compliance
	Overseeing investigations related to quality issues	Overseeing quality control and assurance processes	Updating and maintaining knowledge databases	Leading continuous improvement efforts	Identifying and implementing process improvements
Industry Context	Primarily in construction, manufacturing, and safety-critical industries	Pharmaceutical and biotechnology industries within the EU	Applicable across various industries, especially information-heavy sectors	Primarily in pharmaceutical and biotechnology industries	Applicable in any industry with defined business processes

Comparison table

Qualified Person (OSHA Definition): Focuses on ensuring compliance with safety standards and solving technical problems. They possess technical expertise and professional recognition and are responsible for designing and installing safety systems.
Qualified Person (EU): Ensures that each batch of medicinal products meets all required provisions before release. They are responsible for compliance with GMP and regulatory standards and must be registered with the competent authority in the EU member state.
Knowledge Owner: Manages and disseminates knowledge within an organization. They ensure that knowledge is accurate, up-to-date, and accessible, and they provide training and support to facilitate knowledge sharing.
ASTM E2500 SME: Ensures that manufacturing systems meet quality and safety standards. They define system needs, develop verification strategies, manage risks, and lead continuous improvement efforts.
Process Owner: Manages and optimizes specific business processes. They define process goals, monitor performance, ensure compliance with standards, and implement improvements to enhance efficiency and effectiveness.

Common Themes

Subject Matter Expertise

All roles require a high level of subject matter expertise in their respective domains, whether it’s technical knowledge, regulatory compliance, manufacturing processes, or business processes.
This expertise is typically gained through formal education, certifications, extensive training, and practical experience.

Ensuring Compliance and Quality

A key responsibility across these roles is ensuring compliance with relevant laws, regulations, standards, and quality requirements.

Risk Identification and Management

These roles are all responsible for identifying potential risks, hazards, or process inefficiencies.
They are expected to develop and implement strategies to mitigate or eliminate these risks, ensuring the safety of operations and the quality of products or processes.

Continuous Improvement and Change Management

They are involved in continuous improvement efforts, identifying areas for optimization and implementing changes to enhance efficiency, quality, and knowledge sharing.
They are responsible for managing change processes, ensuring smooth transitions, and minimizing disruptions.

Authority and Decision-Making

Most of these roles have a certain level of authority and decision-making power within their respective domains.

Collaboration and Knowledge Sharing

Effective collaboration and knowledge sharing are essential for these roles to succeed.

While these roles have distinct responsibilities and focus areas, they share common goals of ensuring compliance, managing risks, driving continuous improvement, and leveraging subject matter expertise to achieve organizational objectives and maintain high standards of quality and safety. They are more similar than dissimilar and should be looked at holistically within the organization.

The Difference Between Education and Training and Impact on Procedure

When we solve problems in the wrong way, we end up creating bigger problems. One of the biggest of these stems from the differences between education and training and how we try to address education deficiencies (real or perceived) in the procedure.

Training: The primary goal of training is to develop specific skills and behaviors that improve performance and productivity in a particular job or task. It is practical and hands-on, focusing on applying knowledge to perform specific tasks effectively. For example, training might involve learning how to use a particular software or operate machinery .
Education: Education aims to provide a broader understanding of concepts, theories, and principles. It is more about acquiring knowledge and developing critical thinking, reasoning, and judgment. Education prepares individuals for future roles and helps them understand the broader context of their work.

For example, in writing a procedure on good documentation practices (GDocP), we might include a requirement to show the work on all calculations except simple. Knowledge of the broader principles of mathematics is education, and a simple calculation is a fundamental building block of mathematics. We now have two choices. We can proceduralize a definition and provide examples of simple calculations, or a basic understanding of mathematics is a prerequisite for doing the work, part of the core competencies.

This example may seem minor, but it quickly builds up. Every time we add an item that should be education to a procedure, we increase the difficulty of using and training on the document. Good documentation practices are a great example because we take some basic ALCOA+ concepts and then give possible permutations, many of which rely on education premises.