Q9 (r1) Risk Management Draft

Q9 (r1) starts with all the same sections on scope and purpose. There are slight differences in ordering in scope, mainly because of the new sections below, but there isn’t much substantially different.

4.1 Responsibilities

This is the first major change with added paragraphs on subjectivity, which basically admits that it exists and everyone should be aware of that. This is the first major change that should be addressed in the quality system “All participants involved with quality risk management activities should acknowledge, anticipate, and address the potential for subjectivity.”

Aligned with that requirement is a third bullet for decision-makers: “assure that subjectivity in quality risk management activities is controlled and minimised, to facilitate scientifically robust risk-based decision making.”

Solid additions, if a bit high level. A topic of some interest on this blog, recognizing the impact of subjectivity is critical to truly developing good risk management.

Expect to start getting questions on how you acknowledge, anticipate and address subjectivity. It will take a few years for this to work its way through the various inspectorates after approval, but it will. There are various ways to crack this, but it will require both training and tools to make it happen. It also reinforces the need for well-trained facilitators.

5.1 Formality in Quality Risk Management

“The degree of rigor and formality of quality risk management should reflect available knowledge and be commensurate with the complexity and/ or criticality of the issue to be addressed.”

That statement in Q9 has long been a nugget of long debate, so it is good to see section 5.1 added to give guidance on how to implement it, utilizing 3 axis:

Uncertainty: This draft of Q9 utilizes a fairly simple definition of uncertainty and needs to be better aligned to ISO 31000. This is where I am going to definitely submit comments. Taking a straight knowledge management approach and defining uncertainty solely on lack of knowledge misses the other element of uncertainty that are important.
Importance: This was probably the critical determination folks applied to formality in the past.
Complexity: Not much said on complexity, which is worrisome because this is a tough one to truly analyze. It requires system thinking, and a ot of folks really get complicated and complex confused.

This section is important, the industry needs it as too many companies have primitive risk management approaches because they shoe-horn everything into a one size fits all level of formality and thus either go overboard or do not go far enough. But as written this draft of Q9 is a boon to consultants.

We then go on to get just how much effort should go into higher formality versus lower level of formality which boils down to higher formality is more stand alone and lower formality happens within another aspect of the quality system.

5.2 Risk-based Decision Making

Another new section, definitely designed to align to ISO 9001-2015 thinking. Based on the level of formality we are given three types with the first two covering separate risk management activities and the third being rule-based in procedures.

6. INTEGRATION OF QUALITY RISK MANAGEMENT INTO INDUSTRY AND REGULATORY OPERATIONS

Section 6 gets new subsection “The role of Quality Risk Management in addressing Product Availability Risks,” “Manufacturing Process Variation and State of Control (internal and external),” “Manufacturing Facilities,” “Oversight of Outsourced Activities and Suppliers.” These new subsections expand on what used to be solely a list of bullet points and provide some points to consider in their topic area. They are also good things to make sure risk management is built into if not already there.

Overall Thoughts

The ICH members did exactly what they told us they were going to do, and pretty much nothing else. I do not think they dealt with the issues deeply and definitively enough, and have added a whole lot of ambiguity into the guidance. which is better than being silent on the topic, but I’m hoping for a lot more.

Subjectivity, uncertainty, and formality are critical topics. Hopefully your risk management program is already taking these into account.

I’m hoping we will also see a quick revision of the PIC/S “Assessment of Quality Risk Management Implementation” to align to these concepts.

ICH Q9 Risk Management (r1) in consultation

ICH Q9 (r1) is in step 2, which means it is out for comments.

Section 5, “Risk Management Methodology” is greatly expanded, with a discussion on just what level of formality means in risk management using three criteria of uncertainty, complexity, and importance. Section 5 then goes into risk based decision making to a greater depth than seen previously in guidances.

Section 6 is greatly expanded as well.

I need to read this in more depth before providing a deeper analysis.

Interpreting Q7

The latest version (version 14) of the “How to do” Document – Interpretation of ICH Q7 Guide and “Review form” for APIs was published a few months back. It is intended to facilitate the implementation of the ICH Q7 Guideline and provides recommendations on interpretation.

In this version, the responsible Task Force of the Quality Group of APIC, which is a sector group of the European Chemical Industry Council (CEFIC), mainly made additions and updates in chapters 11 – Laboratory Controls, 15 – Complaints and Recalls, and in section 16 – Contract Manufacturers (incl. Laboratories).

The addition in section 11.11 for “Approval/rejection of materials” is pretty striaghtforward – have an SOP.

The changes in section 15 for recalls is pretty cosmetic.

I would re-read section 16 on contract manufacturers. Not much substantial here, but the rewrite makes it a good time to ensure compliance.

Rocky Road to ICH Q12 Implementation

Prior to the adoption of Q12 in Singapore at the end of 2019 there was a lot of rumbling from regulatory agencies on how Q12 would be more aspirational in many ways. In the last few weeks we’ve started to see just what that will mean.

FDA to release a guidance

The FDA’s Mahesh Ramanadham, from the Office of Pharmaceutical Quality in the FDA’s Center for Drug Evaluation and Research, provided an update on the agency’s implementation of ICH Q12 in the US on 25 February at the annual IFPAC meeting in North Bethesda, Md. He started that the FDA will soon be issuing guidance implementing the International Council on Harmonization’s Q12 guideline in the US that will, among other things, translate ICH post-approval change classification categories to FDA supplement categories, and address how to file established conditions (ECs).

This Q12 guidance will replace the agency’s 2015 draft guidance for industry on established conditions and reportable chemistry, manufacturing and controls changes to approved drug and biological products. It is expected to be issued in May 2020. The guidance will also discuss the relationship between FDA comparability protocols and the post-approval change management protocol (PACMP) established by the ICH Q12 guideline.

EU says not so fast in their adoption

However, additional scientific risk-based approaches to defining Established Conditions and
associated reporting categories, as described in Chapter 3.2.3, and the Product Lifecycle
Management (PLCM) Document, as described in Chapter 5, are not considered compatible with the
existing EU legal framework on variations.
It is important to note that the legal framework always takes precedence over technical and
scientific guidelines. More specifically this means that the definition of Established Conditions and
their reporting categories must follow the requirements laid down in the current EU Variations
Regulation and associated EU Variations Guidelines. With respect to the Product Lifecycle
Management (PLCM) document, in case such a document is submitted, it cannot be currently
recognised in the EU due to the fact that it is not referred to in the EU legal framework.
EMA/CHMP/ICH/78332/2020

In an explanatory note accompanying the adoption of ICH Q12 and related annexes, the European Commission and the European Medicines Agency point out that there are “some conceptual differences” between the ICH guideline and the EU legal framework on managing post-approval changes, ie, the variations regulation (Regulation (EC) No 1234/2008).

The EU authorities offer no clarity on when and how ICH Q12 would be fully implemented in the EU. The note merely states that the new “tools and concepts in the ICH Q12 guideline that are not foreseen in the EU legal framework will be considered when this framework will be reviewed.” The EU regulators said they would continue to work on the implementation of the ICH Q12 within the existing EU legal framework. The explanatory note also points out that despite some conceptual differences between ICH Q12 and the EU framework, there is also considerable common ground. In fact, some tools and concepts in ICH Q12 tools can already be applied by industry by following the current EU variations framework.

Next Steps

Companies should be ensuring that their knowledge management and risk management processes and understanding continue to grow. ICH Q12 will be a rocky road and I’m not sure we’ll see some of the potential streamlining of regulatory processes for a long time.

ICH Q12 pathway for established conditions

Regulatory Focus on Change Management

November was an exciting month for change management!

ICH Q12 “Technical and Regulatory Considerations for Pharmaceutical Product Lifecycle Management” was adopted by the ICH in Singapore, which means Q12 is now in Stage 5, Implementation. Implementation should be interesting as concepts like “established conditions” and “product lifecycle management” which sit at the core of Q12 are still open for interpretation as Q12 is implemented in specific regulatory markets.

And then, to end the month, PIC/S published draft 1 of PI 054-1 “Recommendation on How to Evaluate / Demonstrate the Effectiveness of a Pharmaceutical Quality System in relation to Risk-based Change Management.”

This draft guidance is now in a review period by regulatory agencies. Which means no public comments, but it will be applied on a 6-month trial basis by PIC/S participating authorities, which include the US Food and Drug Administration and other regulators across Europe, Australia, Canada, South Africa, Turkey, Iran, Argentina and more.

This document is aligned to ICH Q10, and there should be few surprised in this. Given PIC/S concern that “ongoing continual improvement has probably not been realised to a meaningful extent. The PIC/S QRM Expert Circle, being well-placed to focus on the QRM concepts of the GMPs and of ICH Q10, is seeking to train GMP inspectors on what a good risk-based change management system can look like within the PQS, and how to assess the level of effectiveness of the PQS in this area” it is a good idea to start aligning to be ahead of the curve.

“Changes typically have an impact assessment performed within the change control system. However, an impact assessment is often not as comprehensive as a risk assessment for the proposed change.”

This is a critical thing that agencies have been discussing for years. There are a few key takeaways.

The difference between impact and risk is critical. Impact is best thought of as “What do I need to do to make the change.” Risk is “What could go wrong in making this change?” Impact focuses on assessing the impact of the proposed change on various things such as on current documentation, equipment cleaning processes, equipment qualification, process validation, training, etc. While these things are very important to assess, asking the question about what might go wrong is also important as it is an opportunity for companies to try to prevent problems that might be associated with the proposed change after its implementation.
This 8 page document is really focusing on the absence of clear links between risk assessments, proposed control strategies and the design of validation protocols.
The guidance is very concerned about appropriately classifying changes and using product data to drive decisions. While not specifying it in so many words, one of the first things that popped to my mind was around how we designate changes as like-for-like in the absence of supporting data. Changes that are assigned a like-for-like classification are often not risk-assessed, and are awarded limited oversight from a GMP perspective. These can sometimes result in major problems for companies, and one that I think people are way to quick to rush to.

Much of my thoughts on implementing this can be found in my presentation on change management and change control.

It is fascinating to look at appendix 1, which really lays out some critical goals of this draft guidance: better risk management, real time release, and innovative approaches to process validation. This is sort of the journey we are all on.