Quality Risk Management (QRM) is a vital aspect of pharmaceutical and biotechnology manufacturing, aimed at ensuring product quality and safety. I write a lot about risk management because risk management is so central to what I do. However, inappropriate uses of QRM can lead to significant negative consequences and I think it is a fairly common refrain in my day that an intended use is not an appropriate use of risk management. Let us explore these inappropriate uses, their potential consequences, and provide some examples so folks know what to avoid.
1. Justifying Non-Compliance
Inappropriate Use: Using QRM to justify deviations from Good Practices (GxP) or regulatory standards.
Consequences: This can lead to regulatory non-compliance, resulting in action from regulatory bodies, such as warnings, fines, or even shutdowns. Everytime I read a Warning Letter I imagine that there was some poorly thought out risk assessment. Using risk management this way undermines the integrity of manufacturing processes and can compromise product safety and efficacy.
Example: A company might use risk assessments to justify not adhering to environmental controls, claiming the risk is minimal. This can lead to contamination issues, as seen in cases where inadequate environmental monitoring led to microbial contamination of products.
2. Substituting for Scientific Evidence
Inappropriate Use: Relying on QRM as a substitute for robust scientific data and empirical evidence.
Consequences: Decisions made without scientific backing can lead to ineffective risk mitigation strategies, resulting in product failures or recalls.
Example: A manufacturer might use QRM to decide on process parameters without sufficient scientific validation, leading to inconsistent product quality. For example the inadequate scientific evaluation of raw materials led to variability in cell culture media performance.
3. Supporting Predetermined Conclusions
Inappropriate Use: Manipulating QRM to support conclusions that have already been decided.
Consequences: This biases the risk management process, potentially overlooking significant risks and leading to inadequate risk controls.
Example: In a biopharmaceutical facility, QRM might be used to support the continued use of outdated equipment, despite known risks of cross-contamination, leading to product recalls.
4. Rationalizing Workarounds
Inappropriate Use: Using QRM to justify workarounds that bypass standard procedures or controls.
Consequences: This can introduce new risks into the manufacturing process, potentially leading to product contamination or failure.
Example: A facility might use QRM to justify a temporary fix for a malfunctioning piece of equipment instead of addressing the root cause, leading to repeated equipment failures and production delays.
5. Ignoring Obvious Issues
Inappropriate Use: Conducting risk assessments instead of addressing clear and evident problems directly.
Consequences: This can delay necessary corrective actions, exacerbating the problem and potentially leading to regulatory actions.
Example: A company might conduct a lengthy risk assessment instead of immediately addressing a known contamination source, resulting in multiple batches being compromised.
Inappropriate uses of Quality Risk Management can have severe implications for product quality, regulatory compliance, and patient safety. It is crucial for organizations to apply QRM objectively, supported by scientific evidence, and aligned with regulatory standards to ensure its effectiveness in maintaining high-quality manufacturing processes.
Layers of Controls Analysis (LOCA) provides a comprehensive framework for evaluating multiple layers of protection to reduce and manage operational risks. By examining both preventive and mitigative control measures simultaneously, LOCA allows organizations to gain a holistic view of their risk management strategy. This approach is particularly valuable in complex operational environments where multiple safeguards and protective systems are in place.
One of the key strengths of LOCA is its ability to identify gaps in protection. By systematically analyzing each layer of control, from basic process design to emergency response procedures, LOCA can reveal areas where additional safeguards may be necessary. This insight is crucial for guiding decisions on implementing new risk reduction measures or enhancing existing ones. The analysis helps organizations prioritize their risk management efforts and allocate resources more effectively.
Furthermore, LOCA provides a structured way to document and justify risk reduction measures. This documentation is invaluable for regulatory compliance, internal audits, and continuous improvement initiatives. By clearly outlining the rationale behind each protective layer and its contribution to overall risk reduction, organizations can demonstrate due diligence in their safety and risk management practices.
Another significant advantage of LOCA is its promotion of a holistic view of risk control. Rather than evaluating individual safeguards in isolation, LOCA considers the cumulative effect of multiple protective layers. This approach recognizes that risk reduction is often achieved through the interaction of various control measures, ranging from engineered systems to administrative procedures and emergency response capabilities.
By building on other risk assessment techniques, such as Hazard and Operability (HAZOP) studies and Fault Tree Analysis, LOCA provides a more complete picture of protection systems. It allows organizations to assess the effectiveness of their entire risk management strategy, from prevention to mitigation, and ensures that risks are reduced to an acceptable level. This comprehensive approach is particularly valuable in high-hazard industries where the consequences of failures can be severe.
LOCA combines elements of two other methods – Layers of Protection Analysis (LOPA) and Layers of Mitigation Analysis (LOMA).
Layers of Protection Analysis
To execute a Layers of Protection Analysis (LOPA), follow these key steps:
Define the hazardous scenario and consequences:
Clearly identify the hazardous event being analyzed
Determine the potential consequences if all protection layers fail
Identify initiating events:
List events that could trigger the hazardous scenario
Estimate the frequency of each initiating event
Identify Independent Protection Layers (IPLs):
Determine existing safeguards that can prevent the scenario
Evaluate if each safeguard qualifies as an IPL (independent, auditable, effective)
Estimate the Probability of Failure on Demand (PFD) for each IPL
Identify Conditional Modifiers:
Determine factors that impact scenario probability (e.g. occupancy, ignition probability)
Estimate probability for each modifier
Calculate scenario frequency:
Multiply initiating event frequency by PFDs of IPLs and conditional modifiers
Compare to risk tolerance criteria:
Determine if calculated frequency meets acceptable risk level
If not, identify need for additional IPLs
Document results:
Record all assumptions, data sources, and calculations
Summarize findings and recommendations
Review and validate:
Have results reviewed by subject matter experts
Validate key assumptions and data inputs
Key aspects for successful LOPA execution
Use a multidisciplinary team
Ensure independence between IPLs
Be conservative in estimates
Focus on prevention rather than mitigation
Consider human factors in IPL reliability
Use consistent data sources and methods
Layers of Mitigation Analysis
LOMA focuses on analyzing reactionary or mitigative measures, as opposed to preventive measures.
A LOCA as part of Contamination Control
A Layers of Controls Analysis (LOCA) can be effectively applied to contamination control in biotech manufacturing by systematically evaluating multiple layers of protection against contamination risks.
To determine potential hazards when conducting a Layer of Controls Analysis (LOCA) for contamination control in biotech, follow these steps:
Form a multidisciplinary team: Include members from manufacturing, quality control, microbiology, engineering, and environmental health & safety to gain diverse perspectives.
Review existing processes and procedures: Examine standard operating procedures, experimental protocols, and equipment manuals to identify potential risks associated with each step.
Consider different hazard types. Focus on categories like:
Chemical hazards (e.g., toxic substances, flammable materials)
Physical hazards (e.g., equipment-related risks)
Radiological hazards (if applicable)
Analyze specific contamination hazard types for biotech settings:
Mix-up: Materials used for the wrong product
Mechanical transfer: Cross-contamination via personnel, supplies, or equipment
Airborne transfer: Contaminant movement through air/HVAC systems
Retention: Inadequate removal of materials from surfaces
Proliferation: Potential growth of biological agents
Conduct a process analysis: Break down each laboratory activity into steps and identify potential hazards at each stage.
Consider human factors: Evaluate potential for human error, such as incorrect handling of materials or improper use of equipment.
Assess facility and equipment: Examine the layout, containment measures, and equipment condition for potential hazards.
Review past incidents and near-misses: Analyze previous safety incidents or close calls to identify recurring or potential hazards.
Consult relevant guidelines and regulations: Reference industry standards, biosafety guidelines, and regulatory requirements to ensure comprehensive hazard identification.
Use brainstorming techniques: Encourage team members to think creatively about potential hazards that may not be immediately obvious.
Evaluate hazards at different scales: Consider how hazards might change as processes scale up from research to production levels.
Facility Design and Engineering Controls
Cleanroom design and classification
HVAC systems with HEPA filtration
Airlocks and pressure cascades
Segregated manufacturing areas
Equipment and Process Design
Closed processing systems
Single-use technologies
Sterilization and sanitization systems
In-line filtration
Operational Controls
Aseptic techniques and procedures
Environmental monitoring programs
Cleaning and disinfection protocols
Personnel gowning and hygiene practices
Quality Control Measures
In-process testing (e.g., bioburden, endotoxin)
Final product sterility testing
Environmental monitoring data review
Batch record review
Organizational Controls
Training programs
Standard operating procedures (SOPs)
Quality management systems
Change control processes
Evaluate reliability and capability of each control:
Review historical performance data for each control measure
Assess the control’s ability to prevent or detect contamination
Consider the control’s consistency in different operating conditions
Consider potential failure modes:
Conduct a Failure Mode and Effects Analysis (FMEA) for each control
Identify potential ways the control could fail or be compromised
Assess the likelihood and impact of each failure mode
Facility design and control considerations for mitigating viral contamination risk is a holistic approach to facility design and controls, considering all potential routes of viral introduction and spread. A living risk management approach should be taken to identify vulnerabilities and implement appropriate mitigation measures.
Facility Considerations
Segregation of areas: Separate areas for cell banking, small-scale and large-scale upstream cell culture/fermentation, downstream processing, media/buffer preparation, materials management, corridors, and ancillary rooms (e.g. cold rooms, freezer rooms, storage areas).
Traffic flow: Control and minimize traffic flow of materials, personnel, equipment, and air within and between areas and corridors. Implement room segregation strategies.
Air handling systems: Design HVAC systems to maintain appropriate air quality and prevent cross-contamination between areas. Use HEPA filtration where needed.
Room Classifications
For open operations:
Open sterile and aseptic operations must be performed in an environment where the probability of contamination is acceptably low, i.e. an environment meeting the bioburden requirements for a Grade A space.
Open bioburden-controlled processing may be performed in an ISO Grade 8/EU Grade C or EU Grade D environment as appropriate for the unit operation.
Open aseptic operations require a Grade A environment. Maintaining a Grade A cleanroom for large bioreactors is not feasible.
For closed operations:
Closed systems do not require cleanroom environments. ICH Q7 states that closed or contained systems can be located outdoors if they provide adequate protection of the material.
When all equipment used to manufacture a product is closed, the surrounding environment becomes less critical. The cleanroom requirements should be based on a business risk assessment and could be categorized as unclassified.
Housing a closed aseptic process in a Grade C or Grade B cleanroom would not mitigate contamination risk compared to an unclassified environment.
For low bioburden closed operations, the manufacturing environment can be unclassified.
Equipment Considerations
Closed vs. open processing: Utilize closed processing operations where possible to prevent introduction/re-introduction of viruses. Implement additional controls for open processing steps.
Closure Level
Description
Closed Equipment
Single use, never been used, such as irradiated and autoclaved assembles; connections are made using sterile connectors or tube wielders/sealers
Functionally closed equipment: cleaned and sterilized
Open vessels or connections that undergo cleaning and sterilization prior to use and are then aseptically connected. The connection is then sterilized after being closed and remains closed during use.
Functionally closed equipment: cleaned and sanitized
Open vessels or connections that are CIPed including bioburden reducing flushes, but not sterilized before use and remain closed during use
Open
Connections open to the environment without subsequent cleaning, sanitization or sterilization prior to use
Operational Practices
Personnel controls: Implement rigorous training programs, safety policies and procedures for personnel working in critical areas.
Cleaning and sanitization: Establish frequent and thorough cleaning protocols for facilities, equipment, and processing areas using appropriate cleaning agents effective against viruses.
Material and equipment flow: Define procedures for disinfection and transfer of materials and equipment between areas to prevent contamination spread.
Storage practices: Implement proper storage procedures for product contact materials, intermediates, buffers, etc. Control access to cold rooms and freezers.
Additional Controls
Pest control: Implement comprehensive pest control strategies both inside and outside facilities, including regular treatments and monitoring.
Water systems: Design and maintain water systems to prevent microbial growth and contamination.
Process gases: Use appropriate filtration for process air and gases.
I hasn’t been difficult to notice that a whole lot of biological new drug applications have been rejected in the last few years, many for CMC reasons. Recently CDER Director Patrizia Cavazzoni spoke on the matter at a recent at a Duke University and FDA event at the National Press Club iin the video above.
“Our standards have not changed. We have exactly the same standards as we had in 2018 and 2019,” she said, before going on to talk about how the quality related issues the FDA is seeing: contamination, overall oversight, manufacturing controls or insufficient quality management systems.
Max Van Tassell, a senior pharmaceutical quality assessor in CDER’s Office of Pharmaceutical Quality, provided insights from analyzing 100 complete response letters (CRLs) for Biologics License Applications (BLAs) issued between 2014 and 2024. He noted that facility-related deficiencies in CRLs typically stem from inadequate demonstration that proposed corrective and preventive actions would effectively mitigate risks identified during on-site inspections.
It should be a key takeaway from this presentation that:
The International Conference on Harmonization (ICH) was established to harmonize the technical requirements for pharmaceutical product registration across Europe, Japan, and the United States. ICH Q10, finalized in June 2008, emerged from this initiative as a guideline for a comprehensive Pharmaceutical Quality System (PQS) applicable throughout the product lifecycle. It was adopted by the FDA in April 2009, following its implementation by the European Commission in July 2008.
ICH Q10 aims to provide a model for pharmaceutical manufacturers to develop and maintain effective quality management systems. The guideline emphasizes a lifecycle approach, integrating quality management principles from ISO standards and regional GMP requirements. The primary objectives of ICH Q10 include:
Ensuring consistent product quality that meets customer and regulatory requirements.
Establishing effective monitoring and control systems for process performance and product quality.
Promoting continual improvement and innovation throughout the product lifecycle.
The guideline outlines the key elements of management responsibilities, Corrective and Preventive Action (CAPA) , process performance and product quality monitoring, change management, and management review. ICH Q10 is usually considered part of the “Quality Trio” with ICH Q8 and Q9. Quality by design is only possible through proper risk management and a robust quality system.
FDA Guidance for Industry on Quality Systems Approach to Pharmaceutical CGMP Regulation
The FDA developed guidance on implementing modern quality systems and risk management practices to align with the CGMP (Current Good Manufacturing Practice) requirements outlined in parts 210 and 211 of the FDA regulations. These regulations govern the manufacturing of human and veterinary drugs, including biological products. Published in 2006, this guidance should be viewed as part of a continuum of thought with ICH Q10 and not as an earlier draft.
This guidance aims to assist manufacturers in meeting cGMP requirements by adopting a comprehensive quality systems model. It emphasizes the integration of quality systems with regulatory requirements to ensure full compliance without imposing new expectations on manufacturers. Key aspects of the guidance include:
Highlighting the consistency of the quality systems model with cGMP regulations.
Encouraging the use of risk management and quality systems to enhance compliance and product quality.
Providing a framework for manufacturers to gain control over their manufacturing processes.
Six-System Inspection Model
The FDA’s Six-System Inspection Model is a framework introduced in this guidance to ensure compliance with current Good Manufacturing Practice (CGMP) regulations in the pharmaceutical industry. This model helps FDA inspectors evaluate the robustness of a company’s quality management system by focusing on six key subsystems.
I am a huge fan of the six subsystem approach. Basically we have here the organization of the quality manual, a guide to what standards you need to write in a bigger company, and a franework for understanding the cGMPs as a whole (great for education purposes).
Here’s a detailed explanation of each subsystem:
1. Quality System
Role: Acts as the central hub for all other systems, ensuring overall quality management.
Focus: Management responsibilities, internal audits, CAPA (Corrective and Preventive Actions), and continuous improvement.
Importance: Ensures that all other systems are effectively integrated and managed to maintain product quality and regulatory compliance.
2. Facilities and Equipment System
Role: Ensures that facilities and equipment are suitable for their intended use and maintained properly.
Focus: Design, maintenance, cleaning, and calibration of facilities and equipment.
Importance: Prevents contamination and ensures consistent manufacturing conditions.
3. Materials System
Role: Manages the control of raw materials, components, and packaging materials.
Focus: Supplier qualification, receipt, storage, inventory control, and testing of materials.
Importance: Ensures that only high-quality materials are used in the manufacturing process, reducing the risk of product defects.
4. Production System
Role: Oversees the actual manufacturing processes.
Focus: Process controls, batch records, in-process controls, and validation.
Importance: Ensures that products are manufactured consistently and meet predefined quality criteria.
5. Packaging and Labeling System
Role: Manages the packaging and labeling processes to ensure correct and compliant product presentation.
Focus: Label control, packaging operations, and labeling verification.
Importance: Prevents mix-ups and ensures that products are correctly identified and used.
6. Laboratory Controls System
Role: Ensures the reliability of laboratory testing and data integrity.
Focus: Sampling, testing, analytical method validation, and laboratory records.
Importance: Verifies that products meet quality specifications before release.
Integration and Interdependence
Quality System as the Fulcrum: The quality system is the central element that integrates all other subsystems. It ensures that each subsystem functions correctly and is aligned with overall quality objectives.
State of Control: The primary goal of the six-system inspection model is to ensure that each subsystem is in a state of control, meaning it operates within predefined limits and consistently produces the desired outcomes.
The Six-System Inspection Model provides a structured approach for FDA inspectors to assess the compliance and effectiveness of a pharmaceutical company’s quality management system. By focusing on these six subsystems, the FDA ensures that all aspects of manufacturing, from raw materials to final product testing, are adequately controlled and managed to maintain high standards of product quality and safety.
A Complementary and Holistic Approach
Both ICH Q10 and the FDA’s guidance on quality systems approach aim to enhance the quality and safety of pharmaceutical products through robust quality management systems. ICH Q10 provides a harmonized model applicable across the product lifecycle, while the FDA guidance focuses on integrating quality systems with existing CGMP regulations. Together, they support the pharmaceutical industry in achieving consistent product quality and regulatory compliance.
Aspect
ICH Q10
FDA Guidance on CGMP
ISO 13485 and 21 CFR 820
ISO 9000
Purpose and Scope
Comprehensive model for pharmaceutical quality systems across the product lifecycle.
Quality systems approach to ensure CGMP compliance in pharmaceuticals.
Quality management system for medical devices, incorporating ISO 13485 and regulatory requirements of 21 CFR 820.
Fundamentals and vocabulary for quality management systems applicable to any industry.
Industry Focus
Specifically for the pharmaceutical industry.
Specifically for the pharmaceutical industry.
Specifically for the medical device industry.
Applicable to any industry.
Key Elements
Management responsibilities, CAPA, process performance, change management, management review.
Management responsibilities, quality systems, process validation, continuous improvement.
Quality management principles, terms, and definitions.
Regulatory Focus
Strong emphasis on regulatory compliance and lifecycle management.
Strong emphasis on regulatory compliance with CGMP.
Incorporates regulatory requirements specific to medical devices (21 CFR 820).
Does not directly address regulatory compliance.
Flexibility
Flexible, adaptable to specific product and process needs.
More prescriptive with specific compliance requirements.
Harmonized with international standards but includes specific regulatory requirements.
Provides a broad framework for customization.
Management Involvement
Emphasizes management’s role in quality and regulatory compliance.
Emphasizes management’s role in quality and CGMP integration.
Emphasizes management’s role in quality and risk-based decision making.
Emphasizes management’s role in quality and customer satisfaction.
Implementation
Tailored to pharmaceutical manufacturing, integrating quality management principles.
Mandates oversight and controls over drug manufacturing processes.
Requires a quality manual and specific documentation practices; aligned with international standards.
Requires customization to specific industry needs.
These two documents were developed at the same time and represents the thinking twenty years ago in laying down an approach that still matters today. I usually regard the six system approach as a deepening and defining of what Q10 means by process performance and product quality monitoring.
What is the current agency thinking?
The FDA and other revulatory agencies haven’t stopped their thinking in 2008. Sixteen years later we see the continued push for quality culture and quality maturity. The FDA continues to make this a top priority, as we’ve been seeing in their annual drug shortage reports to Congress. There are a few themes we continue to see driven home.
The Patient is the Customer
Quality management must be customer-focused, ensuring that all processes and materials meet their intended use. Senior management’s commitment is crucial for a strong QMS, which emphasizes proactive quality assurance over reactive quality control. Robust supplier relationships and oversight programs are essential to manage variability in materials and processes.
This application of a core priciple in ISO 9000 may seem to basic to some, but I think it is central to a lot of messaging and should never be taken for granted.
Benefits of Better Quality Performance
A continued focus that a quality-focused culture leads to:
Early problem detection
Enhanced process stability and productivity
Fewer major deviations and failures
Efficient QA release of batches
Reduced customer complaints and returns
Protection of brand and competitiveness
Management Oversight of Drug Quality
Management must address sources of variability, including people, materials, methods, measurements, machines, and environment. Risk management should be dynamic and ongoing, facilitating continual learning and improvement.
Corrective Action and Preventive Action (CAPA)
A structured approach to investigating complaints, product rejections, nonconformances, recalls, deviations, audits, regulatory inspections, and trends is essential. CAPA should determine root causes and implement corrective actions.
Change Management
Timely and effective change management ensures corrections and improvements are undertaken efficiently. This includes implementing product quality improvements, process improvements, variability reduction, innovations, and pharmaceutical quality system enhancements.
Management Review
Management is responsible for quality policy, QMS effectiveness, internal communications, resource management, and supply chain oversight. This includes ensuring the quality of incoming materials and outsourced activities.
Quality Culture Driven by Top Management
A strong corporate quality culture is driven by daily decisions and executive oversight. Sustainable compliance requires aiming for high standards rather than just meeting minimum requirements. Quality management maturity involves proactive and preventive actions, iterative learning, and leveraging modern technologies.
Facility Lifecycle
Senior management must ensure the suitability of operational design, control, and maintenance. This includes addressing infrastructure reliability, appropriateness for new product demands, and mitigating equipment/facility degradation.
Risk Management in Manufacturing
Human factors and manual interventions pose significant risks in pharmaceutical manufacturing. Automation and separation technologies can mitigate these risks, but many facilities still rely on manually intensive processes. Leveraging new technologies and practices is a huge opportunity.
This approach is reflected in the FDA’s Quality Management Maturity (QMM), which promotes advanced quality management practices within drug manufacturing establishments.
Goals of the QMM Program
Foster a Strong Quality Culture Mindset: Encourage establishments to integrate quality deeply into their organizational culture.
Recognize Advanced Quality Management Practices: Acknowledge and reward establishments that go beyond basic CGMP (Current Good Manufacturing Practices) requirements.
Identify Growth Opportunities: Provide suggestions for enhancing quality management practices.
Minimize Risks to Product Availability: Ensure a reliable market supply by reducing quality-related failures and maintaining performance during supply chain disruptions.
Key Components of the QMM Program
Management Commitment to Quality: Leadership must prioritize quality, set clear objectives, and integrate these with business goals. Effective management review processes are crucial.
Business Continuity: Establishments should develop robust plans to handle disruptions, ensuring consistent operations and supply chain reliability.
Advanced Pharmaceutical Quality System (PQS): Implementing quality principles like Quality by Design (QbD) and risk management approaches to maintain system reliability and minimize production disruptions.
Technical Excellence: Emphasizing data management, innovative manufacturing processes, and advanced technologies to enhance quality and operational efficiency.
Employee Engagement and Empowerment: Encouraging employees to take ownership of quality, make suggestions, and understand their impact on product quality and patient safety.
Implementation and Assessment
The FDA has developed a prototype assessment protocol to evaluate QMM. This includes a standardized approach to minimize bias and ensure objectivity. Someday, eventually, it will move away from constant prototyping.
Assessments will focus on qualitative aspects, such as the establishment’s quality culture and how it uses data to drive improvements.
Benefits of QMM
Enhanced Supply Chain Reliability: By adopting mature quality management practices, establishments can reduce the occurrence of quality-related failures. The fact shortages continue to be so damning to our industry is a huge wake-up call.
Proactive Continual Improvement: Encourages a proactive approach to quality management, leveraging technological advancements and integrated business operations.
Long-term Cost Savings: Investing in a mature quality culture can lead to fewer compliance issues, reduced inspection needs, and overall cost reductions.
Conclusion
The FDA’s QMM program aims to transform how pharmaceutical quality is perceived, measured, and rewarded. The program seeks to ensure a more reliable drug supply and better patient outcomes by fostering a strong quality culture and recognizing advanced practices. It should be seen as part of a 20-year commitment from the agency in alignment with its international partners.
