With the publication of ICH Q9 "Quality Risk Management" and its transferral as Annex 20 to the EC GMP Guide, the idea of using risk management as a company-wide system is increasing continuously. The ICH itself has published training material on this topic, see GMP News from 31 October 2006, but there is not much else to help with the implementation.
With the date of 4 January 2010, the Pharmaceutical Inspection Convention Scheme (PIC/S) published a 30-page document as an example of the methodology with which ICH Q9 can be implemented in the pharmaceutical environment. The document is expressly neither a PIC/S recommendation nor a guideline. The (non-)application on the part of the industry does not have any influence on inspections either, as stated in the document's introduction.
The document is divided into 4 sections:
In the chapter "Description of the methodology", an introductory remark points to the fact that Quality Risk Management (QRM) should not be abused as an alibi for insufficient resources and non-compliance. After the QRM process according to ICH Q9 has been explained briefly, it is pointed out that the risk analysis tools (e. g. FMEA, FTA, HAZOP, HACCP) mentioned in ICH Q9 for the support of a global QRM could devour too many resources. As a filter for determining those individual processes in the Quality Management (QM) system of a company that should be taken into account, a "Risk Treatment Process" is presented. This leads to the critical processes whose risks should be reduced if possible (for this purpose, risk analysis tools may be used). Then the results of these individual considerations (primary system risks [Rsp] and residual system risks [Rsr]) are the output. This output is to be observed continuously (e. g. with regard to CAPA measures) and revised at least once per year.
For making better use of the resources, the document distinguishes between what it calls constants (all areas apart from the product) and variables (product characteristics). Finally the global risk (Rg) is the product of system risks (Rs, see above) and the product risks expressed by a product factor (P).
For the quantification, suggestions are made with regard to severity (S), frequency (F) and detectability (D). In addition, another factor N is described, which is meant to represent the compliance history of the company in question. With these parameters, the system risks (Rs) can then be quantified through multiplication. In order to calculate the global risk (Rg), a specific product factor is taken into account. This factor is in turn the sum of two other factors (E, C). These are the product experience (E) itself on the one hand and the product characteristics (C, e. g. pharmacological, physicochemical data) on the other hand.
The assessment and the calculations are conducted according to a standardised computerised procedure. Then primary risks are divided into 3 levels with the help of this software: low, moderate and high. In the moderate area, detectability plays a role, whether the risk can be accepted. These risks are then processed in the EDP system so as to find possibilities for reducing them and then lead to systemic residual risks.
Subsequently, the product factor is determined with the help of the computer (database) by means of selecting specifications regarding the product experience and the product characteristics. Afterwards, the global risk is ascertained through multiplication of the systemic residual risk and the product risk.
The complete document can be found here.
On the topic of Quality Risk Management, the ECA offers the following events:
On behalf of the European Compliance Academy (ECA)