Facilities And Equipment Risk Management: A Quality Systems Approach

By Phil DeSantis

This two-part article focuses on risk management of facilities and equipment. It describes how a risk-based approach to facilities and equipment management fits into an integrated, effective quality systems structure. The principles discussed are equally applicable to all quality systems. The focus is on facilities and equipment because they represent a broad range of risk to product quality and are one of the key quality systems commonly identified in the pharmaceutical manufacturing industry.

Also, the discussion of risk is limited here to quality: safety, purity, strength, and identity of product. Risk to health, safety, the environment (HSE), and business continuity are not considered; however, the principles discussed are fully applicable to those factors, while the risk controls applied may be different.

This first installment provides background and introduction to quality systems and quality risk management and their relationship. The second will look at facilities and equipment risk more specifically and provide a framework for effective risk assessment and quality system application.

Background

In 2002 the U.S. FDA announced Pharmaceutical CGMPs for the 21^st Century — A Risk-based Approach. The purpose of this initiative was nominally to modernize the FDA’s regulation of pharmaceutical manufacturing. Moreover, the initiative encouraged a new culture of continuous improvement within the manufacturing segment of the industry. In the years following the launch of the program, the FDA has adopted its core principles, as follows:

• Risk-based orientation
• Science-based policies
• Integrated quality systems orientation
• International cooperation
• Strong public health protection

Throughout the initiation, implementation, and continuation of this modern approach, the primary focus has remained “to minimize the risks to public health associated with pharmaceutical product manufacturing.”

During this same time, these core elements have become increasingly accepted and practiced by the international regulatory community. This is most in evidence in the works of the International Conference on Harmonization (ICH), particularly its Q8, Q9, and Q10 working groups.

FDA publications, and presentations made by FDA representatives, emphasize that the approach remains aligned and fully compliant with cGMP regulations. In addition, exhaustive comparison of U.S. cGMPs with international regulations resulted in the conclusion that, although there are differences, the regulations are substantively the same and share the same focus of protecting the public health.

Perspective

First rule of quality risk management: “At the end of the day, the only thing that really matters is the patient.”

From the industry perspective, the response to this initiative has been somewhat mixed. Although many companies have established a quality systems structure and introduced some risk-based approaches, there seems to be considerable lag in developing a truly integrated and systematic approach to quality.

This is not entirely surprising considering the history of cGMPs in the U.S. and the rest of the world, which strongly emphasizes “compliance.” Of course, compliance with regulations is necessary to legally and ethically manufacture drug products. However, over time and through long and painful experience, the industry apparently lost sight of the real reason for compliance. That reason is, of course, to ensure quality.

The quest for compliance should not be misinterpreted as a failure to strive for quality. It should be recognized, however, that the emphasis on compliance, often in the pursuit of even the most insignificant and trivial internal procedural requirements, often detracted from the true goal of product quality. It is revealing that during an era when firms were rigorous in pursuing procedural perfection, there were still many warning letters and consent decrees, even among major manufacturers. Resources were frequently expended on issues that meant little with regard to quality. Quality remained important, but it seemed as if much that did not contribute to actual quality was equally as important. The result was that these “faux-critical” issues diverted resources from their proper focus.

Second rule of quality risk management: “If everything is critical, then nothing is critical.”

Until 2002, even the FDA did little to alter this trend. There was an industry perception that the FDA, the EU, and other regulators abhorred change, even change for the better. Consequently, the industry fell into the trap of compliance for the sake of compliance. Even 21CFR Part 11, which was intended to move technology forward by providing a framework for the use of computers in the industry, resulted in the development of such a dogmatic approach to computer validation that actually inhibited our use of automation.

Third rule of quality risk management: “Dogma breeds ritual; ritual breeds waste.”

As the industry adopted dogmatic and ritualistic approaches to deal with quality issues, we tended to crowd out science and common sense. This is not to say that rigorous procedures and documentation are not necessary. It is to say, however, that these procedures and documents are not sufficient to ensure quality. The core of quality is in the product and the process.

In its Final Report on GMPs for the 21^st Century (2004), the FDA resolved to regulate the industry through sound science and to encourage the application of technology and the principles of quality systems to facilitate continuing quality improvement. The FDA and ICH set the framework for the future with guidance on pharmaceutical development, risk management, and quality systems in ICH Q8, Q9, and Q10, respectively. The emphasis has clearly become product quality and the protection of patient welfare. It remains for the industry to understand and follow suit.

Quality Systems

ICH Q10 describes the application of a quality systems approach across the life cycle of a product. This paper focuses primarily on the commercial manufacturing stage of the life cycle, as this is where cGMP regulations have the greatest impact. Some elements of technology transfer are included as being necessary to define product quality attributes and contributing parameters.

ICH Q10 stops short of delineating quality systems in detail, although it does stress four major areas:

• Process performance and product quality monitoring system
• Corrective action and preventive action (CAPA) system
• Change management system
• Management review of process performance and product quality

These core activities can be organized into many different structures, all of which may be effective. A firm’s choice depends on product mix, size and resource availability, process complexity, and many other factors. Some firms choose a major system/sub-system approach. Others organize into many separate systems. It is, however, convenient to organize along the lines that the U.S. FDA uses for its systematic approach to facility inspections. The following are major quality system categories defined by the FDA:

• Quality management (usually includes change management, documentation, deviation management, training)
• Laboratories (includes testing for materials and product)
• Materials management (includes receipt, control and shipping of materials, components, and products)
• Production and process controls
• Packaging and labeling
• Facilities and equipment

The quality systems provide the foundation for recognizing and controlling risk in manufacturing of product for human and animal use. Some of these controls are specific to the system within which they usually reside (e.g., maintenance and calibration within facilities and equipment), while others are foundational and applicable to all systems (e.g., documentation, change management, deviation management/CAPA, training).

The Product And The Process

Common interpretation of GMP regulations notwithstanding, all quality is embodied in the product. The most important factors in achieving quality product are the processes that are employed to manufacture it (including packaging and labeling). These principles are basic to establishment of a science- and risk-based approach to quality. Therefore, a thorough understanding of the product and its quality attributes is essential.

Quality attributes are criteria specified to meet the expectations of the user. In our industry, the user group is a diverse one, including not only patients, but physicians, nurses, pharmacists, other medical professionals, distributors, retailers, and, of course, regulators. Quality attributes may range from the sterility of an injectable to the position of a label on a shipping carton. The quality impact of this broad range of attributes is equally as broad. In order to apply a sense of risk, we often describe a select set of attributes as “critical to quality.” The designation of quality-critical attributes (CQAs) is a relatively recent movement (at least in my experience) aligned with the current emphasis on risk management. By defining CQAs as having a direct effect on product quality (according to U.S. regulation: safety, identity, strength, purity, quality), we enhance our focus on those elements actually affecting the patient.

For many, if not most of us, our influence on product quality is related not to our ability to test for CQAs, but more to the process that manufactures the product. For the sake of this discussion, “process” needs to be broadened to include all influences on quality, including materials, personnel, facilities, controls, and equipment. Those parameters or characteristics that have a direct effect on CQAs we will call “quality-critical requirements” (QCRs). (Note that this is a broader category within which “critical process parameters” – CPPs – fall.) In order to understand and manage the risks associated with facilities and equipment, we need be aware of the QCRs.

The most effective way I have found to identify QCRs is by developing a user requirements specification (URS) for each system, wherein each requirement is categorized as essential for quality (includes GMP compliance), HSE, or business. For example, the throughput or capacity of a system relates to business requirements, while the accuracy of temperature control might be necessary to limit byproduct formation, making it essential to quality and thus a QCR.

In the next article, we turn our attention to facilities and equipment risk, and review a proposed framework for effective risk assessment and quality system application.

About The Author:

Phil DeSantis is a pharmaceutical consultant, specializing in pharmaceutical engineering and compliance. He retired in 2011 as senior director of engineering compliance for Global Engineering Services at Merck (formerly Schering-Plough), where he served as global subject matter expert for facilities and equipment and on the Global Validation Review Board and Quality Systems Standards Committee. DeSantis is a chemical engineer, having received a BSChE from the University of Pennsylvania and an MSChE from New Jersey Institute of Technology. He has nearly 50 years of pharmaceutical industry experience. He is vice-chair of PDA Science Advisory Board and is active in ISPE. He has been a frequent lecturer and has published numerous articles and book chapters.