Quality Risk Management: Reduce Risk By Embracing It

It has been nine years since the International Conference of Harmonisation (ICH) released the ICH Q9, a guideline for industry on how to implement a systematic approach to quality risk management (QRM). The intent of this requirement was to evaluate the product quality risks associated with a company’s process or system. At the end of last year, the Parenteral Drug Association, along with the FDA, conducted the Pharmaceutical Quality System Workshop on Quality Risk Management. During this event, the PDA ran a poll among attendees in order to measure the industry’s overall understanding of quality risk management (QRM). The results indicated this level is, at best, fair.

Despite the resources available to help companies develop a QRM program, such as the ICH Q9, there are several challenges that commonly prevent a successful implementation. As a recognized industry QRM expert, Ghada Haddad, director in global sterile and validation at Merck, says one of the biggest of these is that people in the industry tend to muddle business risks and safety risks in a quality risk assessment.

“QRM is a systematic process,” says Haddad. “It’s data-driven, it’s objective, and it’s transparent. An effective quality risk management program is able to facilitate better and more informed decisions about the ability of a company to potentially deal with risks. It focuses on product quality as a surrogate to patient safety.”

So while a proper grasp of QRM starts with a complete understanding of the ICH Q9, there are several other best practices that Haddad says can help with creating an effective QRM program.

Don’t Fear Red

Haddad, who has over 15 years of experience in the areas of QRM, validation, quality systems, and regulatory, served as a task force leader and then author of two technical reports for the Paradigm Change in Manufacturing Operations (PCMO) initiative. The PCMO is an effort established by the Parenteral Drug Association (PDA) to drive best practices for the implementation of ICH guidelines. She also teaches QRM courses for the PDA and was part of a dedicated team responsible for implementing the QRM program in her previous position at Genentech.

Through these experiences, Haddad has learned that one of the biggest challenges when trying to implement a QRM program is changing the culture of the company, or as she puts it, teaching them to embrace risk. “In a QRM program, a high risk is illustrated by the color red,” explains Haddad. “The idea behind that is not to say ‘oh no, there’s a red risk and it’s dangerous.’ Instead, it just means there’s a need to prioritize the work and focus the resources on the most important project that will have the greatest impact on product safety and product quality and performance.”

To overcome this, Haddad says the program needs to have sponsorship from the quality head of the company. “If there is buy-in from upper management and they are embracing the concept that it’s okay to have red risks, that is very helpful to the people on the floor to understand that they have their management support and they can start identifying these risks and there are no consequences of bringing forward potential risks.”

The Roles Of A QRM Program

In order to establish a good QRM program, there are a few elements that need to be put in place. First, it’s imperative that people are educated on what QRM is and who will hold the key roles of the program, as those are the ones who have the knowledge on how do to so. These include the facilitator, the risk lead, the decision makers, and the subject matter experts who can contribute their technical knowledge of the system/process/product to the risk assessment

The facilitator is a QRM expert, such as Haddad. The risk lead is responsible for ensuring that all activities are completed on time, similar to a project manager. Subject matter experts perform risk identification, analysis, and evaluation, and compare the identified and analyzed risks against the company’s risk tolerance criteria. Once recommendations are provided by the Risk Assessment team on risk control, decision makers evaluate next steps. “They have to decide whether or not a risk will be accepted or mitigated. They’re the people with the authority to make appropriate and timely QRM decisions,” explains Haddad. “They’re authorized to accept and direct the strategy of risk management.”

In addition to Haddad’s current position at Merck, she is also driving an effort to harmonize the company’s QRM program. She explains that, while employees were trained on QRM and were identifying risks, there wasn’t a consistent process in place across all facilities. By connecting these pieces, Haddad says they will be able to evaluate and analyze the risks across the whole network at the same level, which is another major challenge when putting together a QRM program.

The plan will roll out in phases, starting with the creation of updated QRM guidelines that will be rolled out to all manufacturing sites and functions. Then, the next phase is the establishment of a governance structure to understand who's who and how the program is going to work. Finally they will begin the training program. "The training program is role-based, and it will have tools and templates, so if someone is in Brazil and they want to do a risk assessment, they are using the same guidelines that we use," says Haddad. "Under each of these phases, we have a lot of details on how we're going to actually accomplish this and how we're going to upskill our people and comply with regulatory guidance, as well as be part of the leading QRM companies in the industry."

 Why QRM?

The name alone—quality risk management—clearly indicates its purpose, and anyone involved in the manufacturing of pharmaceuticals knows that mistakes can be detrimental to a company in more ways than one. The fallout usually doesn’t just have a negative financial impact; a company’s reputation often takes a hit too. So while the “why” isn’t a big mystery, some companies still find themselves taking a reactive approach to risk management. However, if you aren’t preventing the fire, you may eventually find yourself in a position where you’re being tasked with putting it out.

QRM is especially important in an environment where firms are downsizing, such as pharma. “The benefit of QRM is that you’re ensuring limited resources are focused on an area that can have the greatest impact on product quality, safety, and performance,” she explains. “It will also help reduce overall costs by ensuring that actions are done right the first time. You can have greater confidence that decision making is consistent and that it’s documented based on scientific evidence.”

For example, if you’re building a facility and you use QRM in the design phase, you’re able to design away the risks you’ve identified. QRM also provides a mechanism for formal risk communication to management. “We all have risks, but sometimes there’s no formal communication regarding those risks,” says Haddad. “So there are a lot of surprises, for example, during inspections. The intent of QRM risk communication is to bring visibility to a potential risk, and the decision makers, who are usually management, will actually have to own these risks. They will then need to make a decision on whether they should accept the risk as is, mitigate it, put more resources on it, spend money, et cetera.”

As an example of the impact a QRM program can have, Haddad cites an example when it was applied to a company’s change control process. She explains. “Some of the questions people started to ask before they made a change were—Am I introducing a new risk by implementing that change? Am I removing a control from an already existing risk that has been mitigating that risk? By integrating QRM into the change control, we were able to reduce the number of changes significantly because people now better understood the impact of the change on the process and on the validated state of the equipment or the process.”

Like Merck, Haddad says most companies already have the pieces in place for a QRM program. It’s just a matter of lining them up and standardizing them. Once you do this, you are not only complying from a regulatory perspective but also, over time, you will begin to see the business benefits of QRM, which is an overall reduction of risk. And once you are confident enough to put the fire extinguisher down, you will now be able to dedicate your resources to what they do best—making effective drugs that save lives.