In a recent issue of the Economist, an international publication not known for hyperbole, risk management was discussed: "Managing risk is one of the things that bosses are paid for," yet "most companies still don't have any idea what is required of risk management."1 While each of us informally uses risk management in our personal and professional lives, regulatory agencies and the pharmaceutical and biopharma industry are looking at how this process can be formalized and implemented with the goal of reducing risks to patients. To do this, we must have a much better understanding of risks, how to identify and assess them, and, when appropriate, the most suitable methods to control them.
Risk assessment and risk management in a Good Manufacturing Practice (GMP) context is a challenge to both firms and regulators, but the benefits of better and more cost-effective assurance of the safety, identity, strength, purity, and quality of products is substantial. This article discusses risk assessment (RA) and risk management (RM). It provides an overview of the concepts, tools, and processes used and the organizational structure that can support a combined program. RA is part of the broader process of risk management RM (Figure 1). The combination of both is called RARM and can be applied to both products and processes.
Figure 1. The Risk Management Process
FDA's 2002 initiative, "GMPs in the 21st Century"2 has raised visibility and interest in RARM. The initiative, of which RARM is a key element, emphasizes new control technologies and modern quality management systems.
While RARM is not a formal requirement of Current Good Manufacturing Practice (cGMP) regulations, the concepts have been at the heart of the agency's drug approval activities since 1962. When reviewers consider the safety of a drug, they use data gathered from adequate and well-controlled animal and clinical studies. Side effects and potential hazards are weighed against the benefits to the patient. Information provided on the label and inserts helps mitigate potential risks by communicating facts and cautions. If the product's risks outweigh its safety and benefits, the drug or biological is not approved or licensed.
James L. Vesper, MPH
RARM is used in other FDA-regulated industries. For example, medical devices regulated by the Center for Devices and Radiation Health and created according to FDA's Quality System Regulation (formerly called "GMPs for Medical Devices"), must meet the requirement that "Design validation shall include software validation and risk analysis, where appropriate."3 In sectors of the food industry, notably the seafood and juice segments, FDA even requires the use of a specific RARM program.4,5 FDA's regulations for low-acid canned foods also incorporate specific RARM principles.6
Recent FDA guidance documents such as Q7A, the GMP requirements for making active pharmaceutical ingredients,7 frequently use terms such as "critical" and "where appropriate." This indicates that a rational judgment, based on potential risks and the best ways to control them, is important in deciding what to do.