5. Identify how the risk might be expressed and its criticality. Consider its severity, frequency, and probability of detection.
6. Determine if the risk is acceptable or if it must be mitigated in some way.
7. If risk is to be controlled, identify appropriate methods.
8. Reevaluate controlled risk to determine if residual risk is acceptable or unacceptable.
9. Implement risk control methods.
10. Document RARM activities.
11. Monitor the process or product to ensure the RARM was effective and to determine if previously unknown risks have become
apparent.
In a GMP environment, the involvement of the quality unit is essential at certain points. Requiring the quality unit's approval
for completion of certain tasks is recommended. Additionally, running periodic quality audits to ensure the proper use and
functioning of the RARM system is good practice.
WHO OR WHAT IS AT RISK?
Defining the scope of a risk involves determining who or what is at risk. RARMs can be extensive and include considerations
of the environment, workplace health and safety, GMP compliance, facilities and equipment, patients, finances, and corporate
image.
From a GMP standpoint, regulatory agencies are concerned with the impact of a failure (an "expressed" risk) on the safety,
identity, strength, purity, and quality of the drug product and what that means to the product's users. A failure may signal
an underlying weakness of a process or system. In a GMP context, a RARM focuses on what a failure means to the product and
the patient and, secondarily, to the particular manufacturing process and elements within the quality system. This is considerably
different than the "classic" RARMs of the chemical, nuclear, and aerospace industries that are conducted out of concern for
workers, the equipment and facility, the community, and the environment.
RISK ANALYSIS METHODS
A number of widely accepted and well-defined methods and processes for conducting RARMs have been developed. Some focus only
on risk assessment, while others also address the broader process of risk management. Some can be easily applied to a variety
of manufacturing, testing, and logistics processes or products, while others have been optimized for certain type of processes,
such as those found in chemical or API manufacturing.
Some methods are mathematically based, using historical data to predict the reliability of a component or feature. The methods
described below are qualitative or semiquantitative. A common characteristic of all these methods is that they are meant to
be proactive — used before a process or product is developed and finalized.
Methods vary in how they view potential failures. Most use inductive logic — that is, they use "forward thinking" to explore
potential consequences of a failure. These tools are used to address "what if?" questions. Other tools use a deductive approach,
looking "backward" or "top down" to address the question "What caused X to happen?"
There is some variation in risk assessment tools and methods, especially in how tables used to present data are formatted.
The American Institute of Chemical Engineers' guidelines describe how to use most of the methods summarized below.17
Preliminary Risk Analysis (PRA)
PRA is a qualitative method for initial consideration of new technologies or processes when there is little specific information
available. It is an inductive tool used to determine the event sequences that can transform a hazard into an accident, the
accident's potential consequences, and how the accident can be prevented. One variation of the PRA is a free-form brainstorming
session where a cross-functional group of experts asks "what if" questions to identify the impact and make recommendations.
The quality of the results is highly dependent on the experience and knowledge of the participants.
|
