ARE RISK ASSESSMENT EXERCISES WORTH THE EFFORT?
Conducting risk assessments is a lot of work, however, as the group exercise made clear. Some raised the question of whether
it is worth the effort, because it seems that in most cases, the risks identified are the usual suspects.
"The majority are the usual suspects," acknowledged Richard O'Keeffe of Amgen. "But you are documenting what previously might
only have been in people's heads. One of the benefits comes from systematic documentation."
"But it seems we are making it out to be more than it should be," countered Mhatre of Biogen Idec. "I hope we are not taking
it so far that it just becomes an exercise and we lose all the practicality of it, like what happened years ago with process
Sally Seaver of Seaver Associates agreed that getting real value out of risk assessments requires doing them properly, and
not letting them become a rote exercise. "I think if risk assessments are done well there will be surprises—we will identify
some unexpected risks," she said.
Furthermore, the work involved in formalizing risk management processes should get easier with time, said Genentech's Nashabeh.
"In the early stages, you layer these things onto what you are already doing," he said. "If we get to a point where we integrate
this into existing systems, we may save resources, but we are not there yet."
Julia Edwards of Genentech agreed. "Conducting risk assessments needs to be integrated into your quality systems, not an additional
activity," she said.
Weese added that additional benefits are gained when risk assessment work is standardized throughout a company. "What we have
done with Q9 is to establish a common framework across molecules, and across departments," he said. "That's the big benefit,
in addition to reducing overall risk."
The cross-functional dialogue that occurs naturally during risk assessments is another big gain, Weese said. He cited an example
where staff from different groups found out important information about a process during a risk assessment exercise. "'You
are really doing that?' one group asked another. 'You can't do that!' That was really important," said Weese. "That exercise
clearly paid for itself."
Genentech's Edwards gave a presentation in which she showed how her company is applying risk assessments to multi-use facilities,
and then leveraging that work at other sites. The biggest gains, she said, can be achieved by using that information to file
comparability protocols with the FDA. "By leveraging integrated quality risk management in regulatory submissions, we can
effectively say, 'if we make this change at one site without a problem, we should also be able to make it at a different site,'
since QRM allows us to account for site-specific considerations," she said.
Risk assessment tools also can be used to get upper management to recognize and formally accept risks, several participants
said. Nadine Ritter of Biologics Consulting Group cited the example of a project manager who used a form listing the risks
of changing an analytical method. The form required a signature from senior management, stating that they accepted responsibility
for the decision. "Then they would re-think it carefully," she said. "That was brilliant."
Yet making the business case for quality risk management work is not easy, said Krista Terry of Genentech, because many of
the gains relate to preventing problems, and it is difficult to assign a dollar value to such benefits. "On the operations
side, for example, we have seen a decrease in the number of discrepancies, perhaps because staff are more aware of the importance
of following procedures," she said. "It's more about working toward cost avoidance."
Applying quality risk management principles is not a regulatory requirement in the US, but it is in Europe, and may become
one in other jurisdictions too.
"Under Chapter 1 of the EU GMPs, it is a requirement for companies to have a quality risk management program as part of the
quality assurance system. This has been in place since July of last year," said O'Donnell of the Irish Medicines Board. O'Donnell
went on to explain that although additional guidance on quality risk management is available in Annex 20 to the EU GMP guide,
that guidance is voluntary at this time, meaning that companies are not required to comply with it.
Anthony Ridgway of Health Canada also foresees that this requirement eventually could be adopted in Canada and internationally.
"ICH Q9 clearly states that it is not intended to influence regulatory requirements, however, if doing risk assessments becomes
a routine part of good manufacturing practices, it could potentially get included in a future version of GMP regulations,"
And all the regulators at the meeting said they saw value in quality risk management.
"Conducting risk assessments is not a regulatory requirement [in the US], but companies that have risk management programs
in place tend to have a good handle on their processes," said Waites of CBER. "They communicate well among themselves and
often catch problems earlier."
Waites also noted that inspectors would look at the outcome of risk management efforts, not the process. "We won't fault you
for ranking a risk as a 3 rather than a 7, but the outcome of ranking something too low might be inadequate validation," she
said. "And we do give out 483s for a lot of things that wouldn't have occurred if you had done a risk assessment," CDER's
Kozlowski said that regulatory agencies should also use risk-based approaches. "One of the most common complaints we get from
industry is that we pay too much attention to lower risks," he said. "So if we apply the concept of risk management, it will
Some companies have also made effective use of quality risk management in regulatory filings. Examples mentioned included
filings for process and site changes, and even expanded comparability protocols. "I've seen it used in cases where a legacy
process needed to be updated, such as for introducing new equipment or operating principles," said Patricia Hughes of CDER.
"It's useful for improving processes."
Hughes also mentioned the example of changing a facility from single- to multi-product production. "This is especially useful
in cases where you have very difficult cleaning validation issues for potent products, or different cell lines used in a multi-product
facility," she said. "Risk analysis helps you understand the risks involved, and determine how to handle them."
The discussions, presentations, and group workshop at the recent CMC Strategy Forum made it much easier to understand how
to tackle the challenges involved in conducting quality risk assessments as part of a quality risk management program.
The discussions clarified how to think about potential harms, how to account for controls that prevent or mitigate risks,
and how to handle the subjectivity of scoring. Speakers also stressed the importance of skilled facilitation, and of assembling
a crossfunctional team for risk assessment exercises to ensure that all critical groups involved in a given unit operation
No one doubted that conducting quality risk assessments is time-consuming and a lot of work. But the benefits, most said,
are worth it. Apart from the obvious gain of reducing risk, and avoiding future compliance failures and their related costs,
some said that the results could be used to justify manufacturing changes and even to support expanded comparability protocols.
In addition, many participants said the process itself was useful, by fostering cross-functional dialogue and recording institutional
knowledge. And although quality risk management is not yet a regulatory requirement in the US, it is already codified into
European regulations, and that trend may expand.