Implementing a formalized quality risk management (QRM) program offers many benefits to industry and regulators. QRM allows a systematic approach to risk assessment (RA), incorporating it directly into a quality system, and provides the infrastructure (policies, standards, tools, and so on) to create a meaningful and sustainable program. ICH Q9 provides the framework for implementing QRM as a holistic program throughout a product's lifecycle (1).

Risk management is not synonymous with risk assessment. Per ICH Q9, risk management is “the systematic application of quality management policies, procedures, and practices to the tasks of assessing, controlling, communicating, and reviewing risk.” QRM is a living process and must be managed throughout the lifecycle of product, process, or system. Risk management involves four steps: risk assessment, risk control, risk review and monitoring, and risk communication.

The focus of the July 2009 CMC Strategy Forum was the RA step. ICH Q9 defines risk assessment as “a systematic process of organizing information to support a risk decision to be made within a risk management process. It consists of the identification of hazards and the analysis and evaluation of risks associated with exposure to those hazards.” For several years the biopharmaceutical industry and several regulatory agencies have actively worked with qualitative and/or semiquantitative RA methods (e.g., failure modes and effects analysis, FMEA, and preliminary hazard analysis, PHA). This CMC Strategy Forum was designed to provide attendees with a greater understanding of how RA is applied throughout biopharmaceutical development and manufacturing — and also how risk management results are used both internal to a company and in its communications with regulatory agencies. This was accomplished with presentations and case-studies from regulators and industry as well as hands-on exercises illustrating key concepts.

Section 1: Current Industry RA Practices



The morning of 27 July 2009 featured presentations by Richard O'Keeffe (“Quality Risk Management: Industry and Regulatory Pulse Survey Results”) and Dan Weese (“Overview of Risk Assessment Methods and Applications”) of Amgen; and by Keith Webber (“Quality Risk Management from Concept to Practical Strategies”), Terrance Ocheltree (“The Role of Quality Risk Management in New Drug Development and Manufacturing: Findings from the ONDQA Pilot Program”), and Patrick Swann of FDA's Center for Drug Evaluation and Research (“The Role of Quality Risk Management in New Drug Development and Manufacturing: Biotechnology Products”).

Current Industry and Regulatory Trends: To get a pulse on QRM trends within the industry and regulatory agencies, the CMC Strategy Forum planning committee designed and sponsored a survey before the conference. The 80 survey respondents represented 29 companies and regulatory agencies. O'Keeffe opened the conference by reporting on the survey results. His key theme was that industry and regulatory knowledge and understanding of QRM is evolving. Four in ten of company respondents said their organizations were in the development stages of a formalized QRM program; only 9% hadn't started ICH Q9 implementation. Responses also indicated that the industry would like more information about which tools to use in different situations, and that alignment among guidance from different regulatory agencies is important.

From Concepts to Practical Strategies: Webber presented for Gregg Claycamp on “risk-scientific” implementation of QRM concepts. Although risk is intuitive to everyone, application of that intuition to complex problems is not easy. Several RA tools provide a risk score; however, that does not equate to the actual “risk” and should not be represented as measuring it. Risk scoring methods are mostly about prioritization under a consistent process and do not constitute a “quantitative” assessment. They also drive consistent decisions within a quality management system. Webber discussed the importance of expert judgment during scoring and how “group think” can contribute to risk assessment outcomes.

Types of RA Tools: Because the focus of the forum was practical application of risk assessment, Weese presented an overview of available RA tools, including their strengths and limitations. Risk assessments are not easy to perform; appropriate training and expertise are needed for their execution. In choosing a tool, it is important first to thoroughly understand the purpose and desired outcomes of a risk assessment.

RA tools vary in their approach and level of rigor. A tool must be appropriate to the objectives of the assessment and the criticality of what is being assessed. It was noted that risk assessments can be both formal and informal; they may also take the form of a narrative or be performed using scoring tools. Typically RA starts with a top-down, broader-scope tool (e.g., PHA or risk ranking and filtering). Next, more focused and sophisticated assessments may be performed as needed using detailed tools (e.g., FMEA and hazards analysis and critical control points, HACCP).

Some more familiar RA tools include risk ranking, HACCP, hazard operability analysis (HAZOP), FMEA, PHA, and fault tree analysis (FTA). Most tools are intended to be prospective and use predefined ranking/scoring criteria and risk acceptance thresholds. Most also use impact/consequences and probability as their main considerations in risk scoring. The score for each risk identified using a qualitative or semiquantitative tool is typically a simple multiplication of its scores for impact/consequence, probability of occurrence, and sometimes likelihood of detection. It was also noted that tools are often customized to fit specific needs. For example, depending on the level of information available, a PHA may or may not include the detection score.



THE CMC STRATEGY FORUM SERIES
The purpose of the CMC Strategy Forum series is to provide a venue for biotechnology/biological product discussion. These meetings focus on relevant chemistry, manufacturing, and controls (CMC) issues throughout the lifecycle of such products and thereby foster collaborative technical and regulatory interaction. The forum committee strives to share information with regulatory agencies to assist them in merging good scientific and regulatory practices. Outcomes of the forum meetings are published in this peer-reviewed journal with the hope that they will help assure that biopharmaceutical products manufactured in a regulated environment will continue to be safe and efficacious. The CMC Strategy Forum is organized by CASSS, an International Separation Science Society (formerly the California Separation Science Society), and is cosponsored by the US Food and Drug Administration (FDA).

Before selecting a tool for RA, it is important to clearly understand your objectives, scope, and assumptions. A trained facilitator and the “right” multidisciplinary team of experts are also critical to creating a meaningful assessment and ensuring the appropriate risk management decisions. The facilitator must be both an expert in the particular RA tool and trained in group facilitation. RA participants should be trained in its use, scoring criteria, and key assumptions for the assessment. Clear definitions and scoring criteria are especially important because there will always be subjectivity in a nonquantitative assessment, but the objective should be to make that assessment as standalone as possible, with supporting information and rationale for the scores adequately documented within it.

The FDA's perspective on QRM application to new drug development and manufacturing was presented by Terrance Ocheltree — learnings from the Office of New Drug Quality Assessment's ONDQA's quality by design (QbD) pilot program — and Patrick Swann (the QbD pilot program of the Office of Biotechnology Products, OBP).

Overall, reviewers participating in the ONDQA program found risk assessments to be very useful. They were a central theme among submissions, with different tools used for different purposes. For example, some companies use FMEAs during development to link process inputs and outputs to critical quality attributes (CQAs). Ocheltree also described several improvements that could be made based on deficiencies found in those pilot filings: The scope, outcomes, and decision making process for risk assessments should be clearly defined and well thought out to ensure that risks and decisions are understood, addressed, and explained adequately. RAs should evaluate interactions between multiple inputs and outputs, which was found to be a limitation in the ONDQA filings. Although detection of a risk may not constitute control, it does offer an important prioritization mechanism and should be assessed during development of a control strategy. Risk assessments should be integrated across a product's lifecycle and include raw materials, equipment, product, and processes. And finally, it is important to address how RAs will be used to handle future changes.

Swann discussed how QRM can be integrated into a QbD approach throughout process development, characterization, validation, and monitoring for biotechnology products and processes. Examples illustrated how different companies used different RA tools (risk ranking and filtering, FMEA) to identify CQAs in OBP QbD pilot program proposals. Most of these assessments included considerations of the impact of an attribute on safety and efficacy including pharmacokinetics and immunogenicity. Some included toxicology data, results from in vitro biological activity assays, and pharmacodynamic endpoints as part of attribute assessment.

After their presentations, the presenters participated in a panel discussion of current industry RA practices moderated by Joseph Siemiatkoski of Biogen Idec. Some questions addressed by this panel were as follows: What are the advantages and challenges of risk management? When is it appropriate to use a narrative RA rather than a semiquantitative/quantitative RA? What detail should be in a regulatory guidance? What RA tools have been successfully applied during product development, and what were the challenges? A summary of the key discussion areas is provided below.

Risk management is a valuable exercise to drive cross-functional and external communications, and it focuses resources and forces better understanding of product and process. Risk is conceptual and not easy to translate to a business program without considerable effort; subjectivity must be addressed, but over-standardization can be an issue. In general, the forum attendees would like more guidance and understanding about which tools are most appropriate to use for what applications. More discussion around how to deal with the subjectivity of risk assessments would be quite beneficial. Both industry and regulators agreed that better crafted guidance in these areas would be highly valuable.

Section 2: Operational Details



After the morning warm-up presentations and discussions, the afternoon of 27 July 2009 was set up to engage the audience for hands-on experience with performing risk assessments. The purpose of these exercises was practical demonstration of the benefits, challenges, and application of risk assessments. These exercises provided substantial background and training in RA approaches, scoring principles, and facilitation challenges while highlighting the importance of team structure and group dynamics.

The first exercise was a “fishbowl” to take preidentified participants from industry and regulatory agencies through a risk assessment in front of the conference attendees. A hands-on mock RA followed, with the conference attendees divided into four groups.

The unique hands-on format was very successful not only in highlighting benefits and challenges of QRM practical application, but also in teaching attendees which fundamental concepts and behaviors are absolutely essential for performing effective risk assessments. The shared experience also highlighted in practice that RA is not equivalent to risk acceptance or risk management — and that development and deployment of a successful risk management program requires trained and dedicated individuals. Each of the four group assessments involved identical starting materials. All participants gained insight into what parameters can affect scoring and outcomes.

Fishbowl Exercise: A panel of experts from industry, the FDA, and Health Canada was facilitated by Emabelle Ramnarine of Genentech through PHA for a prefilled syringe filling operation. The experts for the fishbowl session were Andrew Donnelly (MedImmune), Matthew Hilton (Eli Lilly and Company), Patricia Hughes (FDA-CDER), Suzanne Kiani (Genentech), Ingrid Markovic (FDA-CDER), Richard O'Keeffe (Amgen), Stephanie Pluschkell (Pfizer), Anthony Ridgway (Health Canada), and Joseph Siemiatkoski (Biogen Idec). The objective of this exercise was to familiarize the audience with key RA application concepts.

Ramnarine opened up the session by orienting the team and audience to how a PHA is performed, including scoring criteria and ground rules for the working session. PHA was selected because it is a top-down RA tool that can be used with minimal data to understand high-level hazards and harm for an operation, process, or equipment. It is often a precursor to further in-depth analysis using another tool.

As emphasized above, it is crucial that all members of the RA team understand the scope of their assessment, inputs and outputs, assumptions, and RA terminology, and that their facilitator is experienced in guiding a team objectively. For purposes of these exercises, standard PHA definitions were explained to the team to ensure consistent application: