Risk Tool Selection With ICH Q9(R1) In Mind

By Amanda McFarland and Ryan Murray, ValSource, Inc.

In January 2023, ICH Q9 Quality Risk Management¹ was revised for the first time since its debut in 2005. In the revision, topics like subjectivity, product availability, risk-based decision making, hazard identification and risk assessment formality were elaborated upon. This article will focus on the formality concept. In the initial version of ICH Q9, the concept of formality was addressed through a single statement in the document: “The level of effort, formality and documentation of the quality risk management process should be commensurate with the level of risk.”¹ This statement provided clues to the industry that tool selection was a decision to be taken; however, the industry has often fallen into a mindset of “the more formal the better” and often resorted to the use of Failure Modes and Effects Analysis (FMEA) to address all levels of risk. The industry was presented with a gift in 2011, when K.S. Murray and S. Reich published their work on tool selection in an article titled “Quality Risk Management (QRM) Tool Selection: Getting to Right First Time.”² The authors outlined the how and why of tool selection by providing examples of tool application and gave insight into the concept of how understanding risk and tool selection go hand in hand. This concept was novel at the time and is one of the key elements of revision in the 2023 release of ICH Q9(R1). Formality has been further enhanced with parameters to consider, such as importance, complexity, and uncertainty. This trio of considerations aids in identifying the appropriate risk tool and reinforces that formality is to be viewed as a spectrum.

Importance, Complexity, Uncertainty (ICU)

Once the risk question is well defined and the scope of the risk assessment is agreed upon, there are three elements to consider when selecting a risk management tool, the first of which is importance (I). Importance is understanding the criticality of a system or the process that is under evaluation compared to other systems. The second parameter is complexity (C), and it asks, How complex is the system that you are evaluating? The final parameter is uncertainty (U): How much do you know about the process you are assessing? For many organizations, the ICU approach to tool selection will further open the possibility of better risk tool selection and the opportunity to expand their risk tool kit beyond FMEA. In ICH Q9 (R1), complexity and importance are well defined, and guidance is provided on how they influence risk tool selection; however, the concept of uncertainty is left to be interpreted.

Considering uncertainty in the tool selection process offers the user the opportunity to select a tool that aligns with the maturity of the process under assessment. Formal risk tools such as FMEA and Hazard Analysis and Critical Control Points (HACCP) are structured, granular, and most effectively executed when process knowledge and experience are available to a team. Using a formal risk management approach when there is a lack of process knowledge and historical data can often feel like the tool is asking questions that you don’t know the answer to, leading to frustration with the assessment process. Considering the amount of available data when selecting a tool can help to alleviate that frustration and allow the team to explore the risk question without the pressure of having a highly structured analysis and still preserves the intent of the risk management process by exploring hazards and harms.

Historically, the industry has gathered a cross-functional team to assess risks when formal tools were executed; however, risk team composition can be influenced by uncertainty. In conditions where data is available and well understood, the risk team may be limited to a core set of subject matter experts (SMEs), while in conditions of high uncertainty, the team may be enhanced by having more than one representative from each functional group. Having an enhanced team of SMEs in these instances offers more perspectives for exploring hazards and harms, thereby expediting the knowledge gathering process. In the way that tool selection is a spectrum, the team composition will vary depending upon the amount of uncertainty of the topic under assessment. For example, an FMEA (a formal risk tool) being performed on a legacy process will have a representative from each functional group impacted by the assessment, whereas a hazard identification tool (a less formal risk tool) will have an enhanced team of SMEs to enable broader cross-functional understanding.

In addition to the team composition, the documentation of the risk management activity can be driven by the ICU approach. Risk tools used to answer risk questions that have low importance, low criticality, and low uncertainty may be documented in a memo, whereas risk questions being addressed with a more formal approach due to a high contributing factor of ICU will warrant a formal report.

Let’s examine an overview of risk assessment tools of varying formality, their potential applications, the level of uncertainty when these tools are most optimal, and the team composition.

Uncertainty: Low

• Checklists and decision trees: Checklists and decision trees are excellent sources of risk analysis and risk evaluation; however, strong understanding of the system/product/process is required to develop a successful checklist or decision tree. The development of such risk-based decision-making tools requires the input of all impacted SMEs.
  • Use when: A situation or set of circumstances is likely to occur on many occasions and the user has experience with the hazards and harms associated with the system/process.
  • Example application: Checklist to assess or classify raw materials. A checklist can offer a standard set of attributes to consider such that materials can be considered individually or as a group.
  • Team Composition: Checklists and decision trees are risk-based decision-making frameworks that have been designed to enable a specific aspect of the quality system. Because the decision-making framework has been previously sanctioned by decision-makers, the method can be used by any employee within the organization, with appropriate training, to ensure decisions are aligned with the overall organizational risk tolerance.
• Failure Mode & Effects Analysis (FMEA): FMEA is a powerful tool for a detailed assessment of a system to demonstrate knowledge of critical process parameters and critical quality attributes related to a manufacturing process or of individual pieces of critical equipment.
  • Use when: There is a robust data set available for analysis and ranking detectability has meaningful impact on risk analysis.
  • Example application: Evaluating the relationship between critical quality attributes (CQAs) and critical process parameters (CPPs).
  • Team composition: A core team of SMEs from each impacted functional group is recommended for established processes. For prospectively performed assessments, the team may include SMEs that represent the product or process under assessment as well as SMEs from other products/processes that can bring knowledge about previously identified and mitigated risks.

Uncertainty: Medium

• Preliminary Hazard Analysis (PHA): PHA can be used to determine the robustness of controls and assess the need for additional controls when new equipment or process controls are introduced. The tool can be used to prospectively or retrospectively understand the state of control when changes are proposed to a system.
  • Use when: The team has some historical data and/or knowledge about the system function and potential impacts.
  • Example application: Assessing the impact of changing an analytical instrument from one manufacturer to another.
  • Team composition: A core team of SMEs from each impacted functional group is recommended for established processes. For prospectively performed assessments, the team may include SMEs that represent the product or process under assessment as well as SMEs from other products/processes that can bring knowledge about previously identified and mitigated risks.
• Intervention Risk Evaluation Model (IREM):³ IREM analysis considers factors such as complexity, proximity, and duration of the intervention to determine classification.
  • Use when: Some historical data and/or knowledge about the intervention hazards and potential impacts is required.
  • Example application: To assess the risks related to aseptic interventions.
  • Team composition: An enhanced core team of SMEs from each impacted functional group that includes a range of levels of the organization, including manufacturing managers, supervisors, and operators.
• Layers of Protection Analysis (LOPA): LOPA is a system of analysis that enables the assessment of complex and overlapping systems of controls.
  • Use when: You need to establish the controls in place and assess the effectiveness of those controls as they relate to one another.
  • Example application: LOPA can be used to understand the risks related to cross-contamination and to identify the effectiveness of the controls in place that could lead to hazards such as mix-ups, mechanical transfer, retention, and proliferation.
  • Team composition: An enhanced team of SMEs from each impacted functional group that includes representatives from each product manufactured at the facility including manufacturing operators, supply chain, validation, and quality control.
• Hazard Analysis and Critical Control Points (HACCP): HACCP can be used to understand the hazards related to controlled environments, to identify environmental monitoring and critical utilities sample locations, and determine in-process monitoring locations.
  • Use when: You need to capture opportunities for microbial introduction such as material transfer, aseptic technique, and open and closed connections.
  • Example application: To develop an environmental monitoring program when there is historical data and/or knowledge about the system function and potential impacts.
  • Team composition: A core team of SMEs from each impacted functional group is recommended for established processes. For prospectively performed assessments, the team may include SMEs that represent the product or process under assessment as well as SMEs from other products/processes that can bring knowledge about previously identified and mitigated risks.

Uncertainty: High

• Hazard Identification Tool (HIT): The HIT is a means of exploring possible hazards and the range of impacts that an individual hazard may evoke. HIT can aid a cross-functional team in brainstorming when there is a large amount of uncertainty and aid in developing a robust risk assessment.
  • Use when: You need to explore a novel system to determine the hazards and their range of impacts.
  • Example application: When process knowledge and experience are limited and there is a lack of understanding of potential hazards and resulting harms, i.e., early-phase development.
  • Team composition: The team includes SMEs that represent the product or process under assessment as well as SMEs from other products/processes that can bring knowledge about previously identified and mitigated risks.

Moving Forward

ICH Q9(R1) offers a range of new concepts to consider in risk management execution. The new guidance related to formality provides evidence that tool selection is to be made by considering multiple dimensions and that formality is not a binary concept — this alone should enhance the risk management techniques being chosen across the industry. While importance and criticality are factors that contribute to tool selection, the third factor of uncertainty plays an equally valuable role in not only the tool selection but also the team’s composition. Considering both the tool that is selected and the knowledge available to explore hazards and harms will not only provide a framework for risk management maturity, but it will also enable our ability to identify the uncertainties, plot a course for understanding, and enable knowledge management.

Acknowledgments

The authors wish to thank Kelly Waldron, PhD, Business Unit Manager, ValSource, Inc. and James Vesper, PhD, MPH Director, ValSource Learning Solutions for their review and contribution to this article.

References

1. ICH Quality Guideline Q9(R1): Quality Risk Management; International Conference on Harmonization: 2023. www.ich.org  
2. Quality Risk Management (QRM) Tool Selection: Getting to Right First Time, K.S. Murray and S. Reich, PHARMACEUTICAL ENGINEERING, The Official Magazine of ISPE, July/August 2011, Vol. 31 No. 4
3. https://www.pda.org/pda-letter-portal/home/full-article/a-line-of-sight-approach-for-assessing-aseptic-processing-risk-part-ii

About The Authors:

Amanda McFarland is a quality risk management and microbiology senior consultant with ValSource, Inc. She specializes in the creation and implementation of risk management programs and developing risk-based strategies for use in clinical and commercial settings. McFarland is an active member of the Parenteral Drug Association (PDA), co-chair of the PDA ANSI standard on QRM in aseptic processing, a member of the PDA Regulatory Affairs and Quality Advisory Board, and an instructor for the PDA. She has a B.S. in entomology and an M.S. in mycology, both from the University of Florida. She can be contacted at amcfarland@valsource.com.

Ryan Murray is a quality and manufacturing science senior consultant with ValSource, Inc. His focus is in the areas of facility design and control, technology transfer, process qualification, and aseptic risk management in biologics and advanced therapy medicinal products (ATMPs). He is an active member of the International Society for Pharmaceutical Engineering (ISPE) and the Parenteral Drug Association (PDA) and holds a B.S. in biomedical science and an M.S. in biochemistry and biophysics from Texas A&M University. He can be reached at rmurray@valsource.com.