Ich q9

Content
ICH Q9 QUALITY RISK MANAGEMENT
Quality
Risk Management
ICH Q9
Content
Disclaimer: This presentation includes the authors views on quality risk management theory and practice.
The presentation does not represent official guidance or policy of authorities or industry.
prepared by some members of the ICH Q9 EWG for example only; not an official policy/guidance July 2006, slide 1
Content
Purpose of this part
 To guide through the content of the ICH Q9 document
 Provide some considerations, possible interpretations

and where appropriate examples
Content
ICH Q9: Quality Risk Management (QRM)

 Document is available on the ICH Webpage
www.ich.org
Content
Table of contents
1. Introduction
2. Scope
3. Principles of Quality Risk Management
4. General Quality Risk Management Process
5. Risk Management Methodology
Annex I: Risk Management Methods and Tools
6. Integration of QRM process
into Industry and Regulatory operations
Annex II: Potential Applications for QRM
7. Definitions
8. References
Content
1. Introduction
Risk Management
Quality Risk Management
Quality Systems
Harm
Severity
Stakeholder
Product Life Cycle
GMP Compliance
Content
2. Scope
This guideline provides
principles & examples of tools
of quality risk management that can be applied to
different aspects of pharmaceutical quality.
These aspects include development, manufacturing,
distribution, and the inspection and submission/review
processes throughout the lifecycle
of drug substances, drug (medicinal) products,
biological and biotechnological products
ICH Q9
Content
ICH Q9 QUALITY RISK MANAGEMENT CONSIDERATIONS
2. Scope
 Drug substances,
 Drug (medicinal) products,
 Biological and biotechnological products
Including the selection and use of

> Raw materials
> Solvents
> Excipients
> Packaging and labelling materials
> Components
Content
3. Principles of Quality Risk Management

Two primary principles:
The evaluation of The level of effort,

the risk to quality formality and
should be based on documentation
scientific knowledge of the quality risk
and ultimately link management process
to the protection should be commensurate
of the patient with the level of risk
ICH Q9
Content
Systematic processes
designed to
coordinate, facilitate and improve
science-based decision making
with respect to risk to quality
ICH Q9
Content
Initiate
4. A General Quality Risk Management Process
Quality Risk Assessment
Risk Risk Identification
Management Risk Analysis
Process
Risk Evaluation
unacceptable
Risk Management tools

Risk Communication
Risk Control
Risk Reduction
Risk Acceptance
Team Output / Result of the

approach Quality Risk Management Process
Risk Review
Review Events
ICH Q9
Content

Decision makers:
Person(s)
with competence and authority
to make a decision
 Ensuring that
ongoing Quality Risk Management processes operate
responsibility
Management
 Coordinating
quality risk management process
across various functions and departments
 Supporting
ICH
Q9 the team approach
Content

Team approach
 Usually, but not always, undertaken by interdisciplinary
teams from areas appropriate to the risk being
considered e.g.
> Quality unit
> Development
> Engineering / Statistics
> Regulatory affairs
> Production operations
> Business, Sales and Marketing
> Legal
> Medical / Clinical
> &… Individuals knowledgeable of the QRM processes
Content

When to initiate and plan a QRM Process
 First define the question which should be answered
(e.g. a problem and/or risk question)
> including pertinent assumptions identifying
the potential for risk
 Then assemble background information and/ or data
on the potential hazard, harm or human health impact
relevant to the risk
> Identify a leader and necessary resources Initiate Quality
Risk Management Process
Risk Assessment
Risk Identification
> Specify a timeline, deliverables and

Risk Analysis
Risk Evaluation

Risk Communication
unacceptable
Risk Control
appropriate level of decision making

Risk Reduction
Risk Acceptance
Output / Result of the Quality
for the QRM process

Risk Review
ICH Q9 Review Events
Content
When to apply Quality Risk Management?

Should risks
be assessed?
1. What might go wrong?
2. What is the likelihood (probability)
Are there clear rules it will go wrong?
No or 3. What are the consequences (severity)?
for decision making? justification needed
e.g. regulations
Can you answer

the risk assessment
questions? No
“formal RM“
Yes Agree on a team

Yes (small project)
“informal RM“
“no RM“
Risk assessment not required Initiate Risk assessment Select a Risk Management tool
(No flexibility) (risk identification, analysis & evaluation) (if appropriate e.g. see ICH Q9 Annex I)
Follow procedures Run risk control Carry out the

(e.g. Standard Operating Procedures) (select appropriate measures) quality risk management process
Document results,
decisions and actions Document the steps
Based on K. Connelly, AstraZeneca, 2005

Content

Risk Assessment
3 fundamental
 Risk Identification
questions
What might go wrong?
 Risk Analysis
What is the likelihood (probability) it will go wrong?
 Risk Evaluation
What are the consequences (severity)?
Note: People often use terms Initiate Quality
“Risk analysis”, “Risk assessment” and

Risk Assessment
Risk Identification
Risk Analysis
“Risk management” interchangeably

Risk Evaluation

Risk Communication
unacceptable
Risk Control
Risk Reduction
Risk Acceptance
which is incorrect! Output / Result of the Quality

Risk Review
Content

Risk Assessment: Risk Identification
“What might go wrong?”
 A systematic use of information

to identify hazards
referring to the risk question or problem
> historical data
> theoretical analysis Initiate Quality
Risk Assessment
> informed opinions Risk Identification
Risk Analysis
Risk Evaluation

Risk Communication
unacceptable
Risk Control
> concerns of stakeholders Risk Reduction
Risk Acceptance

Risk Review
Content

Risk Assessment: Risk Analysis
“What is the likelihood it will go wrong?”
 The estimation of the risk

associated with the identified hazards.
 A qualitative or quantitative process of linking
the likelihood of occurrence and severity of
harm Initiate Quality
Risk Assessment
 Consider detectability if applicable

Risk Identification
Risk Analysis
Risk Evaluation

Risk Communication
unacceptable
Risk Control
(used in some tools)

Risk Reduction
Risk Acceptance

Risk Review
Content

Risk Assessment: Risk Analysis
Often data driven
Keep in mind:
Statistical approach may or may not be used
 Maintain a robust data set!
 Start with the more extensive data set and reduce it
 Trend and use statistics (e.g. extrapolation)
 Comparing between different sets requires
compatible data
Initiate Quality
Risk Assessment
Risk Identification
Risk Analysis
 Data must be reliable

Risk Evaluation

Risk Communication
unacceptable
Risk Control
Risk Reduction
Risk Acceptance
 Data must be accessible

Risk Review
Review Events
Content

Risk Assessment: Risk Evaluation
“What is the risk?”
 Compare the identified and analysed risk

against given risk criteria
 Consider the strength of evidence

for all three of the fundamental questions
> What might go wrong?
Initiate Quality
> What is the likelihood (probability) it will go wrong? Risk Assessment

Risk Identification
Risk Analysis
Risk Evaluation

> What are the consequences (severity)?
Risk Communication
unacceptable
Risk Control
Risk Reduction
Risk Acceptance

Risk Review
Review Events
Content

Risk Assessment: Risk Evaluation
A picture of the life cycle = Risk Priority Number
Probability x Detectability x Severity
Can you find it?

Data refers to
• Frequency of
“occurences”
Impact
driven by
the number
of trials
• Degree
of belief
past today future time

Content

Risk Control: Decision-making activity
 Is the risk above an acceptable level?

 What can be done to reduce or eliminate risks?
 What is the appropriate balance
between benefits, risks and resources?
 Are new risks introduced as
a result of the identified Initiate Quality
Risk Assessment
risks being controlled? Risk Identification
Risk Analysis
Risk Evaluation

Risk Communication
unacceptable
Risk Control
Risk Reduction
Risk Acceptance

Risk Review
Content

Risk Control: Residual Risk
 The residual risk consists of e.g.

> Hazards that have been assessed and
risks that have been accepted
> Hazards which have been identified but
the risks have not been correctly assessed
> Hazards that have not yet been identified
> Hazards which are not yet linked to the patient risk
 Is the risk reduced to an acceptable level?
Initiate Quality
Risk Assessment
Risk Identification
Risk Analysis
> Fulfil all legal and internal obligations Risk Evaluation

Risk Communication
unacceptable
Risk Control
Risk Reduction
> Consider current scientific knowledge & techniques Risk Acceptance

Risk Review
Review Events
Content

Risk Control: Risk Reduction
 Mitigation or avoidance of quality risk

 Elimination of risks, where appropriate
 Focus actions on severity and/or probability
of harm; don’t forget detectability
 It might be appropriate to revisit the
risk assessment during the life cycle
Initiate Quality
for new risks or increased significance

Risk Assessment
Risk Identification
Risk Analysis
of existing risks Risk Evaluation

Risk Communication
unacceptable
Risk Control
Risk Reduction
Risk Acceptance

Risk Review
Content

Risk Control: Risk Acceptance
 Decision to
> Accept the residual risk
> Passively accept non specified residual risks
 May require support by (senior) management

> Applies to both industry and competent authorities Initiate Quality
Risk Assessment
Risk Identification
Risk Analysis
Risk Evaluation
 Will always be made on a case-by-case basis

Risk Communication
unacceptable
Risk Control
Risk Reduction
Risk Acceptance

Risk Review
Review Events
Content

 Discuss the appropriate balance between

benefits, risks, and resources
 Focus on the patients’ interests and
good science/data
 Risk acceptance is not
> Inappropriately interpreting Initiate Quality
data and information

Risk Assessment
Risk Identification
Risk Analysis
Risk Evaluation

Risk Communication
unacceptable
> Hiding risks from management / Risk Control

Risk Reduction
Risk Acceptance
competent authorities Output / Result of the Quality

Risk Review
Review Events
Content
What is an “acceptable risk”?

Who has to accept risk?
 Decision Maker(s)
> Person(s) with the competence and authority
to make appropriate and timely
quality risk management decisions
 Stakeholder
> Any individual, group or organization
that can …be affected by a risk
> Decision makers might also be stakeholders
> The primary stakeholders are the patient, healthcare
professional, regulatory authority, and industry (ICH Q9, definition)
> The secondary stakeholders are
patient associations, public opinions, politicians
Content
ICH Q9 QUALITY RISK MANAGEMENT EXAMPLE

A Risk Risk reduction step
finished
Acceptance process
1/3 Finish baseline for
risk acceptance decision
risk identification, risk analysis,
risks evaluation, risks reduction
Stakeholders
No
involved as appropiate?
Yes
Revisit All identified Initiate Quality

No Risk Assessment
risk assessment step risks assessed? Risk Identification
Risk Analysis
Risk Evaluation

Risk Communication
unacceptable
Risk Control
Risk Reduction
Yes Risk Acceptance

Risk Review
Review Events
Content
4. General Measures/
actions needed?
Quality
Yes
Risk
Evaluate measures
Management on severity, probability, detectability
Process Check needed resources

e.g. employee, money
A Risk No Measures / Actions Revisit

Acceptance appropriate?
No
risk reduction step
process Yes
2/3
Other hazards
Yes
caused?
Initiate Quality
Risk Assessment
Risk Identification
No Risk Analysis
Risk Evaluation

Risk Communication
unacceptable
Risk Control
Risk Reduction
Is a risk Risk Acceptance
reducible? Risk Management Process
Risk Review
Review Events
Content

A Risk Acceptance process 3/3
Is a risk
No
reducible?
Yes
Revisit No
Accept the Yes
Advantage
risk assessment step residual risk? outweighs risk?
Yes No
Accept risk Risk not acceptable

Sign off documentation Sign off documentation
Initiate Quality
Ready for communication Risk Assessment

Risk Identification
Risk Analysis
Risk Evaluation

Risk Communication
unacceptable
Risk Control
Risk Reduction
Risk Acceptance

Risk Review
Review Events
Content

Risk Communication
 Bi-directional sharing of information
about risk and risk management
between the decision makers and others
 Communicate at any stage of the QRM process
 Communicate and document
the output/result of the QRM process appropriately
 Communication need not be carried out
Initiate Quality
for each and every individual risk acceptance

Risk Assessment
Risk Identification
Risk Analysis
 Use existing channels as specified in

Risk Evaluation

Risk Communication
unacceptable
Risk Control
Risk Reduction
Risk Acceptance
regulations, guidance and SOP’s Output / Result of the Quality

Risk Review
According to ICH Q9 Review Events
Content

Risk Communication
 Exchange or sharing of information, as appropriate
 Sometimes formal sometimes informal

> Improve ways of thinking and communicating
 Increase transparency
Initiate Quality
Risk Assessment
Risk Identification
Risk Analysis
Risk Evaluation

Risk Communication
unacceptable
Risk Control
Risk Reduction
Risk Acceptance

Risk Review
Review Events
Content
Quality risk management

Communication
facilitates trust
and understanding
Regulators Industry
operation operation
- Reviews - Submissions
- Inspections - Manufacturing
Content

Risk review: Review Events
 Review the output / results of the QRM process

 Take into account new knowledge and experience
 Utilise for planned or unplanned events
 Implement a mechanism to review or monitor events
 Reconsideration of risk acceptance decisions,
as appropriate
Initiate Quality
Risk Assessment
Risk Identification
Risk Analysis
Risk Evaluation

Risk Communication
unacceptable
Risk Control
Risk Reduction
Risk Acceptance

Risk Review
Content
One method
“all inclusive”?
Initiate Quality
Risk Assessment
Risk Identification
Risk Analysis
Risk Evaluation

Risk Communication
unacceptable
Risk Control
Risk Reduction
Risk Acceptance

Risk Review
Review Events
Cartoon: © Zurich Insurance Inc.
Content
Expectations on methods and tools
 Supports science-based decisions

 A great variety are listed but other existing or
new ones might also be used
 No single tool is appropriate for all cases
 Specific risks do not always require the same tool
 Using a tool the level of detail of an investigation will
vary according to the risk from case to case
 Different companies, consultancies and competent
authorities may promote use of different tools based
on their culture and experiences
Content
Contributing items to manage quality risks

 System Risk (facility & people)
> e.g. interfaces, operators risk, environment,
components such as equipment, IT, design elements
 System Risk (organisation)
> e.g. Quality systems, controls, measurements,
documentation, regulatory compliance
 Process Risk
> e.g. process operations and quality parameters
 Product Risk (safety & efficacy)
> e.g. quality attributes:
measured data according to specifications
Content
 Supports a scientific and practical approach to

decision-making
 Accomplishing steps of the QRM process

> Provides documented, transparent and
reproducible methods
> Assessing current knowledge
> Assessing probability, severity and Initiate Quality
sometimes detectability Risk Assessment

Risk Identification
Risk Analysis
Risk Evaluation

Risk Communication
unacceptable
Risk Control
Risk Reduction
Risk Acceptance

Risk Review
Content
 Adapt the tools for use in specific areas

 Combined use of tools may provide flexibility
 The degree of rigor and formality of QRM
> Should be commensurate with the complexity and
/ or criticality of the issue to be addressed and
reflect available knowledge
 Informal ways Initiate Quality
Risk Assessment
Risk Identification
> empirical methods and / or Risk Analysis
Risk Evaluation

Risk Communication
unacceptable
Risk Control
internal procedures Risk Reduction
Risk Acceptance

Risk Review
Content
Annex I: Risk Management Methods and Tools

 Provides a general overview of
and references for some of the primary tools
 Might be used in QRM by industry and regulators
 This is not an exhaustive list
 No one tool or set of tools is applicable to every
situation in which a QRM procedure is used
 For each of the tools
> Short description & reference Initiate Quality
Risk Assessment
Risk Identification
> Strength and weaknesses

Risk Analysis
Risk Evaluation

Risk Communication
unacceptable
Risk Control
Risk Reduction
> Purely illustrative examples Risk Acceptance

Risk Review
Content
Overview: Some tools and their key words

 Failure Mode Effects Analysis (FMEA)
> Break down large complex processes into manageable steps
 Failure Mode, Effects and Criticality Analysis (FMECA)
> FMEA & links severity, probability & detectability to criticality
 Fault Tree Analysis (FTA)
> Tree of failure modes combinations with logical operators
 Hazard Analysis and Critical Control Points (HACCP)
> Systematic, proactive, and preventive method on criticality
 Hazard Operability Analysis (HAZOP)
> Brainstorming technique
 Preliminary Hazard Analysis (PHA) Initiate Quality
Risk Assessment
Risk Identification
> Possibilities that the risk event happens Risk Analysis
Risk Evaluation

Risk Communication
unacceptable
 Risk ranking and filtering

Risk Control
Risk Reduction
Risk Acceptance
> Compare and prioritize risks with factors for each risk
Risk Review
Review Events
Content

 Supporting statistical tools
> Acceptance Control Charts (see ISO 7966)
> Control Charts (for example)
 Control Charts with Arithmetic Average and
Warning Limits (see ISO 7873)
 Cumulative Sum Charts; “CuSum” (see ISO 7871)
 Shewhart Control Charts (see ISO 8258)
 Weighted Moving Average
> Design of Experiments (DOE)

 Pareto Charts
Initiate Quality
> Process Capability Analysis

Risk Assessment
Risk Identification
Risk Analysis
Risk Evaluation
> Histograms

Risk Communication
unacceptable
Risk Control
Risk Reduction
Risk Acceptance
> Use others that you are familiar with….

Risk Review
Content
Q9 does not provide

“drivers licences”
Content
6. Integration into
Industry and Regulatory Operations
 Foundation for “science-based” decisions
 Does not obviate industry’s obligation
to comply with regulatory requirements
 May affect the extent and level
of direct regulatory oversight
 Degree of rigor and formality commensurate with
the complexity and/or criticality of the issue
 Implement QRM principles when updating
existing guidelines
ICH Q9
Content
This Annex is intended to identify potential uses of

quality risk management principles and tools by
industry and regulators.
However, the selection of particular risk management
tools is completely dependent upon specific facts and
circumstances.
These examples are provided for illustrative purposes and
only suggest potential uses of quality risk management.
This Annex is not intended to create any new
expectations beyond the current regulatory requirements.
ICH Q9 Introduction to Annex II
Content
Quality risk management as part of

 Integrated quality management
> Documentation Competent
> Training and education authorities
> Quality defects

Industry
> Auditing / Inspection
> Periodic review
> Change management / change control
> Continual improvement
Content
Annex II: Potential opportunities

for conducting quality risk management
Quality risk management as part of
 Regulatory operations Competent
authorities
> Inspection and assessment activities
 Industry operations
> Development
> Facilities, equipment and utilities Industry
> Materials management
> Production Competent
authorities
> Laboratory control and stability testing
> Packaging and labelling
Content
COMMUNICATION
Preliminary Hazard Analysis
Fault Tree Analysis FTA
Failure Mode, Effects & Criticality Analysis FMECA
Failure Mode Effect Analysis FMEA

ICH Q9
TOOLS PRODUCTION
Hazard Operatibility Analysis Quality Risk
MATERIALS
Hazard Analysis & Critical Control Points Management
Peter Gough, Stephan Roenninger, Bill Paulson, ICH Q9 Provides Implementation

ICH Q9 : Quality Risk Management - an update Framework for Quality Risk Management
Regulatory Affairs Journal, 16, 2005, 91-93 QUALITY SYSTEM Gold Sheet, 39, May 2005
prepared by some members of the ICH Q9 EWG for example only; not an official policy/guidance © J. Arce, F. Hoffmann-La Roche July 2006, slide 47
Content Initiate
Quality Risk Management Process
Risk Assessment
Risk Identification
Risk Analysis
Risk Evaluation
unacceptable

Risk Communication
Risk Control
Risk Reduction
Risk Acceptance
Output / Result of the

Quality Risk Management Process
Risk Review
Review Events
Use the right “risk” expression

please!

Ich q9

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Ich q9

Hochgeladen von

Copyright:

Verfügbare Formate

Content

ICH Q9 QUALITY RISK MANAGEMENT

Purpose of this part

 To guide through the content of the ICH Q9 document

 Provide some considerations, possible interpretations

ICH Q9: Quality Risk Management (QRM)

Including the selection and use of

3. Principles of Quality Risk Management

The evaluation of The level of effort,

4. General Quality Risk Management Process

Quality Risk Assessment

Risk Risk Identification

Management Risk Analysis

Risk Management tools

Team Output / Result of the

4. General Quality Risk Management Process

4. General Quality Risk Management Process

4. General Quality Risk Management Process

> Specify a timeline, deliverables and

Risk Management tools

appropriate level of decision making

Output / Result of the Quality

for the QRM process

ICH Q9 Review Events

When to apply Quality Risk Management?

Can you answer

Yes Agree on a team

Follow procedures Run risk control Carry out the

Based on K. Connelly, AstraZeneca, 2005

4. General Quality Risk Management Process

“Risk analysis”, “Risk assessment” and

“Risk management” interchangeably

Risk Management tools

which is incorrect! Output / Result of the Quality

ICH Q9 Review Events

4. General Quality Risk Management Process

“What might go wrong?”

 A systematic use of information

> informed opinions Risk Identification

Risk Management tools

> concerns of stakeholders Risk Reduction

Output / Result of the Quality

ICH Q9 Review Events

4. General Quality Risk Management Process

“What is the likelihood it will go wrong?”

 The estimation of the risk

 Consider detectability if applicable

Risk Management tools

(used in some tools)

Output / Result of the Quality

ICH Q9 Review Events

4. General Quality Risk Management Process

 Data must be reliable

Risk Management tools

 Data must be accessible

4. General Quality Risk Management Process

“What is the risk?”

 Compare the identified and analysed risk

 Consider the strength of evidence

> What is the likelihood (probability) it will go wrong? Risk Assessment

Risk Management tools

Output / Result of the Quality

4. General Quality Risk Management Process