1.0 Purpose
1.1 This Standard Operating Procedure (SOP) establishes uniform requirements for quality risk management (QRM) utilizing a risk-based systems approach for implementation into a quality system.
2.0 Scope
2.1 The procedure is applicable to product, process, equipment and systems of NAME Pharmaceuticals Ltd.
3.0 Responsibility
3.1 Manufacturing head/designee shall be responsible to demonstrate a commitment to the risk management process by:
Ø Providing leadership for the risk management process to ensure that ongoing Quality Risk Management
processes operate
effectively.
Ø Ensuring
adequate resources for execution.
Ø Create' a cross-functional team across various functions and departments and appoint a Team Leader
appropriate to the risk being considered.
Management is applied:
Ø The evaluation of the risk to quality is based on scientific knowledge and ultimately linked to the protection of
the patient.
Ø The level of effort, formality, and documentation of the quality risk management process should be aligned
with the level of risk.
Ø To
assure coordination of quality risk
management across the’ various
functions and departments.
Ø To
facilitate continuous improvement in manufacturing resulting from knowledge gained through
periodic.
Ø Quality
Risk Management system reviews.
Ø Authorization
and oversee the creation of Quality Risk Management procedures that include the requirements established in this SOP.
Ø Ensure appropriate training of personnel involved in Quality Risk Management activities and provide for
traceable record
keeping of such training.
Ø Maintain a GMP compliant document
control system for the review, approval, issuance, maintenance .and archiving of Quality Risk
Management Records throughout
the product or device lifecycle.
Ø Ensure all paper-based or electronic Quality Risk Management documents are prepared, securely
stored, executed, reviewed, approved, signed and dated by appropriately trained, responsible
persons and distributed according
to written procedures.
Ø Serve as the gatekeeper for initiation of and as a final approver for Quality Risk Management activities and
reports.
Ø Ensure personnel alerts the Quality Unit in accordance with the current version of the SOP for
Deviations Management / Incidents if they observe a possible product quality risk so it can be
evaluated to determine if initiation of a Quality Risk Management process
is warranted.
Ø Serve
as: The initiator of QRM change control activities.
Ø The
preparer of the quality risk management
control strategy and a risk assessment.
Ø Prepare related reports and records or delegates these duties to qualified team members for specific aspects
of the Quality Risk Management process.
Ø Ensure assigned Quality Risk Management design and implementation teams are qualified to perform
assigned tasks and include subject matter experts (SMEs) from the affected areas (e.g., quality unit,
business development, engineering, regulatory affairs, production operations, sales and marketing, legal,
statistics and clinical, as appropriate), as well as SMEs in the QRM process.
4.0 Abbreviations and Definitions
4.1 A/E : Adverse Event
4.2 APQR : Annual Product Quality Review
4.3 CAPA : Corrective and Preventive Action
4.4 CQ : Corporate Quality
4.5 FMECA: Failure Mode Effects and Criticality Analysis
4.6 HACCP: Hazard Analysis and Critical Control Points
4.7 PQR : Product Quality Review
4.8 QRM : Quality Risk Management
4.9 SME : Subject Matter Expert
5.0 Materials and Equipment
5.1 None
6.0 Precaution / Health and Safety Considerations
6.1 None
7.0 Procedure
7.1 Quality Risk Management:
7.1.1 Perform Risk Management by using a systematic process, designed to coordinate, facilitate and improve
science-based decision making with respect to risk.
7.1.2 Occurrence based events like OOS, market complaints, unplanned deviations, etc. as well as system -based
events like change controls, planned deviations, etc. shall undergo risk management process.
7.1.3 Implementation of the quality risk management process includes the following major steps:
7.1.4 Risk assessment (identification / analysis /evaluation).
7.1.5 Risk control (reduction, acceptance) conducted commensurate with the level of risk.
7.1.6 Review of Risk -evaluating and communicating the results of the risk management efforts.
7.2 Initiating and planning the Quality Risk Management process:
7.2.1 Identify a qualified and quality risk management team leader and cross-functional team (CFT) with experience
from the affected areas and trained in the Quality Risk Management process.
7.2.2 Answer the define the question or problem statement that (e.g., a problem and/or risk question).
7.2.3 Include pertinent assumptions identifying the potential for risk.
7.2.4 Assemble background information and /or data on the potential hazard. harm or impact relevant to the risk and
gather appropriate information for consideration and inclusion in the Quality Risk Management Process including but
not limited to:
Ø Master formulae
Ø GMP
requirements
Ø Regulatory commitments
Ø Validation
documents. as applicable
Ø Technical information/reports
Ø Pilot
plant data
Ø Development Protocols and Reports
Ø Product
specifications/packaging
specifications
Ø Bill
of materials / Formulation Order
Ø Change
control documents
Ø Investigation report
commitments
Ø Audit
commitments
Ø Regulatory inspection
findings / commitments
Ø Related
subject SOPs
Ø Annual
/Product Quality Reviews (APQR/PQR)
Ø Rework
or reprocess documentation
Ø Product-specific equipment
or tools used in manufacturing
Ø License
documents, license applications or equivalent documents.
Ø Formal, approved drawings showing the movement of materials, personnel, and equipment through all
production areas.
7.3 Complete the risk assessment (refer to the section below on process for completing a risk
assessment to classify risk):
7.3.1 Risk identification: A systematic use of objective evidence to identify hazards through processes like
collection and organizing information, reviewing appropriate references and identifying assumptions. The information
required to risk identification shall be gathered from questions like:
7.3.2
What
Ø Might
go wrong?
Ø Is the
likelihood it will go wrong?
Ø Are
the consequences?
7.3.3.1 The estimation of the risk associated with the identified hazards. Include in the risk analysis process a linking the likelihood of occurrences and severity of harm.
7.3.3.2 For each risk event (i.e. identified potential hazards), severity, probability of occurrence and detection shall be assessed separately.
7.3.4
Risk
evaluation:
Identify the consequences
(severity) of the risk. Compare the identified and analyzed risk against
given risk criteria considering the
probability, detectability, and severity.
7.3.5 Risk Communication (Quality Risk Management):
7.3.5.1 Ensure bi-directional sharing of information between departments and within the organization
about any identified risk and risk management-strategies employed by the Quality Risk Management team
leader / CFT members.
7.3.5.2 Escalation of significant quality concerns shall be initiated in accordance with the SOP.
7.3.5.3 The sharing of information can be formal and/or informal. The Quality Risk Management CFT leader
will coordinate notifications to external stakeholders, Agency filings or submissions with an appropriate
site or quality unit representative.
7.3.5.4 Communication can occur at any stage of the Quality Risk Management process.
7.3.5.5 Document and communicate the output/result of the Quality Risk Management process.
7.3.6.1 Determination
of risk category (Risk Assessment Matrix) (Example Template).
7.3.6.2 Risk
assessment of quality-related events shall be performed to classify the
risk category.
7.3.6.3 The level of risk shall, in turn, help in prioritization of investigation, and finalization of strategy and CAPA used
to resolve the
incident & event.
7.3.6.4 The
following three factors
shall be considered when
assessing the level of risk:
Ø Severity/impact of risk
Ø Probability of occurrence
Ø Probability of detection
(State of controls)
7.4
Assessment
of Severity (S) / impact of event
/ incident on product quality and patient safety:
7.4.1 Having determined that the event / incident-may have a risk(s) on the safety, identity, strength, purity, and quality of the product, the Quality Risk Management team leader / CFT shall assign a risk rating as per Table A below:
Table A:
Severity / Impact - Rating and Criteria
Quantitative |
Qualitative |
Criteria |
Rating |
Risk
Rating |
|
1-2 (Low) |
Low |
No impact on product identity, strength,
purity, and quality. |
Minor GMP
non-compliance. |
||
No impact
on patient safety (defects which may
not pose any significant hazard to health) |
||
3-4 (Medium) |
Medium |
Likely
impact on product identity, strength, purity, and quality |
Major-GMP
non-compliance. |
||
The
potential impact on patient
safety (defects which could
cause illness or mistreatment but are not life-threatening or serious
ones or are medically
reversible) |
||
5-6 (High) |
High |
Direct
impact on product identity, strength, purity, and quality· |
Critical
GMP non-compliance. |
||
Critical
impact on patient safety
(defects which are potentially
life- threatening or could
cause serious risk. to health) |
7.4.2
Examples of 'Low Severity’ defects include (but are not limited to):
Ø Missing or wrong text / figures on the packaging which will, however, not affect the product / batch
identity or usage instructions.
Ø Faulty closure,
which will not cause
any
medical consequences.
Ø Insignificant
Ø Faulty
secondary or tertiary packaging, which
will not, however, affect product quality.
Ø Poor /
improper presentation of product
containers.
Ø Quality
defects which are likely to cause efficacy issues, but will not cause any significant
hazard to health.
Ø Quality defects are likely to cause AE/efficacy issues which are, however not Life -threatening, or serious
ones, or are medically reversible.
Ø
Failure
to meet specifications (such as for
Assay, Stability, Fill Weight, etc.)
Ø Wrong/missing text or figures which may affect the product identity/usage instructions (e.g. missing
or incorrect manufacturing/expiry date, missing patient information leaflets or leaflets with incorrect
information), significant
shortages
Ø
Extraneous matter in non-inject able / non-ophthalmic products that may not have life-
threatening consequences.
Ø
Insecure closure with medical consequences
(e.g. potent products such as cytotoxic, etc.)
7.4.4
Examples of 'High Severity’ defects include (but are not limited to):
Ø
Quality
defects which are likely to cause AE/ efficacy issues with
life-threatening consequences.
Ø
Any extraneous matter in injectable and ophthalmic products.
Ø Extraneous matter in non - injectable / non -ophthalmic product with life- threatening consequences (like
metal, glass,
etc.)
Ø
Wrong
product (label and contents are different).
Ø
Correct
product but wrong strength, with serious medical consequences.
Ø
Microbial
contamination of sterile injectable or ophthalmic products.
Ø
Chemical
contamination (abnormal impurities, cross-contamination, etc.) with serious
medical consequences.
Ø
Mix-up
of some products (rogues).
Ø
The
wrong active ingredient in a
multi-component product, with serious
medical consequences.
Note: Categorization examples quoted in this section are provided for illustration only and are not meant to
be exhaustive.
7.5 Assessment of Probability of Occurrence (O) of the Cause:
7.5.1 The review of the cause of the
incident/event to determine the ‘probability of occurrence' in the
future.
7.5.2 The Quality Risk Management team leader / CFT shall assign a rating as per Table B below:
Table B: Probability
of Occurrence - Rating and Criteria
Quantitative |
Qualitative |
Criteria |
Rating |
Risk
Rating |
|
1-2
(Low) |
Low |
The
quality-related event is
unlikely to occur (i.e. it has not occurred in. the past and is not expected to occur
or recur) |
3-4
(Medium) |
Medium |
The
quality-related event may occur (i.e. it has occurred infrequently in the past and is expected to recur) |
5-6
(High) |
High |
The quality-related event is likely to occur (i.e. it has occurred
in the past on a frequent basis and is definitely expected to occur again). |
Note: Definitions of 'past' and 'frequent' for calculation of the probability of occurrence of product
quality complaints (PQCs) shall be customized by considering at a minimum, the actual
frequency of occurrence of such events. These definitions shall be captured in specific site/regional procedures.
Example: If a site has an average of 5 recalls in a year, 'past' may be defined as: '2 years' and 'frequent' may
be defined as 'more than 2'. However, if the same site receives an average of 30 recalls in a year, it is more logical
to define ‘past’ as '6 months’
and ‘frequent’ as ‘more than 5’.
(Please note: this example is only for the purpose of illustrating the logic to be used to frame the definition
of 'past' and frequent'-
this should not be considered as a benchmark
for the definitions).
7.6 Assigning Level of Risk-Based on 'Severity of Impact' (S) and 'Probability of Occurrence' (O):
7.6.1 After assessing the ‘Severity of impact' and 'probability of occurrence' the Quality Risk Management team
leader
/ CFT shall assign a risk level as shown in Table
C.
7.6.2 It should be noted that severity (i.e. the impact on the patient) carries a heavier weighting than the probability of occurrence:
Table C: Risk Level based on Severity & Probability of Occurrence (Qualitative Analysis)
|
Risk Rating based on
Probability of Occurrence |
||||
Low |
Medium |
High |
Not Applicable |
||
Risk Rating based on Severity |
High |
Level
ONE |
Level
ONE |
Level
ONE |
Level
ONE |
Medium |
Level TWO |
Level TWO |
Level ONE |
Level TWO |
|
Low |
Level
THREE |
Level
THREE |
Level
TWO |
Level THREE |
|
Not Applicable |
Level
THREE |
Level
THREE |
Level
TWO |
Not
Applicable |
7.7 Probability of Detection (State of Controls)- Rating and Criteria Assessment of the 'Probability of Detection (D) (or 'State of Control'):
7.7.1 The purpose of this stage in the risk assessment process is to determine if there are sufficient controls to ensure
that the cause for the incident/event can be recognized or detected and prevented from recurrence.
7.7.2 The incident/event may have occurred due to a lapse in the application of existing controls or may be due to the
absence of sufficient controls.
7.7.3 The Quality Risk Management team leader / CFT shall assess the state of controls surround the incident/ event
and assign a rating as per Table D below:
Table D: Probability
of Detection- Rating and Criteria
Quantitative |
Qualitative |
Criteria |
Rating |
Risk
Rating |
|
5-6
(Weak) |
Weak |
The
Quality System has either 'weak'
or 'no' controls to detect the quality-related event after its occurrence
and prevent it from recurring,
e.g. systems are non-validated or with perception-based evaluation techniques, process
controls are dependent on human
efficiency, etc. |
There
is a low chance the current controls will detect the quality event after its
occurrence. Explanation:
· There is little to no chance that the patient will detect the quality issue
after its occurrence. Passes
the faults (to the patient) undetected. |
||
Quality
System has weak controls to detect the quality-related event after its occurrence and prevent it
from recurring (e.g., systems are not validated). |
||
3-4
(Medium) |
Medium |
The system has controls and will possibly
detect the quality-related event after its occurrence. |
Explanation:· Patient
will possibly detect the
quality issue after its occurrence: Some
faults may be detected; several coincident faults may go undetected. |
||
The quality
system has controls and will possibly detect
the quality- related event
after its occurrence and avoid it
from recurring (e.g.,
Statistical Process Control is used in the process, but the product undergoes final inspection off-line). |
||
1-2 (Strong) |
Strong |
The system
has multiple controls
and is very likely to detect
the quality-related event
after its occurrence |
Explanation:' Patient
is very likely to detect the
quality issue after occurrence: The
fault will be caught certainly or
most certainly. |
||
The quality system has multiple controls and
is very likely to detect the event after its occurrence and prevent it from recurring (e.g., 100% automatic inspection with regular calibration and preventive
maintenance of the inspection equipment.
Validated systems having multi-level checks. Alarm systems/ direct measurement techniques to monitor faults). |
7.8 Final Risk Classification:
7.8.1 Using the results of the risk assessment process as described in the earlier sections to identify the level of risk based on the 'severity' and 'probability of occurrence' of the quality issue and corresponding 'probability of detection' (state of controls), the team leader / CFT shall assess the risk and classify the same as 'Critical' / Major' / ‘Minor’ as also defined in Table E:
Table E: Final Risk Classification
|
Rating – Probability of
Detection |
||||
Strong |
Medium |
Weak |
Not Applicable |
||
Risk Level based on Severity and Probability of
Occurrence |
Level
ONE |
Major |
Critical |
Critical |
Critical |
Level
TWO |
Minor |
Major |
Critical |
Critical |
|
Level
THREE |
Minor |
Minor |
Major |
Major |
|
Not
Applicable |
Unclassified |
Unclassified |
Unclassified |
Unclassified |
Notes:
1) Upgrade the risks level determined through this matrix to a higher level, if
needed, based on a case-by-case evaluation by QA.
2) If severity, probability of occurrence, and the probability of detection
are determined to be 'not applicable'
(example: alleged lack of effect
(LOE),PQC received for non-company products,
etc.), the risk category
shall be concluded as 'unclassified.'
3) In case of quantitative analysis, risk priority number (RPN) shall be calculated using the rating values
of Severity (S), Probability of Occurrence
(O) and Detection (D):
Risk Priority
Number (RPN) = S x O x D
7.9 Risk Evaluation:
7.9.1
Determine the risk category /
calculate the RPN values.
7.9.2 Annexure-II:” Risk Assessment Form- Qualitative Risk Assessment” and Annexure-III: ”Risk Assessment Form- Quantitative Risk Assessment” may be used for evaluating the risks.
Risk Evaluation (Qualitative Analysis)
Risk Category |
Action Plan |
Minor |
Acceptable |
Major |
Acceptable with
control / explanation of Control |
Critical |
Requires control
measure before acceptance |
v The Risk Evaluation is given as below quantitative assessment:
Risk Evaluation (Quantitative Analysis)
Events |
Risk Ratings and
Classification |
||
Minor |
Major |
Critical |
|
Risk
on Product / Patient |
<
20 |
<60 |
≥
60 |
Risk on People /
Facility / Organization |
<
25 |
<75 |
≥
75 |
7.10 Risk Control/Mitigation:
7.10.1 The output of the risk assessment exercise shall be considered by the CFT nominated to perform the Risk
Control/Mitigation exercise to identify the action plans for control / mitigation of risk as immediate action based
on risk evaluation.
7.10.2 This may lead to the correction of process,
procedures, and practices to avoid the aggravation of the impact of the risk.
7.10.3 Risk control/mitigation shall focus on the following
questions:
Ø Is the
risk above an acceptable level?
Ø What
can be done to reduce or eliminate risks?
Ø What
is the appropriate balance among benefits, risks, and resources?
Ø Are
new risks introduced as a result of the identified risks being controlled?
7.10.4 Control measures/CAPA shall be considered for
risk control/mitigation and shall be
implemented using applicable
procedures for the same.
7.10.5 Such actions shall be prioritized to
control/mitigate the risk or reduce it
to an acceptable level.
7.11 Risk Reduction (Quality Risk Management):
7.11.1 Risk reduction shall focus on processes for control/mitigation or avoidance of quality risk when it exceeds an
acceptable level. It might include actions
taken to mitigate the probability of harm.
7.11.2 It may achieve by (but not limited to):
Ø Improvement in the quality of the product by design - this may include improvement in the process,
procedures, control measures, monitoring.
Ø Change
of process and/or procedures.
Ø Revision
of specification to stringent limits.
Ø Improvement of the periodicity of the measurement of parameters.
Ø Change in the frequency of calibration, qualification, validation, quality system internal audits in order
to
proactively identify the chances of the risk.
7.12 Risk Acceptance (Quality Risk Management) :
7.12.1 Risk acceptance is a decision to accept the identified & evaluated risk. It is a formal decision to accept the residual
risk. For some types of harms, even the best quality
risk management practices might not
entirely eliminate risk.
7.12.2 In these circumstances, it might be agreed that the optimal quality risk management strategy has been applied and
that quality risk is reduced to an acceptable level.
7.12.3 This acceptable level will depend on many parameters and shall be decided on a case-by-case basis as explained
in Table F:
Table
F: Action items based on Risk Classification
Overall Risk Classification |
Action Plan |
Minor |
Acceptable |
Major |
Acceptable as an
isolated exception, if states of control can be improved. States
of control have to be
improved, where visible |
Critical |
Not Acceptable. Improve the States of control |
7.13 Risk Communication and Reporting:
7.13.1 Risks identified by the risk analysis/evaluation
steps shall be communicated to relevant
stakeholders.
7.13.2 The table given below shows risk categories
and their level of communication and reporting in the organization.
Table
G: Communication and Reporting
Risk Type |
Communication and Reporting |
Minor |
Functional /
Departmental Head, Head of Quality Assurance |
Major |
Functional /
Departmental Head , Head of Quality
Assurance & Head of Plant |
Critical |
Functional Head , Head of Quality Assurance , Head of
Plant , AGM- Operation & Managing Director |
7.13.3 In any case, risk on patient safety and risk on quality which is classified as 'major' or 'critical' should be
formally reported on a monthly basis.
7.14 Risk Review (Quality Risk Management):
7.14.1 Effectiveness of control measures / CAPA implemented to reduce the risk level shall be reviewed; The CFT
shall decide the effectiveness
review criteria with respect to:
Ø What
and Why to review?
Ø How to
review?
Ø When
to review?
Ø Who
will review?
7.15 Risk Management Tools:
7.15.1 Numerous risk management tools are available to support objective, science-based decisions, used either alone or
in
combination.
7.15.2 No one tool or set of tools is applicable to every situation in which a quality risk management procedure is used,
the selection of a tool should be
commensurate with the level of risk.
7.15.3 Listed below are examples of tools successfully used in Quality Risk Management by industry and regulators? (Reference Examples of common risk management tools), but it is not an exhaustive list:
Ø Flow
Charting - well suited as a first step
Ø Brain
storming - free form collaborative discussion
among key stakeholders of possible solutions to an identified
problem or question
Ø Process mapping
- the visual representation of workflow
inputs and outputs o Statistical
tools
Ø Risk
ranking & filtering
Ø Preliminary hazard analysis (PHA) - focuses on
hazardous situations o Root cause
analysis - suited for
retrospective. Analysis
Ø Ishikawa or Fish Bone Diagrams (also called
Cause and Effect Diagrams) - suited
for defining process variables and process elements
Ø FMEA (failure
mode and effects analysis)/FMECA (failure
mode effects and criticality analysis)
- suited for prospective analysis
to predict multiple effects;
Ø HACCP(hazard analysis
and critical control points)
- supports the identification of critical
control points in a process
Ø Variation
risk management
Ø Decision
trees
Ø Event
tree analysis
Ø FTA
(Fault tree analysis) - suited for retrospective analysis
7.16 Numbering System:
7.16.1 Risk Identification number shall provide as SPL/R001, SPL/R002…. So on, for the risk management protocol and
the severity, likelihood and mitigation of risk shall be evaluated on the basis of qualitative and quantitative means.
7.17 Requirements (Quality Risk Management):
7.17.1 Occurrence based events including (but not limited to): OOS, product quality complaints, unplanned deviations,
etc., as well as system-based events like change controls, planned deviations, etc., shall be submitted to the quality unit
for Quality Risk Management process initiation.
7.17.2 Any deviation from the written procedures or processes shall be recorded, justified and, if warranted, identified
as an event and investigated, then assessed or reexamined in accordance with the quality risk management process.
7.17.3 Processes using Quality Risk Management methodologies should be dynamic, iterative and responsive to change.
7.17.4 Enable the capability for continual improvement in the Quality Risk Management process.
7.17.5 Do not reduce an acceptable level of risk to a simple constant value:
7.17.6 This is due to the wide range of possible risk acceptance levels that a variety of real- world circumstances will
present.
7.17.7 How the values were determined shall be documented since they will depend on parameters used by the Quality
Risk Management team leader / CFT on a case-by-case basis.
7.17.8 Control measures/CAPA shall be considered for risk control/mitigation and shall be implemented in accordance
with SOP corrective and preventive action. Such actions shall be prioritized to control/mitigate the risk or reduce it to an
acceptable level.
8.0
Reference Document
8.1 ICH Q9
– Quality Risk Management
8.2 WHO Technical Report Series No. 981,2013; Annex-2
9.0 Annexure
9.1 Annexure –I : Schematic Representation of Quality Risk Management Process
9.2 Annexure –II : “Risk Assessment Form- Qualitative Risk Assessment”
9.3 Annexure –III : “Risk Assessment Form- Quantitative Risk Assessment”
9.4 Annexure –IV : Risk Assessment Register
10.0 Revision History
Version No. |
Brief Reason for the Revision |
Effective Date |
Remarks |
01. |
New |
|
|
|
|
|
|
11.0 Training
11.1 Training is required for all concern
person of all departments trained by Head of Department / Head of Quality Assurance.
Annexure
–I :
Schematic Representation of Quality Risk Management Process
Annexure
–IV :
Risk Assessment Register
Sl. No. |
Equipment
/ System / Process / Product Name : |
Risk
Id no: |
Department |
Done By |
Reviewed By |
Remarks |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Page … of …