Get more pharma manufacturing insight with our FREE newsletter  sign me up

Guest Column | June 27, 2018

Quality Risk Management 101: Overcoming Common Challenges In QRM

Implementation
By Kelly Waldron, Ph.D., ValSource, LLC

This article marks the last in a series of six intended to provide a holistic primer
on the field of quality risk management (QRM). The first article, Quality Risk
Management 101: Risks Associated with Medicinal Products, discussed the
difference between intrinsic and extrinsic risks and clarified the scope of QRM
efforts. It was followed by Quality Risk Management 101: A Brief History Of Risk
Management In The Regulation of Medicinal Products. Quality Risk Management
101: ICH Q9 In Context” offered a critical discussion of the QRM process proposed
by ICH Q9, while Quality Risk Management 101: QRM and the Product Life Cycle
[link] discussed the relationship between QRM and quality by design, the
pharmaceutical quality system, and post-approval change management. Quality
Risk Management 101: A Review Of Required Reading For QRM Practitioners
discussed some pivotal publications that all QRM practitioners should be familiar with. This article explores challenges with QRM
implementation that are shared by many within industry.

After 10 years of quality risk management (QRM) experience in the pharmaceutical, biopharmaceutical, and medical device industries, I
have had the opportunity to discuss QRM implementation with practitioners across the globe. Over time, I have identified several
challenges that appear to permeate the industry as a whole, each of which poses a unique and very real challenge to the fully effective
implementation of a QRM program. This article explores each of these challenges and explains the ways in which they might sabotage
QRM efforts.

Misconceptions Regarding Quality Vs. Compliance, Or “Taking A Conservative Approach”

The first theme is confusion between compliance with ICH Q9 and effectiveness of QRM implementation. These, of course, are two very
different concepts; compliance is often defined as “following regulation,” or applying the GMPs, while effectiveness in QRM stems from
applying the regulations in a way that has tangible benefits such as product quality improvement, quality systems improvement, and
realization of business objectives. Over the years, I have formed a habit of asking industry practitioners to sketch their understanding of
the relationship between quality and compliance using a Venn diagram format. Venn diagrams are graphs of interlocking circles that are
often used to demonstrate the relationship between categories, including the relative size or contribution of each category (as depicted by
the size of a given circle) and the level of similarities and differences between categories (as depicted by the extent to which the circles
overlap). A pattern in these Venn diagrams emerged early on, and has been reinforced many times at multiple industry conferences. The
vast majority of industry practitioners draw a diagram similar to that shown in Figure 1.

Figure 1: Typical Venn diagram sketched by industry practitioners to illustrate the relationship between quality and compliance

This diagram implies that most of industry believes there are aspects of quality that are unrelated to compliance, and more worryingly,
that there are aspects of compliance that are unrelated to quality. With this being the paradigm under which some members of industry
operate, it is not surprising that quality culture has become a topic of concern with regulators, since this opinion could embitter personnel
to compliance and QRM-related activities if the value is not understood.
This website uses cookies to ensure you get the best experience on our website. Learn more Got it!
/
 This poses a serious challenge
Gettomore
the enhancement of QRM effectiveness
pharma manufacturing insight withinour
industry, since the difference
FREE newsletter between quality and compliance
 sign me up
(or compliance and effectiveness) is fundamental to understanding the role that QRM plays in the pharmaceutical and biopharmaceutical
industries. ICH Q9 notes that “appropriate use of quality risk management can facilitate but does not obviate industry’s obligation to
comply with regulatory requirements”1 — a tenet that (in my opinion) should be understood to mean that QRM is a mechanism through
which compliance-related activities can be linked to product quality. In addition, QRM offers industry an opportunity to define what
quality looks like for its patients, products, and businesses, beyond the basic requirements associated with regulatory compliance. As a
result, the Venn diagram showing the relationship between quality and compliance through the lens of QRM looks more like that shown in
Figure 2.

Figure 2: Venn diagram of quality and compliance through the lens of QRM

In this model, compliance is wholly encompassed by quality, such that all compliance-related activities likewise add to the quality of the
product, and the circle representing quality has been enlarged based on the knowledge gained through QRM. This is the purpose of QRM;
in ensuring that compliance supports quality and quality is based on risk management principles and practices, the patient is adequately
supported.

A consequence of the misunderstanding of the role of quality risk management in protecting the patient has manifested with some
members of industry claiming to use a “conservative approach” in lieu of QRM. Discussions with many industry practitioners reveal a
misunderstanding that QRM need not be used in certain circumstances if a “conservative approach” is employed. One practitioner
summed up the intent of this term with regard to validation, indicating that he did not apply QRM to determine what and how much to
validate, because he validates “everything.” Seasoned QRM practitioners cringe at this statement, since it indicates a void of knowledge
about the purpose of risk management. For example, validating “everything” circumvents any drive to distinguish between critical and
noncritical elements, as identified in ICH Q8 and Q11, and therefore dilutes the amount of attention and resources spent assuring that
elements critical to the patient are under control — an approach that is certainly not conservative with regard to the patient. It appears
that some members of industry perceive QRM as a mechanism to do less, shrinking the amount of resources needed to perform an
activity, rather than reallocating available resources to focus more on things that are critical and less on things that are not.

Insufficient Regulatory Guidance, Combined With Overly Prescriptive Regulatory Requirements

Many industry practitioners consider the lack of concrete, actionable guidance in ICH Q9 (and regional regulations adopted from this
guideline) to be a challenge associated with QRM implementation. ICH Q9 outlines a framework for QRM and offers examples of how
QRM can be applied but does not provide tactical information regarding how QRM can be used to fulfill these purposes. This challenge
has been compounded by the eagerness of regulatory authorities to encourage industry to adopt QRM practices, publishing a flurry of
requirements to use QRM to accomplish certain deliverables without sufficient guidance on how this should be accomplished within a
QRM framework.

For example, a small group of delegates at a 2015 conference met after the day’s activities to discuss how their respective companies
planned to implement the (then) recently released EU guideline “on the formalised risk assessment for ascertaining the appropriate good
manufacturing practice for excipients for medicinal products for human use.” This document requires the use of a formal risk tool
(hazard analysis and critical control point [HACCP] is suggested) to determine the rigor of GMP to be applied by suppliers of excipients
and enforced by the drug manufacturer.2 The document lists 18 factors to be considered in the risk assessment, as follows:

1. “Transmissible spongiform encephalopathy

2. Potential for viral contamination
3. Potential for microbiological or endotoxin/pyrogen contamination
4. Potential, in general, for any impurity originating from the raw materials, e.g., aflatoxins or pesticides, or generated as part of the
process
This website uses andtocarried
cookies ensure over,
you gete.g.,
the residual solvents
best experience on and catalystsLearn more
our website. Got it!
5. Sterility assurance for excipients claimed to be sterile /
 6. Potential for any impurities
Get morecarried overmanufacturing
pharma from other processes,
insight in absence
with of dedicated
our FREE equipment
newsletter and/or facilities
 sign me up
7. Environmental control and storage/transportation conditions including cold chain management, if appropriate
8. Supply chain complexity
9. Stability of excipient
10. Packaging integrity evidence
11. The pharmaceutical form and use of the medicinal product containing the excipient
12. The function of the excipient in the formulation, e.g., lubricant in a tablet product or preservative material in a liquid formulation,
etc.
13. The proportion of the excipient in the medicinal product composition
14. Daily patient intake of the excipient
15. Any known quality defects/fraudulent adulterations, both globally and at a local company level related to the excipient
16. Whether the excipient is a composite
17. Known or potential impact on the critical quality attributes of the medicinal product
18. Other factors as identified or known to be relevant to assuring patient safety”2

The group of delegates lamented the challenges posed by this guideline: the poor fit between many items on the list of required
considerations and formal risk tools (including HACCP as the document had suggested), the number of individual risk assessments to be
performed (one each per excipient per supplier), and the short timeframe for required implementation (roughly one year from the date of
publication). Several delegates agreed that a tool such as risk ranking and filtering (RRF), also described in ICH Q9, would be a better fit
than HACCP or FMEA (failure modes and effects analysis); other delegates pointed out that RRF is typically considered a less formal tool
and would not meet the requirement that a “formalized” risk assessment be performed. One delegate expressed his wish that the
guideline had simply included the expected format, so he could spend his time executing the approach rather than trying to define it. The
informal meeting concluded with no harmonized agreement on the best path forward.

This anecdote is just one example of the struggles reported by QRM practitioners when trying to meet the detailed requirements of
regional regulatory bodies within a more fluid, loosely defined QRM framework as offered by ICH Q9. The gap between an overly
prescriptive “what” and an insufficiently prescriptive “how” has been identified as one of the obstacles preventing a more effective state of
QRM implementation to be reached.

Excessive Numbers Of Risk Assessments

As suggested above, many industry practitioners cite the sheer number of risk assessments that have been created as a challenge in
achieving a more mature state of QRM. Some note that regulators appear to expect a discrete risk assessment for every decision or GMP
direction in which their companies proceed. Using the above example regarding excipients, a firm with five products, each having four
excipients that can be purchased from a mere two qualified suppliers, would need to create and periodically review 40 risk assessments —
just for the relatively narrow risk question regarding the level of GMP required of its excipient suppliers. Indeed, this trend can be seen in
other areas as well; regulators expect risk assessments related to elemental impurities as described in ICH Q3D, Guideline for Elemental
Impurities3, risk assessments related to viral or other contamination such as those implied (among other sources) in ICH Q5A(R1), Viral
Safety Evaluation of Biotechnology Products Derived from Cell Lines of Human or Animal Origin4 and FDA Guidance Sterile Drug
Products Produced by Aseptic Processing – Good Manufacturing Practice5; risk assessments related to cross-contamination such as that
suggested by EMA’s Guideline for setting health based exposure limits for use in risk identification in the manufacture of different
medicinal products in shared facilities6; and so on.

These individual, narrowly construed risk assessments can quickly compound to the point of unmanageability. In December 2009,
Wallace Torres at Roche told The Gold Sheet that in response to the 2007 public health crisis associated with chemical contamination of
its popular HIV drug Viracept, “we performed more than 100,000 full FMEA analyses worldwide in the first year [following the initiation
of the company’s QRM program].”7 While at the time this was a triumph of QRM implementation, I have since seen many examples where
excessive numbers of risk assessments bogged down the QRM program and minimized value that can be extracted from the assessments,
as time spent administering the program is time not spent gaining knowledge. It is my opinion that instead of using a “shotgun approach”
to the creation of risk assessment, industry should focus on the creation of a strategic risk assessment library that minimizes the number
of unique risk assessments performed while maximizing the scope and breadth of a given risk assessment to include multiple
considerations of product quality, including those required by regulation.

Lack Of Resources To Focus On Risk Management

Many industry practitioners cite a lack of resources, including time and personnel, to focus on risk management as a potential obstacle in
the way of further progress. Perhaps this concern is more appropriately characterized as a lack of managers’ willingness to deploy
resources toward QRM, rather than a lack of availability of these resources. Formal risk management techniques such as FMEA often
consume between 40 and 80 hours of work for a team of six to 12 people, not including the resources needed to prepare for the assessment
or to track and implement risk control/mitigation actions. The challenge of resourcing is particularly acute at those companies with a
“fire-fighting” culture, where personnel are largely (perhaps habitually) focused on solving existing problems rather than identifying and
resolving potential risks. I suggest that management’s role in encouraging proactive behavior, including that required by effective QRM, is
to identify and reward those individuals engaged in quality risk prevention, rather than exclusively rewarding those who solve “crises.”

Fear As An Obstacle To Implementing QRM

This website uses cookies to ensure you get the best experience on our website. Learn more Got it!
/
 It is quite interesting that a Get
primal emotion
more pharmabemanufacturing
listed as an obstacle
insightpreventing the successful
with our FREE implementation
newsletter of QRM; however, this
 sign me up
concept has indeed revealed itself. Many industry practitioners report a general reluctance within their organizations to embrace the
transparency needed to perform QRM tasks, manifesting in several ways:

Reluctance to analyze products, processes, and systems in a way intended to identify weakness, stemming from the fear that an
urgent looming problem would be identified. Some practitioners liken this to a perception that “what we don’t know can’t hurt us,”
pointing out that in most cases, QRM results in more work through the identification of mitigation activities.
Uneasiness with the idea that, were weaknesses identified and documented, regulators would use the information to assign
inspection observations. Some compare risk assessments with internal audit reports, which must be completed as part of a larger
program but are generally not reviewed by inspectors so as to not discourage a firm from thoroughly identifying actual and potential
problems, believing that risk assessments should be treated similarly.
Discomfort with anticipated differences of opinion between the risk team that created a risk assessment and a third-party reader
(whether internal or external to the company). Because QRM is often a subjective endeavor, it ought to be difficult to proclaim its
outputs correct or incorrect without data to prove otherwise; however, some in industry indicate that their internal stakeholders
often disagree with the analysis performed and conclusions drawn, while others express concern that an inspection observation
might been received when an inspector believes that certain “rules” should have been applied to the scoring of individual risks where
the risk team had felt otherwise.

Dr. Janet Woodcock, head of the CDER at the FDA, has also expressed concerns regarding a culture of fear, noting:

“Let me just step back another step and say — and this would also disturb some people — that I really think the culture of regulation that
we had over the years, [produced] a kind of a fear relationship. And I am still told that industry is in a state of fear, many of them, of FDA.
That kind of a fear relationship is not going to grow a quality culture, because there is a fear of adverse consequences… That is antithetical
to the idea of a quality culture, where people own quality and say, ‘we can stand up to the FDA because we make a quality product and we
know it and we monitor it and we are proud of it. That is our quality culture.’”8

The reluctance to embrace QRM based on these fears is indicative of a lack of risk maturity and a struggling company culture. Leadership
within each company should strive to encourage such transparency and honest, open discussions regarding the identified vulnerabilities
and the actions that may be taken to minimize them.

The challenges described in this article are industrywide problems and should therefore have industrywide solutions. I encourage those in
industry who have successfully managed these challenges to share their experiences — speak at industry conferences, join QRM-related
interest groups, and publish your experiences for others to learn from. Industry, academia, and regulators alike should strive to overcome
these issues to enhance the effectiveness of QRM programs, and, most importantly, to deliver the highest quality to the patient, each and
every time.

References:

1. ICH. ICH Q9: Quality Risk Management. Jun 2005.

2. EU. Guideline 2015/C 95/02. On the formalised risk assessment for ascertaining the appropriate good manufacturing practice for
excipients for medicinal products for human use. March 19, 2015.
3. ICH. ICH Q3D: Guidelines for Elemental Impurities. Dec 2014.
4. ICH. ICH Q5A(R1): Viral Safety Evaluation of Biotechnology Products Derived from Cell Lines of Human or Animal Origin. Sep
1999.
5. FDA. Guideline for Industry: Sterile Drug Products Produced by Aseptic Processing – Good Manufacturing Practice. Sep 2004.
6. EMA. Guideline for setting health based exposure limits for use in risk identification in the manufacture of different medicinal
products in shared facilities. Nov 2014.
7. Cox, B. Roche Builds Quality Risk Management Program in Response to Viracept Crisis. The Gold Sheet. Dec 1, 2009.
8. International Pharmaceutical Quality (IPQ). Transcript of Dr. Janet Woodcock's speech on FDA's "Quality Revolution," given at the
April 2015 ISPE quality metrics meeting. [Online] May 2015. [Cited: October 29, 2017.] [Link]
content/uploads/2015/05/[Link].

About The Author:

Kelly Waldron is currently a senior consultant with ValSource and a member of the Pharmaceutical Regulatory Science
Team (PRST) at the Dublin Institute of Technology in Dublin, Ireland. She has particular expertise and a specialized
focus on the development and implementation of innovative approaches to quality risk management (QRM). Her
expertise also extends to various quality functions in the pharmaceutical, biopharmaceutical, and medical device
industries, including quality system design, quality strategy and planning, deviations/investigations, CAPA, change
management, audit and inspection programs and response, stability programs, and design control. In addition, Waldron
has authored numerous industry and academic papers on QRM. She has a BA in biology from Boston University, an MBA
in pharmaceutical management from Fairleigh Dickinson University, and a Ph.D. in pharmaceutical regulatory science (thesis in QRM)
from the Dublin Institute of Technology. She can be reached at kwaldron@[Link].

Comments (6)
Login

Sort by: Date Rating Last Activity

This website uses cookies to ensure you get the best experience on our website. Learn more Got it!
/
 Mark Witcher · 82 weeks ago Get more pharma manufacturing insight with our FREE newsletter 0 me up
 sign

Kelly;
I share your concern regarding the severe weaknesses of QRM methods, particularly with respect to how they are practiced in the
industry. FMEA and other risk matrix methods are flawed and frequently do not work. The wider risk community has known this for
years (references available: Hubbard, Cox, et. al.). After 40+ years in biotech, I have come to the conclusion product quality is a control
issue. Developing appropriate control systems is a superset of compliance and is the best route to product quality. Control systems are
developed using risk methods. After studying the issue, the approach I recommend is outlined in the following article:

Witcher MF. Analyzing and managing biopharmaceutical risks by building a system risk structure (SRS) for modeling the flow of threats
through a network of manufacturing processes. BioProcess J, 2017; 16. [Link]

I continue to work on the SRS approach and feel it is the best strategy for QRM. The approach starts with what should be a quick 3x5
card analysis that then expands to a level of complexity commensurate with the importance of the risk.

Thanks for the interesting articles. - Mark

Reply 1 reply · active 80 weeks ago

kwaldronQRM 1p · 80 weeks ago +1

Thanks for sharing your thoughts Mark, and also for referencing your own work in this space. Industry really needs folks working to
unravel the challenges of QRM, which has the potential to offer so many benefits!

Reply

Markus Multhauf · 81 weeks ago 0

Dear Kelly,
yes, there is a "lack of managers’ willingness to deploy resources toward QRM". As you wrote: "FMEA often consume between 40 and 80
hours of work for a team of six to 12 people". So, a typical FMEA costs 40hrs x12people x120Euro/hr = 57.600,-Euro (I did not take the
80!!)! Never seen a FMEA-doc with such a value-content! 99% of the FMEA-results are trivial and obvious. So, I clearly understand each
manager, who limits the resources to QRM (e.g. set the target to do the FMEA within 3hrs with 2 persons).
It's a problem with the “expensive, time-consuming process that adds little value...” [copy from 2005 ISPE White Paper Risk-based
qualification for the 21st century]. It's mostly a waste of money for regulatory reasons, not adding any safety or quality to our products.
If we would have a free choice, we would better decide to use these 56K Euro to buy better equipment or PAT.
It's high time to correct the regulation.

Greetings from Germany

Markus Multhauf

Reply 1 reply · active 80 weeks ago

kwaldronQRM 1p · 80 weeks ago +1

Thank you for offering this note Markus. I agree that many risk assessments do not offer the value that we in industry may hope--
however, my own experience indicates that this is more of a problem with how industry current executes QRM, rather than with QRM
itself. Done properly, the return on investment (cost savings, time savings, and also quality improvement leading to fewer deviations,
etc.) of well-done risk assessments is extremely positive. I am actually completing a risk assessment right now that will save US
$500K per year going forward, as compared to the ~US$200K expended to complete the assessment. The tangible benefits of QRM
are very real-- but to your point, only when it is done properly.

Reply

Anupsinh Gadhavi · 81 weeks ago 0

Thanks for Sharing,

Sir, What i personally feeling is, the QRM methods (ICH) i have referred is so complex, it is not so friendly to interpretative as well as not
easy to execute on ground floor, i mean to say it is not so practical . Sir we are a very small pharmaceutical APIs manufacturing unit in
INDIA, even though with very limited resources i want to apply QRM in my plant.
My plant operations comprise with many like, Dispensing / Weighing / charging / Analysis / RM Inward / Dispatch / Storage / Clean
room operations/ Hazardous material storage . I m very confused how to proceed for risk assessment for all this activity & sub activity.

REMARK: THIS IS MY TOTALLY PERSONAL EXPERIENCE , I MAY BE WRONG , PL GUIDE ME

Thanks
Anupsinh

Reply 1 reply · active 80 weeks ago

kwaldronQRM 1p · 80 weeks ago +1

Dear Anupsinh,

You are not wrong in your opinion-- many people share your frustration and confusion when starting in QRM. Not all risk tools are
complex; there are many simple ones that can help improve quality (see for example the two less-formal tools I discussed many years
ago here: [Link]/integration-less-formal-risk-as.... In fact, ICH Q9 acknowledged this by noting "the level of effort,
formality, and documentation [of QRM] should be commensurate with the level of risk." This means that using complex tools like
FMEA all the time is not a good idea. Less formal tools work better in certain situations. I always recommend that people have several
risk tools available o they can choose the right one for the situation.

The best advice I can give to those starting out in QRM is to have discussions that relate certain actions or issues to their
consequences to the patient. This "risk-based thinking" will take you very far and help you apply more complex or sophisticated QRM
approaches later on.

Good luck!
Kelly

Reply

Post a new comment

This website uses cookies to ensure you get the best experience on our website. Learn more Got it!
/
 Enter text right here!
Get more pharma manufacturing insight with our FREE newsletter  sign me up

Comment as a Guest, or login:

Name Email Website (optional)

Displayed next to your comments. Not displayed publicly. If you have a website, link to it here.

Subscribe to None Submit Comment

Newsletter Signup

Get the latest articles from Pharmaceutical Online

delivered to your inbox.

Email

I agree to the Terms and Privacy

Statement.

 SIGN ME UP

YOU MAY ALSO LIKE...

Quality Risk Management 101: ICH Q9 In Context
ICHQ9,Quality Risk Management, represents the first internationally recognized guideline specifically addressing QRM for the
pharmaceutical and biopharmaceutical industries, offeringan overview of...

Embracing the Quality Risk Management Process as a Means to a Strong Quality Culture
Using QRM gives a company the ability to maintain compliance while also identifying product issues that could be harmful to the consumers, some being
susceptible patients.

Quality Risk Management: Reduce Risk By Embracing It

Despite the resources available to help companies develop a QRM program, such as the ICH Q9, there are several challenges that commonly prevent a
successful implementation. Ghada Haddad, director in...

Quality Risk Management 101: A Review Of Required Reading For QRM Practitioners
Following the publication of ICH Q9, industry eagerly embraced the opportunity to share ideas and best practices related to QRM. This articlefocuses on
selected publications addressing general,...

Quality Risk Management 101: QRM And The Product Life Cycle
Quality risk management (QRM) is not a concept to be applied in a vacuum. Rather, it is a discipline that provides the most value when used throughout
the product life cycle.

Quality Risk Management 101: Risks Associated With Medicinal Products

Quality Risk Management 101: A Brief History Of Risk Management In The Regulation Of Medicinal Products

Quality Risk Management 101

Applying QRM To The Change Control Process

Managing Risks In The Development And Manufacture Of Potent Pharmaceuticals Products

Developing A Science-, Risk-, & Statistics-Based Approach To Cleaning Process Development & Validation

The Shirokizawa Matrix: Determining The Level Of Effort, Formality, & Documentation In Cleaning Validation

This website uses cookies to ensure you get the best experience on our website. Learn more Got it!
/
 Get more pharma manufacturing insight with our FREE newsletter  sign me up

Advertise Life Science Connect Editorial Learn More

Ad Specifications BioProcess Online Archived Newsletters About Us
Request Media Kit Biosimilar Development Article Reprints Contact Us
Cell & Gene Editorial Submission Guidelines Work For Us
Subscribe Clinical Leader Editorial Contributors
Drug Discovery
Newsletter
Laboratory Network Events
Life Science Leader Magazine
CMO Leadership Awards
Med Device Online
CRO Leadership Awards
Outsourced Pharma
Outsourced Pharma Events

Training
Life Science Training Institute

Copyright © 1996-2020 VertMarkets, Inc. All Rights Reserved. Terms of Use. Privacy Statement. Subscriber Request Form.

This website uses cookies to ensure you get the best experience on our website. Learn more Got it!
/