61
Annex 2
WHO guidelines on quality risk management
1. Introduction 62
1.1 Background and scope 62
1.2 Principles of quality risk management 64
2. Glossary 67
3. Quality risk management process 70
3.1 Initiating a QRM process 70
3.2 Personnel involved in QRM 70
3.3 Knowledge of the product and process 71
3.4 Risk assessment 71
3.5 Risk control 72
3.6 Risk review 73
3.7 Verification of QRM process and methodologies 74
3.8 Risk communication and documentation 75
4. QRM application for pharmaceuticals 76
4.1 Training and education 76
4.2 Responsibilities 76
4.3 QRM application during product development 77
4.4 QRM application during validation and qualification 78
4.5 QRM application during commercial manufacturing 79
4.5.1 QRM integration with key quality system elements 79
4.5.2 QRM application in product manufacturing operations 80
5. QRM considerations for medicines regulatory authorities 81
5.1 Introduction 81
5.2 QRM application to inspection strategy 82
5.2.1 Risk management in inspections 82
5.2.2 Inspection planning and conduct 82
5.2.3 Corrective action and preventive action review, and scheduling of
routine inspections
83
5.2.4 Complaint handling and investigation 83
5.3 Inspection of QRM at a manufacturing site 83
5.4 QRM applied to dossier review (assessment) 85
6. Risk management tools 87
References 91
62
WHO Technical Report Series No. 981, 2013
WHO Expert Committee on Specifications for Pharmaceutical Preparations Forty-seventh report
1. Introduction
1.1 Background and scope
In most countries compliance with good manufacturing practices (GMP)
(1, 2) (including validation), medicines regulatory activities and inspections,
together with supply chain controls throughout the product life-cycle, provide
good assurance that risks are largely controlled. However, where control is
less eective, patients may be put at risk through the production of medicines
of inadequate quality. e assessment of individual risks related to specic
products and starting materials and the recognition of hazards at specic stages
of production or distribution should permit regulatory authorities to improve
control of medicines by increasing the eectiveness of their activities within the
limits of the available resources. Quality risk management (QRM) is a process
that is relevant to all countries and should provide a rationale to understand risk
and mitigate it through appropriate and robust controls.
e aim of these guidelines is to assist the development and
implementation of eective QRM, covering activities such as research and
development, sourcing of materials, manufacturing, packaging, testing, storage
and distribution. In the past, hazard analysis and critical control point (HACCP)
methodology, traditionally a food safety management system but subsequently
applied to other industries, has been the basis of WHO risk management guidance
to the pharmaceutical industry (3).
More recently international guidance has emerged (2, 4–7) that is of
specic relevance to the pharmaceutical industry and which addresses the
full scope of pharmaceutical industry QRM more eectively than HACCP
principles, including how to structure regulatory lings using a risk-based
approach. Consequently, these WHO guidelines have been developed as an
update on WHO's advice to the pharmaceutical industry, taking account of this
new guidance.
To protect patients in terms of quality, safety and ecacy of medicines,
international medicines regulatory authorities (MRAs) are recommending
pharmaceutical manufacturers to adopt a risk-based approach to the life-cycle
of a pharmaceutical product. Some MRAs require the adoption of a risk-based
approach for specic areas in the life-cycle of a pharmaceutical product, e.g.
environmental monitoring in sterile products manufacture. e level of QRM
activity and the density of associated documentation will evolve as the product
progresses from early development through to routine production.
QRM is the overall and continuing process of appropriately managing
risks to product quality throughout the product's life-cycle in order to optimize
its benet–risk balance. It is a systematic process for the assessment, control,
communication and review of risks to the quality of the medicinal product. It can
be applied both proactively and retrospectively.
Annex 2
63
While the choice of the tools to support the QRM approach is optional
and may vary, the tools chosen need to be appropriate for the intended use.
In return for using this approach, there are potential opportunities
for both MRAs and pharmaceutical manufacturers (8) as summarized in the
following sections.
■ Quality risk management (QRM) principles can be applied to both
MRAs and pharmaceutical manufacturers:
– MRAs: systematic and structured planning of reviews and
inspections that are risk-based. e submission review and
inspection programmes can also operate in a coordinated and
synergistic manner.
– Manufacturers: design, development, manufacture and
distribution, i.e. the life-cycle of a pharmaceutical product. QRM
should be an integral element of the pharmaceutical quality
system (QS).
■ Science-based decision-making can be embedded into QRM
processes:
– MRAs: decisions regarding review, inspection or inspection
frequency should consider product risk and GMP compliance
of the manufacturer. e MRA accepts residual risks through
understanding the QRM decisions involved.
– Manufacturers: quality decisions and ling commitments can
be based on a science-based understanding of the process and
QRM (when using the quality by design approach, and other
approaches where appropriate). Its eective application should
oer manufacturers greater freedom to decide how to comply
with the principles of GMP and this, therefore, should encourage
innovation.
e control strategy for the process focuses on critical quality attributes
and critical process parameters.
■ Resources can be focused on risks to patients:
– MRAs: QRM can be used to determine the best allocation of
inspection resources, both in terms of product types and for
specic areas of focus for a given inspection. is enables the most
ecient and eective scrutiny of the most signicant health risks.
ose manufacturers with poor histories of GMP compliance can
also be more closely and frequently evaluated by on-site inspection
than those manufacturers with better records.
64
WHO Technical Report Series No. 981, 2013
WHO Expert Committee on Specifications for Pharmaceutical Preparations Forty-seventh report
– Manufacturers: evaluation of quality risk through science-based
decisions can be linked ultimately to protection of the patient by
ensuring the quality, safety and ecacy of the product. A corporate
culture is supported to produce cost-eective medicines, without
compromising quality, while maintaining the focus on the patient
as a primary stakeholder in all activities.
■ Restrictive and unnecessary practices can be avoided:
– MRAs: regulatory scrutiny should consider the level of risk to
patients. Improvement and innovation by manufacturers should
be encouraged.
– Manufacturers: instead of having systems designed to inhibit
change and minimize business risk, changes can be managed
within a company's quality management system. Innovation and
the adoption of the latest scientic advances in manufacturing and
technology are supported. Unnecessary testing can be eliminated,
for example, with real-time release testing.
■ Communication and transparency are facilitated:
– MRAs: facilitate dialogue with pharmaceutical manufacturers
and communicate clearly to the industry and the public how
the inspection programme may be adjusted based on the risk to
patients. Information-sharing between MRAs will contribute to a
better risk management approach globally.
– Manufacturers: matrix team approach, stakeholders are kept
informed through science-based decisions. is builds a culture
of trust and a “one-team” mindset with a focus on the product
and the patient.
ese guidelines will align with the general framework described in other
current international guidance on this subject.
1.2 Principles of quality risk management
It is not always appropriate nor always necessary to use a formal risk management
process (using recognized tools and/or internal procedures, e.g. standard
operating procedures (SOPs)). e use of an informal risk management process
(using empirical tools or internal procedures) can also be considered acceptable.
e two primary principles of QRM are that:
■ e evaluation of the risk to quality should be based on scientic
knowledge and ultimately linked to the protection of the patient.
Annex 2
65
■ e level of eort, formality and documentation of the QRM
process should be commensurate with the level of risk.
In addition to the two principles above, the following principles are also
part of the QRM methodology:
■ When applied, processes using QRM methodologies should be
dynamic, iterative and responsive to change.
■ e capability for continual improvement should be embedded in the
QRM process.
is guidance describes the WHO approach to QRM, using the concepts
described in ICH Q9 (6) and illustrated in Figure 1. e emphasis on each
component of the framework might dier from case to case but a robust process
will incorporate consideration of all the elements at a level of detail that is
commensurate with the specic risk.
Figure 1
Overview of a typical quality risk management process
Reproduced from reference 5: ICH Q9: Quality Risk Management.
66
WHO Technical Report Series No. 981, 2013
WHO Expert Committee on Specifications for Pharmaceutical Preparations Forty-seventh report
Decision points are not shown in the diagram above because decisions
can occur at any point in the process. e decision might be:
■ to return to the previous step and seek further information;
■ to adjust the risk models; or even
■ to terminate the risk management process based upon information
that supports such a decision.
e approach described in these guidelines may be used to:
■ systematically analyse products and processes to ensure that the best
scientic rationale is in place to improve the probability of success;
■ identify important knowledge gaps associated with processes that
need to be understood to properly identify risks;
■ provide the communication process that will best interface with all
relevant parties involved in the QRM activities;
■ facilitate the transfer of process knowledge and product development
history to ease product progression throughout its life-cycle and to
supplement already available knowledge about the product;
■ enable the pharmaceutical industry to adopt a risk-based approach
to development as described in regulatory guidance (4–6). e
QRM outputs will potentially serve as reference documents to
support product development and control strategy discussions in
regulatory lings.
Early in development, the purpose of the QRM process may be to
acquire sucient product and process knowledge to assess risks associated
with formulation development of the nished pharmaceutical product (FPP)
according to the quality target product prole (QTPP). In recognizing risks and
knowledge gaps, the QRM process plays a signicant role in proactively enabling
the prioritization and mitigation of risks. e objective is to develop the FPP
through maximizing product and process knowledge and risk mitigation.
As FPP development progresses, in addition to supporting that
development, the purpose of the QRM process is to determine and manage
risks to bioavailability, safety, ecacy and product quality. QRM in development
should dierentiate process parameters and quality attributes from critical process
parameters (CPPs) and critical quality attributes (CQAs), thereby contributing to
dening and rening the control strategy.
e long process of product development is inevitably complex and
requires the continual exchange of data, decisions and updates both internally
Annex 2
67
within companies and, where required, with external stakeholders, such as MRAs.
A crucial aspect of product development and QRM is the maintenance of an
eective and secure knowledge management and documentation system. Such
a system must facilitate transparent communication and the highlighting of key
issues to stakeholders and must also include a well-structured archive. Clearly,
the ability to organize diverse data and information eectively and then retrieve
it as required for updating and further evaluation, e.g. for the purposes of process
validation, would be hugely benecial.
Finally, it should be noted that QRM activities are focused on the product/
process development and product manufacturing, ultimately to ensure a robust,
safe and eective FPP.
2. Glossary
e denitions given below apply to the terms used in these guidelines. ey may
have dierent meanings in other contexts.
control strategy
A planned set of controls, derived from current product and process understanding
that assures process performance and product quality. e controls can include
parameters and attributes related to active pharmaceutical ingredients (APIs)
and nished pharmaceutical product (FPP) materials and components, facility
and equipment operating conditions, in-process controls, nished product
specications, and the associated methods and frequency of monitoring and
control.
critical quality attribute (CQA)
A physical, chemical, biological or microbiological property or characteristic that
should be within an appropriate limit, range, or distribution to ensure the desired
product quality.
failure mode
Dierent ways that a process or subprocess can fail to provide the anticipated
result.
failure mode, effects and criticality analysis (FMECA)
A systematic method of identifying and preventing product and process problems.
finished pharmaceutical product (FPP)
A nished dosage form of a pharmaceutical product that has undergone all stages
of manufacture, including packaging in its nal container and labelling.
68
WHO Technical Report Series No. 981, 2013
WHO Expert Committee on Specifications for Pharmaceutical Preparations Forty-seventh report
formal experimental design
A structured, organized method for determining the relationship between factors
aecting a process and the output of that process. Also known as “design of
experiments”.
occurrence
Probability of negative events within a xed time frame.
pharmaceutical product
Any material or product intended for human or veterinary use presented in its
nished dosage form or as a starting material for use in such a dosage form, that
is subject to control by pharmaceutical legislation in the exporting state and/or
the importing state.
pharmaceutical product target profile (PPTP)
A denition of the target properties of the FPP, including dosage form and
strength(s), route of administration and relevant drug release and pharmacokinetic
requirements.
planned risk assessment
An assessment that is conducted in advance of an activity, either before any work
is conducted or before further work is conducted. is enables quality to be built
into activities and risk to be reduced, e.g. design of high containment facilities for
manufacture of cytotoxic products.
process robustness
Ability of a process to tolerate variability of materials and changes of the process
and equipment without negative impact on quality.
qualification
e action of proving and documenting that any premises, systems and equipment
are properly installed and/or work correctly and lead to the expected results.
Qualication is oen a part (the initial stage) of validation, but the individual
qualication steps alone do not constitute process validation.
quality critical process parameter
A process parameter which could have an impact on the critical quality attribute.
quality risk management
A systematic process for the assessment, control communication, and review of
risks to the quality of the pharmaceutical product across the product life-cycle.
risk
Combination of the probability of occurrence of harm and severity of the harm.
Annex 2
69
risk analysis
e estimation of the risk associated with the identied hazards.
risk assessment
A systematic process of organizing information to support a risk decision to be
made within a risk management process. It consists of the identication of hazards
and the evaluation of risk associated with exposure to those hazards.
risk control
e sharing of information about risk and risk management between the decision-
maker and other stakeholders.
risk evaluation
e comparison of the estimated risk to given risk criteria using a quantitative
or qualitative scale to determine the signicance of the risk.
risk identification
e systematic use of information to identify potential sources of harm (hazards)
referring to the risk question or problem description.
risk priority number (RPN)
A numeric assessment of risk assigned to a process, or steps in a process, as part
of failure mode eects analysis (FMEA). Each failure mode gets a numeric score
that quanties likelihood of occurrence, likelihood of detection and severity
of impact. e product of these three scores is the RPN for that failure mode.
RPN= severity rating × occurrence rating × detection rating.
risk review
Review or monitoring of output or results of the risk management process
considering (if appropriate) new knowledge and experience about the risk.
stakeholder
Any individual, group or organization that can aect, be aected by, or perceive
itself to be aected by a risk. Primary stakeholders are the patient, health-care
professional, MRAs and the pharmaceutical industry.
unplanned risk assessment
An assessment that is conducted to assess the impact of a situation that has
already occurred, e.g. impact of a deviation from normal ways of working.
validation
e documented act of proving that any procedure, process, equipment, material,
activity or system actually leads to the expected results.
70
WHO Technical Report Series No. 981, 2013
WHO Expert Committee on Specifications for Pharmaceutical Preparations Forty-seventh report
verification
e application of methods, procedures, tests and other evaluations, in addition to
monitoring, to determine compliance with the quality risk management activities.
3. Quality risk management process
3.1 Initiating a QRM process
QRM activities should be performed using systematic processes designed to
coordinate, facilitate and improve science-based decision-making with respect
to risk. e possible steps to be taken in initiating and planning a QRM process
might include the following (5):
■ dene the problem and/or risk question, including pertinent
assumptions identifying the potential for risk;
■ assemble background information and/or data on the potential
hazard, harm or human health impact relevant to the risk assessment;
■ identify a leader and the necessary resources;
■ specify a timeline, the deliverables, and an appropriate level of
decision-making for the risk management process.
Internal SOPs should dene steps, stakeholders, roles and responsibilities
(governance and management responsibilities).
3.2 Personnel involved in QRM
e implementing party, i.e. the pharmaceutical manufacturer or regulatory
authority, should assure that personnel with appropriate product-specic
knowledge and expertise are available to ensure eective planning and
completion of QRM activities. is may be best accomplished by assembling a
multidisciplinary team according to the guidance provided in section 4.2.
e personnel appointed should be able to:
■ conduct a risk analysis;
■ identify and analyse potential risks;
■ evaluate risks and determine which ones should be controlled and
which ones can be accepted;
■ recommend and implement adequate risk control measures;
■ devise procedures for risk review, monitoring and verication;
■ consider the impact of risk ndings on related or similar products
and/or processes.
QRM activities should be dened and documented.
Annex 2
71
3.3 Knowledge of the product and process
QRM should be based on knowledge of the product or processes concerned,
according to the stage of the product life-cycle.
A ow diagram may be helpful, covering all operations and controls in
the process under evaluation. When applying QRM to a given operation, the
steps preceding and following that operation should also be considered. A block-
type diagram may be suciently descriptive. Amendments to the ow diagram
may be made where appropriate, and should be documented.
3.4 Risk assessment
When risk assessment is conducted, safety and ecacy need to be considered in
addition to the quality concerns.
During the assessment all the risks that may reasonably be expected to
occur when conducting the activity under evaluation should be listed. is is
usually done when the risk assessment is made for the rst time, i.e. initiated,
when there is a change or a concern and may also be applied to existing processes.
An analysis should be conducted to identify which risks it is essential to eliminate
or to reduce to acceptable levels.
A thorough risk assessment is required to ensure eective risk control.
Risk assessment should review the materials, operations, equipment, storage,
distribution and intended use of the product. Typically a list of the potential
risks (biological, chemical and physical) which may be introduced, increased or
controlled in each area should be drawn up. In the risk assessment the following
basic questions should be addressed:
■ What might go wrong?
■ What is the nature of possible risks?
■ What is the probability of their occurrence and how easy is it to
detect them?
■ What are the consequences (the severity)?
It should then be decided which of the potential risks should be addressed
by the QRM activities and what control measures, if any, should be taken for
each risk. If a risk has been identied at a step where control is necessary for
safety, and no control measure exists at that step or at any other, the product or
process should be modied at that step, or at an earlier or later stage, to include
such a control measure. More than one control measure may be required to
control a specic risk and more than one risk may be controlled by a specied
control measure.
Options for risk assessment methodologies are described in section 5.
72
WHO Technical Report Series No. 981, 2013
WHO Expert Committee on Specifications for Pharmaceutical Preparations Forty-seventh report
Risk assessment can be aided by the use of a decision-tree, which
facilitates a logical approach. e way that a decision-tree is used will depend
on the operation concerned, e.g. production, packaging, reprocessing, storage or
distribution. e best use of QRM tools is discussed further in section 5.
Normally, potential risks in relation to the following should be considered:
■ materials and ingredients;
■ physical characteristics and composition of the product;
■ processing procedures;
■ microbial limits, where applicable;
■ premises;
■ equipment;
■ packaging;
■ sanitation and hygiene;
■ personnel (human error);
■ utilities;
■ supply chain.
e output of a risk assessment is either a quantitative estimate of risk
(numeric probability) or a qualitative description of a range of risk (e.g. high/
medium/low) and may be related to a risk matrix (see section 5). e scoring
system and trigger points for mitigating action are subjective so the rationale for
score categorization should be dened in as much detail as possible. If the score
and trigger action are supported by factual evidence it should be more obvious
what mitigating action is required – the mitigating action is as important as the
score assigned. Professional judgement should be used in interpreting the factual
evidence but must be subject to justication.
Records of risk assessments should be maintained.
e expectation of QRM is to assess risks to the product quality and to
the patient and then manage these risks so that they are kept at an acceptable
level. It is appropriate for companies to assess their control systems so as to
implement the appropriate controls to ensure product quality and patient safety.
An important principle in QRM is to design risks out of the process or eliminate
such risks prospectively, whenever practical and feasible. Risk assessment and
mitigation to achieve cost savings, but which could be to the detriment of the
well-being of the patient, is an unacceptable practice (9).
3.5 Risk control
Risk control is a decision-making activity designed to reduce and/or accept risks.
It usually occurs aer risk assessment, and at a fundamental level its purpose is to
reduce the risk to an acceptable level.
Annex 2
73
During risk control activities the following key questions should be asked:
■ What can be done to reduce or eliminate risks?
■ What is the appropriate balance between benets, risks and resources?
■ Are new risks introduced as a result of the identied risks being
controlled?
Risk control can include:
■ not proceeding with the risky activity;
■ taking the risk;
■ removing the risk source;
■ changing the likelihood of the risk;
■ changing the consequences of the risk;
■ sharing the risk with another party (e.g. contractor);
■ retaining the risk by informed decision.
Risk control activities usually involve identifying controls and measures
which may reduce or control the risk associated with a failure mode or negative
event. Risk control activities can serve to determine critical process parameters
for certain controls, how they will be monitored, and the level of qualication
and validation, if any, which may be required for such controls.
If risk assessments are conducted and risk controls are employed they
should be documented. If the risk assessment is conducted for an ongoing activity
it should be subject to periodic review and the frequency of review should be
appropriate for the nature of the activity.
Based on the criticality or level of risk, specic corrective actions should
be developed to prevent recurrence of instances where there have been deviations
from established risk control measures, especially for high risks. ese actions
should ensure that the risk is brought under control as soon as possible in
compliance with the established deviation handling procedures.
Specic corrective actions should be developed in advance for each
identied risk, including what is to be done when a deviation occurs and who is
responsible for implementing the corrective actions. A record should be kept and
maintained of the actions taken.
3.6 Risk review
Appropriate systems should be in place to ensure that the output of the QRM
process is periodically monitored and reviewed, as appropriate, to assess new
information that may impact on the original QRM decision. Examples of such
74
WHO Technical Report Series No. 981, 2013
WHO Expert Committee on Specifications for Pharmaceutical Preparations Forty-seventh report
changes include changes to control systems, changes to equipment and processes,
changes in suppliers or contractors and organizational restructuring.
Monitoring is the scheduled measurement or observation of a specic risk
control measure relative to its acceptance limits. Monitoring should be recorded.
All records and documents associated with risk review should be signed
and dated by the person(s) carrying out the review and by a responsible ocial(s)
of the quality unit of the company.
3.7 Verification of QRM process and methodologies
Once in production, the QRM documentation can be integrated into the quality
system and used to provide input into the product process.
e established QRM process and methodologies need to be veried.
Verication and auditing methods, procedures and tests, including random
sampling and analysis, can be used to determine whether the QRM process is
working appropriately. e frequency of verication should be sucient to
conrm the proper functioning of the QRM process.
Verication activities include:
■ review of the QRM process and its records;
■ review of deviations and product dispositions (management control);
■ conrmation that identied risks are being kept under control.
Initial verication of the planned QRM activities is necessary to determine
whether they are scientically and technically sound, that all risks have been
identied and that, if the QRM activities are properly completed, the risks will be
eectively controlled.
Information reviewed to verify the QRM process should include:
■ expert advice and scientic studies;
■ in-plant observations, measurements and evaluations.
Subsequent verications should be performed and documented by a
QRM team or an independent expert, as needed. For example, verications may
be conducted when there is an unexplained system failure, when a signicant
change in product, process or packaging occurs or new risks are recognized.
Where possible, verication should include actions to conrm the ecacy of all
elements of the QRM activities.
In addition, a comprehensive review of the QRM process and specic
instances of QRM application by an independent third party may be useful.
is would include a technical evaluation of the risk analysis and each element
of the QRM process and its application as well as an on-site review of all ow
Annex 2
75
diagrams and appropriate records of the operation of the QRM activity. Such a
comprehensive verication is independent of other verication procedures and
should be performed to ensure that the QRM process is resulting in the control
of the risks. If the results of the comprehensive verication identify deciencies,
the QRM process should be modied as necessary.
Individuals doing verication should have appropriate technical expertise
to perform this function.
3.8 Risk communication and documentation
Communication of the QRM process should include key stakeholders. Engaging
the key stakeholders in both the data collection process for the risk assessment
and the decision-making for risk control will ensure their commitment and
support for the QRM. e output of the QRM process and associated risk
analysis justifying the approach taken should be documented and endorsed by
the organization’s quality unit and management. Additionally, this information
should be communicated to stakeholders to keep them informed and to ensure
their support.
ere should be a report for every risk assessment, but the level of eort,
formality and documentation necessary will be commensurate with the level of
risk (2).
Regarding conclusions of a risk assessment, the mitigation controls
should minimize the likelihood of risk to patient safety to an acceptable level of
assurance, on the understanding that no risk whatsoever is unlikely in reality.
e degree of risk tolerated very much depends on the circumstances, the
proximity to the patient and other controls that might follow in response to the
process being assessed before the product reaches the patient (2). It is expected
that risk mitigation plans will be developed and implemented wherever any
risk to patient safety is posed. Companies should take the holistic view and be
mindful that critical issues oen arise where multiple failures in systems occur
together, so mitigation plans should be suciently robust to cover this scenario.
Inspectors will assess whether risk assessments underrate the likelihood of
occurrence and the consequences of overrating detection such that the patient
risk is underestimated. e factual evidence behind statements should be robust
to challenge by inspectors.
All risk assessments performed by an organization should be documented.
e documentation should list and track all key risks as perceived by the
organization and summarize how the risks have been mitigated. ere should
be a clear reference to risk assessments and a list of risk assessments conducted
should be maintained. A management process should be in place to review QRM
– this may be incorporated into the quality management review process.
76
WHO Technical Report Series No. 981, 2013
WHO Expert Committee on Specifications for Pharmaceutical Preparations Forty-seventh report
4. QRM application for pharmaceuticals
4.1 Training and education
Training of relevant personnel in industry, MRAs and universities in QRM
principles and applications is essential for its eective implementation. Industry
employees should understand what QRM is, possess the skills necessary to
apply it properly, and have access to appropriate resources to enable the eective
practice of the QRM principles.
In developing the training programme to support QRM activities,
working instructions and procedures should be drawn up which clarify the
strategy and dene the tasks of all personnel involved in these activities. Specic
training should be provided as required to enhance awareness. Sta with the
responsibility for managing and reviewing risks should receive formal training
in the relevant procedures.
Cooperation between producers, traders and responsible authorities is
vital. Opportunities should be provided for the joint training of industrial sta
and MRAs to encourage and maintain a continuous dialogue and create a climate
of understanding in the practical application of QRM.
e success of QRM depends on the education and training of
management and employees to understand the importance of QRM in producing
and supplying safe pharmaceuticals.
4.2 Responsibilities
Successful application of QRM is dependent on a clear understanding of
responsibilities by all personnel involved in the QRM activities. It is recommended
that a cross-functional matrix of assigned responsibilities and accountabilities is
drawn up and shared with all relevant personnel.
e pharmaceutical manufacturer should ensure that appropriate
knowledge and expertise are available for the eective planning and completion
of QRM activities. QRM activities are usually, but not always, undertaken by a
matrix of interdisciplinary teams. When teams are formed they should include
experts from the appropriate areas (e.g. quality unit, product development,
engineering, regulatory aairs, production operations, statistics, clinical, and
others, such as sales, marketing or legal, as applicable), in addition to individuals
who are knowledgeable about the QRM process.
In this respect it is acceptable for external consultants to participate in the
QRM matrix team where they can provide specic expertise or knowledge. eir
role should be justiable and clearly dened and the resultant accountability
must be understood. A technical agreement or other equivalent document with
the consultant may be appropriate where a GMP responsibility is assumed.
Annex 2
77
Similarly, contract sta may become involved in leading or participating
in risk assessments, e.g. a contract authorized person. e extent of their
involvement and responsibility and accountability must be documented in
a technical agreement or other equivalent document between the individual
concerned and the pharmaceutical company. Regarding the authorized person
it is important that a company’s internal procedures are clear on where the
responsibility lies for nal approval of risk acceptance documents.
Eective matrix team leadership is required to take responsibility for
coordinating QRM across various functions and departments of the organization
and to ensure that the QRM activities are adequately dened, planned, resourced,
deployed and reviewed. e leader and team will need to identify critical
resources required to implement the QRM activities, and also specify a timeline,
deliverables and appropriate levels of decision-making for the QRM process.
4.3 QRM application during product development
e application of QRM procedures evolves through the various stages in the
development of a product.
e rst QRM exercise should be performed once the QTPP is dened
and preformulation work on the candidate medicine is complete. At this stage of a
project there may be signicant gaps in knowledge. erefore, it will be important
to apply risk tools that are appropriate for such a situation. ese might include:
■ cause and eect diagrams (also known as Ishikawa or Fishbone
diagrams);
■ owcharts (e.g. input-process-output (IPO));
■ decision-trees;
■ fault-tree analysis;
■ relationship matrices.
As the product progresses to later stage of development, a more detailed
analysis of the risks associated with both the active pharmaceutical ingredient
(API) and the FPP should be considered. Risks would cover concerns associated
with stability, bioavailability and patient safety including any challenges to these
areas resulting from the manufacturing process (including, for example, API
form conversion under certain conditions of processing).
As product knowledge advances, more detailed QRM exercises can be
considered, concentrating on areas considered to present higher priority risk.
As the product's critical quality attributes (CQAs) become dened, the potential
risks arising from each input material (API, excipients, any device or pack
components) and each secondary product unit operation can be investigated.
78
WHO Technical Report Series No. 981, 2013
WHO Expert Committee on Specifications for Pharmaceutical Preparations Forty-seventh report
Eventually, for the developed FPP, the increasingly comprehensive risk
assessment will support a thorough understanding of the product and will enable
all key variables to be identied, understood and controlled.
4.4 QRM application during validation and qualification
In keeping with the principles of QRM, these guidelines recommend that
process validation embraces the product life-cycle concept already mentioned.
Accordingly, process validation activities should involve the generation and
evaluation of data throughout the process, from development to full-scale
production, which will provide a science-based assurance of consistent delivery
of quality product in the production operation (9–10).
It is important to emphasize that the building of scientic assurance
begins early in development. It is obtained through rational design of experiments
and robust evaluation of data during product and process development through
to the commercial production phase, by which time the API and FPP CQAs are
well understood and controlled. In this scenario, validation or (perhaps more
appropriately termed) conformance batches serve to reinforce the science- or
risk-based decisions that have been made as product development has advanced
and should demonstrate good control of all critical sources of variability that have
been identied. Any unplanned variations within a batch or between batches
should be evaluated employing suitable statistical tools, e.g. trend analysis, to
check on process control.
A potential advantage of this approach is that there can be exibility in
the number of validation or conformance batches required for regulatory scrutiny
prior to approval. e traditional number of batches required for validation has
been three but, with QRM embedded in a product's development process, the
number of conformance batches needed depends on the depth of knowledge
about the process. For very low-volume products, e.g. orphan drugs, this may
preclude the need to manufacture multiple batches. It would be benecial for
decisions of this nature regarding conformance batches to have an eective
company–MRA dialogue to agree on requirements for a regulatory submission.
When applicable, the principles of QRM should also be applied for
qualication activities.
QRM principles can be used to determine the scope of qualication. ey
can also be used to determine the optimal schedule for maintenance, monitoring,
calibration and requalication.
Manufacturers should have sucient knowledge of the process and
product to ensure that by the time the product is commercialized, processes are
optimized and risks are minimized.
Annex 2
79
4.5 QRM application during commercial manufacturing
In general, implementing QRM should not obviate a manufacturer’s obligation
to comply with regulatory expectations (e.g. regulatory requirements, regulatory
lings and inspection commitments). All QRM activities should be structured
in a way that allows responsibility for risk assessment and actions at appropriate
levels of the hierarchy within the organization. Special focus can be put on the risk
assessment and risk control during the life-cycle of a product, and may include:
■ product quality risks;
■ adverse impact on patient health resulting from product quality
defects;
■ interruption of product supply to patients;
■ GMP and regulatory compliance risks;
■ multisite risks;
■ multiproduct risks;
■ new facility and changes to existing facility, e.g. start-ups, new
commercial manufacturing processes, technology transfers and
product discontinuation.
Aer completion of the risk assessment and risk control activities, the
outcomes should be summarized and appropriately communicated. e results
may be documented in a new or existing report or they may be included as
part of another document approved by appropriate decision-makers (e.g. site
or functional management, system owner, or quality unit). A risk review is
important if new risks or changes to existing risk levels are identied as a result
of planned or unplanned events such as routine operation, changes, complaints,
product returns, discrepancies or deviations, data monitoring, trends, inspections
or audits, or changes in regulatory environment. Risk review may also include
evaluation of, for example:
■ eectiveness of risk control activities and actions;
■ changes in observed risk levels or existing controls.
In principal, areas of focus when implementing QRM in commercial
manufacturing include a system focus, a process focus and a product focus.
4.5.1 QRM integration with key quality system elements
Eective QRM can facilitate the decision on “What to do?” and, therefore,
support better and more informed decisions. QRM should be integrated into
existing quality system elements and related business processes and documented
appropriately.
80
WHO Technical Report Series No. 981, 2013
WHO Expert Committee on Specifications for Pharmaceutical Preparations Forty-seventh report
Accordingly, the use of QRM can be benecial across a broad spectrum
of operations, e.g.:
■ integrated quality management:
– documentation
– training and education
– quality defects
– auditing and inspection
– change management and change control (includes equipment,
facilities, utilities, control and IT systems)
– continual improvement and corrective and preventive actions
(CAPA);
■ facilities, equipment and utilities:
– design
– qualication
– maintenance and decommissioning of facility or equipment
– hygiene aspects
– cleaning of equipment and environmental control
– calibration and preventive maintenance
– computer systems and computer-controlled equipment;
■ supplier, materials and contract service management:
– assessment and evaluation of suppliers and contract manufacturers
– starting material
– use of materials
–storage
– logistics and distribution conditions;
■ technology transfer:
– from development to manufacturing
– during commercial manufacturing between sites
– from commercial manufacturing to product discontinuation.
4.5.2 QRM application in product manufacturing operations
Eective QRM can facilitate the “How to do it?” and, therefore, ensure that the
products will meet acceptable standards for safety, quality, and compliance.
Annex 2
81
Among others, QRM methodology can support the following actions to
assess and control quality risks:
■ production:
– manufacturing process risks
– validation
– in-process sampling and testing controls
– production planning
– deviation and investigation management
– change management;
■ laboratory control and stability studies:
– out-of-specication results
– retest period and expiry date
– method transfers;
■ packaging and labelling:
– design of packages
– selection of container-closure system
– label controls;
■ storage, transport and distribution:
– e.g. cold chain.
5. QRM considerations for medicines
regulatory authorities
5.1 Introduction
A key principle of these guidelines is that all MRAs, manufacturing sites in
developing countries and API manufacturers should demonstrate, wherever
appropriate, application of QRM throughout the product life-cycle for
development and manufacturing facilities. Inspectors will review this QRM
system as part of the quality systems section of the inspection (along with
complaints, recalls, deviations, product quality reviews and others).
Equally, it is recommended that QRM be applied by the MRAs (for
examples see (2, 8)) themselves (reviewers and inspectorates) as there are clear
benets of a QRM-based review and inspection plan. For example, inspectors
can allocate time and resources commensurate with the perceived signicance of
82
WHO Technical Report Series No. 981, 2013
WHO Expert Committee on Specifications for Pharmaceutical Preparations Forty-seventh report
risk in any given situation and can be pragmatic regarding the level of scrutiny
and degree of formality required.
5.2 QRM application to inspection strategy
5.2.1 Risk management in inspections
e inspection section or unit of an MRA should operate within a written,
implemented quality management system (11). SOPs should be followed for
activities including (but not limited to) inspection planning, review of corrective
and preventive actions aer inspections and complaint handling and investigation.
Where appropriate, the procedures and activities during inspection should be in
line with the principles of QRM.
e unit should have a risk management plan that describes the
philosophy, approach, procedures and implementation of risk management. e
risk management plan should be reviewed and updated on a continuous basis, or
at least annually, and should cover all types of inspections (including GMP, good
clinical practices (GCP), good laboratory practices (GLP)) and other activities.
Appropriate risk assessment tools should be used in the process, and
the risk assessment for a site to be inspected should be documented on a risk
assessment worksheet. Records should be maintained.
A metric system should be used for risk ratings, e.g. on a scale from 1 to 3.
5.2.2 Inspection planning and conduct
e frequency and scope of inspections should be determined based on risk
assessment that covers product risk and patient risk.
Risk rating should normally be done only for sites that have been
previously inspected. e risk assessment worksheet should be completed aer
every inspection. Inspection of a site that has not been inspected previously
may be waived only in cases where a recognition procedure exists between
regulatory inspection units, and where, in addition, appropriate evidence of GXP
compliance is available which indicates that there is no risk or an acceptably low
risk to products and patients.
Various factors should be considered in the risk assessment exercise, and
these factors may be dierent for the dierent types of GXP inspections. Risk
factors to be considered depend on the type of inspection, and may include:
■ outcome of inspection by another regulatory authority;
■ outcome of the previous inspection;
■ complexity of the site (e.g. buildings, utilities);
■ complexity of the product (e.g. sterile, non-sterile);
■ type of product (e.g. biological, low-dose);
Annex 2
83
■ complaints and recalls;
■ signicance of changes (e.g. equipment, key personnel);
■ results of product testing;
■ risk to the patient;
■ complex route of synthesis (API);
■ polymorphism (API);
■ biopharmaceutical classication of the product;
■ innovative or emerging technology.
e number of inspectors and number of days required for the inspection,
as well as the scope of the inspection, should be determined based on the risk
rating of the site inspection.
Inspection reports should contain ndings and observations. Departures
from GXP should be classied where appropriate, as “critical”, “major” or “minor”.
e unit should have an SOP that describes the classication process.
Classication should be based on risk assessment. e level of risk assigned
should be in accordance with the nature of the observation as well as the number
of occurrences.
5.2.3 Corrective action and preventive action review,
and scheduling of routine inspections
CAPA should be requested from a site, following an inspection. e CAPAs
should address the observations included in an inspection report. Based on the
outcome of the inspection and the acceptability of the CAPA, the risk rating of
the site should be reviewed and recorded.
Inspection frequency should be dened based on the risk rating. For
example, the frequency can be dened as every 6, 12, 18 or 24 months. (Note: e
maximum time interval should be no more than every 36 months.)
5.2.4 Complaint handling and investigation
Handling and investigation of quality complaints should be done in accordance
with a written SOP. e scope and depth of the investigation (including whether a
desk review or on-site inspection will be done) should be based on risk assessment.
5.3 Inspection of QRM at a manufacturing site
Note: During inspections, inspectors should assess whether a manufacturer
has appropriate skills and scientic knowledge, as well as product and process
knowledge, for the QRM procedure being inspected. is is also relevant where a
company has made use of contracted parties.
84
WHO Technical Report Series No. 981, 2013
WHO Expert Committee on Specifications for Pharmaceutical Preparations Forty-seventh report
e company's QRM procedure should be appropriately detailed and
should be integrated into the company’s quality management system. It should
cover at least the following areas:
■ It should specify the general approach to both planned and unplanned
risk assessment, including scope, responsibilities, controls, approvals,
management systems, applicability and exclusions.
■ Personnel should have appropriate qualications, experience and
training. eir responsibilities with regard to QRM should be clearly
dened.
■ Senior management should be involved in the identication and
implementation of QRM principles within the company.
■ e risk management procedure(s) for each area of application
should be clearly dened.
■ Quality assurance principles should be applied to QRM-related
documentation, e.g. review, approval, implementation and archiving.
QRM policies and procedures should be clear and the workow should
be systematic and conducted in a logical order.
■ e procedure for risk management should be implemented.
■ Manufacturers should identify signicant risks and consider all the
relevant data from reliable sources.
■ e level of eort and resources used in risk assessment should be
appropriate to the importance of the identied problem.
■ Critical issues should be addressed with appropriate urgency and
formality.
■ ere should be a logical selection of tools for risk assessment.
■ Risk acceptance criteria should be appropriate.
■ Risk assessments should not underrate the severity, nor overrate
detection of occurrences resulting in underestimating patient risk.
■ e risk acceptance criteria should be appropriate for the specic
situation in question.
■ Risk controls should be eective.
■ e company should have a review programme to measure the
eectiveness of the measures taken.
■ Risk-based decision(s) should be science-based and concordant with
the predened acceptance criteria.
Annex 2
85
All documentation related to the QRM activities should be completed
within a reasonable period and should be accessible. Risk assessments performed
should be reviewed when appropriate, and additional controls implemented
when required.
Personnel should be trained and assessed in the principles of QRM.
Where appropriate, a team of members of personnel should participate in the
QRM processes.
5.4 QRM applied to dossier review (assessment)
e assessment processes of national medicines regulatory authorities (NMRAs)
rely on QRM principles in the management of resources (time and assessors), as
well as in the management of product-related risk factors. Ecient management
of resources minimizes the risk that limited resources are not used to their best
eect, and ultimately ensures that important products are made available in a
timely manner. Key factors to be considered include the prioritization of dossiers,
the screening process, identication of the specic risk factors inherent to a given
dossier or dosage form, and allocation of resources to the various sections of
a dossier for a given product. In addition, product-related risk factors must be
managed throughout the life-cycle of the product, for example, through eective
communication between assessors and inspectors, and by establishing systems
for dealing with the products aer approval.
e allocation of priority to dossiers should take into account the
therapeutic needs of the regional population (e.g. disease occurrence, the need
for paediatric formulations, combination products, or experience with innovative
or emerging technology) and the availability of medicines on the market.
Prioritization should be a dynamic process to enable it to accommodate emerging
issues such as pandemics. Other considerations related to prioritization based on
medical need may include xed-dose combinations versus single-ingredient or
co-packaged products, extended release products versus products administered
as two or three daily doses, second-line versus rst-line products, exible dosage
forms such as dispersible tablets and variable dose products such as oral liquids.
e screening process examines the completeness of a dossier. Screening
ensures that only those dossiers that meet minimum standards for completeness
can enter into the full assessment process. Insucient screening processes allow
lower quality dossiers to be accepted for review, thus signicantly increasing
assessment time.
Identication of dossier-related and product-related risk factors allows
for the allocation of appropriate resources to specic dossiers. Possible risk
factors include: the experience and track record of the manufacturer, narrow
therapeutic range products, sterile versus non-sterile APIs and products;
86
WHO Technical Report Series No. 981, 2013
WHO Expert Committee on Specifications for Pharmaceutical Preparations Forty-seventh report
API-related considerations such as use of semi-synthetic and fermentation
products, complex routes of synthesis, polymorphism, isomerism and potential
genotoxic impurities; and product-related considerations such as the use of
novel excipients, the complexity of the formulation, single-ingredient versus
xed-dose combinations, and special delivery systems (e.g. modied release,
transdermal products, and inhalation products). Once risk factors have been
identied, resources should be allocated to minimize risk. For example, assessors
with expertise related to the product-related risk identied should be assigned to
assess the dossier whenever possible. When resources allow, the assessors may
be organized according to specialization, assigning assessors to various product
categories (e.g. generic products, sterile products, solid oral dosage forms, or
special delivery systems). is can facilitate the development of expertise in
key areas and promote consistency of review, as well as ensuring that products
requiring specialized knowledge are identied and assessed by those with the
appropriate expertise. Where a high level of risk is identied for a dossier, the
more experienced assessors need at least to be available on a consultation basis.
e risk level associated with a dossier may change during the course
of assessment. For example, rejection of the bioequivalence study will result in
additional time required to conduct and assess additional studies and associated
additional quality information. In such a scenario the risk relates both to the use
of additional resources and to an increased risk that the overall product quality
may be poor.
Allocation of resources to various aspects or sections of the dossier is an
important QRM consideration, in order to ensure that the resources used are
commensurate with the risk level. An understanding of the relative criticality of
dossier sections or aspects is necessary for ecient use of resources. All aspects of
the dossier are important to achieve overall quality, safety and ecacy; however
some areas are inherently more critical from a risk perspective and warrant
more attention in the assessment process. Examples include the clinical reviews,
bioavailability reviews, API synthesis, specications and stability studies, FPP
manufacturing details, pharmaceutical development studies including biowaiver
justication, process validation, specications and stability studies. An example
applicable to most simple solid oral products is that more time should be allocated
to the review of manufacturing steps prior to packaging than to reviewing the
packaging process.
During the assessment process there should be a standard procedure
for communicating to the inspectors those issues identied which may require
consideration during inspection. Aer approval of a product, QRM principles
should be applied to evaluate the impact of proposed variations or changes. Clear
guidelines that outline possible post-approval changes and assign an associated
risk level are an eective means to achieve this.
Annex 2
87
6. Risk management tools
A variety of tools can be used for the purposes of QRM, either alone or in
combination. It is important to note that no single tool or combination of tools
is applicable to every situation in which a QRM procedure is used. Examples
of tools are listed in regulatory guidance (6, 8); neither list is exhaustive. e
important criterion for acceptability is that the tool or tools are used eectively to
support the key attributes of a good risk assessment.
e Product Quality Research Institute (PQRI) Manufacturing Technology
Committee (MTC) has produced a summary (9) of common risk management
principles and best practices, several working tools to foster consistency in
the use of ICH Q9 (5) in day-to-day risk management decision-making, and a
series of examples of risk management applications currently in use by major
pharmaceutical rms. ey have also produced very helpful risk tool training
modules for risk ranking and ltering, failure modes eects analysis (FMEA)
(12–15), hazard operability analysis (HAZOP) (16) and HACCP (3).
One aspect worth highlighting is the development of a risk matrix to
facilitate categorization of risks identied during the risk assessment phase. In
order to prioritize a risk, it is essential to agree upon its signicance. e risk
associated with any situation or event can be represented as the impact of that
event multiplied by the probability of its occurrence; in other words: how likely is
it to happen? and how severe would it be if it did happen? Impact and probability
can each be classied, e.g. into 5 levels (1–5) or with a weighting towards the
higher probability and impact ratings (e.g. 1, 3, 5, 7, 10, etc.), so that a grid or
matrix can be constructed (Table 1).
Table 1
An example of a probability versus impact matrix
Impact
Probability Negligible Marginal Moderate Critical Catastrophic
Almost certain 5 10 15 20 25
Likely 4 8 12 16 20
Possible 3 6 9 12 15
Unlikely 2 4 6 8 10
Rare 1 2 3 4 5
88
WHO Technical Report Series No. 981, 2013
WHO Expert Committee on Specifications for Pharmaceutical Preparations Forty-seventh report
e shading in the table represents an example of how the risk values
(sometimes called composite risk indices or risk index values) can be assigned a
high, medium or low status. e denition for each status should be predetermined
in the QRM process aer consideration of the specic consequences for the
process undergoing risk assessment. ese consequences can be split according
to the probability and impact scores, as exemplied in Table 2.
Table 2
Example of a consequences table for probability and impact
Score Probability Example Score Impact Consequence
1 Rare t4FFOFWFSZ
10–30 years
1 Negligible t/PSFHVMBUPSZJTTVF
t/PFõFDUPOBOEOPU
noticeable by patient
2 Unlikely t 4FFOFWFSZ
5–10 years
2 Marginal t.BZSFRVJSF.3"
notification
t%FDJTJPOUPSFMFBTF
product not
compromised
3 Possible t4FFOFWFSZ
1–5 years
3 Moderate t.3"JOTQFDUJPO
may identify a
major concern but
EFmDJFODZ
RVJUF
easily resolved
t-JNJU
FE
QSPEVD
U
recall possible
4 Likely t4FFOUP
occur more
than once a
year
4 Critical t.3"JOTQFDUJPONBZ
conclude serious
non-compliance
t-JLFMZQSPEVDUSFDBMM
from one or more
markets
5 Almost
certain
t4FFOTFWFSBM
times a year
5 Catastrophic t&OGPSDFNFOUBDUJPO
by MRA such as
consent decree,
product seizure
t(MPCBMQSPEVDUSFDBMM
MRA, Medicines regulatory authority.
Source: Based on reference 9. This table has been amended, but was originally produced within the
context of the Product Quality Research Institute (PQRI), 2107 Wilson Blvd, Suite 700, Arlington, Virginia
64"XFCTJUFIUUQXXXQRSJPSHJOEFYBTQ123*IBTLJOEMZBHSFFEUPUIFVTFPGJUT
material.
Annex 2
89
is table is a very basic example and would need to be customized for
the specic process in question to enable a better and more practical denition of
the consequence categories. It should be cautioned that the value of a risk matrix
relies very heavily upon input information and should only be used by sta with
a good understanding of the embedded judgements and, as such, the resolution
of the low, medium or high categorization.
As a summary of the common, well-recognized QRM tool options
available for the purposes of these guidelines, Table 3 has been based on the
one from the Product Quality Research Institute Manufacturing Technology
Committee (PQRI-MTC) report (9). e list is not comprehensive but it does
include some of the more frequently used approaches.
Table 3
Examples of common risk management tools
Risk management tool Description, attributes Potential applications
Tools
%JBHSBNBOBMZTJT
t Flowcharts
t Check sheets
t Process mapping
t$BVTFFõFDUEJBHSBNT
t4JNQMFUFDIOJRVFTUIBU
are commonly used to
gather and organize
data, structure risk
management processes
and facilitate decision-
making
t Compilation of
observations, trends or
other empirical information
to support a variety of
less complex deviations,
complaints, defaults or
other circumstances
Risk ranking and
filtering
t Method to compare and
rank risks
t Typically involves
evaluation of multiple
EJWFSTFRVBOUJUBUJWFBOE
RVBMJUBUJWFGBDUPSTGPSFBDI
risk, and weighting factors
and risk score
t Prioritizing operating
areas or sites for audit or
assessment
t Useful for situations when
the risks and underlying
DPOTFRVFODFTBSFEJWFSTF
and difficult to compare
using a single tool
Fault-tree analysis t Method used to identify all
root causes of an assumed
failure or problem
t Used to evaluate system
or subsystem failures one
at a time, but can combine
multiple causes of failure
by identifying causal chains
t Relies heavily on full
process understanding to
identify causal factors
t Investigate product
complaints
t&WBMVBUFEFWJBUJPOT
continues
90
WHO Technical Report Series No. 981, 2013
WHO Expert Committee on Specifications for Pharmaceutical Preparations Forty-seventh report
Risk management tool Description, attributes Potential applications
Tools
Hazard operability
analysis (HAZOP)
tTool assumes that risk
events are caused by
deviations from the design
and operating intentions
tUses a systematic
UFDIOJRVFUPIFMQJEFOUJGZ
potential deviations from
normal use or design
intentions
tAccess manufacturing
processes, suppliers,
GBDJMJUJFTBOEFRVJQNFOU
tCommonly used to
evaluate process safety
hazards
Hazard analysis and
critical control point
(HACCP)
tIdentify and implement
process controls that
consistently and
FõFDUJWFMZQSFWFOUIB[BSE
conditions from occurring
tBottom-up approach that
considers how to prevent
hazards from occurring
and/or propagating
t&NQIBTJ[FTTUSFOHUIPG
preventive controls rather
than ability to detect
tBetter for preventive
applications than reactive
tValuable precursor or
complement to process
validation
tAssessment of the
efficacy of critical control
points and the ability to
consistently execute them
for any process
'BJMVSFNPEFTFõFDUT
BOBMZTJT'.&"
tAssumes comprehensive
understanding of the
process and that CPPs
have been defined prior to
initiating the assessment.
Tool ensures that CPPs will
be met.
tAssesses potential failure
modes for processes, and
UIFQSPCBCMFFõFDUPO
outcomes and/or product
performance
tOnce failure modes are
known, risk reduction
actions can be applied to
eliminate, reduce or control
potential failures
t&WBMVBUFFRVJQNFOU
and facilities; analyse a
manufacturing process
to identify high risk steps
and/or critical parameters
Table 3 continued
continues
Annex 2
91
Risk management tool Description, attributes Potential applications
Tools
'BJMVSFNPEFTFõFDUT
BOBMZTJT'.&"
tHighly dependent upon
strong understanding of
product, process and/or
facility under evaluation
tOutput is a relative “risk
score” for each failure
mode
Source: Based on reference 9. This table has been amended, but was originally produced within the
context of the Product Quality Research Institute (PQRI), 2107 Wilson Blvd, Suite 700, Arlington, Virginia
64"XFCTJUFIUUQXXXQRSJPSHJOEFYBTQ123*IBTLJOEMZBHSFFEUPUIFVTFPGJUT
material.
References
1. Quality assurance of pharmaceuticals. A compendium of guidelines and related materials. Vol. 2, 2nd
updated ed. Good manufacturing practices and inspection. Geneva, World Health Organization,
2007; Quality assurance of pharmaceuticals. A compendium of guidelines and related materials.
World Health Organization, 2011 (CD-ROM) (http://www.who.int/medicines/areas/quality_safety/
quality_assurance/guidelines/en/index.html).
2. EudraLex The rules governing medicinal products in the European Union, Vol. 4. Good manufacturing
practice (GMP) guidelines (http://ec.europa.eu/health/documents/eudralex/vol-4/index_en.htm).
3. Application of hazard analysis and critical control point (HACCP) methodology to pharmaceuticals.
In: Quality assurance of pharmaceuticals. A compendium of guidelines and related materials. Vol. 2,
2nd updated ed. Good manufacturing practices and inspection. Geneva, World Health Organization,
2007; Quality assurance of pharmaceuticals. A compendium of guidelines and related materials.
World Health Organization, 2011 (CD-ROM) (http://www.who.int/medicines/areas/quality_safety/
quality_assurance/guidelines/en/index.html).
4. ICH harmonised tripartite guideline. ICH Q8(R2): Pharmaceutical development. August 2008
(http://www.ich.org).
5. ICH harmonised tripartite guideline. ICH Q9: Quality risk management 9 November 2005
IFPMA; Quality Risk Management ICH Q9 Briefing pack, July 2006, ICH-webpage publishing; ICH
harmonised Q8/9/10 Questions & Answers, November 2010; ICH harmonised Q8/9/10 Training
material, November 2010, ICH-webpage publishing; ICH harmonised points to consider for ICH
Q8/Q9/Q10 implementation, 6 December 2011 (FIP, AM and IFPMA) (http://www.ich.org).
6. Guidance for industry: PAT – A framework for innovative pharmaceutical development,
manufacturing and quality assurance. US Food and Drug Administration, Center for Drug
Evaluation and Research (FDA CDER), September 2004 (http://www.fda.gov/Drugs/default.htm).
7. Pharmaceutical cGMPs for the 21st century – A risk-based approach. US Food and Drug
Administration, Center for Drug Evaluation and Research (FDA CDER), September 2004 (http://
www.fda.gov/Drugs/default.htm).
8. Medicines and Healthcare Products Regulatory Agency. MHRA guidance: GMP-QRM – Frequently
Table 3 continued
92
WHO Technical Report Series No. 981, 2013
WHO Expert Committee on Specifications for Pharmaceutical Preparations Forty-seventh report
asked questions (http://www.mhra.gov.uk/Howweregulate/Medicines/Inspectionandstandards/
GoodManufacturingPractice/FAQ/QualityRiskManagement/index.htm).
9. Frank T et al. Quality risk management principles and industry case studies (December 2008)
sponsored by the Product Quality Research Institute Manufacturing Technology Committee
(PQRI-MTC) (http://www.pqri.org).
10. Boedecker B. GMP Inspectorate of Hannover, Germany. EU GMP requirements – quality systems.
Presentation Ankara, Turkey Ministry of Health, 20–21 October 2009.
11. WHO guidelines on quality system requirements for national good manufacturing practice
inspectorates. In: WHO Expert Committee on Specifications for Pharmaceutical Preparations. Thirty-
sixth Report. Geneva, World Health Organization, 2002 (WHO Technical Report Series, No. 902),
Annex 8 (http://www.who.int/medicines/areas/quality_safety/quality_assurance/inspections/en/
index.html).
12. US Department of Health and Human Services Food and Drug Administration Center for Drug
Evaluation and Research (CDER)/Center for Biologics Evaluation and Research (CBER)/Center
for Veterinary Medicine (CVM) guidance for industry – process validation: general principles
and practices. Silver Spring, MD, IFPMA, 2011 (http://www.fda.gov/downloads/Drugs/
GuidanceComplianceRegulatoryInformation/Guidances/UCM070336.pdf).
13. Stamatis DH. Failure mode and effect analysis. FMEA from theory to execution, 2nd ed. Milwaukee,
American Society for Quality, Quality Press, 2003.
14. Guidelines for failure modes and effects analysis (FMEA) for medical devices. Ontario, Canada,
Dyadem Press, 2003.
15. McDermott R et al. The basics of FMEA. Portland, OR, Productivity, 1996.
16. IEC 61882 - Hazard operability analysis (HAZOP). Geneva, International Electrotechnical
Commission, Headquarters (IEC 61882 Ed.1, b:2001).
Further reading
FDA's new process validation guidance – A detailed analysis. European Compliance Academy, November
2008 (http://www.gmp-compliance.org/eca_news_1402_5699,6013.html).
Validation of analytical procedures used in the examination of pharmaceutical materials. In: WHO
Expert Committee on Specifications for Pharmaceutical Preparations. Thirty-second report. Geneva, World
Health Organization, 1992 (WHO Technical Report Series, No. 823), Annex 5 (http://who.int/medicines/
publications/pharmprep/en/index.html).
