Media 3198

Layout Draft
ICH Q9 QUALITY RISK MANAGEMENT
品質リスクマネジメント
prepared by members of the ICH Q9 EWG slide 1 , July 11, 2006
Layout Draft
ICH Q9: Quality Risk Management
prepared by members of the ICH Q9 EWG slide 2 , July 11, 2006
The ICH Q9 briefing pack is offered as a supplementary explanation of the material in ICH Q9.
It was prepared by some members of the ICH Q9 EWG for example only. It has not gone
through any ICH formal process. It does not represent an official policy/guidance.
Quality Risk Management ICH Q9
Briefing Pack
Introduction
ICH Q9 together with ICH Q8 and Q10 is one of the ICH Q-topics that encourage
further development science based and risk based approaches to quality. The
intention of ICH Q9 is to focus the behaviours of industry and regulatory
authorities on the two primary principles of Quality Risk Management, which are:
• The evaluation of the risk to quality should be based on scientific

knowledge and ultimately link to the protection of the patient; and
• The level of effort, formality and documentation of the Quality Risk
Management process should be commensurate with the level of risk.
To support the implementation of Quality Risk Management into daily operations

for Regulators and Industry some members of the ICH Q9 Expert Working Group
have prepared a set of slides, which are intended to be used for information
purposes in industry, regulators and other facilitators such as consultants. When
using these slides it should be remembered that:
One purpose is to provide general guidance and references for some of

the primary tools as well examples that might be used in quality risk
management by industry and regulators.
The slides are provided for illustrative purposes and suggest possible
interpretations of the ICH Q9 guideline. It must be remembered that the
selection of particular risk management methodology / tools is
completely dependent upon specific facts and circumstances related to
the risk being managed.
Many of the slides contain animations. Viewing the slides in PowerPoint
as a slide show will help the reader to understand the context in which
the particular slide was derived.
The slides are not intended to create any new expectations beyond the
current regulatory requirements.
The slides include the authors' views on the theory and practice of
Quality Risk Management and do not represent official guidance or
policy for either regulators or industry.
The slides are placed in the public domain and should not be copied or
republished for purposes of financial gain.
Briefing Pack
Disclaimer:
The Q9 briefing pack is offered as a supplementary explanation of the material in
ICH Q9. It was prepared by some members of the ICH Q9 EWG for example only.
It has not gone through any ICH formal process. It does not represent an official
policy/guidance.
Quality Risk Management ICH Q9
Briefing Pack
On the ICH Q9 document slides are available on:
Executive summary for regulators and industry HTML PPT
Background HTML PPT
History HTML PPT
Content HTML PPT
Tools - overall notes HTML PPT
Basic Risk Management Facilitation Methods HTML PPT
Failure Mode Effects (Criticality) Analysis (FMEA & FMECA) HTML PPT
Fault Tree Analysis (FTA) HTML PPT
Hazard Analysis and Critical Control Points (HACCP) HTML PPT
Hazard Operability Analysis (HAZOP) HTML PPT
Preliminary Hazard Analysis (PHA) HTML PPT
Risk Ranking and Filtering HTML PPT
Supporting Statistical Tools HTML PPT
Combination of Tools HTML PPT
Application - overall notes HTML PPT
Integrated Quality Management HTML PPT
Regulatory Operations HTML PPT
Development HTML PPT
Facilities, Equipment and Utilities HTML PPT
Materials Management HTML PPT
Production HTML PPT
Laboratory Control and Stability Studies HTML PPT
Packaging and Labelling HTML PPT
Frequently Asked Questions (Q&A) HTML PPT
For creating paper copies of a manual with all slides see the Acrobat (pdf) version
• Executive summary, Background, History, Content and FAQ

• Tools / Applications
Disclaimer:
The Q9 briefing pack is offered as a supplementary explanation of the material in
ICH Q9. It was prepared by some members of the ICH Q9 EWG for example only.
It has not gone through any ICH formal process. It does not represent an official
policy/guidance.
Team recruited from the
Members of the Expert Working Group:
Writers
Stephan Rönninger (Chair) F. Hoffmann-La Roche Ltd
Gregg Claycamp FDA
formerly with Eli Lilly Inc.; David Begg
Peter Gough
Associates
Malcolm Holmes Glaxosmithkline
Takayoshi Matsumura Eisai Co. Ltd
Christine Mundkur Barr Laboratories
Tetsuhito Takarada Mochida Pharmaceutical Co. Ltd
Hideki Sasaki Nippon Shinyaku Co. Ltd
Reviewers
Emer Cooke EMEA
Diana Dowthwaite Health Canada
Albinus D'Sa FDA
Gregg Guyer Merck& Co. Inc.
David Horowitz FDA
Yukio Hiyama MHLW
Georgia Keresty Centocor
Sabine Kopp WHO
Urs Kopp Swissmedic
Agence Française de Sécurité
Jacques Morenas Sanitaire des Produits de Santé -
AFSSAPS
Markus Müller Swissmedic
Etienne Ouimette Health Canada
Consumer Health Care Products
Fred Razzaghi
Association
Also supported by EFPIA and JPMA ICH Q9 Topic Groups.

Executive summary Executive summary
ICH Q9 QUALITY RISK MANAGEMENT ICH Q9 QUALITY RISK MANAGEMENT
The situation today

Quality The situation today for both regulators and industry
Risk Management > Increasing external requirements

> Increasing efforts and costs
ICH Q9 > Growing complexity and scope of risks

Empowerment & Flexibility is needed
> Master complexity and streamline decision making
Executive summary > Proactive disclosure build trust and understanding
> Improve communication through sharing best practice
for competent authorities and industry and science based knowledge
Disclaimer: This presentation includes the author’s views on quality risk management theory and practice. > Convert data into knowledge
The presentation does not represent official guidance or policy of authorities or industry.
prepared by some members of the ICH Q9 EWG for example only; not an official policy/guidance July 2006, slide 1 prepared by some members of the ICH Q9 EWG for example only; not an official policy/guidance July 2006, slide 2

New Regulatory Paradigm The new paradigm

• ICH Regulators:
> FDA: New paradigm with the 21st Century GMP initiative
> EMEA: Revised EU directives
> MHLW: Revised Japanese law (rPAL)
“risk-based”
• EU & Japan became involved at ICH
GMP Workshop in July 2003: 5 year vision agreed:
concepts and
“Develop a harmonised pharmaceutical quality system applicable principles
across the life cycle of the product emphasizing an integrated approach
to quality risk management and science”
• Consequent ICH Expert Working Groups (EWG):
> ICH Q8, on Pharmaceutical Development, doc. approved 2005
Q8
> ICH Q9, on Quality Risk Management, doc. approved 2005
Q9 Q 10
> ICH Q10, on Quality Systems, topic accepted 2005

ICH Q9 QUALITY RISK MANAGEMENT ICH Q9 QUALITY RISK MANAGEMENT CONSIDERATIONS
Process
Incremental steps Understanding
Process Process
Pharmaceutical Development (Q8) Understanding Understanding
CMCCMC
regulatory
Changed Past: Data transfer / Variable output regulatory
Oversight CMCCMCregulatory
Paradigm Present: Knowledge transfer / Science
(Submission)
oversight Oversight
regulatory
CMC
(Submission)
oversight
based / Consistent output regulatory
oversight
cGMP cGMP
regulatory
cGMPcGMP
regulatory
Quality Risk Management (Q9)
regulatory
oversight
(Inspection)
oversight
Q8 regulatory
oversight Q10 cGMP
regulatory
& &
(Inspections)
oversight oversight
Past: Used, however poorly defined

Present: Opportunity to use structured Company’s Q9 Company’s Q9 Company’s
Quality system Quality system Quality system
process thinking
Post
Continuous
Pharmaceutical Quality Systems (Q10) Approval
approval
Change
PAC
PAC toto Improvement
change
(PAC)
Past: GMP checklist Continuous
Continuous
Q10
Q8
Improvement Risk
Improvement
Future: Quality Systems across product Risk
Q9
life cycle (perceived Risk

(P/R)& real)
Based on A. Hussain, FDA, September 2004
Disclaimer: The ICH Q9 briefing pack is offered as a supplementary explanation of the material in ICH Q9. It was prepared by some
members of the ICH Q9 EWG for example only. It has not gone through any ICH formal process. It does not represent an official
policy/guidance.
ICH Q9 Briefing pack I, July 2006, page 1
The Desired State driven by ICH Q9 The Desired State
• Manage risk to patient, based on science: • Barriers to continuous improvement

> Product, process and facility
reduced or removed
> Improved manufacturing efficiency
> Robustness of Quality System
> Sustained or improved product quality
> Relevant controls to assess & mitigate risk
• Specifications based on parameters
• Level of oversight required commensurate that truly impact product quality
with the level of risk to patient for:
> Marketing authorisation applications • Common understanding and language on risk
> Post-approval change review • Both, industry and competent authorities focus on
> GMP inspections areas of greatest risk and understanding of residual
risks

Pharmaceutical industry and quality risk management Advantages of quality risk management as technique
• Pharmaceuticals have lagged behind related • Improves decision making

industries in adopting structured risk management in > Identifies what gives most benefit to the patient
the quality area; e.g. • Is scientific & data-driven
> Medical devices have ISO 14971 > Reduces subjectivity
> Food industry uses HACCP • Ranks risk - allows prioritization
> Better use of resources
• We are using quality risk management but • Means of building in Quality
> Implementation is patchy • Improves transparency - inside organisation and
builds trust with competent authorities
> It is often not fully integrated with rest of the
Quality System > Enables regulatory flexibility
• Benefits apply throughout product lifecycle

Why did we need ICH Q9? Quality Risk Management is NOT
• To ensure a common understanding of

Quality Risk Management (QRM) among • Hiding risks
industry and competent authorities • Justifying poor quality of product and / or
processes
• To facilitate moving to the “Desired State”
> To facilitate communication and transparency • Excusing industry’s obligation
> To move from ‘fire fighting’ to management of risk to comply with regulatory requirements
• ICH Q9 explains HOWEVER

> A common language and process • It might bring about the revision or withdrawal of
> Potential methodologies for QRM some non risk base guidance
> Where QRM can add value
policy/guidance.
What does Senior Management need to do? Conclusions
• Ensure organisation is aware of ICH Q9 • ICH Q9, together with “Pharmaceutical development”
and the opportunity it affords (ICH Q8) and “Quality systems” (ICH Q10), provides
opportunity for a revised, optimised and, less restrictive
> Appropriate education and training
regulatory paradigm
• Encourage open, risk aware culture > Based on scientific knowledge
> Establish & support “QRM leaders” across organisations > Enable continuous improvement
> Greater transparency and efficiency
• Encourage integration of Quality Risk Management
> Focusing on things that add value for patients
with existing Quality systems
> Improved relationship between industry and competent
> Do NOT set up as a separate department
authorities based on trust
> Coordinate implementation and resource allocation
• We must seize this opportunity
> Prioritise; start small, learn as you go
Executive summary Executive summary Focus resources

Keep always in mind the

where they matter most to protect the patient
Principles of Quality Risk Management
The evaluation of The level of effort,

the risk to quality formality and
should be based on documentation
scientific knowledge of the quality risk
and ultimately link management process
to the protection should be commensurate
of the patient with the level of risk
ICH Q9
policy/guidance.
Background Background
Purpose of this part

Quality • To provide information on
Risk Management
the background
of the ICH Q9 document
ICH Q9 • Give an aid by providing some points of discussions

on the understanding of the quality risk management
concept
Background
Disclaimer: This presentation includes the authors views on quality risk management theory and practice.
Agenda Agenda
• The ICH process • The ICH process
• ICH Q9 and other ICH guidelines • ICH Q9 and other ICH guidelines
• From “Risk” to “Quality Risk Management” • From “Risk” to “Quality Risk Management”
• Opportunities, Challenges and Benefit • Opportunities, Challenges and Benefit
EWG’s include observers and

International Conference constituted from both authorities & industry
on Harmonisation
of Technical
Guidelines on
Requirements Expert Working
Groups (EWG)
Quality
Chemical and
for Registration of pharmaceutical QA

Safety
In vitro and in-vivo pre-
Pharmaceuticals clinical studies

Efficacy
Clinical studies
for Human Use in human subject

Multidisciplinary
General topics
policy/guidance.
Agenda ICH Q-Documents
• Q1 Stability
• The ICH process
• Q2 Analytical Validation
• Q3 Impurities
• ICH Q9 and other ICH guidelines • Q4 Pharmacopoeias
• Q5 Quality of Biotechnological Products
• From “Risk” to “Quality Risk Management” • Q6 Specifications
• Q7 Good Manufacturing Practice
• Opportunities, Challenges and Benefit • Q8 Pharmaceutical Development
Different:
• Q9 Quality Risk Management - not a recipe
• Q10 Pharmaceutical Quality Systems - not a “SOP”
just a guidance
ICH Q9 Link back to patient risk Risk Management across the

Product lifecycle for drug (medicinal) products
Opportunities to impact Research
risk using quality risk Preclinical
Design management Phase
Clinical
Phases End of
Process life cycle
Launch
Manufacturing
Materials Manufacturing
& Distribution
Facilities
Distribution GLP Safety
GCP Efficacy
Patient
GMP Quality
G.- Claycamp, FDA, June 2006 GDP ICH Q9
ICH Q9 QUALITY RISK MANAGEMENT CONSIDERATIONS ICH Q9 QUALITY RISK MANAGEMENT
Managing the risk of drug New Regulatory Paradigm

(medicinal) product use • ICH Regulators:
> FDA: New paradigm with the 21st Century GMP initiative
Medication or Device Product
Known Side Effects > EMEA: Revised EU directives
Error Defects
Avoidable Unavoidable
ICH Q9 > MHLW: Revised Japanese law (rPAL)
Efficacy Quality
Safety Preventable
• EU & Japan became involved at ICH
Adverse GMP Workshop in July 2003: 5 year vision agreed:
Events
“Develop a harmonised pharmaceutical quality system applicable
across the life cycle of the product emphasizing an integrated approach
to quality risk management and science”
Unexpected Injury or
Consequences Death • Consequent ICH Expert Working Groups (EWG):
> ICH Q8, on Pharmaceutical Development, doc. approved 2005
Public Health > ICH Q9, on Quality Risk Management, doc. approved 2005
Source: basic model adapted from FDA (1999). Managing the Risks from Medical Product Use. > ICH Q10, on Quality Systems, topic accepted 2005
policy/guidance.
The new paradigm Incremental steps

Pharmaceutical Development (Q8)
Changed Past: Data transfer / Variable output
Paradigm
“risk-based” Present: Knowledge transfer / Science
based / Consistent output
concepts and Quality Risk Management (Q9)

Past: Used, however poorly defined
principles Present: Opportunity to use structured
process thinking
Pharmaceutical Quality Systems (Q10)

Q8 Past: GMP checklist
Q10
Q9
Q8
Q 10 Future: Quality Systems across product
Q9
life cycle
How Q9 interacts with Q8 and Q10 ICH Q9 Link back to patient risk
Opportunities to impact
Risk from Manufacturing site
High risk using quality risk

Q10 Pharm. Quality Systems
Design management Q9
t
en
em
ov
Process
pr
m
li
ua
Using Q9 Materials Manufacturing

in
nt
Quality Risk
co
Management Facilities
Distribution
principles
Low Q8 Pharmaceutical Development
Patient
Low High
Product / Process Risk Q8 Q10
Base: J. Ramsbotham, Solvay Pharm. NL / EFPIA G.- Claycamp, FDA, June 2006
ICH Q9 QUALITY RISK MANAGEMENT CONSIDERATIONS ICH Q9 QUALITY RISK MANAGEMENT CONSIDERATIONS
Process
A Vision of the future becomes fact Understanding
Process Process
Understanding Understanding
Old Approach New Approach Remarks CMCCMC
regulatory
regulatory
Oversight CMCCMCregulatory
Quality decisions divorced Quality decisions and filing Design Space concept (Submission)
oversight Oversight
regulatory
from science and risk committments based on introduced to integrate CMC
(Submission)
oversight
Broad Concept evaluation. Process Understanding process knowledge with regulatory
oversight
Adherence to filing and Risk Management. regulatory evaluation. cGMP cGMP
regulatory
cGMPcGMP
regulatory
commitments.
Post-factum sampling and
Quality by Design.
Management of variability Quality by design definition
regulatory
oversight
(Inspection)
oversight
Q8 regulatory
oversight Q10 cGMP
regulatory
& &
quality testing. Process control focused on applied. Measure critical (Inspections)
oversight oversight
Quality Process Validation. critical attributes. process parameters to control
Continuous Quality
Verification.
output product quality.
Company’s Q9 Company’s Q9 Company’s
Systems designed to inhibit Changes managed within Regulators and industry place Quality system Quality system Quality system
changes & minimize business company's quality system. higher reliance / trust /
Systems risks. Discourages Real time batch release understanding on systems. Post
Continuous
improvement & innovation. feasible. Multidisciplinary evaluation Approval
approval
Change
PAC
PAC toto Improvement
and decision making. change
(PAC)
Compliance focus. Regulatory scrutiny adjusted Requires mechanisms to Continuous
Continuous
Improvement Risk
Changes require prior to level of Process communicate Process Improvement
Regulatory approval. Understanding. Continuous
improvement allowed
Understanding data
("inspectable rather than
Risk
(perceived Risk
within Design Space. reviewable") . (P/R)& real)
Based on EFPIA, PAT Topic Group, 2005 Based on A.Hussain, FDA, September 2004
policy/guidance.
Agenda
ICH Q9
• The ICH process
Quality Risk Management
• ICH Q9 and other ICH guidelines
What does it mean?
• From “Risk” to “Quality Risk Management”
What is it worth?
• Opportunities, Challenges and Benefit Where does it lead?
Managing risk is a behavior Risk Management as a discipline

provides multiple benefits
“The investigation of risks • Understand and influence the factors (hazards)
which impact regulators and industry business
is at once • Create awareness and a culture
> Supports an effective pro-active behaviour
a scientific activity and > Open factual dialogue
> Make decisions traceable and consistent
an expression of culture” • Provide assurance
> Risks are adequately managed
> Compliance to external and internal requirements
Kasperson, Renn, Slovic et al. (1988) • Recognise risks at a desired level
> Zero risk not possible
Empowerment & Flexibility

Increasing
The Hurdles
Growing An appropriate integrated approach
external complexity helps to meet requirements more efficiently
requirements and scope of risks
?
for best practice,
transparency and Improve
compliance • Globalisation Proactive Quality
“Multinational” communication
• Public / Community
• Governments • Multi-factor approaches
disclosure Risk through sharing best
build trust and
• Regulators
• Patients
• Regulatory expectations
• Acceptance of understanding Management practice and science
risk and uncertainty
based knowledge
• Investors / Creditors
Increasing
efforts and costs •• Documentation Master complexity
Projects
for sustainability • Systems
Convert data into knowledge
• Interfaces e.g. by using methodology and tools
Based on D. Geller, Roche Based on D. Geller, Roche
policy/guidance.
Different meaning of risk Different meaning of risk

• Individual • Organizations might use many different meanings of risk
> Risk is a cognitive and emotional response to expected loss > Depending on the type of risk management program
• In general, "probability" and "severity" must be considered

• Technicians
> In a given program definitions will fine-tune the concepts
> Risk is usually based on the expected value of the so that a risk management program can be created
conditional probability of the event occurring multiplied by and applied
the consequences of the event given that it has occurred
> Make the detail in the definition fit the objective
of the program
• ICH Q9
> Combination of the probability of occurrence of harm and • Accept the different "realities" among the stakeholders
the severity of that harm > Harmonized guidance needs to focus concepts
into useful terms for the purpose (e.g. protection of patient [Q9])
Based on G. Claycamp, FDA, September 2005 Based on G. Claycamp, FDA, September 2005
Severity and Probability are simple concepts? The “risk-based approach”
• Which consequence is more severe?

> 300 lives lost in single, fiery plane crash.
> 300 lives lost on US roads over a weekend.
> 300 lives potentially lost from cancer within the next 20 years Parameters hi
gh
probability
for
• Which probability is probable? evaluating risks
m
ed
What does a “30% chance of rain tomorrow” mean? iu
m
y
> 30% of the days like tomorrow will have at least a trace of rain.
lit
bi
> 30% of the area will have rain tomorrow. lo
ta
w
ec
t
> 30% of the time tomorrow, it will rain.
de
Gigerenzer, et. al (2005) ris
k severity
G. Claycamp, FDA, September 2005
Parameters for “calculating” risks (Dis)Advantage calculated numbers & data

A picture of the life cycle
• Numbers
= Risk Priority Number > Does the “Risk Priority Number” tell the truth?
Probability x Detectability x Severity • Keep a robust data set for further evaluation!
> Is the data set comparable?
> Are the data plain and concise?
Refers to
Refers to
Refers to
> What about trending and use of statistics

including extrapolation?
> What amount of data is enough?
e.g. start with the existing data set
past today future time
policy/guidance.
Hazards in Quality Anything Risk and Uncertainty Tomorrow ?

that has the potential to
harm patients,
Process Parameter Æ
Potential threat
- chemical reaction product quality or Upper Specification Limit (USL) Uncertainty
- manufacturing issues
- facilities and equipment the business
(loss, interruption, image)
hazard Lower Specification Limit (LSL)

Failure
- technical breakdown System defect
- human breakdown - not detected
- insufficiently prevented
Time Æ today
- extrinsic effect
- emerges by degree
RISK: For a given severity of risk event, what are the chances
(probability) of exceeding the USL in the next period of time?
S. Rönninger, Roche, 2004 G. Claycamp, FDA, Sept. 2005
Risk and Uncertainty Risk and Uncertainty

Different Risk Management Control? Is the Risk of Exceeding USL = Zero?
Tomorrow ?
Tomorrow ?
Upper Specification Limit (USL)

Upper Specification Limit (USL)
Uncertainty Uncertainty
Lower Specification Limit (LSL) Lower Specification Limit (LSL)
Time Æ today
Time Æ Take a cut today
at a
RISK: Control options are scenarios for risk management. Note moment in time:
that this scenario shows the best estimate is below the USL. Risk has a distribution.
G. Claycamp, FDA, Sept. 2005 G. Claycamp, FDA, Sept. 2005
Uncertainty and Quality Risk Management Definitions

Lack of, or inadequate knowledge
Quality Degree to which a set
of inherent properties
uncertainty Hazard of a product, system or process
Hazard
may may not fulfills requirements
cause harm cause harm Risk combination of the
Manage risks probability of occurrence of harm and
in relation to the severity of that harm
probability &
severity Management
Systematic process for the assessment,
Hazard control, communication and review
is less likely to QRM of risks to the quality of the
cause harm drug (medicinal) product
across the product lifecycle ICH Q9
policy/guidance.
Has QRM already been implemented? Risk Management

Not a new concept
Yes, however we need to firm-up and • ISO/IEC Guide 73: 2002 - Risk Management -
set the priorities in relation to risks Vocabulary - Guidelines for use in Standards
• ISO/IEC Guide 51:1999 - Safety Aspects -
• We need to know… Guideline for their inclusion in standards
> How good is our QRM compliance and decision making? • WHO Technical Report Series No 908, 2003 Annex 7 Application
of Hazard Analysis and Critical Control Point (HACCP)
> To what extent QRM has to be implemented or formalised? methodology to pharmaceuticals
• GAMP Good Practice Guide ISPE, 2005
• An then focus efforts and communicate in order to… A risk-based approach to compliant electronic records and
> Avoid duplication of effort and to align initiatives signatures
> Develop scope by using different viewpoints • ISO 14971:2000 - Application of Risk Management
to Medical Devices
e.g. from management, internal and external customers
ISO 14971 (medical devices) & ICH Q9 What is ICH Q9 about?

Initiate
Quality Risk Management Process
Risk Assessment
• The ICH Q9 document:
Risk Identification
> Main body explains the “What?”
Risk Analysis > Annex I give ideas on the “How?”
Risk Evaluation > Annex II give ideas on the “Where?”
unacceptable
Risk Management tools
Risk Communication
Risk Control
• It can be implemented by industry and regulators
Risk Reduction
> Pharmaceutical development (ICH Q8) and Quality Systems
Risk Acceptance
(ICH Q10) will facilitate the “What?”, “How?” and “Where?”
Output / Result of the • “It helps prevent overly restrictive and unnecessary
requirements being imposed by either industry or
Risk Review
regulators” (ICH Q9)
Review Events
Why we have ICH Q9? Quality Risk Management is NOT
• To show how it can be applied by regulators and

industry to quality of pharmaceuticals (including API) • Hiding risks
> We already do a lot of quality risk management

activities without identifying them as such • Writing half the truth (e.g. in an investigation report)
• To enable manufacturing and regulatory flexibility

• A means of removing industry’s obligation to comply
• Provides the “What?” “How?” and “Where?” for with regulatory requirements
quality risk management
> Pharmaceutical development (ICH Q8) and Quality
Systems (ICH Q10) will facilitate the
“What?”, “How?” and “Where?”
policy/guidance.
Manage quality risks! Implementing ICH Q9 means

What if
disaster happens?
Consequences
Prior use of QRM may

lower the consequences
Nowadays
QRM
Using QRM
The weakest chain will no longer be a problem

Quality management as function of time
Based on Prof. M. Haller, University St. Gallen, Switzerland
Agenda Integrate QRM during product life cycle
Gain experience
• The ICH process
Analyse root cause: (Risk of) Failure ?
Continuous Manufacture
• ICH Q9 and other ICH guidelines improvement for market
Quality Risk
Management
• From “Risk” to “Quality Risk Management” Improve it (QRM) Do, what you say
• Opportunities, Challenges and Benefit Update Approval

documentation
Say, what you do

Risk Management & Flexibility QRM may help define acceptable quality levels
• Definitions of “Compliance”:
> Conformity in fulfilling official requirements
Use
> The act or process of complying to a
“science-based” and
desire, demand, or proposal or to coercion “risk-based” behavior
> A disposition to yield to others
> The ability of an object to yield elastically • Not every single detail can nor should be covered by
when a force is applied: flexibility
> Specifications (product quality)
> Documents (quality systems)
• Definition of “Flexibility”:
> characterised by a ready capability • Set priorities and allocate resources
to adapt to new, different, or changing requirements according to the potential for protection of patients
Source: www.webster.com, 01. Nov.04
policy/guidance.
Opportunity for the Industry & Regulators Conclusions for ICH Q9
• Using the same guideline apply QRM to • Over all: Positive Contribution to patient protection
> Industry (development, manufacture and distribution) > Further develops Quality Risk Management awareness,
> Competent authorities (reviewer and inspectorate) that is already part of industry and regulatory culture
• Facilitates common approaches to quality risk • Ongoing change in behaviour
management in our every day jobs
> Identifying risks can be positive
• Supports science-based decision making > A long list of identified risks that are assessed and
controlled provides high quality capability
• Focus resources based on risks to patients
• Awareness of quality risks
• Avoids restrictive and unnecessary requirements
> “Risk-based approach”
• Facilitates communication and transparency > A potential of risks remains - No “Zero” risk!
Way Forward for Industry and Regulators Opportunities & Benefits

• Encourages transparency
• Improve communication and transparency
> Create baseline for more science-based decisions
• Adapt existing • Facilitates communication
structures, organizations and systems > Matrix team approach
> Raise awareness of rationales for decision making > An aid to convince the stakeholders with trust
> Develop training on methods and tools, as appropriate • Encourages a preventive approach
> Proactive control of risks and uncertainty
> Do not create new QRM organisations > Benefit of knowledge transfer by team approach
> Do not create new requirements • Changes behavior
• Adapt existing requirements using quality risk > Better understanding of risk-based decisions
management behaviors > Acceptance of residual risks
Remember Change in behaviour

Sharing information
• The use of Quality Risk Management is not mandatory
However, if you don’t use it,

you will not gain the benefits
policy/guidance.
Change in behaviour Change in behaviour
From tick-box
Doing things,
approach for compliance
that do not matter
towards
systematic for the patient
risk-based thinking
Background
Integration of QRM
into existing systems
and
regulatory processes
will take time, trust and
communication
prepared by some members of the ICH Q9 EWG for example only; not an official policy/guidance July 2006, slide 75
policy/guidance.
History History
Purpose of this part is to:

Quality
Risk Management • Guide you through
the history
of the development of the ICH Q9 document
ICH Q9
• Highlight some of the decisions and
History rationales for making them
History History
The history of Q9 document ICH Q9 Milestones

November 2003 Concept
Osaka paper ICH Steering Committee agrees to new document
March 2004 June 2004
London Washington
Step 1 Scientific discussions within the EWG
Sep. 2004 Nov. 2004
Telecon Yokohama
Osaka London Washington Yokohama Feb. 2005 March 2005
Step 2 Consensus of the 6 ICH partners and release for
November 2003 March 2004 June 2004 November 2004 Telecon Steering C. pubic consultation within the 3 Regions
May 2005
Brussels
Step 3 Consolidation of public comments
Nov. 2005
Step 4 Agreement of the 3 ICH regulators and
2006 Chicago "Signed off" by ICH Steering Committee
Not legally binding,
unless incorporated in local law
Draft for consultation Chicago ICH Q9 2006 Step 5 Implementation within the 3 Regions
2005 ongoing
March 2005 November 2005
History History
ICH Concept paper Osaka, November 2003 Result of ICH Q9 EWG Meeting London, March 2004
• Technology focus
• A draft table of contents, flow diagram, definitions
> Increase process capability were agreed
> Focus on critical control points
• Assignments to produce first drafts
• Product
of the full text for each section
> Stabilise manufacturing steps (decrease variability) of the draft table of contents were agreed
> Guarantee shelf-life
• People • Started the dialogue with the ICH Q8 EWG
> Result in a superior performance of the Q-System • Regulatory flexibility
• Customer > The degree to which the final versions of both Q9 and Q8
> Reduce deviation could refer to 'regulatory relief' was a debate on principles.
> Reduce market complaint rate > Term changed to “regulatory flexibility” or “risk
confidence”.
> Reduce technical related adverse events
policy/guidance.
History History
ICH Q9 Version 1 Result of ICH Q9 EWG Meeting Washington, June 2004
• Good agreement on overall content

> No major disagreements between parties
“Forget it” > Training and experience needed
• The first official draft (No 2) was issued

> All accept that wording is not perfect
• Reaching ICH Step 2 in November was still the target

> Highly dependent on the extent of comments received on draft
expressed what the EWG was thinking
in terms of creating text on the agreed content
History History
Result of ICH Q9 EWG Telecon September 2004 Result of ICH Q9 EWG Meeting November 2004
• Optional nature of ICH Q9 to be emphasized • Milestone: Draft 4 issued as “pre-step 2” document
• All EWG parties want to push ICH Q9 forward • Major concerns were addressed and resolved
> No support for delaying ICH Q9 • Primary principle: link back to the potential harm to
the patient
• Appointments for redrafting in six groups
• Integration of QRM into existing systems & regulatory
> Subgroup decide on details of Chapter 5 / 6 as annex or not
processes will take time
> One subgroup to deal with ICH Q8 relationships
• For more details:
• Case studies: Peter Gough and Stephan Roenninger,
> Which ones are appropriate to use in ICH Q8, Q9 or Q10? ICH Q9 : Quality Risk Management - an update
> Everybody should decide, whether the case studies should Regulatory Affairs Journal, 16, 2005, 91-93
be included as an annex in the ICH Q9 document or used as
training material - Decision to be made in Yokohama
History History
Result of ICH Q9 EWG Telecon February, 22 2005 ICH Q9 Expert Working Group (EWG) as of ICH Step 2
• All EWG parties agreed Mr. David Horowitz Dr. Greg Guyer (Rapporteur)
to put Q9 forward to step 2
Director, Office of Compliance, CDER Merck &Co, Vice President, MMD QA
Dr. H. Gregg Claycamp Dr. Georgia Keresty
Director Scientific Support Staff Centocor, Inc.,GlobalBiologicsSupply
Vice President, Worldwide Quality
Ms. Diana Kolaitis
District field inspector
Mr. Jon Edward Clarke
Dr. Yukio Hiyama FDA HFD (alternate: Q8) Ms. Emer Cooke
Head of sector Inspections EMEA
• Training slides will be provided Chief, Third Section: Division of Drugs

Mr. Ichiro Tsunoi
Dr. Jacques Morenas
Inspection and Companies Directorate
Compliance & Narcotic division
Dr. Yoshihiro Matzuda Expert Working AFSSAPS, FEMEA, PIC/S
Mr. David Cockburn(alternate)
> Slides to be discussed after step 4 MHLW, Registration Biol.
Dr. Mayumi Shikano Group (EWG)
Principal Scientific Administrator EMEA
Review director Office of biologics

Dr. Tamiji Nakanishi
Reviewer, Office of new drugs I
Dr. Yoshihiro Matsuda
• Next meeting of the EWG: Reviewer, Office of new drugs I
Mr. Etienne Ouimette
Compliance and Enforcement Coordination division, Mr. Peter Gough
ICH Meeting, November 2005, Chicago Health prod. & Food Branch Inspectorate Health CDN
Ms. Christine Mundkur
International Generic Pharmaceutical Alliance
Lilly, GB, Senior Quality Consultant, Corporate QS
Dr. Stephan Rönninger
F.Hoffmann-LaRoche, CH, Global Quality Manager
Mr. Frederick Razzaghi
Mr. Takayoshi Matsumura Consumer Health Product Association
Eisai, Assistant Manager, Corporate QA Department Dr. Sabine Kopp
Mr. Tetsuhito Takarada QA & Safety Medicines, WHO
Mochida Pharm.Deputy Director, Quality Control Dr. Urs Kopp
Mr. Hideo Sasaki(alternate) Head of Inspectorate, Swissmedic
Nippon Shinyaka Co Ltd, Manager Anal.Chem.Sect.
policy/guidance.
History History
Result of ICH Q9 EWG Meeting

ICH Q9 Expert Working Group (EWG) as of ICH Step 4
Chicago November, 6.-8. 2005
Points of discussion and changes to the step 2 document
Dr. H. Gregg Claycamp (Rapporteur) Dr. Georgia Keresty
Centocor, Inc.,GlobalBiologicsSupply
• Separate the “How to do?” (annex) from the “What to do?”

Director Scientific Support Staff
Vice President, Worldwide Quality
Mr. A. D’Sa
Compliance Officer, CDER
Mr. Tobias Massa
Bristol-Myers Squibb
Ms. Diana Kolaitis
(text) and move the tools examples to the annex
Vice president Global Regulatory Sciences-CMC
District field inspector
Dr. Yukio Hiyama

• Modify original diagram in section 4 Chief, Third Section: Division of Drugs
Ichiro Tsunoi
Assistant Director, Office of Compliance,
Ms. Emer Cooke
Head of sector Inspections EMEA
Dr. Jacques Morenas
Pharm.& Food Safety Bureau, MHLW Inspection and Companies Directorate
> Take an alternative proposal Tamiji Nakanishi
Reviewer, Office of New Drugs I,PMDA
Expert Working AFSSAPS, FEMEA, PIC/S
Mayumi Shikano Group (EWG)

showing communication routes Review Director,Office of Biologics,PMDA
Yoshihiro Matsuda
Reviewer, Office of New Drug I,PMDA
• Move “continuous improvement” to Annex II.1 (see ICH Q10) Yukio Saito
GMP Inspector, PMDA
Takashi Nagashima
GMP Expert, PMDA Ms. Diana Dowthwaite
• Reduce complexity by combining and re-wording the
Compliance and Enforcement Coordination division, Mr. Malcolm Holmes
Health prod. & Food Branch Inspectorate Health CDN GSK, UK, Global Quality Assurance, Director
Ms. Christine Mundkur Dr. Stephan Rönninger
individual sections
International Generic Pharmaceutical Alliance F.Hoffmann-La Roche, CH, Global Quality Manager
Mr. Frederick Razzaghi
Consumer Health Product Association
Mr. Takayoshi Matsumura Dr. Sabine Kopp
> “formal” and “informal” risk management referenced Eisai, Assistant Manager, Corporate QA Department
Mr. Tetsuhito Takarada
QA & Safety Medicines, WHO
Dr. Markus-Peter Müller
Head of QM-Inspectorate, Swissmedic
Mochida Pharm.Deputy Director, Quality Control
Mr. Hideo Sasaki
> “detectability” as an element in several chapters Nippon Shinyaka Co Ltd, Manager Anal.Chem.Sect.
History History
Publication and implementation of ICH Q9 European legal position of ICH Q9

Legal position of ICH Q9 Publication of the document in EU for comments:
• US / FDA: • “It should be borne in mind that this guideline does
- Guidance for Industry (June 2006) not introduce new requirements or expectations but
- By law, guidance documents are not enforceable or binding should be considered a resource document that
FDA will use the document internally in this spirit, as well
can be used together with existing quality-related
• Japan / MHLW: guidelines when a risk-based approach is
- Product GMP Guideline appropriate.”
“Annex”: ICH Guidelines
• “Therefore, as well as complementing GMP
• EU / EMEA: guidelines, the document should be seen as also
EUDRALEX Volume 4 - Medicinal Products for Human and
Veterinary Use : Good Manufacturing Practice complementing and supporting existing and future
- EU-GMP Vol. 4, Annex 20 guidelines published by CHMP and CVMP
- Teams established to update chapters of EU-GMP, NfG etc. concerning the quality of medicinal products.”
EU-Publication of Step 2 document
History History
ICH Q9 Briefing Pack July 2006 ICH Q9 Briefing Pack

ICH EWG members published a set of slides
Authors Reviewers with more details on possible implementations
• S. Rönninger, Roche (Chair) • E. Cooke, EMEA > ICH homepage: www.ich.org -> -> scroll down to ICH Q9
• G. Claycamp, FDA • Y. Hiyama, MHLW
• P. Gough, former Lilly • D. Horowitz, FDA
• M. Holmes, GSK • G. Keresty, Centocor • On the ICH Q9 Document
• T. Matsumura, Eisai Co. • U. Kopp, Swissmedic > Background
Current direct link:
• H. Sasaki, Nippon Shinyaku • J. Morénas, AFSSAPS > History http://www.ich.org/cache/html/3157-272-1.html
• T. Takarada, Mochida Pharm. • C. Mundkur, Barr Laboratories > Content
> Tools
• M.-P. Müller, Swissmedic
> Applications
• F. Razzaghi, CHPA
• Additional features
Supported by EFPIA and JPMA > Senior Management Training
ICH Q9 topic groups > Frequently Asked Questions (Q&A)
policy/guidance.
History Content
Quality
Risk Management
Optional ICH Q9
but can benefit
from its use!
Content
Content Content
Purpose of this part ICH Q9: Quality Risk Management (QRM)

• Document is available on the ICH Webpage
• To guide through the content of the ICH Q9 document
www.ich.org
• Provide some considerations, possible interpretations
and where appropriate examples
Content Content
Table of contents 1. Introduction

1. Introduction
Risk Management
2. Scope Quality Risk Management
3. Principles of Quality Risk Management Quality Systems
4. General Quality Risk Management Process Harm
5. Risk Management Methodology Severity
Annex I: Risk Management Methods and Tools Stakeholder
6. Integration of QRM process Product Life Cycle
into Industry and Regulatory operations GMP Compliance
Annex II: Potential Applications for QRM
7. Definitions
8. References
policy/guidance.
Content Content
2. Scope 2. Scope
This guideline provides • Drug substances,
principles & examples of tools • Drug (medicinal) products,
of quality risk management that can be applied to • Biological and biotechnological products
different aspects of pharmaceutical quality.
Including the selection and use of
These aspects include development, manufacturing,
> Raw materials
distribution, and the inspection and submission/review > Solvents
processes throughout the lifecycle > Excipients
of drug substances, drug (medicinal) products, > Packaging and labelling materials
biological and biotechnological products > Components
ICH Q9
Content Content
3. Principles of Quality Risk Management 4. General Quality Risk Management Process

Two primary principles:
The evaluation of The level of effort, Systematic processes

the risk to quality formality and designed to
should be based on documentation coordinate, facilitate and improve
scientific knowledge of the quality risk
science-
science-based decision making
and ultimately link management process
to the protection should be commensurate
with respect to risk to quality
of the patient with the level of risk
ICH Q9 ICH Q9
Content Content
4. A General Initiate
Quality Risk Management Process 4. General Quality Risk Management Process
Quality
Decision makers:
Risk Assessment
Risk Risk Identification

Person(s)
Management Risk Analysis
with competence and authority
Process
Risk Evaluation to make a decision
unacceptable
Risk Communication
Risk Control
Risk Reduction • Ensuring that

ongoing Quality Risk Management processes operate
responsibility
Management
Risk Acceptance
• Coordinating
Team Output / Result of the quality risk management process
approach Quality Risk Management Process
across various functions and departments
Risk Review
Review Events
• Supporting
ICH
ICH Q9 Q9 the team approach
policy/guidance.
Content Content
4. General Quality Risk Management Process 4. General Quality Risk Management Process
Team approach When to initiate and plan a QRM Process
• Usually, but not always, undertaken by interdisciplinary • First define the question which should be answered
teams from areas appropriate to the risk being (e.g. a problem and/or risk question)
considered e.g. > including pertinent assumptions identifying
> Quality unit the potential for risk
> Development
> Engineering / Statistics • Then assemble background information and/ or data
> Regulatory affairs on the potential hazard, harm or human health impact
> Production operations relevant to the risk
> Business, Sales and Marketing
> Identify a leader and necessary resources Initiate Quality
> Legal
Risk Manage ment Process
Risk Assessme nt
Risk Identification
> Medical / Clinical > Specify a timeline, deliverables and Risk Analysis
Risk Evaluation
Risk Management t ools

Risk Comm uni cation
unacceptable
appropriate level of decision making

Risk Control
> &… Individuals knowledgeable of the QRM processes

Risk Reduction
Risk Acceptance
for the QRM process

Output / Result of the Quality
Risk Review
ICH Q9 Review Events
Content Content
When to apply Quality Risk Management? 4. General Quality Risk Management Process
Should risks
be assessed? Risk Assessment
1. What might go wrong?
2. What is the likelihood (probability) 3 fundamental
Are there clear rules it will go wrong? • Risk Identification
for decision making?
No or 3. What are the consequences (severity)? questions
e.g. regulations
justification needed
What might go wrong?
Can you answer
the risk assessment
questions? No
• Risk Analysis
“formal RM“
What is the likelihood (probability) it will go wrong?
Yes Agree on a team
Yes
“no RM“
“informal RM“ (small project)
• Risk Evaluation
Risk assessment not required Initiate Risk assessment Select a Risk Management tool What are the consequences (severity)?
(No flexibility) (risk identification, analysis & evaluation) (if appropriate e.g. see ICH Q9 Annex I)
Follow procedures Carry out the

Note: People often use terms Initiate Quality
Run risk control Risk Manage ment Process
(e.g. Standard Operating Procedures) “Risk analysis”, “Risk assessment” and

Risk Assessme nt
(select appropriate measures) quality risk management process Risk Identification
Risk Analysis
“Risk management” interchangeably

Risk Evaluation

unacceptable
Risk Control
Document results, Risk Reduction
Document the steps

which is incorrect!
Risk Acceptance
decisions and actions Output / Result of the Quality

Risk Review
Based on K. Connelly, AstraZeneca, 2005 ICH Q9 Review Events
Content Content
Risk Assessment: Risk Identification Risk Assessment: Risk Analysis
“What might go wrong?” “What is the likelihood it will go wrong?”
• A systematic use of information • The estimation of the risk

to identify hazards associated with the identified hazards.
referring to the risk question or problem
• A qualitative or quantitative process of linking
> historical data
the likelihood of occurrence and severity of
> theoretical analysis Initiate Quality harm Initiate Quality
Risk Manage ment Process Risk Manage ment Process
> informed opinions

Risk Assessme nt Risk Assessme nt
• Consider detectability if applicable

Risk Identification Risk Identification
Risk Analysis Risk Analysis
Risk Evaluation Risk Evaluation


unacceptable unacceptable
> concerns of stakeholders

Risk Control Risk Control
(used in some tools)

Risk Reduction Risk Reduction
Risk Acceptance Risk Acceptance
Output / Result of the Quality Output / Result of the Quality

Risk Review Risk Review
policy/guidance.
Content Content
Risk Assessment: Risk Analysis Risk Assessment: Risk Evaluation
Often data driven
Keep in mind: “What is the risk?”
Statistical approach may or may not be used
• Compare the identified and analysed risk
• Maintain a robust data set! against given risk criteria
• Start with the more extensive data set and reduce it
• Consider the strength of evidence
• Trend and use statistics (e.g. extrapolation) for all three of the fundamental questions
• Comparing between different sets requires > What might go wrong?
compatible data
Initiate Quality
Initiate Quality
> What is the likelihood (probability) it will go wrong?

Risk Assessme nt
Risk Assessme nt
Risk Identification
Risk Identification
Risk Analysis
Risk Analysis
• Data must be reliable

Risk Evaluation
> What are the consequences (severity)?
Risk Mana ge me nt t ools

Risk Evaluation
Risk Comm unication

unacceptable

unacceptable
Risk Control
Risk Control
Risk Reduction
Risk Reduction
Risk Acceptance
Risk Acceptance
• Data must be accessible

Risk Review
Risk Review
Review Events
Review Events
Content Content
Risk Assessment: Risk Evaluation Risk Control: Decision-making activity
A picture of the life cycle = Risk Priority Number
• Is the risk above an acceptable level?
Probability x Detectability x Severity • What can be done to reduce or eliminate risks?
Can you find it?
• What is the appropriate balance

Data refers to
• Frequency of
“occurences” between benefits, risks and resources?
Impact
driven by
the number • Are new risks introduced as
of trials
• Degree a result of the identified Initiate Quality
risks being controlled?

Risk Assessme nt
of belief
Risk Identification
Risk Analysis
Risk Evaluation

unacceptable
Risk Control
Risk Reduction
Risk Acceptance
past today future time

Risk Review
Content Content
Risk Control: Residual Risk Risk Control: Risk Reduction
• The residual risk consists of e.g. • Mitigation or avoidance of quality risk

> Hazards that have been assessed and
• Elimination of risks, where appropriate
risks that have been accepted
> Hazards which have been identified but • Focus actions on severity and/or probability
the risks have not been correctly assessed of harm; don’t forget detectability
> Hazards that have not yet been identified
> Hazards which are not yet linked to the patient risk • It might be appropriate to revisit the
risk assessment during the life cycle
• Is the risk reduced to an acceptable level? for new risks or increased significance
Initiate Quality
Initiate Quality
Risk Assessme nt
Risk Assessme nt
Risk Identification
Risk Identification
> Fulfil all legal and internal obligations

Risk Analysis
of existing risks
Risk Analysis
Risk Evaluation
Risk Evaluation
Risk Comm unication
unacceptable
unacceptable
Risk Control
Risk Control
Risk Reduction
> Consider current scientific knowledge & techniques

Risk Reduction
Risk Acceptance
Risk Acceptance

Risk Review
Risk Review
ICH Q9
Review Events
Review Events
policy/guidance.
Content Content
Risk Control: Risk Acceptance Risk Control: Risk Acceptance
• Decision to
• Discuss the appropriate balance between
> Accept the residual risk benefits, risks, and resources
> Passively accept non specified residual risks
• Focus on the patients’ interests and
good science/data
• May require support by (senior) management
• Risk acceptance is not
> Applies to both industry and competent authorities > Inappropriately interpreting
Initiate Quality
Risk Manage ment Process Initiate Quality
data and information

Risk Assessme nt
Risk Assessme nt
Risk Identification
Risk Identification
Risk Analysis
Risk Analysis
Risk Evaluation
• Will always be made on a case-by-case basis

unacceptable Risk Evaluation
> Hiding risks from management /
Risk M anagement t ools

unacceptable
Risk Control
Risk Control
Risk Reduction
Risk Reduction
Risk Acceptance
Risk Acceptance

Risk Review
Review Events
competent authorities Output / Result of the Quality
Risk Review
Review Events
Content Content
ICH Q9 QUALITY RISK MANAGEMENT ICH Q9 QUALITY RISK MANAGEMENT EXAMPLE
What is an “acceptable risk”? 4. General Quality Risk Management Process

Risk Control: Risk Acceptance A Risk Risk reduction step
finished
Who has to accept risk? Acceptance process
• Decision Maker(s) 1/3 Finish baseline for
risk acceptance decision
> Person(s) with the competence and authority risk identification, risk analysis,
to make appropriate and timely risks evaluation, risks reduction
quality risk management decisions

• Stakeholder No
Stakeholders
involved as appropiate?
> Any individual, group or organization
that can …be affected by a risk Yes
> Decision makers might also be stakeholders

Revisit All identified Initiate Quality
> The primary stakeholders are the patient, healthcare

No Risk Assessme nt
risk assessment step risks assessed? Risk Identification
professional, regulatory authority, and industry

Risk Analysis
(ICH Q9, definition)

Risk Evaluation

unacceptable
Risk Control
> The secondary stakeholders are

Risk Reduction
Yes Risk Acceptance
patient associations, public opinions, politicians

Risk Review
Review Events
Content Content
ICH Q9 QUALITY RISK MANAGEMENT EXAMPLE ICH Q9 QUALITY RISK MANAGEMENT EXAMPLE
4. General Measures/ 4. General Quality Risk Management Process

actions needed?
Quality A Risk Acceptance process 3/3
Yes
Risk
Evaluate measures
Management on severity, probability, detectability Is a risk
No
reducible?
Process Check needed resources
e.g. employee, money Yes
A Risk No
Revisit
risk assessment step
No
Accept the
residual risk?
Yes
Advantage
outweighs risk?
Measures / Actions Revisit
Acceptance appropriate?
No
risk reduction step
Yes No
process Yes Accept risk Risk not acceptable
2/3 Sign off documentation Sign off documentation
Other hazards
Yes
caused?
Initiate Quality Initiate Quality
Risk Assessme nt Ready for communication Risk Assessme nt

No Risk Analysis Risk Analysis



Is a risk Risk Acceptance Risk Acceptance
reducible?

Review Events Review Events
policy/guidance.
Content Content
Risk Communication Risk Communication
• Bi-directional sharing of information
about risk and risk management • Exchange or sharing of information, as appropriate
between the decision makers and others
• Communicate at any stage of the QRM process • Sometimes formal sometimes informal
• Communicate and document > Improve ways of thinking and communicating
the output/result of the QRM process appropriately
• Communication need not be carried out • Increase transparency
for each and every individual risk acceptance
Initiate Quality Initiate Quality

Risk Analysis Risk Analysis
• Use existing channels as specified in

Risk M anagement t ools



regulations, guidance and SOP’s Output / Result of the Quality


According to ICH Q9 Review Events Review Events
Content Content
Quality risk management 4. General Quality Risk Management Process

Risk review: Review Events
Communication
facilitates trust
and understanding • Review the output / results of the QRM process
• Take into account new knowledge and experience
• Utilise for planned or unplanned events
Regulators Industry
• Implement a mechanism to review or monitor events
operation operation • Reconsideration of risk acceptance decisions,
- Reviews - Submissions
as appropriate
Initiate Quality
- Inspections - Manufacturing
Risk Assessme nt
Risk Identification
Risk Analysis
Risk Evaluation

unacceptable
Risk Control
Risk Reduction
Risk Acceptance

Risk Review
Content Content
5. Risk Management Methodology Expectations on methods and tools
• Supports science-based decisions

• A great variety are listed but other existing or
new ones might also be used
• No single tool is appropriate for all cases
One method
“all inclusive”? • Specific risks do not always require the same tool
• Using a tool the level of detail of an investigation will
vary according to the risk from case to case
• Different companies, consultancies and competent
Initiate Quality
Risk Assessme nt
Risk Identification
Risk Analysis
Risk Evaluation
authorities may promote use of different tools based

unacceptable
Risk Control
Risk Reduction
on their culture and experiences

Risk Acceptance

Risk Review
Cartoon: © Zurich Insurance Inc.

Review Events
policy/guidance.
Content Content
Contributing items to manage quality risks 5. Risk Management Methodology

• System Risk (facility & people) • Supports a scientific and practical approach to
> e.g. interfaces, operators risk, environment, decision-making
components such as equipment, IT, design elements
• System Risk (organisation) • Accomplishing steps of the QRM process
> e.g. Quality systems, controls, measurements, > Provides documented, transparent and
documentation, regulatory compliance reproducible methods
• Process Risk > Assessing current knowledge
> e.g. process operations and quality parameters > Assessing probability, severity and Initiate Quality
sometimes detectability
• Product Risk (safety & efficacy)

Risk Assessme nt
Risk Identification
Risk Analysis
Risk Evaluation

unacceptable
Risk Control
> e.g. quality attributes:

Risk Reduction
Risk Acceptance
measured data according to specifications

Risk Review
Content Content
5. Risk Management Methodology Annex I: Risk Management Methods and Tools

• Provides a general overview of
• Adapt the tools for use in specific areas and references for some of the primary tools
• Combined use of tools may provide flexibility • Might be used in QRM by industry and regulators
• The degree of rigor and formality of QRM • This is not an exhaustive list
> Should be commensurate with the complexity and • No one tool or set of tools is applicable to every
/ or criticality of the issue to be addressed and situation in which a QRM procedure is used
reflect available knowledge
• For each of the tools
• Informal ways Initiate Quality
> Short description & reference Initiate Quality
> empirical methods and / or

Risk Analysis
Risk Evaluation > Strength and weaknesses Risk Analysis
Risk Evaluation


internal procedures
> Purely illustrative examples


Content Content
Overview: Some tools and their key words 5. Risk Management Methodology
• Failure Mode Effects Analysis (FMEA) • Supporting statistical tools
> Break down large complex processes into manageable steps
• Failure Mode, Effects and Criticality Analysis (FMECA) > Acceptance Control Charts (see ISO 7966)
> FMEA & links severity, probability & detectability to criticality > Control Charts (for example)
¾ Control Charts with Arithmetic Average and
• Fault Tree Analysis (FTA)
Warning Limits (see ISO 7873)
> Tree of failure modes combinations with logical operators ¾ Cumulative Sum Charts; “CuSum” (see ISO 7871)
• Hazard Analysis and Critical Control Points (HACCP) ¾ Shewhart Control Charts (see ISO 8258)
> Systematic, proactive, and preventive method on criticality ¾ Weighted Moving Average
• Hazard Operability Analysis (HAZOP) > Design of Experiments (DOE)
> Brainstorming technique ¾ Pareto Charts
• Preliminary Hazard Analysis (PHA) Risk Assessme nt
Initiate Quality
Risk Identification
> Process Capability Analysis
Initiate Quality
Risk Assessme nt
Risk Identification
> Possibilities that the risk event happens Risk Analysis Risk Analysis
> Histograms

• Risk ranking and filtering

> Compare and prioritize risks with factors for each risk Risk Review
> Use others that you are familiar with…. Output / Result of the Quality
Risk Review
Review Events
policy/guidance.
Content Content
5. Risk Management Methodology 6. Integration into

Industry and Regulatory Operations
• Foundation for “science-based” decisions
• Does not obviate industry’s obligation
to comply with regulatory requirements
• May affect the extent and level
of direct regulatory oversight
• Degree of rigor and formality commensurate with
Q9 does not provide the complexity and/or criticality of the issue
• Implement QRM principles when updating
“drivers licences” existing guidelines
ICH Q9
Content Content
Annex II: Potential Applications for QRM Annex II: Potential Applications for QRM
This Annex is intended to identify potential uses of Quality risk management as part of
quality risk management principles and tools by • Integrated quality management
industry and regulators.
> Documentation Competent
However, the selection of particular risk management authorities
> Training and education
tools is completely dependent upon specific facts and
circumstances. > Quality defects
Industry
These examples are provided for illustrative purposes and > Auditing / Inspection
only suggest potential uses of quality risk management. > Periodic review
This Annex is not intended to create any new > Change management / change control
expectations beyond the current regulatory requirements. > Continual improvement
ICH Q9 Introduction to Annex II
Content Content
RE
Annex II:Potential opportunities

DU
C TIO CE
N AN
TION PT
EVALUA CE
for conducting quality risk management
AS
CRITERIA SE AC
S SM
ANALYSIS EN
T ENTS
W EV
Y REVIE
CONTROL
IN
ER IT
Quality risk management as part of SE V TIO
N K)
TE
ICA COMMUNICATION SIDUAL RIS

IT Y NTIF
(RE
R
ACCEPT
D EA
BIL IDE
IS M
BA
T
C S
O
T`?
IP
• Regulatory operations Competent PR

HA
LI
N
W
AR
authorities
PROCESS
Y
Preliminary Hazard Analysis PHA
> Inspection and assessment activities Fault Tree Analysis FTA ASSESSMENT
FMECA N
Failure Mode, Effects & Criticality Analysis INSPECTIO
LATORY
Failure Mode Effect Analysis FMEA REGU
ICH Q9
• Industry operations TIO N U
HAZOP TOOLS APPLICA Q PRODUCTION
Hazard Operatibility Analysis Quality Risk INDU
ST RY
HACCP MATERIALS
Management
> Development
Hazard Analysis & Critical Control Points
L QUAL
INFORMA ITY Mg CHAN
K PR GE CO
> Facilities, equipment and utilities Industry RIS IN

C IP
t.
AUDITIN
G
NTRO
L
LE TRAINING
RD
Y S
ERIT
> Materials management
PATIE DOC
SEV
ZA
NT PR UMEN
M OTEC TA
HA
HAR TION TIO

N
OF
> Production Competent BAB
ILIT
Y
A GE
EF
FO
RT
PRO AM
authorities EO
FD
AR
M
> Laboratory control and stability testing CA
US
EO
FH
US
CA
> Packaging and labelling Peter Gough, Stephan Roenninger, Bill Paulson, ICH Q9 Provides Implementation
ICH Q9 : Quality Risk Management - an update Framework for Quality Risk Management
Regulatory Affairs Journal, 16, 2005, 91-93 QUALITY SYSTEM Gold Sheet, 39, May 2005
prepared by some members of the ICH Q9 EWG for example only; not an official policy/guidance July 2006, slide 143 prepared by some members of the ICH Q9 EWG for example
© J.only;
Arce,not F.
an official policy/guidance
Hoffmann-La Roche July 2006, slide 144
policy/guidance.
Content Initiate
Frequently Asked Questions (FAQ)
Risk Assessment
Risk Identification
Risk Analysis
Quality
Risk Evaluation
unacceptable
Risk Management

Risk Communication
Risk Control
Risk Reduction
Risk Acceptance
ICH Q9
Output / Result of the
Frequently Asked
Risk Review
Review Events Questions (FAQ)

Use the right “risk”
risk” expression Disclaimer: This presentation includes the authors views on quality risk management theory and practice.
The presentation does not necessarily represent official guidance or policy of authorities or industry.
please!
Frequently Asked Questions (FAQ) Frequently Asked Questions (FAQ)

Purpose of this part What makes Q9 different?

• It provides principles and a framework
for decision making
• To provide answers to questions that have been > Q9 is a quality improvement methodology
frequently asked of members of the ICH Q9 Expert
Working Group. • It is a “guidance” not an “SOP”
> Simple
> Flexible
> Not mandatory
• It supports science-based decision making
> Facilitates communication and transparency
> Supports build up trust
• Q9 is for both industry and competent authorities (CA)

How can Q9 be implemented? How can Q9 be implemented? ICH Q9
Existing
• It can be implemented by industry and competent d
internal ase
k-b ch
authorities (reviewers and inspectorates) documentation Where Ris proa r
ng
to be in ap e
al risk
t h nt
ki
residu ble
system id
in
se me
• The ICH Q9 document: future? ns Q9

ta
Co CH
ba ple
(Mission, Policy)
d
ls
I
A
> Main body explains the “What?”

ris Im
too
E
ific or
What to do?
M
f
> Annex I give ideas on the “How?”

k-
e.g. F
s
(e.g. Directives)
ple
list of
ec
> Annex II give ideas on the “Where?”

us Exam
sp
How to do?
> Pharmaceutical Development (ICH Q8) and
in g
(e.g. Guidelines)
Quality Systems (ICH Q10) will facilitate the use of Q9
Detailed instructions
• Do not set up a QRM department (e.g. Standard Operating Procedures)
Records
• See following slide indicate some of the impacts that

Rules & Procedures Records &
ICH Q9 can have on an existing documentation system. (internal regulations) Reports
policy/guidance.
How to select the tool for my needs? What is an “acceptable risk”?
• The level of detail and quantification needed • This has to be decided in the context of each
helps to determine the tool to use: specific risk management problem
> Methodology • If you put in precise and definite data, you will receive
e.g. formal or informal risk management process a clear answer. This enables decision makers to make
> System risks good and transparent decisions
e.g. risk ranking and filtering, FMEA
• Accept residual risk, where further effort to reduce a
> Process risks
e.g. FMEA, HACCP, process mapping, flow charts risk is disproportional to the protection of the patient
> Product risks • Always remember: The protection of the patient
e.g. flow charts, decision trees, tables, check sheets
• It’s up to the organization whether they accept risks
that meet the principles of QRM

What is an “acceptable risk” to quality? What is a residual risk?

e.g. discrepancy, • Residual risk addresses hazards that
complaint,
An event deviation, issue,
> Have been assessed and
risks that have been accepted
potential recall
> Have been identified but
Considerations: the risks have not been correctly assessed
• “Industrial risk” could be different from “political risk” > Have not yet been identified
> Are not yet linked to the patient risk
• Notion of "risk" could be not the same for
industry and competent authority (CA) • Is the risk transferred to an acceptable level?
> Consider current scientific knowledge & techniques
• CA are often face to face with public opinion and
> Fulfil all legal and internal obligations
politicians
• Compromise according to ICH Q9: As hazards remain
“link back to the protection of the patient” Zero risk is never possible

What is the content of the “output/result” box? When to stop a QRM process?
• When you decide, through a risk management process,
• The rationale and output have to be communicated that a certain residual risk is acceptable,
after decision making you can close your QRM process for that particular risk
> The means and records of what is communicated > You should communicate the outcomes on that QRM
will vary in individual circumstances process, as appropriate, to stakeholders
• Adequate documentation • However, quality risk management process is

continuous and the outputs/results may or may not
> The choice from short summary to detailed report need to be reviewed frequently during the life cycle
is case dependant
> The need to review or not should be decided based upon
> It should contain the rationale and conclusions the level of accepted risk and other cumulative factors
(e.g. process changes, events)
see section 4 of ICH Q9 document
policy/guidance.
How will Q9 be involved in the submission Will ICH Q9 be applied by competent authorities as
and review process? they develop / review regulations?
Q9 supports presentation of scientific arguments: • There have already references been made to the use
of ICH Q9 principles in recent regulatory documents.
• For proposals in the submission This indicates the awareness and commitment to ICH
Q9 in some competent authorities
• For answering subsequent questions and • There are some existing and proposed regulations
proposals the reviewers may raise which do not recognise the use of ICH Q9 principles.
It is the hope and expectation that this will be taken
• When linked with “Pharmaceutical development” into account as the opportunity arises for revision or
(ICH Q8) it might avoid the need for such questions prior to publication
by reviewers

How will Q9 activity be inspected/audited? How will Q9 activity be inspected/audited?

• However inspections/audits already focus on
No structured Quality Risk Management QRM activities e.g.
> How the problems have been solved?
in place > What corrective and preventive measures have been taken?
= • Inspectors/Audits might review/inspect:
> Whether the quality risk management performed is
In theory integrated in the Quality System of the organization
> Traceability, transparency
• no observation > How was the decision made?
• No recommendation > Was a (risk) problem / question defined?

> Did the process performed answer this question?
because using ICH Q9 is not mandatory > Were the appropriate functions allocated to all teams?
> Were the right documents recognized?
> Was the decision based on scientific knowledge?
Frequently Asked Questions (FAQ)

How will Q9 outcomes be reviewed and inspected?
• Competent authorities will check if the science used

for the quality risk management process is acceptable
• Competent authorities may not accept the outcome of

the risk management process if it is not satisfactory in
terms of science
> Debate and seek agreement on science
prepared by some members of the ICH Q9 EWG for example only; not an official policy/guidance July 2006, slide 161
policy/guidance.

Media 3198

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Media 3198

Uploaded by

Copyright:

Available Formats

Layout Draft

ICH Q9 QUALITY RISK MANAGEMENT

prepared by members of the ICH Q9 EWG slide 2 , July 11, 2006

• The evaluation of the risk to quality should be based on scientific

To support the implementation of Quality Risk Management into daily operations

One purpose is to provide general guidance and references for some of

On the ICH Q9 document slides are available on:

Executive summary for regulators and industry HTML PPT

Background HTML PPT

History HTML PPT

Content HTML PPT

Tools - overall notes HTML PPT

Basic Risk Management Facilitation Methods HTML PPT

Fault Tree Analysis (FTA) HTML PPT

Hazard Analysis and Critical Control Points (HACCP) HTML PPT

Hazard Operability Analysis (HAZOP) HTML PPT

Preliminary Hazard Analysis (PHA) HTML PPT

Risk Ranking and Filtering HTML PPT

Supporting Statistical Tools HTML PPT

Combination of Tools HTML PPT

Application - overall notes HTML PPT

Integrated Quality Management HTML PPT

Regulatory Operations HTML PPT

Development HTML PPT

Facilities, Equipment and Utilities HTML PPT

Materials Management HTML PPT

Production HTML PPT

Laboratory Control and Stability Studies HTML PPT

Packaging and Labelling HTML PPT

Frequently Asked Questions (Q&A) HTML PPT

• Executive summary, Background, History, Content and FAQ

Also supported by EFPIA and JPMA ICH Q9 Topic Groups.

The situation today

Risk Management > Increasing external requirements

ICH Q9 > Growing complexity and scope of risks

Executive summary Executive summary

New Regulatory Paradigm The new paradigm

Executive summary Executive summary

Past: Used, however poorly defined

life cycle (perceived Risk

The Desired State driven by ICH Q9 The Desired State

• Manage risk to patient, based on science: • Barriers to continuous improvement

Executive summary Executive summary

• Pharmaceuticals have lagged behind related • Improves decision making

Executive summary Executive summary

Why did we need ICH Q9? Quality Risk Management is NOT

• To ensure a common understanding of

• ICH Q9 explains HOWEVER

What does Senior Management need to do? Conclusions

Executive summary Executive summary Focus resources

Keep always in mind the

Principles of Quality Risk Management

The evaluation of The level of effort,

Purpose of this part

ICH Q9 • Give an aid by providing some points of discussions

• The ICH process • The ICH process

• Opportunities, Challenges and Benefit • Opportunities, Challenges and Benefit

EWG’s include observers and

for Registration of pharmaceutical QA

Pharmaceuticals clinical studies

for Human Use in human subject

Agenda ICH Q-Documents

ICH Q9 Link back to patient risk Risk Management across the

Managing the risk of drug New Regulatory Paradigm