GMP Application of Risk Assessment

in Qualification, Validation & Change Contr ol

Kevin ODonnell
Inspector, IMB
Information Day, 15th October 2004
1

EU GMPs, Annex 15 states

A risk assessment approach should be used to determine the
scope and extent of validation.
The likely impact of changesshould be evaluated, including
risk analysis.
Proposed Annex 18 / ICH Q7A states .
The potential impact of the proposed changeshould be
evaluated. Scientific judgement should determine what
additional testing and validation studies are appropriate to
justify a change in a validated process.
2

Topics which will be covered:

The Legal Basis for requiring Risk Assessment

References to Risk/Risk Assessment in the EU GMPs, examples of how

Risk Assessment can be used to determine the Scope & Extent of
Qualification & Validation, & in Change Control

Risk Concepts, Definitions & General Considerations

Risk Assessment & Risk Management Tools

What Companies may expect during IMB Inspections

______________________

Appendix 1 Case Study: Presentation & Use of a Risk Assessment Tool

Applicable in GMP Environments
Appendix 2 Other EU GMP Risk References & Examples
Appendix 3 Bibliography

Legal Basis

Risk Assessment/Risk Analysis written requirement of the EU GMPs

Irish Manufacturing Regulations, SI No. 40/1993 (H), & SI No.
179/1996 (V) as amended, set out conditions on which IMB
Manufacturing licences are granted
Condition No. 18 Manufacturing Licence (Human) states: The
licence holder shall comply with the principles and guidelines of
GMP.. laid down in Directive 2003/94/EC
Condition No. 19 Manufacturing Licence (Vet) states: The licence
holder shall comply with the principles and guidelines of GMP..
laid down in Directive 91/412/EC..
EU GMP Guide given legal standing in EU via GMP Directive
2003/94/EC, Ref: Article 3(2), and Dir. 91/412/EC, Articles 3 & 4
4

Chapter 1 Quality Management (Principle)

Manufacturers must ensure their medicinal products do not place
patients at risk due to inadequate safety, quality of efficacy
Comment & Example

Many recalls occur every year because medicinal products

manufactured with validated processes do in fact put patients
at risk

e.g. in 2003, over 50 batches of a potent analgesic product were

recalled to patient level worldwide, including one batch on the
market in Ireland, due to concerns of non-uniformity of content
of the active ingredient in the product.
5

Example Contd

A pro-active risk assessment approach could have determined

that the extent of process validation performed was deficient
as validation had not adequately addressed API particle size
homogeneity issues

Chapter 2 Personnel, 2.1

The responsibilities placed on any one individual should not be so
extensive as to present any risk to quality.
Comment & Example:

Validated packaging processes resulted in many products being

packaged with the wrong Patient Information Leaflets in recent
years

Many recalls to retail level in Ireland were required

e.g. In some companies, resources dedicated to artwork control and

packaging component compliance can be deficient from a personnel
perspective.

Example Contd

An inadequate no. of people may be in place for managing

packaging component compliance (e.g. for a no. of company
manufacturing sites, & for a large no. of company products.)

Non-compliances can easily occur

A risk assessment approach can identify and reduce the risk of

non-compliance, & packaging validation requirements can be
better identified.

A risk assessment approach can help determine that the scope

of packaging validation should extend to artwork control &
packaging component compliance activities
8

Chapter 3 Premises & Equipment, 3.39

Production equipment should not present any hazard to the products.
Example:
A polyurethane scraper was used to scrap down the sides of a dryer to
dislodge dried product. The scraper was corroded and damaged when
inspected (doubt over product quality)

A risk assessment approach could have identified the need to qualify

or validate the use of this ancilliary equipment during either the
Performance Qualification (PQ) of the dryer, or the process validation
of the drying and discharging process (PV).

Thus, a risk assessment approach here could have helped determine

the extent of Qualification or Validation.

Annex 15 Qualification & Validation

A risk assessment approach should be used to determine the scope and
extent of validation.
Example
Upon inspection, one companys Validation Master Plan showed that
cleaning validation was not included

i.e. the scope of the companys validation programme did not extend to
the validation of cleaning procedures

This was a multi-product plant.

Company Rationale: each equipment train was dedicated to a specific

product

10

IMB is willing to accept this rationale if justified

A Risk Assessment approach can be used to justify this, or it can show

that some cleaning validation is required.

e.g. during campaign manufacturing of a non-sterile API for use in a

sterile medicinal product, residues can build up in equipment, e.g. in
mixing vessels, centrifuges & dryers, and cleaning intervals may
require validation to address microbial and endotoxin levels in
residues.

Risk Assessment can help determine risks associated with residues in

dedicated equipment, and can help determine the extent of cleaning
validation required, if any.

11

Appendix 2 to this presentation.

Other Selected References to Risk & Risk Assessment, together with other examples
of where Risk Assessment can be used to determine the scope and extent of
validation, are presented for.

Chapter 5 Production
Annex 1 - Manufacture of Steriles
Annex 2 - Biologicals for Human Use
Annex 4 - Veterinary Products other then IVMPs
Annex 8 Sampling of Starting & Packaging Materials
Annex 9 - Liquids, Creams & Ointments
Annex 13 Investigational Medicinal Products
Annex 15 Qualification & Validation
Annex 17 Parametric Release
Proposed Annex 18 GMPs for APIs (ICH Q7A)

12

Risk Concepts, Definitions & General

Considerations

13

What is risk?
Many Definitions:

It is widely accepted that the concept of risk has two

components Chance & Consequences:
How likely is the scenario to happen?
If it does happen, what are the consequences?

Key Considerations:

The probability of occurrence of harm, (chance, possibility,

uncertainty, etc.)
The consequences or severity of that harm, (injury, cost,
supply issues, etc.)

14

A Risk Definition

Risk is the combination of the probability of occurrence of

harm and the severity of that harm
Risk = Probability x Severity
Risk = (P x S)

Risk can be Quantified or Qualified

Risk = (4 x 3) = 12
Risk = (Moderate x Major) = Unacceptable

15

What about Detection?

Are Detection Controls not taken into account?

Is Risk Not (Probability x Severity x Detection)?

Risk Priority Number (P x S x D) often used, especially in
FMEA, FMECA
Advantage simple concept, easy to use and understand

Comment

There is much confusion about where to consider detection

controls during Risk Assessment.

16

Detection Contd

If the detection controls serve to prevent the failure from

occurring, then detection will reduce the probability of
occurrence, and should be considered when estimating the risk
during Risk Assessment.

However, if the detection controls serve only to detect the failure

once it has occurred, then these detection controls should not be
used to estimate the risk during the Risk Assessment process
they should be considered as part of Risk Control measures

17

Hazards & Failure Modes

A Hazard is a potential source of harm

e.g. an untrained analyst performing dissolution testing

A Failure Mode is a way in which a process can fail to provide the

anticipated result.
it is a term used in some risk assessment tools, e.g. FMEA
e.g. a malfunctioning pump feeding material to a nano-mill is a failure
mode
The feed rate may be critical to the particle size reduction result
achieved, and this can directly impact upon the bioavailability of
the API in the medicinal product.

18

What is Risk Assessment?

Risk Assessment is a method which

identifies hazards or failure modes in a process, facility, system

or product*
estimates or calculates the risk associated with these hazards or
failure modes*
assesses that risk by comparing it against predefined risk
acceptability criteria**

Risk Assessment tells us whether a risk is acceptable or not!

* This is often called Risk Analysis
** This is often called Risk Evaluation
19

What is Risk Control?

A process in which risks are reduced or maintained within

specified levels. It occurs after Risk Assessment.

Helps you determine what detection or other controls are already

in place to maintain the risk within specified levels

Helps you determine whether these controls give assurance that

the risk is adequately controlled & no further controls required

Helps you determine what additional actions or controls are

needed to reduce the risk or maintain it within specified levels

20

Additional Controls could include:

Eliminating the hazard by designing it out of the process

Designing in Redundancy
Building in new & improved Detection Mechanisms
Improving Preventative Maintenance Activities
Training Operators to better detect the effects of the failure mode
Risk Control work also helps determine Critical Control Points,
(or Critical Process Parameters), how they will be monitored, and
what level of Qualification & Validation are required

21

What is Risk Management?

The combination of Risk Assessment & Risk Control, with

mechanisms for Periodic Review of the RA, and for Risk
Communication
Periodic Review uses new info (e.g. market surveillance,
deviations, process experience, etc.), to increase knowledge
about hazards, and to improve the Risk Assessment

Risk Management should be viewed as an on-going Quality

Management process

22

Some General Considerations for Risk

Assessment and Risk Management
Start Early!
It is more difficult and more costly to make changes to a
process, facility, system or product after the fact than early on
Map the Process. and do this well.
A well mapped process is usually a major advantage when
doing Risk Assessment work

This is also a prerequisite of most Risk Assessment tools, eg

FMEA, HACCP
23

General Considerations Contd

Hazard / Failure Mode Identification is perhaps most crucial step!
A variety of approaches can be used here, e.g.

Brain-storming within the right team of people

Cause & Effect Diagrams
Complaint & Deviations Data
Fault Tree Analysis
Human Factors Engineering & Heuristic Analysis
Statistical Design of Experiments Methodologies
24

General Considerations Contd

When estimating risk, there are statistical tools available which
help determine the Probability of Occurrence of a hazard or
failure mode:

Process Capability Analysis (CpK)

Control Charts
Cumulative Sum Charts
Analytical Simulation Techniques
Also, Complaint Rates, Deviations Information, & Expert
Judgement can be used to determine Probability of Occurrence
25

Risk Should we Quantify or Qualify?

Most Risk Assessment methods require you to determine the Probability of

Occurrence of a failure mode or hazard

But accurate Probability of Occurrence info can often be very difficult to

establish!

Reasons:
Probability relates not to the effects of the failure, but to the probability of
occurrence of the failure mode itself or to its cause, and this can be difficult to
determine accurately

Some hazards occur because of systematic errors, as opposed to random

errors. & systematic errors are difficult to quantify
e.g. errors of commission or omission which, under some set of circumstances,
result in a hazardous situation

26

Quantify vs Qualify?

Severity & Probability are ordinal scales

their magnitude is not meaningful
a Probability of Occurrence of 4 is higher but not necessarily twice as likely as a
Probability of 2
it is not mathematically permissible to multiply ordinal scales.
numerical operations such as (Risk = 3 x 4) or (Risk = 3 x 4 x 2) have questionable
validity

Word descriptors (e.g. high, medium, low) may be more valid than numerical
descriptors, and are preferable, because we will not then be tempted to multiply
categories

More recent publications, e.g. ISO 14971 Application of Risk Management to

Medical Devices do not actively promote numerical operations in risk
determination.

27

Quantify vs Qualify - Conclusion

Inadvisable to place too much faith in risk quantitation

A good qualitative estimation is better than a poor quantitative
estimation
Risk assessment is not an exact science imagination, expert opinion,
etc.
Charles Dickens highlighted the absurdity of misunderstanding risk
numbers
One day, in late December, he announced he couldnt ride the train
anymore that year because the average annual quota of railroad
accidents had not been filled and disaster was obviously imminent!

28

Risk Assessment & Risk Management

Tools

29

Whats in a Name?
Many of us do Risk Assessment & Risk Management
without calling it this

Warehouse Temperature Mapping is a form of Risk

Assessment

Change Control is a Risk Management tool to a degree

A Company Validation Master Plan is a form of Risk

Management

Self-Inspection Programme is a component of Risk

Assessment

30

Risk Assessment & Risk Management Tools

Many formal tools are available

HACCP - Hazard Analysis and Critical Control Points

HAZOP Hazard Operability Analysis
FTA Fault Tree Analysis
FMEA Failure Mode & Effects Analysis
FMECA - Failure Mode, Effects & Criticality Analysis
PHA - Preliminary Hazard Analysis
ISPEs Impact Assessment Method for GEP, Commissioning &
Qualification
GAMP 4 & GAMP Forum methods

31

General Comments
Some of these techniques are complementary
FTA aids FMEA in Failure Mode Identification one is actually
the reverse of the other
HACCP aids FMECA in determining Critical Control Points
(or Critical Process Parameters)
Most tools were developed for non-pharma industries
Most do not address Qualification & Validation requirements
So some degree of modification can be required

32

What is FMECA?
Failure Mode, Effects & Criticality Analysis

A Risk Assessment tool based around Failure Modes

(A Failure Mode is a way in which a process can fail to provide

the anticipated result)

FMECA

Identifies potential Failure Modes in a system, facility, process

or product
Prioritises the Failure Modes in accordance with their risk
Puts controls in place to address the most serious concerns

33

What is HACCP
Hazard Analysis and Critical Control Points

A Risk Assessment tool based around Critical Control Points

In HACCP

Hazards & their Preventative Measures are Identified

Critical Control Points are Devised
we will use Critical Process Parameters
CCP Limits & Monitoring Methods are Established
Corrective Actions are Pre-determined for Deviations
CCPs are Verified ( or validated in our industry)
Record keeping requirements are Defined

34

Probability of Occurrence Levels

Probability

This Means The Failure Mode

Frequent

is Very Likely to Occur, > 20%

Probable

will Probably Occur, 5 20%

Occasional

should Occur at Some Time, Infrequently, 0.1 5%

Remote

Unlikely to Occur in Most Circumstances

< 0.1%

Note: These levels are arbitrary and for illustrative purposes only
35

Severity Levels
Severity

This Means the Failure Mode May Result in.

Critical

Very Significant Non-Compliance with GMP or MA

Patient Injury

Major

Significant Non-Compliance with GMP or MA,

Patient Impact

Minor

Minor Infringement of GMP / MA

No expected Patient Impact

Note: These levels are arbitrary and for illustrative purposes only
36

Risk Table Acceptance Criteria

Failure Mode

Minor
Severity

Major
Severity

Critical
Severity

Frequent
Probable
Occasional
Remote
Note: These criteria are arbitrary and for illustrative purposes only
37

Risk Table Acceptance Criteria

Failure Mode

Minor
Severity

Major
Severity

Critical
Severity

Frequent

Unacceptable Intolerable

Intolerable

Probable

Unacceptable Unacceptable

Intolerable

Occasional

Acceptable

Unacceptable

Unacceptable

Remote

Acceptable

Acceptable

Unacceptable

38

Acceptance Criteria Notes

Red Means

The Risk is Intolerable. Eliminate the Hazard or build in systems/controls to ensure the effects of th
hazard are not realised (e.g. redundant systems)

Amber Means
The Risk is Unacceptable. The Risk must be Reduced or Controlled to an acceptable level

Green Means
The Risk is Acceptable. No Reduction or New Controls are Required

39

Detection Levels
Detection

This Means.

High

High Likelihood that Controls will Detect the Failure

Mode or its Effects

Medium

Medium Likelihood that Controls will Detect the

Failure Mode or its Effects

Low

Low Likelihood that Controls will Detect the Failure

Mode or its Effects

None

Detection Controls are Absent

Note: These levels are arbitrary and for illustrative purposes only
40

Schematic Overview of GMP Risk Management

Risk Assessment

Risk Management

Hazards identified, risk estimated, decision re. risk

acceptability made

Risk Control
Risk Reduction or Risk Maintenance Controls Initiated
until Risk is Acceptable or Adequately Controlled

Periodic
Review

Qualification & Validation

requirements are determined & actioned

Risk Knowledge Is Communicated

41

What to expect during IMB Inspections

Inspectors may ask to see evidence of how Risk Assessment was used
when determining what qualification & validation work was carried out
on a certain process, piece of equipment, etc

Inspectors may ask to see evidence of how Risk Assessment was used
when designing qualification & validation protocols, and in Change
Controls

Inspectors will not require any specific Risk Assessment tool to have
been used

We will look for evidence that hazards were adequately identified and
that risks were adequately assessed & managed

We will ask to see how risk acceptability criteria were chosen

42

Appendix 1
Case Study

43

Case Study - Introduction

To demonstrate an application of Risk Assessment in GMP

environments, we have designed a simple qualitative Risk Assessment &
Risk Management tool based on

FMECA
HACCP but with Critical Process Parameters
ISO 14971 (Risk Management for Medical Devices)
Qualification & Validation requirements are built in

Key elements of this tool are described next

The retrospective application of this tool to the manufacture of a

suspension medicinal product is then presented

44

Case Study: Proposed RA Tool How it works

1.
2.
3.
4.
5.
6.
7.
8.
9.
10.

Select the Process for the Risk Assessment exercise

Assemble a Multi-Disciplinary Team
Define your Probability of Occurrence Levels
Define your Severity Levels
Draw up your Risk Acceptability Criteria (or table)
Determine your Detection Levels
Map the Process (as it stands) & present as a series of steps
Input each process step into the Risk Assessment worksheet
Work through & Complete the worksheet, as required
Implement the actions identified and communicate.
45

Case Study: The RA Worksheet Involves

a. Identifying failure modes, their causes & consequences
b. Calculating the Risk associated with each failure mode
c. Deciding is the Risk acceptable or not
d. If unacceptable: checking what detection controls are in place
e. If controls are adequate, stop the RA here & proceed to the
qualification & validation section near the end
f. If controls are inadequate, implement new Risk Control measures
& repeat steps b & c above
g. If risk still unacceptable: put new detection controls in place
h. When controls adequate, go to qualification & validation section
i. Implement the validation & qualification actions identified (and
any other actions)
46

Appendix 2
Other GMP Risk References & Examples

47

Chapter 5 Production, 5.19

Cross contamination should be avoided by.. minimising the risk
of contamination caused by re-circulation or re-entry of untreated
or insufficiently treated air.
Also
Proposed Annex 18 (ICH Q7A) Paragraph 4.22
If air is re-circulated. appropriate measures should be taken to
control risks of contamination and cross contamination.

48

Example

A change control was approved for changing the status of a dryer from
being dedicated to drying one product to drying two products

The dried products were relatively potent materials, they were exposed
to the air in the room during manual handling, and the room was
serviced with HEPA filtered re-circulated air.

No risk assessment performed as part of this change control, e.g. risks

associated with a HEPA filter failure or a HEPA filter change not
assessed.

A risk assessment approach could have helped determine whether the

change required any additional qualification or validation work for the
HVAC & cleaning controls.

49

Annex 1 - Manufacture of Steriles, 42

Risk of microbial contamination mentioned several times, also
Validation of aseptic processing should include a process simulation test
using a nutrient medium (media fill).. It should take into account.
worst case situations
Annex 15 Qualification and Validation (Paragraph 17 & 16)
Performance Qualification (PQ) should include.. production
materials. or simulated product. and tests to include a condition
or set of conditions encompassing upper and lower processing limits
(.. sometimes referred to as worst case conditions.)

50

Comment

A risk assessment approach can be used to determine the extent of

media fill validation and the extent of performance qualification of the
filling equipment
because it can help to identify which worst case conditions and
interventions pose the greatest change of product or process failure.

Worst Case a condition or set of conditions encompassing upper and

lower processing limits & circumstances, including those within SOPs,
which pose the greatest chance of product or process failure when
compared to ideal conditions. Such conditions do not necessarily
induce product or process failure.

51

Example
Examples of some worst case conditions & interventions for
evaluation via Risk Assessment

Operator fatigue
Room temperature and humidity set-point extremes
Performing the media fill after completion of the last batch in a campaign
Using the maximum defined time between completion of equipment
sterilisation and starting the media fill
Highest allowed number of personnel working in the area during the
media fill
Filling the largest vial size at the slowest operating speed
Clearing broken ampoules from a fill/seal filling area

52

Annex 2
Manufacture of Biologicals for Human Use, 39
In virus inactivation or removal processes, measures should be
taken to avoid the risk of recontamination of treated products by
non-treated products
Annex 5 - Manufacture of Immunological Veterinary Medicinal
Products (Paragraph 5)
For Immunological products, the risk of contamination by
personnel is particularly important.

53

Example

GMP controls in place for a human vaccine process did not

adequately address re-contamination risks of virus inactivated
product
a recall in Ireland & elsewhere to physician level and patient
follow-up (re-vaccination) were required.

A Risk Assessment approach in Change Control and a site-wide

understanding of the hazards associated with production changes
may have prevented the re-contamination event
a Culture of Risk Awareness reqd
this is one reason why risk communication steps are often
included in Risk Assesment/Risk Management tools
54

Annex 4
Manufacture of Vet Medicinal Products, 4
Because of the large volume of dust generated during
processing bulk material for premixes, specific attention
should be given to the need to avoid cross contamination.
e.g. via sealed transport systems and dust extraction.. buffer
zone to minimise risk of contamination of other
manufacturing areas

55

Comment & Example

A Risk Assessment approach can aid in the Design Qualification of such

premix manufacturing premises because it can help determine
whether
dedicated facilities within a multipurpose building may be used for premix
manufacturing, or
whether a separate building is required

A Risk Assessment approach can also help determine the extent of

qualification required for dust control systems and HVAC controls and
buffer zones.

Also, it is important to bear in mind that premix manufacturing can

involve the use of large quantities of vegetable matter, which can
attract insects & rodents.

56

Annex 8
Sampling of Starting & Packaging Materials

Risk not specifically mentioned

However, validation requirements before going into reduced

identity testing of starting materials are discussed

Such a change towards reduced testing would require an

approved change control, and Annex 15 requires risk analysis
as part of Change Control

Comment

Risk assessment can help determine the extent of validation

required for reduced sampling & reduced testing plans:

57

Example

One company was observed to be doing very limited identity and other
testing on a critical incoming material. (Identity and Particle size were
critical attributes.)

The material was contract manufactured by Company A, for

Company B, both outside the EU.

The material was imported into the EU by Company C, who supplied

it on to the Irish company (D), who then used the material in its
manufacturing process.

Companies A, B & C were all involved in labelling and re-labelling the

drums of the material before it reached the Irish manufacturer (D).

58

Example Contd

The drum labels contained critical identity & particle size info.

No in-house particle size testing was performed on any drum. A drum

labelling error could have been a serious mix-up.

The only validation work performed before reduced identity testing

and eliminating particle size testing was implemented was a supplier
audit performed on Company A, the manufacturer.

This extent of validation was insufficient to support the reduced

testing; a Risk Assessment approach could have picked this up.
Note: Chapters 5 & 6, and Annexes 8 & 18 of the EU GMPs discuss
supplier approval and reduced testing reqs.

59

Annex 9 Liquids, Creams & Ointments

Risk of microbial proliferation discussed. Other risks are implied, such as risk
associated with the use of glass apparatus.

Care should be taken to maintain the homogeneity of mixtures, suspensions,

etc. during filling. Mixing and filling processes should be validated.

Comment
Risk assessment can help determine the extent of validation required for mixing
and filling processes.
Example
The application of a Risk Assessment and Risk Management tool to the mixing
& filling of a suspension for paediatric use is discussed elsewhere in this
presentation

60

Annex 13
Manufacture of Investigational Medicinal Products

Risk is mentioned several times, focuses on the risk of cross

contamination and packaging mix-ups

Also, the extent of process validation is discussed.. Production

processes are not expected to the validated to the extent necessary
for routine production

Comment
This does not imply that no process validation is required! A Risk
assessment approach can help determine the extent of process
validation required.
61

Annex 15 & Proposed Annex 18

Significant changes should be validated
The likely impact of changes should be evaluated, including
risk analysis.
Comment
Risk Assessment can help determine factors that can sometimes be
overlooked.
e.g. the type of medicinal product being manufactured can impact
the extent of validation required in a Change Control

62

Example

A company plans to change its supplier of a preservative.

This preservative (mixture of propyl & methyl parabens) is used in
various company products, including a multi-dose powder for suspension
containing frusemide
This suspension is reconstituted with tap water by pharmacists, & it has a
45 day shelf life after reconstitution
More extensive validation work (e.g. Some Process Validation,
Preservative Efficacy Testing, Stability testing,) may be required to justify
this preservative change for this medicinal product than for other
products. Why?
Multi use product & potential risk associated with product opening,
closing, handling and re-use.
Potential microbial risk associated with the water used.

63

Annex 17 Parametric Release, 3.7

A risk

analysis of the sterility assurance system focussed on an

evaluation of releasing non-sterilised products should be performed.

Annex 1 - Manufacture of Sterile Medicinal Products (Paragraph 42 )

Where Parametric Release has been authorised, special attention
should be paid top the validation and monitoring of the entire
manufacturing process.
Comment
Any application for Parametric Release will require an inspection; it
will be assessed in conjunction with the IMB Assessment Function
(HML & Veterinary) and a detailed Risk Analysis will be required

64

Appendix 3 - Bibliography
See

next page

65