Risk assessment is not a new concept to the pharmaceutical industry, but lately the phrase has become a mantra. FDA’s recent guidance on process validation relies heavily on the concept, which regulators partly view as a way to make process changes possible. The industry has performed risk assessment in manufacturing and validation to reduce disruptions and ensure patients’ safety. But ICH Q9 has prompted regulators to ask for more formal documentation of the assessments than before. A systemic, science-based way to manage risk is becoming essential to meeting the spirit and letter of FDA requirements.

Assessing risk
A company’s method of collecting product and process knowledge and of managing risk should be the same throughout the product life cycle. The goal should be to create a single framework for product and process knowledge that the whole company shares. A key element of that framework is the technical risk profile, a document that identifies areas of great process variability that strongly influence the quality of the finished product, says Philippe Cini, vice-president and leader of process and operational improvement practice at Tunnell Consulting.

In addition to quantitative process data, it’s crucial for the technical risk profile to include scientists’ and engineers’ assessments about what the main sources of variability in the manufacturing process are, says Cini. The experts’ knowledge lends weight to certain process data over others, which makes it easier to understand correlations between the input (i.e., raw-material properties and process conditions) and the output (i.e., finished-product properties). After experts identify areas of risk, the company designs experiments to confirm them before developing means to control them.

To determine the probability of various failures, personnel may calculate process capability as one of several strategies. This effort requires a significant amount of data—as much as 100 or 200 lots’ worth. To come up with an estimate before these data are collected, companies “can look to similar processes for evidence of process capability and probability of defects,” says Jason Orloff, engineering statistician at PharmStat. Companies that run many processes with long histories can take this approach, but startup companies will need to rely more heavily on subject-matter experts, advanced statistical techniques, and the design of experiments.

Regulators expect firms to use a formal process to determine what risk is excessive, what risk needs to be reduced, and what can be accepted, says Mike Long, director of consulting services at Concordia ValSource. The failures that have the most severe effects on patients or processes, have relatively high occurrence rates, and are poorly controlled should be addressed first. When companies identify a way to modify the process to reduce a given risk, they must follow the change-control procedure, which includes documenting that process change and checking its effectiveness.

Review of risk assessment
After a company has completed a formal risk assessment of a product or process, it must review that assessment periodically. Regulatory guidance documents do not state how often the review must occur, but it should be done at least once a year as part of an annual review, says Long. Some agencies expect companies to review risk during quality-management reviews. “Also, any time a change is made to a product or process, risk assessments must be reviewed,” says Long. Whenever risk-management reviews occur, senior management levels of a firm should be made aware of the hazards that pose the greatest risk.

Any time a deviation happens or a process is changed, personnel should update the risk assessments to include the new information. “The risk assessments are living documents. They’re not just there to sit on the shelf,” says Long.

Industry approach
The industry’s approach to risk is more sophisticated now, but still has room for improvement. “We need to formalize and reinforce those business processes that will help us understand exactly how a process and materials behave,” says Cini. Drug companies sometimes lack certain capabilities that could help enhance product and process knowledge. For example, they may not have statisticians on their staff or individuals who can manage large amounts of data, and they “need to strenghten those capabilities,” says Cini.

In next few years, the pharmaceutical industry is likely to become more data-driven, and to embrace and exploit quality by design to a greater extent. These changes will enhance product and process knowledge, thus improving companies’ ability to design robust processes and mitigate risk effectively. As a result, firms will enjoy fewer disruptions, and patients will benefit from medicines with high and reliable quality.