Risk identification and analysis
Table 1: Risk-evaluation score.
|
As partially shown in Table I, the site has prepared a master list identifying all operations and associated systems which
have potential impact on product quality.
The risk-analysis stage of the QRM process estimates the potential harm(s) associated with each potential risks. The analysis
may be qualitative or quantitative in nature, or a combination of the two. The risk score in the current case study will be
determined by combining the probability or likelihood of a problem in a given site operation and the outcome, or potential
undesired consequences, if a problem were found in the operation. A numerical value of 1, 2, or 3 is assigned to correspond
with a low, medium, or high risk-analysis determination, respectively. The risk-evaluation score is calculated as follows:
(Probability Score × Outcome Score) = Risk Evaluation Score
The probability and outcome scores and subsequent risk-evaluation scores for the selected operations are presented in Table
I. If desired, for this application, the risk ranking and filtering tool may be modified to include consideration of the length
of time since the last audit was performed. To include this element in the risk-evaluation process, the formula for determining
the risk-evaluation score is modified to include the time since the last audit as follows:
(Probability Score x Outcome Score) + (Years since last audit) = Risk Evaluation Score
As a result of the executed QRM evaluation, the site is now able to better prioritize resource utilization to focus auditing
efforts on those areas with the highest risk scores.
Risk control and documentation
In the current case study, risk is reduced by identifying site operations above a specific threshold score from the risk ranking,
and scheduling internal audits for those operations. Inherent risk will be accepted for those site operations which are below
that threshold. For those operations, an internal audit will be deferred until audits have been completed for those operations
with a higher risk ranking.
Communication of the utilized QRM process should include all key stakeholders of the affected departments throughout the department
to ensure organizational buy-in and support. The output of QRM process, the audit schedule, and associated risk analysis justifying
the approach, should be documented and endorsed by the site quality unit and effectively communicated to stakeholders.
Risk review
In the case study presented, it may be convenient to review the risk-assessment process and assumptions as the annual schedule
is developed. During this activity, the site will confirm that included operations/systems are still in use, remove those
that are not and add any new operations/systems to the process. Examples of changes that may potentially impact risk of site
operational systems include: changes to control systems, changes to equipment and processes, changes in suppliers/contractors,
and organizational restructuring.
Ted Frank is with Merck & Co; Stephen Brooks, Kristin Murray,* and Steve Reich are with Pfizer; Ed Sanchez is with Johnson
& Johnson; Brian Hasselbalch is with the FDA Center for Drug Evaluation and Research; Kwame Obeng is with Bristol Myers Squibb;
and Richard Creekmore is with AstraZeneca.
*To whom all correspondence should be addressed, at kristin.murray@pfizer.com
|
