Quality Risk Management

Transcription

1 Quality Risk Management Audit Expectations and Observations Matthew Davis Lead Auditor Office of Manufacturing Quality, TGA CAPSIG 4 th May 2011

2 2

3 QRM - TGA Expectations and Observations - QRM Background - TGA Expectations - Areas of Application - Audit Observations to Date - Questions 3

4 Quality Risk Management - Background - Risk management has been part of the pharmaceutical industry for many years. - Legislation - Codes of GMP - Default Standards - PIC/S Guide places greater emphasis on formalising these processes and using formal risk management tools. - From a GMP point of view, we are only concerned with risks associated with product quality (Purity, Identity, Efficacy, Safety) - quality risk management. - Manufacturer is responsible for assessing risks to the medicinal product and managing these risks to an acceptable level. 4

5 QRM in the PIC/S Guide to GMP PE Changes in the Code - Chapter 1 Quality Management - Quality Risk management 1.5 Quality risk management is a systematic process for the assessment, control, communication and review of risks to the quality of the medicinal product. It can be applied both proactively and retrospectively. 5

6 QRM in the PIC/S Guide to GMP PE The quality risk management system should ensure that: - the evaluation of the risk to quality is based on scientific knowledge, experience with the process and ultimately links to the protection of the patient; - the level of effort, formality and documentation of the quality risk management process is commensurate with the level of risk. 6

7 QRM in the PIC/S Guide to GMP PE Annex 20 Quality Risk Management - Based on ICH Q9 - Guidance Annex, Voluntary - Is not intended to create new regulatory expectations. - Provides good instruction regarding the principles of Quality Risk Management - Provides details for integration into your QMS - Annex I lists a number of recognised methods for performing Risk Assessments Basic risk management facilitation methods (flowcharts, check sheets etc.); Failure Mode Effects Analysis (FMEA); Failure Mode, Effects and Criticality Analysis (FMECA); Fault Tree Analysis (FTA); Hazard Analysis and Critical Control Points (HACCP); Hazard Operability Analysis (HAZOP); Preliminary Hazard Analysis (PHA); Risk ranking and filtering; Supporting statistical tools - Annex II contains suggested areas of application for QRM 7

8 TGA Expectations -Timeline for implementation of QRM - Expectations at audit - Audit process regarding QRM - Deficiency classification 8

9 QRM - TGA Expectations -Timeline for Implementation of QRM Between July and December 2010 Between January and June 2011 From July 2011 Approved policy Quality Risk Management Documented assessment where QRM will apply Commenced amending and drafting procedures Commenced training staff in QRM QRM is built into the Quality System. Commenced using QRM in changes, investigations etc. Full implementation - 9

10 QRM TGA Expectations (Today) - Written Policy (or Procedure) - Aspects of the business where QRM will be applied - Methods to be used (commensurate) - Demonstrated implementation of QRM into QMS - Updated procedures - Formal methods defined (where used) - Training of staff in updated procedures. - Systematic Approach - Local SOPs guide user into performing and documenting risk analysis. - Mechanism for storage and on-going review of significant risk assessments used to justify operational activities, validations etc. (Live Documents) - One-off risk assessments should be documented, approved and retained. - Evidence of proactive and retrospective risk assessments in place where required. 10

11 QRM TGA Expectations (Today) - Assessments link to Product Quality - Performed from an objective position - Conservative approach used - Ultimately linked patient safety - Outcomes are justified on a scientific basis - Decisions made on a factual evidence, with data available - Explanations of assumptions and reasons for decisions are documented - Assessments are commensurate to level of risk identified. - If the potential risk is high, a more thorough evaluation and report is required. - For low risk items, may be a one line justification. 11

12 QRM Typical Audit Process - Time is allocated to QRM in Audit Plan - Review of Documentation - Policies (or equivalent procedure) - (What, where, when) - Specific Procedures - (Who & How) - Risk Assessment (incl. risk identification, analysis and evaluation) - Risk Control (incl. risk reduction and risk acceptance); - Communication (i.e. the residual risk should be communicated to the stakeholders and regulators); - Regular Review of the Risks - Evaluate risk assessments - Question and challenge assumptions - Review evidence - Time spent will usually be dependent on the perceived risk, complexity and clarity of the QRM systems. - Auditor may ask for copies of complex assessments for further analysis. 12

13 QRM Typical Audit Process - Auditor potential QRM related questions: - Whether the QRM performed was integrated into the Quality System? - Was the process and documentation transparent & traceable? - Were the formalised documented procedures followed? - Was a risk problem or question well defined? - Did the completed process address the risk problem/question? - How was the decision made and documented? - Was there appropriate communication throughout the process? - Was a systematic approach applied? - Were the selected methods / tools suitable? 13

14 QRM Typical Audit Process - Were all relevant facts and risks identified and analysed? - Was the risk acceptance / mitigation criteria appropriate? - Were the people involved qualified? - Were the appropriate functions allocated to appropriate team members? - Was the risk decision well-informed, science-based and comprehensible? - Was the risk assessment periodically reviewed? - Was the level of effort and reaction time commensurate with the level of risk? 14

15 QRM Typical Audit Process Auditors will: - Be prepared so that the process is understood - Have sufficient knowledge to understand what has been done and challenge assumptions, omissions etc - Be clear about when QRM is not appropriate - Be flexible and accept the outcome of a scientifically sound QRM exercise 15

16 QRM - Deficiency Classifications - Classification of a QRM deficiency is dependent on: - Activities undertaken by the manufacturer - The number of observations relating to the incorrect application of QRM - Wherever companies demonstrate they are meeting the minimum expectations the OMQ will not cite a deficiency - If the manufacturer has not undertaken an appropriate approach to implementing the new requirements or may not achieve compliance in a timely manner, a deficiency will be reported and will usually be cited as an 'other' deficiency against the relevant part of the Code 16

17 QRM - Deficiency Classifications - Major deficiencies will generally only be cited where a manufacturer has not commenced, or significantly progressed, action to implement the new Code requirements, or where a manufacturer's implemented procedures and systems do not meet the requirements of the Code - Critical deficiencies may reference QRM where risk assessments have been used to inappropriately support the release of products that pose a risk to patient safety. 17

18 QRM Basic Areas of Application - Deviation Management - Investigations - Complaints - Changes/Change Control - Validations - Computerised Systems - Sampling - Premises & Equipment design/operation 18

19 QRM Potential Areas of Application - Within the QMS - Product Quality Reviews - New product introduction - Training Plans/Programs - Supplier evaluation - Product testing regimes - To demonstrate compliance with GMP requirements 19

20 QRM Potential Areas of Application - Within Production - Multi-purpose Facilities - Equipment Design and Installation - Process control (APIs - HACCP) - HVAC containment strategies - Cleaning Regimes - Campaign Manufacture - Environmental Monitoring Plans - Services and Equipment monitoring - Maintenance intervals - Calibration intervals 20

21 QRM Potential Areas of Application - Within Laboratories - Sampling/Testing policies - OOS investigations - Repeat testing, retesting and re-sampling - Method Validation - Equipment Qualification - Microbiological contamination & Objectionable Organisms - Ongoing stability protocols & Testing 21

22 QRM - Common Issues No consideration given to QRM Inappropriate application of QRM Improper implementation Inadequate or no assessment of impact on product quality Lack of evidence supporting decisions Lack of process understanding and/or regulatory requirements Systematic approach not applied to the review of assessments. There is a desired outcome and risk management is used to justify it Invalid assumptions suit the desired outcome Variable tolerance of risk 22

23 QRM - Audit Observations - The manufacturer had not implemented a system for Quality Risk Management. - The SOP relating to QRM did not provide specific information about how QRM was to be performed and implemented. 23

24 QRM - Audit Observations - There was no risk register to facilitate the management, monitoring and review of formal risk assessments. There were numerous and significant changes to processes, equipment and facilities which may impact on decisions or outcomes of previous risk assessments or mitigation strategies. - (TGA & MHRA Joint Audit) 24

25 QRM - Audit Observations - Containment The risks to manufacture from the cytotoxic products product XYZ and product ABC in a non dedicated facility have not been considered with sufficient attention since: The risk assessment for the cross contamination by cytotoxic products of the other products manufactured in building 123 has not ranked cross contamination risk with the highest level for severity. There is no dedicated freeze-dryers and filling lines for cytotoxics. The production is not based on a campaign mode. 25

26 QRM - Audit Observations The company s approach and risk assessments for preventing cross contamination were not evident, incomplete and did not include all relevant manufacturing areas and products. The proposed manufacturing processes permitted the use of AREA A for the production of both cytotoxic and non-cytotoxic products, however; a comprehensive evaluation and risk assessment that justified the proposed work method was not available. 26

27 QRM - Audit Observations - Inadequate Assessment of the Manufacturing Process The requirements of Annex 1 have not been fulfilled in relation to the aseptic manufacture of sterile Cephalosporin powders as evidenced by: The process for the transfer of the sterile API canister and sterile stopper pan into the grade A zone did not provide adequate grade A protection of the exposed API, stopper pan or the associated canister during transfer. Hence, the sterility assurance of the process could be compromised. 27

28 QRM - Audit Observations - Validation - A risk assessment was performed of the MRP system to determine what functional transactions required validation. This assessment incorrectly determined that Quality functions such as status control of starting materials and finished product did not require validation. 28

29 QRM - Audit Observations An initial isolator gassing study performed during OQ failed due to the presence of a foreign Gram positive rod within the cultured biological indicator broth; however, the result was not thoroughly investigated. In addition, there was no detail of the cycle parameters used during OQ and subsequent augmentation of the cycle. 29

30 QRM - Audit Observations - Environmental Monitoring (Aseptic Production) - The sample locations, sample frequencies and methods for Environmental Monitoring within the grade A filling zone and surrounding areas were not appropriate: - The risk assessment for the justification of sample locations was based upon an assessment of the existing locations, rather than an assessment of the criticality of each graded area and the activities undertaken within. 30

31 QRM - Audit Observations - Deviation Management The established systems for the management of deviations and unplanned events were not fully effective in ensuring that all issues were appropriately recorded, investigated and justified. For example: Deviation X relating to a high WFI TOC result of 491ppb did not include any assessment of the potential impact on product quality; A temperature excursion of 12.5 C was noted on cool storage area ABC on 3rd Feb 2010 during which time product was present, and no deviation was generated to cover the event. 31

32 QRM - Audit Observations There were examples of significant deviations that had not been thoroughly investigated, documented and the potential impact upon product quality fully assessed. In each case the report was classified as type X, i.e. that there was no impact on the product quality; however the reports reviewed did not contain conclusive evidence to indicate that this was indeed the case. 32

33 Quality Risk Management Summary - The concept of QRM is not necessarily new to the Pharmaceutical Industry - Many examples of risk management strategies in place - PIC/S Guide to GMP PE009-8 specifies requirements for the implementation of formal systems embedded in the manufacturers QMS. 33

34 Quality Risk Management Summary - TGA Expectations - QRM will be reviewed at each audit - Policies - Implementation into the QMS - Updated procedures that guide the user in to performing some form of assessment. - QRM used in decision making - Level and formality of the process commensurate with the level of risk - Clear process for communication and review of risk management processes and assessments - Updated Training - Full implementation by June

35 Quality Risk Management Summary - There are many areas of the manufacturers QMS in which QRM can be applied. - Areas of application will depend upon the complexity and nature of the business. - Manufacturer is responsible for identifying areas of application, identifying risk to product quality and managing that risk. 35

36 Quality Risk Management Summary - Observed progress to date in respect of QRM is generally good - Good application of principles - Clear and objective assessments - Good implementation into QMS and evidence of a systematic approach. - However, there are some examples of inappropriate use of QRM or lack of systems. 36

37 Quality Risk Management the future... - Greater application of QRM across industry as confidence increases - Increased use of complex QRM methods and assessments - Better scientific knowledge of the manufacturing process(es) and products - Greater understanding what is important - Focusing resources- time, energy, capital, and people on the important things that ultimately links to the protection of the patient - Facilitating communication, both internally and to regulators - If done properly there should be increased assurance of quality (and possibly cost savings) 37

38 Thank-you for your attention Questions? 38

39 Further Reading PIC/S Guide to GMP & Annex 20 - PIC/S Example of QRM implementation PS/INF 1/ ISO Risk Management Risk Assessment Techniques - ISO Medical Devices Application of risk management to medical devices - WHO Annex 7 Application of Hazard Analysis and Critical Control Point (HACCP) methodology to pharmaceuticals 39