The document discusses quality risk management in the pharmaceutical industry. It defines key terms like risk, hazard, harm, and provides an overview of the quality risk management process. This includes risk assessment, analysis, evaluation, control, communication, and review. It also discusses tools that can be used for risk management like FMEA and benefits of implementing quality risk management. The document is from Tehran University of Medical Sciences School of Pharmacy and provides guidance on applying a systematic approach to quality risk management.

1. Tehran University of Medical
Sciences
School of Pharmacy
Quality Risk Management
Risk Analysis
Or in more general terms:
Quality Risk Management
March 2014

2. Quality Risk Management
June 2014
2 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Quality Relationship
Quality Management
Quality Assurance
GMP
Production and Quality Control

3. Quality Risk Management
June 2014
3 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Quality Relationship
GMP
(Good Manufacturing Practices )
Is the part of quality assurance that ensures that products are
produced and controlled consistently and reliably.
It can only come about by having clear descriptions of the way
in which the work will be done.
GMP specifically addresses risks that cannot be fully controlled
by testing of the final product:
•Cross-contamination
•Mix-ups
These risks can best be controlled by having a properly
managed system of working that takes them into account.
Quality Management
Quality Assurance
Production and Quality Control

4. Quality Risk Management
June 2014
4 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Quality Relationship
Quality Management
ICHQ10:
Pharmaceutical
Quality SystemQ7:
GMP
Q8:
Pharmaceutical
Development
Q9:
QRM

5. Quality Risk Management
June 2014
5 of 31
Tehran University of Medical
Sciences
School of Pharmacy
INTRODUCTION
• Risk management is not new – we do it informally all
the time
• Risk management principles are effectively utilized in
many areas of business and government.
• Military Standard 1629 dated 1974 regarding formal
risk management
• Risk management has been used in the medical device,
telecommunications, aerospace and car industries for
many years.

6. Quality Risk Management
June 2014
6 of 31
Tehran University of Medical
Sciences
School of Pharmacy
INTRODUCTION
ISO 31000:2009 Principles (Clause 3) Risk management
should….
1.Create value
2.Be an integral part of organizational processes
3.Be part of decision making
4.Explicitly address uncertainty
5.Be systematic and structured
6.Be based on the best available information
7.Be tailored
8.Take into account human factors
9.Be transparent and inclusive
10.Be dynamic, iterative and responsive to change
11.Be capable of continual improvement and enhancement

7. Quality Risk Management
June 2014
7 of 31
Tehran University of Medical
Sciences
School of Pharmacy
INTRODUCTION
• Managing risk means forward thinking
• Managing risk means responsible thinking
• Managing risk means balanced thinking
• Managing risk is all about maximizing opportunity and
minimizing threats
• The risk management process provides a framework to
facilitate more effective decision making
Quality by Design
Risk Management is about making value
out of uncertainty

8. Quality Risk Management
June 2014
8 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Risk Management in Pharma. Industry
• From a GMP point of view, we are only concerned with
risks associated with quality, safety and efficacy
Quality Risk Management
• Organisations use risk approaches in other areas, e.g.
to ensure resources are utilised in the most effective
way.
Patient Safety

9. Quality Risk Management
June 2014
9 of 31
Tehran University of Medical
Sciences
School of Pharmacy
DEFINITIONS
• Harm: Damage to health, including the damage that can occur
from loss of product quality or availability.
• Hazard: The potential source of harm
• Risk (In Pharmaceutical POV): The combination of the
probability of occurrence of harm and the severity of that harm.
• Risk (In General – ISO31000): effect of uncertainty on objectives
– An effect is a deviation from the expected — positive and/or negative.
– Objectives can have different aspects (such as financial, health and safety, and
environmental goals)
– Uncertainty is the state, even partial, of deficiency of information related to,
understanding or knowledge of, an event, its consequence, or likelihood.
– Risk is often expressed in terms of a combination of the consequences of an
event (including changes in circumstances) and the associated likelihood of
occurrence.
EVENT! EVENT!

10. Quality Risk Management
June 2014
10 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Principles
• Two primary principles of quality risk
management are:
– The evaluation of the risk to quality should be based
on scientific knowledge and ultimately link to the
protection of the patient; and
– The level of effort, formality and documentation of
the quality risk management process should be
commensurate with the level of risk.

11. Quality Risk Management
June 2014
11 of 31
Tehran University of Medical
Sciences
School of Pharmacy
QUALITY RISK MANAGEMENT PROCESS
• Quality risk management is a systematic process
for the assessment, control, communication and
review of risks to the quality of the medicinal
product across the product lifecycle.

13. Quality Risk Management
June 2014
13 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Responsibilities
• Quality risk management activities are usually,
undertaken by interdisciplinary teams.
• CFTs may include experts from the appropriate
areas e.g., quality unit, business development,
engineering, regulatory affairs, production
operations, sales and marketing, legal, statistics
and clinical in addition to individuals who are
knowledgeable about the quality risk
management process.

14. Quality Risk Management
June 2014
14 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Risk Assessment
• A systematic process of organizing information
to support a risk decision to be made within a
risk management process.
• It consists of the identification of hazards and
the analysis and evaluation of risks associated
with exposure to those hazards.
1. What might go wrong (Identification)?
2. What is the likelihood (probability) it will go wrong?
3. What are the consequences (severity)?

15. Quality Risk Management
June 2014
15 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Risk Assessment
• Risk identification
– Use of information to identify hazards or potential risks
– Historical data, theoretical analysis, informed opinions
• Risk analysis
– Estimation of risk associated with identified hazards
– Qualitative or quantitative
– Links probability and severity
– In some tools, includes detectability

16. Quality Risk Management
June 2014
16 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Risk analysis
Probability Severity Detectability
Likely to
occur
High
(4)
Serious GMP non-
compliance
Patient injury possible
Critical
(10)
An specific
detection System or
Indicator exists
Easily
Detectable
(0.75)
May occur
Medium
(3)
Significant GMP non-
compliance
Impact on patient
possible
Moderate
(5)
No specific
detection system
but can be
detected on daily
inspections
Moderate
Detectability
(1)
Unlikely to
occur
Low
(2)
Minor GMP non-
compliance
No patient impact
Minor
(1)
May be detected
accidentally
Probably
Detectable
(1.25)
Very
unlikely to
occur
Remote
(1)
No mentionable
Impact
None
(0)
Un-detectable Hardly
Detectable
(1.5)

17. Quality Risk Management
June 2014
17 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Risk Evaluation
• Risk evaluation
– Compares identified and analysed risk against criteria
– Considers probability, severity and detectability
– Output can be qualitative (high, medium or low)
– Output can be quantitative (probability x severity x
detectability)
– Quantitative provides a relative ranking – prioritises risk
Risk = Probability x Severity x Detectability

18. Quality Risk Management
June 2014
18 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Risk Evaluation
• Risk definitions:
Based of Quantitative or Qualitative outputs, Risks are
categorized as follows:
 Intolerable – work to eliminate the negative event or
introduce detection controls is required as a priority
 Unacceptable – work to reduce the risk or control the
risk to an acceptable level is required
 Acceptable – the risk is acceptable and no risk
reduction or detection controls are required

19. Quality Risk Management
June 2014
19 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Risk Control
• Risk control includes decision making to reduce
and / or accept risks.
• The purpose of risk control is to reduce the risk
to an acceptable level.
• The amount of effort used for
risk control should be
proportional to the
significance of the risk.

20. Quality Risk Management
June 2014
20 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Risk Control
• Risk control might focus on the following
questions:
1. Is the risk above an acceptable level?
2. What can be done to reduce or eliminate risks?
3. What is the appropriate balance among benefits,
risks and resources?
4. Are new risks introduced as a result of the
identified risks being controlled?

21. Quality Risk Management
June 2014
21 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Risk Control
• Risk reduction
– Actions taken to lessen the probability of occurrence
of harm and the severity of that harm
– Typically CAPA and change control
• Risk acceptance
– The decision to accept risk
– If risk reduction action taken, follows re-analysis and
evaluation

22. Quality Risk Management
June 2014
22 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Change Control Vs. Risk Management
Change
Control
Risk
Management
OUTPUT /INPUT
Risk Assessment
Risk Control

23. Quality Risk Management
June 2014
23 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Risk Communication
• Risk communication is the sharing of
information about risk and risk management
between the decision makers and others.
• Parties can communicate at any stage of the risk
management process

24. Quality Risk Management
June 2014
24 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Risk Review
• Risk management should be an ongoing part of the quality
management process.
• Review or monitoring of output/results of the risk
management process considering (if appropriate) new
knowledge and experience about the risk
– Ensures nothing has changed to affect the QRM
assumptions, output and conclusions
– Consider during product review
• The frequency of any review should be based upon the level
of risk.
• Risk review might include reconsideration of risk
acceptance decisions

25. Quality Risk Management
June 2014
25 of 31
Tehran University of Medical
Sciences
School of Pharmacy
RISK MANAGEMENT METHODOLOGY
• Quality risk management supports a scientific and
practical approach to decision making.
• It provides documented, transparent and reproducible
methods to accomplish steps of the quality risk
management process.
• Traditionally, risks to quality have been assessed and
managed in a variety of informal ways based on, for
example, compilation of observations, trends and other
information.

26. Quality Risk Management
June 2014
26 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Risk Management Tools
• Pharmaceutical industry and regulators can assess and manage
risk using recognized risk management tools:
– Basic risk management facilitation methods (flowcharts, check sheets etc.)
– Failure Mode Effects Analysis (FMEA);
– Failure Mode, Effects and Criticality Analysis (FMECA);
– Fault Tree Analysis (FTA);
– Hazard Analysis and Critical Control Points (HACCP);
– Hazard Operability Analysis (HAZOP);
– Preliminary Hazard Analysis (PHA);
– Risk ranking and filtering;
– Supporting statistical tools.

27. Quality Risk Management
June 2014
27 of 31
Tehran University of Medical
Sciences
School of Pharmacy
FMEA as an example
• Failure Mode and Effects Analysis (FMEA) was one of the first
systematic techniques for failure analysis.
FMEA
Ref.
Item Potential
failure mode
Potential
cause(s) /
mechanis
m
Mission
Phase
Local
effects of
failure
Next
higher
level
effect
System
Level End
Effect
(P)
Probabilit
y
(estimate)
(S)
Severity
Detection
(Indicatio
ns to
Operator,
Maintaine
r)
(D)
Detection
Dormancy
Period
Risk Level
P*S (+D)
Actions
for further
Investigati
on /
evidence
Mitigation
/
Requirem
ents
1.1.1 Brake
Manifold
Ref.
Designator
2b, channel
A, O-ring
Internal
Leakage
from
Channel A
to B
a) O-ring
Compress
ion Set
(Creep)
failure b)
surface
damage
during
assembly
Landing Decrease
d
pressure
to main
brake
hose
No Left
Wheel
Braking
Severely
Reduced
Aircraft
decelerat
ion on
ground
and side
drift.
Partial
loss of
runway
position
control.
Risk of
collision
(C)
Occasion
al
(VI)
Catastrop
hic (this is
the worst
case)
(1) Flight
Compute
r and
Maintena
nce
Compute
r will
indicate
"Left
Main
Brake,
Pressure
Low"
Built-In
Test
interval is
1 minute
Unaccept
able
Check
Dorman
cy
Period
and
probabili
ty of
failure
Require
redundan
t
independ
ent brake
hydraulic
channels
and/or
Require
redundan
t sealing
and
Classify
O-ring as
Critical
Part Class
1

28. Quality Risk Management
June 2014
28 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Implementation
• PDCA or Deming cycle
• Encourages transparency
– Create baseline for more science-based decisions
• Facilitates communication
– Matrix team approach
– An aid to convince the stakeholders with trust
• Encourages a preventive approach
– Proactive control of risks and uncertainty
– Benefit of knowledge transfer by team approach
• Changes behavior
– Better understanding of risk-based decisions
– Acceptance of residual risks
Benefits of Risk Management Implementation:

29. Quality Risk Management
June 2014
29 of 31
Tehran University of Medical
Sciences
School of Pharmacy
Conclusion
• Quality risk management is a process that
supports science-based and practical decisions
when integrated into quality systems.
• Effective quality risk management can facilitate
better and more informed decisions, and can
provide regulators with greater assurance of a
company’s ability to deal with potential risks.
• In addition, quality risk management can
facilitate better use of resources by all parties.
• Quality risk management should be integrated
into existing operations and documented
appropriately.

30. Quality Risk Management
June 2014
30 of 31
Tehran University of Medical
Sciences
School of Pharmacy
References and Further Readings
• ICH Q9: Quality Risk Management
• ICH Q10: Pharmaceutical Quality System
• ICH-Endorsed Guide for ICH Q8/Q9/Q10 Implementation
• US FDA Guidance for Industry: Q9 Quality Risk Management
• WHO GUIDELINE ON QUALITY RISK MANAGEMENT
• ISO 31000:2009, Risk management – Principles and guidelines
• ISO Guide 73:2009 Risk management – Vocabulary
• ISO 14971:2007 Medical devices -- Application of risk
management to medical devices

31. Quality Risk Management
June 2014
31 of 31
Tehran University of Medical
Sciences
School of Pharmacy
“A ship is always safe at the shore
but that is NOT what it is built for.”
Albert Einstein