ONE GOOD IDEA
Categorize and control your risk management audit data
by John G. Suedbeck
ICH Q9 is a U.S. Food and Drug Administration standard on quality risk management developed by the International Conference on Harmonization of Technical Requirements for Registration of Pharmaceuticals for Human Use. "Quality Risk Management" from Annex II provides guidance for managing risk and lists risk factors to help auditors define the frequency and scope of audits.1
Auditors collect evidence during the audit process and sort evidence according to the appropriate risk factor to facilitate risk assessment mitigation planning. I like to think of the factors provided in ICH Q9 as "risk buckets" for sorting data.
Note that reasonable conclusions are based on evidence that is sufficient, reliable and relevant. Previously, I discussed the reliability of audit evidence in "Solid Proof" (June 2012).2 The following is an approach for determining the relevancy of audit evidence as it pertains to each of the risk factors in ICH Q9:
- Existing legal requirements. Review nondisclosure agreements, supply agreements and quality agreements.
- Overall compliance status and history of the organization or facility. Review regulatory status certifications and customer audit history.
- Robustness of an organization’s quality risk management activities. Verify controls are in place for training, supplier evaluation, recalls, returns, complaints, deviations, out of specification results, internal audits, nonconformances, change control, validation, documentation, calibration and preventive maintenance, product testing criteria and finished goods release. Review for adequacy and compliance.
- Complexity of the site and distribution. Review general site information, pest control, holding and distribution controls and security.
- Complexity of the manufacturing process. Perform process mapping and trace the supply chain. Identify key steps in the process. Verify there are adequate controls in place for each key step. Identify and define quality filters in place (a safeguard analysis that shows what risks are managed and how).
- Complexity of the product and its therapeutic significance. In descending order of risk, review sterile finished products, nonsterile finished products, sterile active pharmaceutical ingredients (API), nonsterile APIs with special risk factors (such as isomerisim, polymorphism or a special risk of harmful impurities), labs and contract research organizations, nonsterile APIs, excipients, labels and product contact packaging.
Also consider risk factors associated with solubility, fermentation, toxicity, synthesis, impurities, solvents, chemical activity, potency and particle size:
- Number and significance of quality defects. This is the quality history review for the item or service. Consider the development history as well. Review recalls, returns, complaints, deviations, out of specification results, internal audit data, nonconformances and internal customer surveys.
- Results of previous audits and inspections. List all evaluations and reevaluations. Include distributors because they are part of the pedigree (an audit trail that follows a drug from the time it is manufactured through the distribution system to a pharmacy).
- Major changes related to building, equipment, processes and key personnel. Review the organization’s history and change notification records.
- Experience with the manufacturing of a product. This may include frequency, volume, number of batches and the percentage of the organization in the pharmaceutical industry. The robustness of their quality management system and the level of technology in use also may serve as evidence of their experience.
- Test results of official laboratories. Review pass and release testing results and regulatory history.
A plethora of evidence often is obtained from the audit process and it can become confusing trying to make sense of it all. The risk factors suggested in ICH Q9 provide a means of sorting the data into manageable buckets that can help your organization assess risk and manage it effectively.
Reference and Note
- Access ICH Q9 at www.fda.gov/downloads/Regulatoryinformation/Guidances/ucm128053.pdf (case sensitive).
- John G. Suedbeck, "Solid Proof," Quality Progress, June 2012, http://asq.org/quality-progress/2012/06/back-to-basics/back-to-basics-solid-proof.html.
John G. Suedbeck is a quality assurance specialist for Metrics Inc. in Greenville, NC. He earned a bachelor’s degree in analytical chemistry from Fayetteville State University in North Carolina. A senior member of ASQ, Suedbeck is an ASQ-certified quality manager, quality improvement associate and quality auditor.