RISK MANAGEMENT IN ICH Q12 - SUPPORTING QUALITY, COMPLIANCE & CULTURE EXCELLENCE OVER THE LIFECYCLE
The ICH guidelines addressing quality as a manufacturing science (i.e., from 2005 and ICH Q8 onwards) cover risk and knowledge management in a way that is only now becoming fully appreciated (Fig. 1). The forthcoming ICH Q12 provides an operational view of how risk and knowledge management can work together to ensure quality, operational and culture excellence at the corporate level. That will come from risk and science-based decisions taken consistently across
1. individual products & processes over lifecycle,
2. product portfolio and
3. technology platforms.
The different elements required for the implementation of Quality Risk Management outlined in ICH Q9 - risk identification, analysis, evaluation and control - demand tools and practices that are at the core of good knowledge management. The initial stages, dealing with risk identification and analysis, can very effectively capture prior knowledge, map processes and allow the definition of an ontology of objects (unit operations) with specific attributes (inputs and outputs). That should be followed by establishing the causality between those inputs (process parameters) and outputs (quality attributes), from which the whole criticality analysis exercise will develop.
When FMEA is not enough? The workflow above will yield a science-based foundation for the risk management exercise. The target of completing an FMEA (Failure Mode and Effects Analysis) is in practice very difficult and extremely time-consuming to achieve if the initial 'knowledge-based' steps are skipped. There are many questions to be answered:
Where is the failure mode root cause located?
Should we monitor cause or effect?
Will we have alternative/competing control strategies?
How effective are those?
Which one will be filed and how should it be explained to authorities?
Figure 1: ICH guidelines dealing with quality as manufacturing science have dealt with QRM and KM. [Normalized instances; total 975 on Risk (R); Risk-Management (RM); Knowledge (K); Knowledge-Management (KM)]
Figure 2 summarizes the different tools that are available in practice for each stage, showing that some are more adequate than others for each stage. In our experience of risk management facilitation, different tools will be required, and the use of mapping and brainstorming tools ensures team alignment, empathy across multiple functions and an effective knowledge-sharing and harvest right from the beginning, all needed for a successful QRM project.
Lifecycle & Post-Approval Change Management
After an end-to-end risk assessment is completed (i.e., risks are identified, understood, quantified, ranked and a control strategy is proposed) a lifecycle management plan should be put in place to manage unacceptable risks - evaluating the control strategy performance, detecting improvement opportunities and managing additional risks originated from new events (e.g., post approval changes). This plan will be used to aggregate all actions, findings and experience - i.e., manage product and process knowledge over the lifecycle. Such foundation will enable science-based justification and risk-based decisions to be taken when deviations occur, CAPAs are implemented, improvement opportunities are evaluated, or any other change management activities are considered.
Recommendation
4-6 March 2025
GMP meets GCP - Live Online Training
The forthcoming ICH Q12 introduces a number of different concepts that will require a level of sophistication in knowledge management that most (if not all) companies are yet not ready to face (Fig. 3). In the words of Deming, "knowledge has a temporal dimension" that is related to the experience a company gains over the lifecycle and that uses to base actions (present) and decisions (future) to better control and improve its technology platforms and portfolio products. However, we all know pharma notoriously lacks "memory". It's a datadriven industry that rather repeats experiments than reuses information or knowledge - and that for decades has neglected the very fact that its products take a generation to develop and at least two of commercial life. At current HR attrition rates in most companies, product launches or commercial life are shared by multiple teams that do not have the full history and knowledge acquired over time of a specific product.
Figure 3: ICH Q12 concepts to become effective in operation to the advantage of pharma companies, require a robust Pharmaceutical Quality System with a risk-management foundation used for science-based decisions2
ICH Q12 provides to a large extent the means and opportunities for companies to formalize their knowledge. First, in terms of quality commitments (cf. "establish conditions" concepts), then requiring an end-to-end and over the lifecycle view of all operations, identifying risks and categorizing types of changes, then proposing management protocols (PACMP) for each type, and finally encouraging rigorous science- and risk-based decisions. The bottom line of ICH Q12, which like with QbD in ICH Q8 remains to be seen, is that a company doing all that within a modern and robust Pharmaceutical Quality System (PQS) will be granted higher regulatory flexibility than other companies without clear evidence of a quality and excellence culture.
Recommendation
Vienna, Austria25-27 March 2025
Qualified Person Education Course Module A PLUS IMP Pre-Course Session
A modern vision of risk management is then the integrated use of various risk management tools in something that could be called standardised workflows or templates, which then take on the causality and attributes of objects to analyse the entire process throughout and across the lifecycle1.
QRM used in that way - i.e., within a LCM framework - is a very effective way to ensure consistency at all levels of modern pharma operations. It is the way forward to Industry 4.0 rooted in a culture of quality and operational excellence. That is the vision of class-A or the so-called 'learning organisations'.
Author:
Prof. Dr. Jose C. Menezes
... as been Director of a Programme in Pharmaceutical Engineering covering QbD and PAT at the Technical University of Lisbon since 2007.
Source:
1 US Pat. 2018 / 0075379 A1 , “Method for Risk-Management over Lifecycle of Complex Products and Processes” (published March 15th, 2018).
2 A Lifecycle Approach to Knowledge Excellence in the Biopharmaceutical Industry. Eds Calnan N, Lipa M, Kane P, Menezes JC, CRC Press (2017).
