Definitions:

Informal Tools: e.g: brain storming or risk ranking can also be applied across the RA spectrum, but will typically be used for better understood/ lower complexity situations/ risk questions.

Formal tools: e.g: FMEA, HACCP can be used throughout the spectrum of RA - simple to complex - formal tools can be adapted to suit the situation they are being applied to - for example a formal tool can be applied in a light manner to a relatively simple/well understood situation.

Note: A combination of basic and advanced tools is also an option.

For informal RA, don't forget to document it.

How to structure Formal Risk Assessment:Standardise your templates to include date, team members, the risk question, quality unit approval.

Potential headings:

✓ Critical Parameter ✓ Failure Mode, ✓ Likelihood x Severity ✓ Overall Risk score/rank.

front

Adapted from ICH Q9 QRM Diagram

FME(C)A

Risk

Eva

luat

ion

Level of Risk Understanding

Comprehensive Unknown

Non

Crit

ical

Im

pact

Criti

cal

Impa

ct

Level of Risk Assessment Formality

Basic Advanced

Memo

PHA

HACCP

HAZOP

Fishbone

Brainstorming

Mapping

Assessment

Filtering

Checksheets

Flowcharts

LEVEL OF RISK ASSESSMENT FORMALITY

Basic Advanced

Comprehensive Unknown

LEVEL OF RISK UNDERSTANDING

RISK

EVA

LUAT

ION

Criti

cal I

mpa

ctNo

n Cr

itica

l Im

pact

Checksheets

Brainstorming

Process Mapping

Fishbone

Technical Memo

Bespoke RiskAssessment

Cause & Effect

Risk Ranking& Filtering

FME(C)AHazop

Flowcharts

PHA

HACCP

Tool Selection Criteria

ConsiderationsFMEA / FMECA

FTA HACCP HAZOP PHA RR&F

Is risk ranking desired?

Is demonstration of the effectiveness of risk controls required?

Is risk indenitifi cation a challenge, do hidden risks need to be revealed or is structured brainstorming desired?

/

Is risk detection capability within the process in question?

/ / /

Is process / product / system knowledge limited?

Is process / product system knowledge advanced?

Is the problem statement simple or is an elegant assessment appropriate?

Is the problem statement complex or is a detailed assessment required?

Is risk data more qualitative in nature?

Is risk data more quantative in nature?

Count

Initiate QRM Process

Risk Assessment

Risk Identification

Risk Analysis

Risk Evaluation

Risk Control

Risk Reduction

Risk Acceptance

Output of QRM Process

Risk Review

Review Events

Risk

Com

mun

icat

ion

Risk

Man

agem

ent T

ools

Unacceptable

Patient Focused Quality Risk Assessment

Key principles of QRM

A Practical ApproachPreparation for

quality risk assessment

Back

Risk: The combination of the probability of occurrence of harm and the severity of that harm (ISO/IEC Guide 51).

Severity: A measure of the possible consequences of a hazard.

Risk Identification: The systematic use of information to identify potential sources of harm (hazards)

Risk Assessment: A systematic process of organizing information to support a risk decision to be made within a risk management process. It consists of the identifi cation of hazards and the analysis and evaluation of risks associated with exposure to those hazards.

Risk Control: Actions implementing risk management decisions (ISO Guide 73)

Risk Communication: The sharing of information about risk and risk management between the decision maker and other stakeholders.

Risk Management & Uncertainty: A core principle underpinning effective Risk Management is the principle that Risk Management explicitly addresses uncertainty i.e., that it explicitly takes account of uncertainty, the nature of that uncertainty, and how it can be addressed (ISO 31000:2009(E)

Useful Definitions

Testing your risk mitigation controls

Risk communication

Link to validation studies

Conduct risk assesment

Risk review: Impacts from deviations, Capa's & change controlKnowledge

management

SEVERITY

LIKL

IHOO

D OF

OCC

URRE

NCE Minor

Medium

Low

Low

Like

lyAv

erag

eRe

mot

e

Moderate

High

Medium

Low

Critical

High

High

Medium

Any good risk assessment must always have the two key principles of scientifi c understanding and patient safety at their core. Next Steps

QRM Acceptance Criteria:

Low: The risk associated with the Failure Mode is acceptable. No mitigation is required prior to implementation.

Medium: The risk associated with the Failure Mode may be acceptable provided additional measures are taken (e.g. risk control/mitigation measures, validation, etc.) or appropriate justifi cation is documented.

High: The risk associated with the Failure Mode is not acceptable. Additional risk control measures or additional data are required to reduce risk to within an acceptable level.

A 9 box grid may be useful to calculate high, medium and low risks

Produced by the Pharmaceutical Regulatory Science Team @DIT for Pharmachemical Ireland.

For reprints contact P CI on info@ibec.ie

PRST

Prerequisites QRA Trigger

Risk Question / Scope Team Formation

Detailed Scope / Complexity

Pre-work

Select Methodologies

Risk Identification

Risk Analysis / Assessment

Risk Ranking

Residual Risk

RiskAcceptance

Risk Mitigation

Goals

Timeline

Roles & Expectations

Teamrisk tools,Informal or Formal?

QRA Trigger occurs, Process Owner alerts team

process owner meets facilitator in advance

Process owner meets Manager & agrees

support team

Process owner meets the SME

to discussProcess

Map

Good to go

facilitator

manager

Process owner

SMEQuality

Identify assumptions

Sources of

uncertainty

Risk Tool

confirmation

Trends

Procedure

Data

Scope

selection

QRA In Progress

Pre requisites for QRM

Trainedfacilitator

Patient

manager SME

Process owner Quality

QRM Pitfalls

QRA TriggerRisk Assessment can be initiated in a number of ways:

Impact: reactive in nature, identified through event or issue.

Proactive: identified through intelligence, new equipment, system, process, product, technology

Retrospective: to gain additional process understanding, to establish a baseline.

Preparation for Risk AssessmentSteps for Success

Outcome: QRA Strategy is agreed

Strategy

Risk strategy: › Ensure the risk question is specific and detailed to assure the risk assessment is exploring the problem or issue fully.

› Spend time reviewing the risk ranking criteria and action levels to add specific layering to increase objectivity when scoring.

› Draft risk question and risk ranking criteria.

› Draft potential failure modes and current controls

Ensure procedure in place based on ICHQ9 guideline

› Including a standard site scoring criteria and ensure that the definitions are appropriately customised to the item under study

› Outline a risk communication process

› Develop QRM document management structure (Templates, repository, list of documents, approval process, tool selection criteria)

› Review process for following up on actions plans / CAPAs / and risk mitigation controls

Training

› Facilitator training program

› Training on QRM approach and methodologies

› Ground rules and behaviours

› Awareness training on the types of bias and human heuristics

› Provide training using examples to ensure a consistent approach.

Meet a typical QRA team

1

2

3

Pitfalls to Avoid

› Influence of the first item we hear

› Preference to keep things ‘mostly’ the same

› Known option can be preferred to unknown option

› More immediate benefits can add weight to preferences

› Recent memories of events, perhaps emotionally charged ones can influence our bias

› Heuristics are cognitive behaviours which are based on our experiences & memories.

› Heuristics can result in bias, which means we don't approach a situation with an 'open mind'

› They come into play when we make judgments in the presence of uncertainty

› Heuristics are a source of significant bias and errors in judgment

› Awareness of the potential adverse influences of human heuristics on the outcomes of QRM exercises is key to designing and implementing your QRM tools successfully

› Inappropriate Team Selection: Team should not all be from one department

› Over reliance on detection controls for risk mitigation

› Inadequate training on QRM purpose, process and roles & responsibilities

› Lack of awareness of inappropriate behaviours and impacts of bias

Examples of BIAS to watch out for

Human Heuristics