**4. Selection of tools**

There are different tools which can be used in QRM, both unspecific and specific for this task "in [2, 6]". In reality, and very unpleasantly for some people, tools just organize in a more or less sophisticated way the information that we have. They will neither provide us with the knowledge that we don't have nor liberate us from the task of thinking about the question. Brainstorming will always be inevitable.

According to their function QRM tools can be classified in three main groups: risk analysis, risk comparison and statistical support.

Risk analysis tools are either inductive or deductive. The first, starting with the normal operation, try to detect possible problems. The second, starting with the problem, try to find the chain of events that led to it. It is also very common to talk about formal and informal tools. In fact the former have really been devised for this purpose, whereas the latter are just data given in a certain way and they can be only considered "tools" in a loose sense.

It might seem surprising to explain that there are QRM tools that do not consider risk, but hazard. Although this is discussed in more detail below, here we need only point out that "risk analysis or management" is a general concept which can consider just hazards or their associated risk too.


#### **Table 4.** Basic classification of tools used in QRM

392 Risk Management – Current Issues and Challenges

An interesting question that might arise as a consequence of the application of QRM is about precedence. What is more important a GMP statement or the result of a QRA? This is however a completely false question because if GMP can be considered the logic baseline in

Problem / question / doubt

3rd Establish its effect/s

5th Look for possible solutions

6th What about GMP?

4th Gather information on it

1st Define it

In fact QRM is complementary to GMP because it provides the frame for taking a decision, whereas GMP proposes us some practical and well known solutions. It is important to understand that "good manufacturing practice" has been, and still is, accompanied by some amount of "bad practice". And this is the result of seeing in GMP as a kind of oracle which

**Adopted solution / approach** 

No solution for a problem should be looked for, before having defined it perfectly. This assertion might seem surprising but experience shows that analysis is often left aside

Once the problem is well understood and its causes and likely effects have been determined is when the search for a solution can be started. In any case this requires, as said before, possessing knowledge. It is evident that GMP has to be taken into account, but only when the problem has been analyzed and understood in depth. Then, an answer to the problem can be found and it is evident that it will be science and knowledge-based and GMP

There are different tools which can be used in QRM, both unspecific and specific for this task "in [2, 6]". In reality, and very unpleasantly for some people, tools just organize in a more or less sophisticated way the information that we have. They will neither provide us with the knowledge that we don't have nor liberate us from the task of thinking about the

because all attention is eagerly focused on the quick search of a solution.

pharmaceutical production, then how can QRA be anything different?

**3. GMP and QRM** 

2nd Look for its cause/s

**Figure 3.** Problem management

compliant.

**4. Selection of tools** 

question. Brainstorming will always be inevitable.

will provide us with magical solutions.

Even if it is true that specific tools have been developed with an intended objective, and this somewhat restricts their scope of use, there is often overseen that they can have a wider utility. In fact tools are at our service and we should use them to organize information in order to get the most of it. Except in those cases when there is a need for coordination, e. g., different sites of the same group, or a requirement by the Authorities we should feel free in the way we use QRM tools.

In practice, it is possible to distinguish six basic cases in QRM:

1. As it has been indicated before the presentation of data is a basic need in QRM, hence informal tools, such as flow charts are necessary.

Quality Risk Analysis: Value for Money in the Pharmaceutical Industry 395

Airlock doors are interlocked. Air is filtered.

verified

Double verification. Materials are controlled and registered while entering and while being used.

Isolator is provided with a pressure gauge. Isolator has an alarm system for pressure.

 Contamination (external): Any contamination of a material or of a product not related to other materials or products manufactured in the factory (e. g., pollen, sand, hair,

Cross-contamination: Contamination of a material or of a product with another material

 Environmental contamination: Contamination of the production rooms, the operators or the surroundings of the pharmaceutical unit because of the voluntary or accidental

Mix up / error: Operation inadequately performed (error) or where one thing is taken

Degradation: Loss of quality of the product because of inadequate conditions

material Inadequate product

(outer) Inflow of dirty air Separation of production

Inadequate CIP

Isolator is not kept at depression

Inadequate

Inadequate humidity

**Hazard Cause Preventive measures Comments** 

areas and air control

Room and people contaminated

Air conditioning with

Note: The contents of this table are just given as an example; they don't intend to represent any real situation.

In order to analyze quality risks in the operations, when there is a significant amount of operator participation, the choice tool is FMECA (failure mode, effects and criticality analysis) "in [2, 6, 7]". It is performed by using a table possessing these main headings:

 Failure mode: the way an element can have a potential failure (in relation to specifications) or do not develop its functions. They are detected as an answer to the question "what might go wrong? It has to be pointed out that a simple function may

cleaning Vessel is dirty Cleaning is validated. Dust liberation Dust extraction system Effectiveness of extraction is

temperature Air conditioning Temperature is controlled

control of humidity Relative humidity is kept ≤ 30%

scales, dandruff, fibers, microorganisms, etc.)

liberation of materials or products

by another one (mix up)

The following table uses this approach:

Mix up / Error Transfer of wrong

or product.

Contamination

Crosscontamination

Environmental contamination

Degradation

**Table 6.** PHA table

**4.3. Risk assessment** 

have several failure modes.


These six cases will cover practically all the needs regarding QRM. Understanding and using them can thus be considered a must.


**Table 5.** QRM most common tools and their practical utilization

## **4.1. Basic data presentation**

Any system may be used to gather and present data and further on we provide some examples. Ishikawa and Pareto diagrams not only show data but the first organizes them at a certain level and the second treats them statistically. This is why they are also mentioned for the root cause identification.

#### **4.2. Basic hazard assessment**

In every situation (product, process, etc.) there is a period of time, in the beginning, when knowledge is very limited and unsure. Suppositions count more than facts. Then, there is a very simple tool, perfectly adapted to this situation: PHA (Primary hazard analysis) "in [2, 6]".

It is developed by using a table, which might vary slightly according to specific needs or requirements, but which considers basically these items: hazards, causes, effects and preventive measures. Note that often it is not necessary to consider the "effects", as they are either evident or are already somewhat included in the "hazard".

The hazards which put the quality of the products at risk during their manufacturing may belong to five categories:


The following table uses this approach:

394 Risk Management – Current Issues and Challenges

parameters.

6. RRF allows for comparisons.

Check lists, reports, graphs, etc.

**4.1. Basic data presentation** 

for the root cause identification.

**4.2. Basic hazard assessment** 

belong to five categories:

using them can thus be considered a must.

Diagrams (flow, Pareto, Ishikawa), histograms, etc.

informal tools, such as flow charts are necessary.

3. If risk assessment is desired, then FMECA is what we need.

1. As it has been indicated before the presentation of data is a basic need in QRM, hence

2. A first task in any QRM is hazard assessment and for doing this PHA is the right tool.

4. HACCP is an appropriate tool for the monitoring of processes by means of their

These six cases will cover practically all the needs regarding QRM. Understanding and

Any system may be used to gather and present data and further on we provide some examples. Ishikawa and Pareto diagrams not only show data but the first organizes them at a certain level and the second treats them statistically. This is why they are also mentioned

In every situation (product, process, etc.) there is a period of time, in the beginning, when knowledge is very limited and unsure. Suppositions count more than facts. Then, there is a very simple tool, perfectly adapted to this situation: PHA (Primary hazard analysis) "in [2, 6]".

It is developed by using a table, which might vary slightly according to specific needs or requirements, but which considers basically these items: hazards, causes, effects and preventive measures. Note that often it is not necessary to consider the "effects", as they are

The hazards which put the quality of the products at risk during their manufacturing may

QRM tool Practical utilization

Basic data presentation

5. When the search for the root cause of an event is required then FTA will do.

**PHA (Primary hazard analysis)** Basic hazard assessment

**FMECA (Failure Mode, Effects & Criticality Analysis)** Risk assessment **HACCP (Hazard Analysis and Critical Control Points)** Process monitoring **FTA (Fault Tree Analysis)** Root cause identification

**RRF (Risk ranking and filtering)** Comparison

**Table 5.** QRM most common tools and their practical utilization

either evident or are already somewhat included in the "hazard".


Note: The contents of this table are just given as an example; they don't intend to represent any real situation.

**Table 6.** PHA table

#### **4.3. Risk assessment**

In order to analyze quality risks in the operations, when there is a significant amount of operator participation, the choice tool is FMECA (failure mode, effects and criticality analysis) "in [2, 6, 7]". It is performed by using a table possessing these main headings:

 Failure mode: the way an element can have a potential failure (in relation to specifications) or do not develop its functions. They are detected as an answer to the question "what might go wrong? It has to be pointed out that a simple function may have several failure modes.



Quality Risk Analysis: Value for Money in the Pharmaceutical Industry 397

**Seriousness of harm** Insignificant Minor Severe Critical Catastrophic

Always High risk

**significant? Why? Preventive** 

filter Yes Product not sterile Process validation

Is there in this stage a hazard with enough probability and seriousness to make it necessary its control?

Yes No

Yes No Yes No

Modify as necessary

Yes No

**measures** 

and monitoring Yes

It is not a CCP

It is not a CCP

allowed Monitoring Yes

Is it necessary to control this stage in order to ensure the quality of the product

**Is it a CCP?** 

HACCP (hazard analysis and critical control points) is a method that detects the hazards for the quality of the products (or for the safety) and then their "critical control points" (CCP)

The flow chart is studied to identify potential hazards, which might affect the quality of the

"in [2, 6, 8]". The rational of HACCP is exposed in the annexed figure.

**Probability of harm** 

**Operation /** 

Test for endotoxin in water

Frequently (probable)

Rare (improbable)

**Table 9.** Example of risk evaluation

Filter sterilization Viable microbes in the

**Table 10.** HACCP – I: CCP establishment

**Figure 5.** Rationale for the establishment of a CCP

Is it necessary to control this stage in order to reduce / eliminate the hazard?

It is a CCP It is not a CCP

Non observable Low risk

This leads to the determination of the CCPs.

**Process stage Potential hazard Is risk** 

Presence of endotoxin

product. Then these hazards have to be assessed. Do they have to be controlled?

Sometimes Medium risk

in water Yes Endotoxin is not

Note: The contents of this table are just given as an example; they don't intend to represent any real situation.

Is there a control measure for this hazard?

The rationale for the establishment of CCP can be summarized as follows.

Measure of pH pH outside range Yes Precipitation Verify pH Yes

Note: The contents of this table are just given as an example; they don't intend to represent any real situation.

#### **Table 7.** FMECA table

This table may include risk reduction and be used as an instrument of risk management.


**Table 8.** FMECA table for risk reduction

#### **4.4. Process monitoring**

It is evident that if a process is well understood it is possible to identify its CPPs and if we can keep them under control by a process monitoring system then the quality of the products will be ensured.

**Figure 4.** HACCP rationale

HACCP (hazard analysis and critical control points) is a method that detects the hazards for the quality of the products (or for the safety) and then their "critical control points" (CCP) "in [2, 6, 8]". The rational of HACCP is exposed in the annexed figure.

The flow chart is studied to identify potential hazards, which might affect the quality of the product. Then these hazards have to be assessed. Do they have to be controlled?


**Table 9.** Example of risk evaluation

396 Risk Management – Current Issues and Challenges

**Failure mode <sup>S</sup>**

5 Dissolution Degradation 3 Temperature >

dosage <sup>3</sup>

**mode S Cause <sup>P</sup>Control** 

**Acceptable?**

rpm

**#** 

**#** 

**Operation / Process stage** 

3 Agitation Speed < 1.400

9 Filling Inadequate

**Table 7.** FMECA table

**Operation / Process stage** 

**Failure** 

**4.4. Process monitoring** 

products will be ensured.

**Figure 4.** HACCP rationale

**CCP management and periodical review**

**CCP monitoring**

**Define CCPs and establish control limits for them**

**Table 8.** FMECA table for risk reduction

Cause: the grounds which provoke a failure.

Effect: the results which appear when the failure mode comes out.

(Severity) **Cause <sup>P</sup>**

2 Failure 1

Failure / wrong adjustment

80ºC <sup>1</sup>

(Probability)

1

Note: The contents of this table are just given as an example; they don't intend to represent any real situation.

This table may include risk reduction and be used as an instrument of risk management.

**in place D RP Risk** 

It is evident that if a process is well understood it is possible to identify its CPPs and if we can keep them under control by a process monitoring system then the quality of the

**Definition of the product / process / system**

**Hazard identification**

**Application of control measures**

**Risk analysis and evaluation** **Inacceptable?**

**Establish corrective measures to be implemented when a CCP is out of range**

**Existing controls** 

Monitoring by computer

Monitoring by computer

Every tube is weighed after filling

**accepted? Actions** 

Risk evaluation Risk reduction

**D**  (Difficulty of detection)

1 2

1 3

1 3

Risk priorisation **(PR = S x P x D)** 

**Risk accepted? (comments)** 

Yes (a tachymeter is in place; speed can vary without sensible effect)

Yes (T is controlled and materials are not affected)

Yes (equipment is qualified and scales are calibrated)

**Reevaluation Risk S P D PR accepted?** 

> **Implement measures for a better process control and for reducing risk**

This leads to the determination of the CCPs.


Note: The contents of this table are just given as an example; they don't intend to represent any real situation.

**Table 10.** HACCP – I: CCP establishment

The rationale for the establishment of CCP can be summarized as follows.

**Figure 5.** Rationale for the establishment of a CCP

Then, for each CCP are defined alert and acceptance limits. As a consequence, monitoring procedures are established and they are accompanied by the set up of corrective actions in case of deviation. Finally as in any monitoring system it is necessary to define how it will be managed and periodically reviewed to verify that it performs as expected.

Quality Risk Analysis: Value for Money in the Pharmaceutical Industry 399

Two simple tools can be used for a primary analysis of causes.

the elements are classified in relation to their cumulative frequency.

effect.

"in [2, 6, 9]".

they belong.

**Figure 7.** FTA diagram

Contaminated object

**and** 

Dirty gloves Glove contact

**Figure 8.** FTA: Examples of "and" and "or" gates

**Intermediate event**: It connects the top event to the basic events.

**Gate**: It connects the events defining their causality reports

The first one is the diagram of Ishikawa, also known as cause-effect or fishbone diagram, which shows in a graphical way cause relations and their interaction to provoke an

The second one is the diagram of Pareto, which orders the data in relation to their importance and this allows for the distinction among frequent and infrequent causes of failures. It is prepared by listing all the elements and determining their frequencies. Then,

FTA (fault tree analysis) is a deductive tool which uses a pictogram to represent in an organized way the factors (causes) which produce or contribute to the production of an undesirable event

The tree is started by placing the top event. Then the events which contributed to it are

Gates can be very varied, but the most common ones are the "and" and "or" gates. Although there are specific gate symbols defined by an international standard, in practice for most cases it would suffice to represent them by a circle and write inside to which type

Faulty sterilization Inadequate manipulation

**or** 

Contaminated vial

Contaminated environment

**Basic event**: It initiates a failure and does not need further development.

**Top event**: The failure or deviation, which starts the AAP

analyzed. Events are united by gates, which show the relation amongst them.

**Event**


Note: The contents of this table are just given as an example; they don't intend to represent any real situation

**Table 11.** HACCP – II: CCP monitoring

#### **4.5. Root cause identification**

When a deviation is detected it is necessary to implement corrective and preventive actions (CAPA system), But this is only possible if the root cause has been identified. To do this we can use several tools, both unspecific (such as Ishikawa or Pareto diagrams) and specific (FTA).

**Figure 6.** Diagrams of Ishikawa and Pareto

Two simple tools can be used for a primary analysis of causes.

398 Risk Management – Current Issues and Challenges

**CCP Acceptable** 

Test for endotoxin in

(FTA).

**Ishikawa** 

**Pareto** 

**range** 

Measure of pH pH = 6-7 Production

Filter sterilization Sterile Production

**Table 11.** HACCP – II: CCP monitoring

**4.5. Root cause identification** 

**Figure 6.** Diagrams of Ishikawa and Pareto

Secondary cause

Primary cause

water < 0,25 U. QC technician LAL test

Then, for each CCP are defined alert and acceptance limits. As a consequence, monitoring procedures are established and they are accompanied by the set up of corrective actions in case of deviation. Finally as in any monitoring system it is necessary to define how it will be

**Monitoring**

Control process parameters (P, T and t)

**A B C D E F G H I J Most important causes Causes of deviation**

**Corrective actions Who? How? When** 

supervisor pH-meter In process Call the supervisor. Add

**Factor 1 Factors which contribute to the effect**

**Factor 2** 

Before starting the production

After sterilization Stop production and call the supervisor

more sodium hydroxide

Stop production and call the supervisor

**100%** 

**Causes** (primary and secondary)/

**Causes** (primary and secondary)/

**Factors which contribute to the effect**

**EFFECT** 

**50%**

**0%** 

managed and periodically reviewed to verify that it performs as expected.

technician

Note: The contents of this table are just given as an example; they don't intend to represent any real situation

**Factor 3 Factor 4** 

When a deviation is detected it is necessary to implement corrective and preventive actions (CAPA system), But this is only possible if the root cause has been identified. To do this we can use several tools, both unspecific (such as Ishikawa or Pareto diagrams) and specific The first one is the diagram of Ishikawa, also known as cause-effect or fishbone diagram, which shows in a graphical way cause relations and their interaction to provoke an effect.

The second one is the diagram of Pareto, which orders the data in relation to their importance and this allows for the distinction among frequent and infrequent causes of failures. It is prepared by listing all the elements and determining their frequencies. Then, the elements are classified in relation to their cumulative frequency.

FTA (fault tree analysis) is a deductive tool which uses a pictogram to represent in an organized way the factors (causes) which produce or contribute to the production of an undesirable event "in [2, 6, 9]".

The tree is started by placing the top event. Then the events which contributed to it are analyzed. Events are united by gates, which show the relation amongst them.

Gates can be very varied, but the most common ones are the "and" and "or" gates. Although there are specific gate symbols defined by an international standard, in practice for most cases it would suffice to represent them by a circle and write inside to which type they belong.

Faulty sterilization Inadequate manipulation

Contaminated environment

**Figure 8.** FTA: Examples of "and" and "or" gates

Dirty gloves Glove contact

Quality Risk Analysis: Value for Money in the Pharmaceutical Industry 401

Risk

**Risk filtration Difficulty of detection** 

Class 3 **3rd priority** 

Class 2 **2nd priority** 

Low Middle High

Class 1 **1st priority** 

Risk classification

Filtering based on risk

Filtering based on resources

It is also possible to rank and filter risks by using tables combining the three well-known

**Risk classification** 

Elements / Components

**A**

**E**

**C**

**B**

**D**

**F** 

This is not the kind of stupid question that, at first sight, might seem. And in fact this is not a question, but two. The first one might be related to the fact that in everyday's life we somehow tend to mix-up hazard and risk. As the latter is the consequence of the former, we tend to consider both practically as synonymous. The second one comes out because of the fact that identification of hazards is a prerequisite for the determination of their risk, and risk allows for an assessment of hazard. Thus, why to limit ourselves to something of "low level" like hazard when we can get something "better" like risk? Unfortunately this is not correct. By definition, to determine risk we have to start by knowing the probability of occurrence of the hazard. And this is often very difficult and in the end it turns to be just an inference. Then, we should know the seriousness of the harm and, although this is usually clearer, it is neither an easy task and often requires some degree of imagination. Consequently, in many cases, risk is not more than an estimation, that has to be improved along the time as more experience is collected. The case might be that hazard, usually a concrete thing, is substituted by risk, an estimated value and this can hardly be something

In practice, our first aim should be to determine hazard and then, only if there is an objective possibility of estimating risk, do it. Speaking in general terms the evolution should be hazard detection > qualitative risk estimation > quantitative risk estimation. In projects or new processes we would move towards the left (hazard), whereas as we gain process

**Figure 11.** Hazard – Risk - Harm

**Problem / Hazard** 

**A**

**Problem / Hazard** 

**B** 

**Problem / Hazard** 

**C** 

**Problem / Hazard** 

**D** 

**Problem / Hazard** 

**E** 

**F** 

**Problem / Hazard** 

**Risk classification Severity** 

**Probability** 

better.

factors (probability, severity and difficulty of detection).

High Middle Low

High **Class 1**  Middle **Class 2** Low **Class 3**

**5. Is it really necessary to determine risk in QRM?** 

knowledge we might move towards the right (risk).

**Figure 12.** RRF: Combination of the risk factors

**Figure 9.** RRF: Example of hazard or problem decomposition (factors intervening in cleaning)

#### **4.6. Comparison**

RRF (Risk ranking and filtering) is a tool specifically devised for the comparison of different sets (units, processes, companies, etc.) possessing varied levels of risks "in [2, 6, 10]". Once they are reduced to a common denominator they can be compared and this allows for the establishment of priorities.

As in any method, it is necessary to individualize first the hazards or problems and then the different attributes, components or elements, which contribute to them.

Then each attribute, component or element is evaluated in terms of risk.


**Figure 10.** RRF: Risk estimation

It is possible to get a comprehensive evaluation taking into account all the intervening elements. This allows for the ranking of the problems or hazards, which can be filtered.

Quality Risk Analysis: Value for Money in the Pharmaceutical Industry 401

**Figure 11.** Hazard – Risk - Harm

400 Risk Management – Current Issues and Challenges

**Product manufactured afterwards** 

**Maximum daily dose Batch size** 

**…** 

**4.6. Comparison** 

**…** 

**manufactured previously** 

**Solubility in water Therapeutic single dose Adsorption to surfaces Particle size Moisture Stability Batch size** 

establishment of priorities.

**Figure 10.** RRF: Risk estimation

**Problem / Hazard Classification Evaluation Low Middle High** 

**Figure 9.** RRF: Example of hazard or problem decomposition (factors intervening in cleaning)

RRF (Risk ranking and filtering) is a tool specifically devised for the comparison of different sets (units, processes, companies, etc.) possessing varied levels of risks "in [2, 6, 10]". Once they are reduced to a common denominator they can be compared and this allows for the

**CLEANING** 

**… Product** 

**Surface extension Type of surface Material of construction Design Mode of use Type of automatisation** 

**…** 

**Type of automatisation Temperature Time Products used** 

**Time remaining dirty** 

**…** 

**Characteristics of the cleaning process** 

**Characteristics of the equipment used** 

**Characteristics of the manufacturing process** 

**Moisture Dispersion Time befor cleaning** 

**…** 

As in any method, it is necessary to individualize first the hazards or problems and then the

**Supplier compliance** (example) **Element Classification Evaluation Low (1) Middle (2) High (3)**  GMP Deficient Acceptable Certified 2 Q system Deficient Acceptable Certified 1 Audits None By other By us 3 Documents Deficient Good Excellent 2 History >5 problems <5 problems No problems 2 10

It is possible to get a comprehensive evaluation taking into account all the intervening elements. This allows for the ranking of the problems or hazards, which can be filtered.

different attributes, components or elements, which contribute to them.

Then each attribute, component or element is evaluated in terms of risk.

It is also possible to rank and filter risks by using tables combining the three well-known factors (probability, severity and difficulty of detection).

