BACKGROUND AND INTRODUCTION - Risk Management Applications in Pharmaceutical and Biopharmaceutical Manufacturing - page 9

ICH Q9 explains what quality risk management is, how it can be applied to
pharmaceuticals, and how it can provide a common language with an agreed pro-
cess for the pharmaceutical industry and regulators. In ICH Q9 risk management
models, “risk” is defined as “the combination of the probability of occurrence of
harm and the severity of that harm.” While the combination of probability and
severity is helpful in reflecting the level of risk importance, detectability often
influences the decision-making process in manufacturing risk management.
ICH Q9 places focus on risk to patient safety due to a product defect or
loss of quality along the supply chain. ICH Q9 defines risk management as a
systematic application of quality management policies, procedures, and practices
to the tasks of assessing, controlling, communicating and reviewing risk .Risk
management is then a process by which sources of risk are recognized and steps
taken to mitigate, reduce, or eliminate the chance of harm. If the objective of risk
management is to avoid harm, then one way to meet this objective is to provide
a means to make decisions based on relative risk [17].
Figure 1.1 of ICH Q9 presents a logical flow for managing risk [17]. The flow
can be broken down into distinct steps and substeps.
1. Risk assessment —understand the process.
• Risk identification—identify process/quality hazards and potential harm
it might cause .
• Risk analysis—determine what event or condition could cause the hazard .
• Risk evaluation—rank or score the relative risk of the hazard, in an effort
to recognize when improvement has occurred .
2. Risk control —react to the outcome.
• Risk reduction—improve the process through mitigation of the risk .
• Risk acceptance—decide if the process risk has been reduced to an
acceptable level or if further mitigation or evaluation is necessary .
3. Risk communication —interact with interested parties to relay risk-related
information in order to implement mitigation-related changes or communi-
cate residual or remaining risk.
4. Risk review —follow up and periodically reassess to determine if changes
have been implemented and if changes are effective.
Risk management is a method to
• recognize and address potential weakness in the process, in an effort to
assure objectives are met
• identify potential hazards
• assess likelihood of occurrence
• decide if process risk is acceptable
• communicate risk
• reduce risk