RISK-BASED CHANGE CONTROL - Risk Management Applications in Pharmaceutical and Biopharmaceutical Manufacturing - page 368

13.6.1 Step 1: Establish Definitions and Levels for Severity, Occurrence,
and Detection and Risk Tolerance
One of the most important steps in FMEA is choosing the definitions for the dif-
ferent levels of severity (S), occurrence (O), and detection (D). These definitions
should be standardized by each company to reflect the risk tolerance. Table 13.2
presents some example definitions used by one company.
The number of levels for severity, occurrence, and detection should be care-
fully chosen. If too many levels are used, then the team may spend excessive
time determining which level to assign. Fewer levels generally will make deci-
sions easier. A simple three-level approach (high, medium, low or 3, 2, and 1)
may be a good starting point.
Severity is a measurement of the potential consequence of a hazard that
could result from a change request, with respect to patient safety. As previ-
ously mentioned, product quality and compliance requirements are often used
as measurements that assure patient safety. A medical professional's judgment
should be sought when necessary.
Occurrence (or likelihood) of the failure event can be separated into categories
ranging from frequent to almost never and may be defined in numeric (e.g., 1%,
10%, etc.) as well as qualitative (e.g., frequent, occasional, almost never, or 3,
2, 1) terms. When possible, numeric definitions should be used. Process capability
index (CpK) is an especially useful measure. The presence of existing controls
should be considered when measuring occurrence.
Detection measures the capability of existing controls to detect the failure
event and to prevent a defective product from reaching patients. (A detection level
of high means there is low detectability and thus high risk.) As with occurrence,
detection may be defined in numerical as well as subjective terms. The presence
of existing controls should be considered when measuring detection.
The change review team should also agree on its risk tolerance; i.e., the level
of risk the team will accept without requiring further mitigation. For example,
the team may decide that a risk priority ranking above a medium severity,
medium occurrence, and high detection level would not be acceptable without
mitigation.
13.6.2 Step 2: Define Critical Quality Attributes (CQAs) and Critical
Process Parameters (CPPs)
It is important to identify the critical quality attributes (CQAs) for the change
request, to understand the risk. CQAs are typically defined as those that have
potential impact to patient health, product quality (for example, release specifi-
cations), and regulatory compliance (stability during shelf life, etc.).
The critical process parameters (CPPs) that ensure meeting the product quality
requirements should also be known and understood. CQAs and CPPs are typically
identified in a development report, technical transfer report, or validation report,
and serve to help define the design space [5].