ality Risk Management (QRM) Workshop 8 Hazard Control and Critical Control Points (HACCP) (Gource: Annex 15, ICH Q9, Step 4) Hazard Analysis and Critical Control Points (HACCP) HACCP is a systematic, proactive, and preventive tool for assuring product quality, reliability, and safety. Itis structured approach that applies technical and scientific principles to analyze, evaluate, prevent, and control the risk or adverse consequence(s) of hazard(s) due to the design, development, production, and use of products. HACCP consists of the following seven steps: 1) conduct @ hazard analysis and identify preventive measures for each step of the process; 2) determine the critical control points; 3) establish critical limits; 4) establish a system to monitor the critical control points; 5) establish the corrective action to be taken when monitoring indicates that the critical control points are not in a state of control; 6) establish system to verify that the HACCP system is working effectively; 7) establish a record-keeping system. Potential Areas of Use(s) HACCP might be used to identify and manage risks associated with physical, chemical and biological hazards (including microbiological contamination). HACCP is most useful when product and process understanding is, sufficiently comprehensive to support identification of critical control points. The output of a HACCP analysis is risk management information that facilitates monitoring of critical points not only in the manufacturing process but also in other life cycle phases. (Introduction to HACCP Principles in Meat Plants, Jeff W. Savell, Texas A&M. University, June 1995) The roots of HACCP go back to the early years of the U.S. space program where food safety was an extreme responsibility for those preparing the foods for use high above the earth. HACCP centers on the prevention of problems rather than inspection and the hopeful identification of problems after-the-fact. HACCP was first used in processes such as canning and other cooked foods applications where failures in food safety had the greatest consequences. HACCP is program that empowers people to focus their attention on prevention rather than discovering or inspecting out problems after they occur. HACCP is not a set of seven independent principles; each must build on the other. No great record keeping and monitoring system will overcome inadequate hazard analysis and critical control point evaluations. As with any other endeavor, all components must be working for the total plan to be effective and successful Singapore -July 2007 Joe Brady DPS/DIT __—_—Rev. 003 Page 70 of 98Quality Risk Management (QRM) Workshop Principle 1. Conduct a hazard analysis, Prepare a list of steps in the process where significant hazards occur and describe the preventive measures, Hazards are categorized into three general areas: * Biological © Chemical © Physical. For the most part, biological, which includes pathogens, is the hazard that most plans are used to prevent. The challenge that faces the HACCP Team is to determine what are truly significant versus insignificant hazards. The Team must weigh both risk and severity when analyzing hazards. Principle 2. Identify the CCPs in the process. ‘A Critical Control Point is defined as a point, step or procedure at which control can be applied and a food safety hazard can be prevented, eliminated, or reduced to acceptable levels. This differs from a Control Point, which is a less specific and important step in the process. The selection of CPS is aided by the use of a CCP Decision Tree. This Decision Tree is designed to allow the Team to ask specific and logical questions to help determine what is truly a Critical Control Point versus a Control Point or something that could be handled under the GMPs (Good ‘Manufacturing Practices) or SOPs (Standard Operating Practices). Although this Decision Tree is not perfect, it certainly helps to focus the attention of the team on what should be used in a HACCP Plan to control hazards. Principle 3. Establish critical limits for preventive measures associated with each identified CCP. Critical Limits are important tools that help the HACCP Plan function properly. Critical Limits serve as the boundaries for each CCP. Examples of Critical Limits are preventative measures such as temperature, pH, salt concentration, time, moisture level, etc. Critical Limits are different from factors that may affect quality. The flavor characteristics of a cooked meat product may be best achieved at a certain endpoint temperature, but the safety of the product may be achieved at another temperature. Principle 4. Establish CCP monitoring requirements. Establish procedures for using the results of monitoring to adjust the process and maintain control. CCP monitoring is a planned sequence of observations or measurements to assess whether a CCP is under control and to produce an accurate record for future use in verification. Monitoring is focused on keeping the process under control and preventing deviations (those occurrences outside the Critical Limits) from happening. If deviations do occur, monitoring will provide the information as to when problems occurred so that corrective action can be taken, Monitoring is performed best in real- time, ie., measuring the process as it occurs rather than taking samples and sending to a laboratory for results that would be produced days later. This is not to say that there is no place for in-depth analyses of processes and products, but that this activity fits best under Principle 7 under verification Singapore - July 2007 Joe Brady DPS/DIT _—Rev. 003 Page 71 of 98Quality Risk Manag (QRM) Workshop Principle 5. Establish corrective action to be taken when monitoring indicates that there is a deviation from an established critical limit. It must be assumed that deviations will occur, even in the best HACCP Plans. There are three areas that corrective action plans address: (a) to determine the disposition of non-compliance product (b) to fix or correct the cause of noncompliance to assure that the CCP is under control (c) to maintain records of the corrective actions that have been taken where there has been a deviation from Critical Limits. All HACCP Principles are important, but this Principle answers the question of “what if” before it happens. It is not in the best interest of the company to leave the decision making process to those in the middle of the crisis. Plans must be in place to address ‘what to do with the product under as many scenarios for violations of Critical Limits as possible. Principle 6. Establish effective recordkeeping procedures that document the HACCP system. ‘The approved HACCP Plan and associated records must be on file at the establishment, For the most part, this may be the only part of the HACCP Plan that vill be audited or reviewed by customers or regulators. Adequate records of what is and was measured and what was done with products that were produced outside of, Critical Limits are items that people look to see if the HACCP Plan is working. Principle 7. Establish procedures for verification that the HACCP system is working correctly. Verification is a process to look at the HACCP Plan as it is being carried out and at the long-term trends and implications. The HACCP Team must strive to continue to update and improve the HACCP Plan knowing that the Plan is a dynamic instrument that will grow and change as products and processes evolve and as new forms of hazards enter the food chain. This Principle deals with reviews of the Plan, both in how itis written and how itis being followed, Outside experts play an important role in giving input to the Team as to ways to improve the Plan, Verification is an on- going process that helps in ensure that the HACCP Plan is doing what it is supposed to do: prevent hazards from becoming a part of the food supply. Singapore - July 2007 Joe Brady DPS/DIT _—_—Rev. 003 Page 72 of 98ality Risk Management (QRM) Workshop eo Y Hock Gutter pd] A000 t+ pickers [at Scaiding | mam(rn) Yy Vent Opener Sizing lines, cut-up, deboning, or further processing Shipping HACCP Flow Diagram (Sources: General Guidelines for Implementation of HACCP In a Poultry Processing Plant, Julie K. Northcuit and Scott M. Russell, The University of Georgia , June 2003) Washing} Neck Breaker Viscera Removal y Carcasses Routed me] cnitor 4 to: Packaging Type of Hazard ‘Critical Limits Physical quay) | Receive product ony it <45 degrees F, nl Blclogcal (contamination) | abnormal sppearance or smell Physical (quatiyy | Mustbe cocked fo internal temperature Bioogical (contamination) 2160 deurees F “Must be cooled to a temperature <41 grees F Physical quality) Biological (contsmination) “Mot: Ategh 41 dogroes F does nol adeqatl teaz pred Wis th it fr esting mcrolslapel growth Some Definitions 1, Eviscerator: removal of the entrails 2. Hock: joint in the leg of a domestic fow! directly above the foot 3. Oil gland: gland at the base of a bird's tail that secretes an oil used in preening 4, Giblets: The edible heart, liver, or gizzard of a fowl 5. Viseera: The soft internal organs of the body, especially those contained within the abdominal and thoracic cavities 6. Cropper: removal of upper gastrointestinal tract Singapore - July 2007 Joe Brady DPS/DIT Rev. 003 Page 73 of 98Q nt (QRM) Workshop HACCP Principle 2 - Determine Critical Control Points (CCPs) [Vanesa eetaere | Q1: Does this step involve a hazard of sufficient likelihood of occurrence and severity to warrant its control? | | Yes No __|-——*/_Not a CCP ¥ Q2: Does a control measure for the hazard exist at this, step? ¥ ¥ [ Yes No Modify the step, process or product, ¥ |s control of this step necessary forsafety/ | ___ 4 Yeg quality / efficacy? ¥ No *|_Not a CCP. >) Stop + Q3: Is control at this step necessary to prevent, eliminate, or reduce the risk of the hazard to patients? Yes No >[ Not a CCP >) Stop Singapore -July 2007 Joe Brady DPS/DIT _—_—Rev. 003 Page 74 of 98Quality Risk Management (QRM) Workshop Risk Assessment and Risk Management in the Pharmaceutical Industry: Clear and Simple (by James L. Vesper, 2006) Several “Preliminary Tasks” at the start of the HACCP process are information related and use the following elements: 1. A description of the product. This includes the specifications and requirements of the product as well as its packaging (e.g., container / closure, thermal protection if needed). Part of the description could be what the product is not supposed to be or do. 2. A description of the distribution process and requirements. It addresses questions like the following ones: Does the product need to be maintained at a constant temperature during its shipping and storage? Are there any other issues, such as the product being particularly susceptible to theft, counterfeiting, or diversion? 3. A description of the intended use of the product and its users. Does the product have to be prepared prior to use, such as being reconstituted with tap / potable water or with water for injection? Also, who are the users of the product? Is the product intended to be used directly by the patient or would it be administered by a healthcare practitioner or by a family member? 4, A detailed description and flow diagram of the process. This is the primary working document that the HACCP team will be reviewing and from which the control points will be identified. 5. The agreed upon data collection sheets. These sheets should be standardized so that the data collection and review process can be consistent. FDA - HACCP hup:/éwww.cfsan.fda,gov/~commy/hacepov html Sait oer [CENTIRFOR FOOD SATY AND AFPLED NUTRITION, Singapore - July 2007 Joe Brady DPS/DIT Rey. 003 Page 75 of 98Quality k Management (QRM) Workshop ‘Figure 1. Preliminary Tasks in the Development of the HACCP Plan Singapore - July 2007 Joe Brady DPS/DIT —_—_—Rev.. 003 Page 76 of 98Quality Risk Management (QRM) Workshop Example of a Flow Diagram for the Production of Frozen Cooked Beef Patties = ee — onda hard nap Principle 2) Step | Poi awaty “ection Hoardtetealvssed | — Contal ipa? Measure) va Geek [Bari paumas | pages ave bea acne wih Y ects 4, abana, | ones offodbome ie os singed cot | decanted gouteet Rev. 003 Page 77 of 98 Singapore - July 2007 Joe Brady DPS/DITRisk Management (QRM) Workshop Determine critical control points (CCPs) (Principle 2) QL. Does this step mvolve a hazard of sufficient likelihood of ‘occurence and severity to warrant its control? 4 4 YES NO Not aCcP J Q2. Does a control measure for the hazard exist at this step? 4 J 1 YES No Modify the step, t 4 rocess or product Pp J Is control at this step T 1 necessary for safety? YES 4 4 J NO + NotaCcP-+ sTOP* Q3. Is control at this step necessary to prevent, climinate, or reduce the risk of the hazard to consumers? 1 4 YES NO - Notaccp sTop+ 4 ce Establish critical limits (Principle 3) Process Step | CCP | Critical Limits | 5.Cooking | YES | Oventemperature °F | ‘Time; rate of heating and cooling (belt speed in Wen): ffexin Paty thickness: in Patty composition: eg all beef Oven humidity: __% REE Singapore - July 2007 Joe Brady DPS/DIT Rey. 003 Page 78 of 98lity Risk Managem it (QRM) Worksho; ee Rewer Rewpeiiiy Reve ne Acie Seng Yeni Upn HACCP Spc |HAGC Contr Panter na Vain HACC i ctosaDeeginad [independent [HACCP Tem | Iplemectancn of Plan eee” Sau vsine CEACCE Pa | Wie Geto Cre, [nips e™ AC Tas Seqticant Chusges m Process, a Exepans Chae Ader Se Fite Varies CCP Moennges [Aredia HAGCD meg, | eewdngho HACCP Pane ne [Records HAGSR Densedte Fan (og menage! |oxrpertid) See Fan ees doy yee peta auch Rev cheng Connie hn | eny ay Aaa fWACeP i Reordra Stow Compa wt Fan cemprtenee HACCP Spon Vaca | iy tpt net Pineau [Dee by oes ante en wig a inpleenegte plan My oie dion etal apr ax wel as boray ed pla en Singapore - July 2007 Joe Brady DPS/DIT Rev. 003 Page 79 of 98Quality Risk Management (QRM) Workshop Annex I: Methods & Tools Source ICH-Q9 Briefing Pack — Q9 PHA - Hazard Analysis and Critical Control Points (HACCP) (prepared by some members of the ICH Q9 EWG for example only; not an official policy/guidance) ee safe sh ined Joint responsibility Responsibility: receiving site Benefit * Teamwork in cross functional groups * Use very similar principles in Qualification & Validation © Critical control points (CPs) are similar to critical process parameters Limitations of the mode! Has to be combined with another tool (e.g. FMEA, statistical tools) Not good for complex processes Assumes you know the processes Most CPs should be addressed for risk control activities May need to use other models for quantifying risk Singapore - July 2007 Joe Brady DPS/DIT Rev. 003 Page 80 of 98ality Risk Management (QRM) Workshop Hazard Control and Critical Control Points (HACCP) Preliminary Tasks atthe start of the HACCP process ‘© Prepare a description of the product Prepare a description of the distribution process and requirements Prepare a description of the intended use of the product and its users Prepare a detailed description and flow diagram of the process ‘Agreed upon data collection sheets Seven (7) HACCE Principles ‘© Principle 1: Conduct a hazard analysis. Prepare a list of steps in the process where significant hazards occur and describe the preventive measures. le 2: Identify the CPs in the process. Principle 3: Establish critical limits for preventive measures associated with each identified CCP. ‘© Principle 4: Establish CCP monitoring requirements. Fstablish procedures for using the results of monitoring to adjust the process and maintain control. ‘+ Principle 5: Establish corrective action to be taken when monitoring indicates that there is a deviation from an established critical limit, ‘© Principle 6: Establish effective recordkeeping procedures that document the HACCP system. ‘* Principle 7: Establish procedures for verification that the HACCP system is working correctly. Singapore - July 2007 Joe Brady DPS/DIT Rev. 003 Page 81 of 98k Management (QRM) Workshop lon Exchange Chromatography Gradient Maker Detector/Recorder 8 Fraction Collector ccp ee: | . “7 ~ ‘Step4: Wash - - Singapore - July 2007 Joe Brady DPS/DIT Rev. 003 Page 82 of 98HACCP Principle 2 - Determine Critical Control Points (CCPs) Q1: Does this step involve a hazard of sufficient likelihood of occurrence and severity to warrant its control? ality Risk Management (QRM) Workshop ¥ No__[|-—*|_Not a ccP Yes ¥ Q2: Does a control measure for the hazard exist at this step? Yes Modify the step, process or product e ¥ |s control of this step necessary for safety/ |___ eg quality / efficacy? y No >|_Not a CCP >| Stop t Q3: Is control at this step necessary to prevent, eliminate, or reduce the risk of the hazard to patients? y | Yes No Nota CCP. >| Stop y ccP Page 83 of 98 Singapore - July 2007 Joe Brady DPS/DIT Rev. 003ality Risk Management (QRM) Worksho) HACCP Principle 2 - Determine if Step-2 of the lon Exchange Chromatography process is a Critical Control Point Q1: Does this step involve a hazard of sulficient likelihood of occurrence and severity to warrant its control? (Yes, because the gradient slope is critical to the separation and timely elution of the bound proteins) No __|-——_Nota CCP ¥ Q2: Does a control measure for the hazard exist at this step? (A series of control measirres is absolutely required) y + Yes No Modify the step, process or product ¥ ¥ Is control of this step necessary for safety/ | ____s-~Yog quality / efficacy? (Yes) Not a CCP. >| Stop Zz & t 3: |s control at this step necessary to prevent, eliminate, or reduce the risk of the hazard to patients? (Yes, because we need to exceed purity of product fraction above 90%) ¥ | Yes No >|_Not a CCP > Stop ¥ ccP Singapore - July 2007 Joe Brady DPS/DIT Rev. 003 Page 84 of 98Quality Risk Management (QRM) Worksho HACCP Exercise 1 ‘You are a health professional researching clinical advice for the preparation of powdered infant formula milk. Use HACCP to assure product quality, reliability, and safety General guidelines Infant formula powder is not sterile; the risks associated with using powdered infant formula milk are reduced if: good hygiene practices be adhered to manufacturer's guidelines are followed feeds are made up using boiled water that is greater than 70°C in practice, this means using water that has been left to cool for no more than half- an-hour feeds are made up fresh for each feed * storing made up formula milk may increase the chance of a baby becoming ill and should be avoided any left over milk is thrown away ‘keep water that has just boiled in a sealed flask and make up fresh formula milk when needed © use a liquid ready-to-feed formula © temperature of the feed be tested and, if required, cooled by holding the bottle, with the cap covering the teat, under cold running water Manufacturer’s guidelines 1. Wash your hands prior to making formula, 2. Always wash the top of the formula can before opening it. 3. Clean or sterilize the bottles and nipples before the first use according to the package directions. 4. Wash all bottle pieces and measuring utensils in hot soapy water before using. Rinse thoroughly and let air ary, 5. Be sure to use the appropriate measuring cups. Cups that measure dry ingredients like powders are different than liquid measuring cups. 6. Check with your health care professional or local health department about the need to boil the water you’ll use to prepare formula. 7. If water must be boiled, heat water until it reaches a rolling boil, continue for 1-2 minutes and let it cool thoroughly before using it to mix formula. 8, Follow formula mixing instructions on the can, unless you have been instructed otherwise by a health care professional and then mix according to instructions provided to you. Singapore - July 2007 Joe Brady DPS/DIT _—_—Rev. 003 Page 85 of 98ality Risk Management (QRM) Worksho; 9. Keep prepared formula in a clean jug in the refrigerator. 10, Formula doesn’t need to be warmed, but if you decide to warm a bottle, hold under running water or place in a cup of hot water for a minute or two. NEVER microwave a bottle as the formula can heat unevenly and burn your baby's mouth, 11, Throw out any unused formula left in a bottle after feeding or which has been unrefrigerated for 1-hour or more. 12, Prepared formula is usually good for 24-48 hours when refrigerated. Check mixing instructions on the can or those given to you by a health care professional, Singapore - July 2007 Joe Brady DPS/DIT Rev. 003 Page 86 of 98ality Risk Management (QRM) Workshop 9 Risk ranking and filtering Adapted from: Risk-Based Method for Prioritizing CGMP Inspections of Pharmaceutical Manufacturing Sites — A Pilot Risk Ranking Model Departnent of Heath and Hannan Services 5. Food and Drug Admilstrnon September 2004 RISK RANKING Risk ranking is a risk management tool for comparing and prioritizing risks. Often the need for risk ranking is driven by a disparity between obligations to manage, mitigate, or reduce an array of risks (or many sources of a given type of risk) and available resources. Formal risk ranking is based on well-defined analytical processes and enhances the quality, transparency, and, potentially, the performance of risk management programs. Formal risk ranking methods are particularly helpful in situations in which the portfolio of risks and the underlying consequences to be ‘managed are diverse and difficult to compare using a single tool. Formal risk ranking uses an analytical process to pose a risk question: 1, Identify potential hazards and risks 2. Characterize factors that can be used as variables for quantifying risk (risk estimation) 3. Mathematically combine the variables to yield an overall risk score for risk ranking (tisk filtering and ranking). General Process for Risk Ranking Foc Complex Systems, Categorize ‘Risk Factors Logically, ‘Adauaiuatively ‘Evumate Risks for Each emia TaventoryPrcoio RanicTems (Risks) Filter Ranked List Yes (=) A high-level schamarie is shown: the process inludes numerous intermediate adminiemative acthites, such ‘as erganising teams of exports and determining dara needs under each factor entity and Lis sete a it AUR bles Obie ‘Me Singapore - July 2007 Joe Brady DPS/DIT__Rev. 003 Page 87 of 98ality Risk Management (QRM) Workshop Hazard Identificat Risk ranking of complex systems typically requires an identification of multiple quantitative and qualitative factors for each risk and/or hazard. These factors, in turn, often fall within a complex hierarchy of criteria under a stated risk question. ‘The conceptual understanding and perception of risk is expected to differ depending on an individual's pertinent training, prior beliefs about the risk, and other psychosocial factors. For the first phase of risk ranking, the job of risk analysts is to elicit from a diverse group of experts a broad range of factors, system concepts, and any other information that might inform the risk analysi ‘This initial brainstorming serves as a qualitative hazard identification phase of the overall risk assessment. In hazard identification, sources of harm, or hazards, are identified as possibilities independently from the probabilities or likelihoods that the hazards cause harm in the defined system. ‘An open-ended, brainstorming approach to identify hazards will generate an abundance of factors believed by individuals or groups of individuals to contribute to risk. In a complex system some factors ate likely to be objective and quantitatively supported while others are likely to be subjective and value-based. Furthermore, the initial list of factors is likely to include competing, overlapping, and, perhaps, multi-dimensional attributes. The second phase of risk ranking typically includes organization and refinement of the original list hierarchically asa predecessor for model building. The need for logical organization (or classification) of factors into categories is apparent. Desirable Attributes of an Idealized Risk-Categorization System for Risk Ranking ‘Categories for Risk Ranking should be... Togieally consistent Exhaustive so that no relevant risks are overlooked. ‘Murually exclusive so that risks are not double counted, Homogeneous to tha ll sis categories con be evaluated on the same st of atibutes. Adlinistratively Compatible ‘© Compatible with existing organizational structures and legislative mandates so that lines of authority ave lear and management ations a cross purposes ate avoided, ‘© Relevant to mnaagement so tht risk priorities ean be mapped into risk-management actions. ‘© Large evoug in number so that regulatory ateaton can be finely targeted, with a minimum of inerpetation by agency staff ‘© Compaible with existing databases, to make best use of available information in any analysis leading to ranking. Equitable ‘© Fairly drawn so that the interests of vious stakeholders are balanced. ‘Compatible with cognitive constraints and biases ‘© Chosen with an awareness of inevitable framing binses, ‘© Simple and compatible with people's existing mental models so that ssk etegoris are easy 10 ccomanieste. ‘* Fevvenouah in mumaber so thot the ranking task is tractable © Frecofihe “Lamp-pou” effet, ia which beter understood risks ae categorized more finely than less understood risks. Source: Morgan, NG etal, RE Anas 2030-58 2000). Singapore - July 2007 Joe Brady DPS/DIT _—_—_—Rev. 003 Page 88 of 98Q Risk Estimation Risk ranking requires estimates of risk for each identified hazard in a list of hazards. One approach is to use a single tool for estimating risks. For example, a risk matrix is often used for risk ranking in systems for which quantitative risk information is scarce, Risk matrices use the probability of occurrence of the defined risk as one dimension and the severity of the risk as the second dimension, ty Risk Management (QRM) Workshop Example of a risk matrix for human health risks bility of Occurrence [verrtow | tow [Medium [igh Wery Hii | ; Severity Scale [Death Hospitalization lAcute Illness A variety of risk tools for the estimation of risks are available to use in conjunction with, or in place of, risk matrices, Examples include fault tree analysis (FTA), probabilistic risk analysis (PRA), event trees (ET), failure mode and effects analysis (FMEA), and expert elicitation. In general, any method that can estimate the probability of occurrence of an adverse event of given severity, given an exposure or existence of the hazard, might suffice for risk estimation. Ranking and Filtering Risks Once risks — referred to as tisk scores, weights, ranks, ot numbers — have been estimated for each item in the risk management system, ranking (the risks) can now occur. This phase of risk ranking has been referred to as “filtering”, which seeks to scale or filter the list commensurately with the resources available to expend on risk management (e.g., mitigation or risk reduction). For some organizations, resources might be available for managing all items in the risk ranking; and for others, resources might be limited to accomplishing only the top N-percent of the list. Risk ranking for the former is done to ensure that the worst risks are addressed first. In the latter situation, the ranking is done to prioritize resources with prior knowledge that not all items on the list can be allocated resources. Singapore - July 2007 Joe Brady DPS/DIT _—Rev. 003 Page 89 of 98,Quality Risk Management (QRM) Workshop DEVELOPMENT OF RISK RANKING MODEL Develop a model, with the commensurate degree of formality depending on the scientific discipline and the intended application, to systematically categorize risk factors for conceptual modeling and convert raw data and expert judgment into quantifiable information. The mathematical formalism in the final risk ranking tool is useful in answering the risk management question at hand. To develop the risk ranking model, follow a multi-step analytical process: 1. Hazard identification 2. Conceptual modeling 3. Risk estimation 4. Risk filtering. Hazard Identification and Conceptual Modeling: A two-step process First, a wide range of factors that could be incorporated in the model (henceforth potential risk factors) are identified. Second, these factors are organized into principal, or top-level, components of the risk-ranking model. Initial brainstorming sessions serves as a qualitative hazard identification phase for the overall risk assessment. In hazard identification, sources of harm (ie., hazards) are identified as possibilities — not probabilities with stated likelihoods of occurrence. Specific questions that should be considered, directly or indirectly, in identifying candidate risk factors include: What hazards (sources of harm) related to manufacturing can adversely impact drug quality attributes? ‘What variables are associated with, or predictive of, those hazards? ‘© What processes and process parameters are critical for quality attributes? ‘What factors may affect the identified hazards and critical parameters and processes? ‘+ What factors are predictive of high or low quality manufacturing? Top-Level Components for the Site Selection Model Factor Category Description Example(s) Product Factors pertaining to the intrinsic properties of drug Dosage form, intrinsic products such that quality deficiencies could chemical properties potentially and adversely impact public health, Facility Factors relating to characteristis ofa manufacturing Poor CGMP compliance site believed to be predictive of potential quality history risks, such as the lack of effective quality systems. Process —_Factors pertaining to aspects of drug manufneruring Measuring; mixing: ‘operations that may predict poteatial difficulties compression: filling ‘with process control and/or Vulnerability to various forms of contamination, Singapore - July 2007 Joe Brady DPS/DIT __Rev. 008, Page 90 of 98Quality Risk Management (QRM) Workshop To develop the conceptual framework for the risk ranking model, the resultant potential risk factors need to be hierarchically organized according to their level of ‘generality and causal relationships. Conceptual Organization of the Site Selection Model Tela (Creede ] — (Trrecess Facility) Categories of Risk Factors Con Cor cn | | Ge Risk Factors (quentitarva or ‘gualtarive variables) Under the above construct, a Site Risk Potential (SRP) is a function of the weighted risk potentials for each of the categories, Product, Facility and Process.s The risk potential for each top-level component is, in turn, a function of select potential risk factors. Thus, a SRP score is derived by mathematical combination of weights or ranks assigned to select potential risk factors. The assignment of weights or ranks to select potential risk factors is based on either empirical evidence or expert judgment or combination of both. To calculate the SRP score, weights/rankings for individual potential risk factors are numerically discrete values (e.g. 0.1, 1, 2, 3, 6). Facility Component ‘The facility component of the risk ranking model includes 4 factors: 1. History of violation (e.g., CGMP deficiencies have higher weights) 2. History of inspection (e.g., no prior inspection, newly registered/licensed or no CGMP inspection in the past 2 years have higher weights than those with recent CGMP inspection) 3. Estimated volume of production output (surrogate for exposure, e.g., higher volume and production output, higher weights) 4, Type of establishment (¢.g., manufacturer, re-packer, contract lab) Singapore - July 2007 Joe Brady DPS/DIT —_—Rev. 003 Page 91 of 98,Quality k Management (QRM) Worksho) Product Component Factors PSileacitiy"} intrinsic 1997 — 2003 Factors Recal Lome [eee] Process Component Factors| EE | Singapore - July 2007 Joe Brady DPS/DIT _Rev. 003 Page 92 of 98(QRM) Workshop Quality Risk Managem Annex I: Methods & Tools i EMER 1.8: Risk ranking and filtering ICH-Q9 Briefing Pack Severity = 5 |< 3 3/2 Risk Class ONE = High Risk Class TWO Medium Risk Class THREE Low = | MEDIUM priority 5 2 5 8 = 8 8 Oo 3 & Singapore - July 2007 Joe Brady DPS/DIT Rev. 003 Page 93 of 98in k Management (QRM) Workshop Part IM —_—Facilitated Workshop Day-2 Exercise-1 An existing and operational pharmaceutical facility is scheduled to have a regulatory audit in 12-months time. Use quality-risk-management techniques that support a scientific and practical approach to decision- making, to identify and mitigate known and potential operational risks to ensure a successful audit outcome. Exercise-2 ‘Anew pharmaceutical facility is currently under construction, and a pre- approval inspection (PAI) is scheduled for 12-months time. Use quality- risk-management techniques that support a scientific and practical approach to decision-making, to identify and mitigate known and potential project risks to ensure a successful inspection outcome. Singapore - July 2007 Joe Brady DPS/DIT __—_—Rev. 003 Page 94 of 98Quality Risk Management (QRM) Workshop Day-2 - Agenda Step-1: Define the problem and/or risk question, including pertinent assumptions identifying the potential for tisk Step-2: Identify the desired state (articulate the solution) Step-3: Assemble background information and/ or data on the potential hazard, harm oor human health impact relevant to the risk assessment © Current cGMP regulations Industry best practice guidelines Site Quality Manual (QMS) Internal audit results CAPA’s Gap Assessment etc. Step-4; Identify a leader and the necessary resources © Lead facilitator * System owners © Project leaders Step-5: Conduct risk ranking and filtering Step-6: Specify a timeline, deliverables and appropriate level of decision making for the risk management process (see following QRM-Plan-Flowchart) D Cnrdeck isle yorkiry ad filferry We needs whetele of rotted 3¢ va ready fir he HSA poe capper nspection Tisites over Me nef Root t hase gawk. Dievday - Qk mabel to male Be priosity are Singapore - July 2007 Joe Brady DPS/DIT _—Rev. 003 Page 95 of 98ality Risk Management (QRM) Workshop QRM-Plan-Flowchart QRM Training Initiate Quality Risk Management Process Prepare QRM Plan (based ons (QRM-Plan-Flowchart) t Conduct risk ranking and filtering t Define categories of risks to be assessed t Identify and rationalize systems and subsystems hierarchies tL Prospectively assign alpha-numeric identifiers to top-level risk assessment reports 4 Prospectively prepare QRM Traceability Matrix Identify and adapt QRM- tools nd process to suit application ‘Train project leaders and system-owners in the use of the adapted tools and process Complete initial ies risk assessments Determine lower-level risk assessments to be completed Prospectively assign hierarchical ia atta identifiers to lower-level reports Complete all lower-level risk assessments Quantitatively pvioriine all identified risks Conduct prioritization consistency-review check across all completed worksheets Keep QRM Traceability Mattix up to date + Decide on mitigation strategies and maintain log Group the mitigation strategies into various categories + Assign grouped mitigation strategies to system-owners / project-leaders t Prepare final report that has a priority list of mitigation strategies to be completed: allocate responsibilities, appropriate resources, and timelines for completion Undertake projects activities as per the QRM final report 1 Periodically review progress against QRM Plan (keep QRM Traceability Matrix up to date) Singapore - July 2007 Joe Brady DPS/DIT Rev. 003 Page 96 of 98k Management (QRM) Workshop Further Studies ' Awarded by the Dublin Institute of Technology (DIT). * Ata pace commensurate with your work/ife/study balance 3 Similarly this program consists of 12-modules Singapore - July 2007 Joe Brady DPS/DIT Rev. 003 Page 97 of 98Quality Risk Management (QRM) Workshop References 1. ICH Q9 Quality Risk Management (Nov 2005) 2. ICH-Q9 Briefing Pack 3. Risk Assessment and Risk Management in the Pharmaceutical Industry: Clear and Simple, by James L. Vesper, 2006 IEE - Quantified Risk Assessment Techniques - Part 1 - FTA (2004) IEE - Quantified Risk Assessment Techniques - Part 1 - FMEA (2004) IEE - Quantified Risk Assessment Techniques - Part 1 ~ ETA (2004) ISPE Baseline Guide 5 ‘Commissioning and Qualification (2001) FDA - Risk-Based Method for Prioritizing CGMP Inspections of Pharmaceutical Manufacturing Sites — A Pilot Risk Ranking Model (Sep 2004) Pras Singapore - July 2007 Joe Brady DPS/DIT Rev. 003 Page 98 of 98