Developing and Implementing a

Science and Risk based approach

to Equipment Qualification

Nick Haycocks, Amgen, USA

IBC Conference Shanghai May 2015
 Program Summary
• Program Enablers
• What the Program is Designed to do
• The Initial Event – System Boundary Classifications
• Introducing the risk based approach

• The Program – What it looks like

• Risk Assessments
• Implementation
• Proof of Concepts and Change Management

• Lessons Learned and Next Steps

 Program enablers
• Company Goal
• “Simplify validation” – Better, Cheaper, Faster

• Industry Guidance Utilized

• ICH Q9 Quality Risk Management
• ICH Q10 Pharmaceutical Quality System
• ASTM E2500 07 & 13
 The Program is Designed to Reduce Project
Costs and Schedules While Enhancing Quality

• Focus on risk to product quality and patient safety

• Focus on quality impacting aspects of the systems through a
risk-based approach
• Streamline and reassess documentation practices
• Provide robust functioning systems with quality built in from
requirements and design through release for use in
operations

Delivery of this program requires cross functional partnership

between Engineering, Automation and Quality at sites & Corporate
 Steps in the Program

• Define What the Program should be

• Sell the Program to stakeholders

• Show the value (proof of concept projects)

• Develop and deliver the Program

• Mentor how to implement

• Mature the program

 The Initial Event

From Impact Assessments to System Boundaries

•The ISPE Method is basic Risk Assessment
• System impact Assessment
• Component Impact assessment
• Direct, Indirect or no impact systems/components

•C&Q impact assessments time consuming

• Impact assessment were giving inconsistent results
• Component and system impact assessments not helpful in
the risk based ASTM E2500 model
System and Component Boundary Diagrams

• Boundary diagrams (SCBD’s) were created for all

systems in Amgen
• Defined a consistent approach
• No need to perform the C&Q system and component
impact assessment process
• Set the stage for the Science and Risk Based
approach to Qualification
 Change from Impact Categorization to
“Levels” – Mindset Change
• Level 1- Equipment assets within a system where
operation or maintenance activities can affect the critical
quality attributes, the critical aspects, or the critical
process parameters of the product the system delivers.
• Level 2 - Equipment assets within a system where
operation or maintenance activities can have an adverse
business impact.
• Level 3 - Equipment assets not included in the
definitions of level 1 or 2.

Note; we do not use “GMP” in the

definitions
 Cold Rooms – System 810

Evaporator
Refrigeration
unit

Racking

Control
Racking System
Conditioned Space
Level 1
Equipment

Racking
CPP
monitoring
system

Associated Equipment System Locations

Air Handling Unit – 345 HVAC HIERARCHY

HEPA Filters – 345 HVAC
Room Certification – 345 HVAC
XXYYY810 : SYSTEM, COLD ROOM

XXYYY810ZZ : SUB-SYSTEM, COLD ROOM

Notes: COLD ROOM
The system boundary suggested is as shown on the drawing. The
COLD ROOM CABINET
flowchart shows the standard list of sub-systems and equipment. Items not
shown on the hierarchy are considered a spare part or consumable to a COMPRESSOR
sub-system listed. CONDENSATE RETURN UNIT

System Quality Attributes/Process Parameters (SQAs/SPPs) - CONDENSER

The potential SPPs are listed below. For the physical system being CONTROL PANEL
evaluated, the SCBD user is responsible for determining which (if not all)
SPPs are needed to ensure the system produces the desired quality: DEHUMIDIFIER
 Temperature DOOR, (type)
 Humidity / Moisture
EVAPORATOR

Instruments directly associated with these attributes as part of the SPP FAN, SUPPLY
Monitoring System shall be classified as level 1. INSTRUMENT – Level 1

Assumptions – INSTRUMENT – Level 2 or 3

The assumptions made when defining the classification level 1 equipment PUMP, (type)
are as follows: Cold rooms used in the storage of controlled materials are
SKID
classified level 1. The example shown indicates a control system
independent of the SPP monitoring system. Only instruments associated TANK
with the SPP monitoring system are considered level 1. The evaporator
VALVE, (type)
location has a direct impact to the temperature map of the room.
Additionally, the SQAs and SPPs are routinely monitored through the VARIABLE FREQUENCY DRIVE
calibrated monitoring system. Through this monitoring, any non-Level 1
equipment failure would be detected.
Equipment in a box indicates Level
1 equipment for classified rooms.
 Traditional Approach - Deliverables

User Design Review Commissioning

Requirements Reports (FAT –SAT)

Installation Operational Qualification Summary

Qualification Qualification Report
 Program Summary

• ASTM 2500 and Quality Oversight Model

• Good Engineering Practices

• Relational Model

• Quality Risk Assessment

• Process Overview

• Example document relationship

• Qualification Summary Report

 ASTM E2500 Provides a process Framework

• A science and “risk-

based” approach to
assure that GMP
equipment & systems
are:
• Fit for use
• Perform satisfactorily

• Amgen interpretation and

application of:
• ASTM-2500
• ICH Q9
• EU Vol. 4 Annex 15
• FDA Process Validation
Guidance
• ISPE Baseline Guide
Vol. 12: (Draft)

Opportunity: apply risk and ‘design quality in’ concepts to

improve delivery of equipment while reducing cost & time
 GEP Framework – with knowledge capture
User
Requirement
Specifications

Engineering Design
Change Automation
Review
Management Project Delivery

Quality Quality GEP review

Requirements Requirements Concept and
Concept design Detail design detail design
stage checks stage checks stage

Commissioning
Planning and
Execution

Facility Process BMA/BAS

Sample Sample Sample HAVC System Pipe System Equipment System Security
Commissioning commissionin
Summary Commissioning commissioning commissioning and Commissionin System
Specifications g sample
Reports Plan / template report sample report sample report Automation g sample Commissioning
guidance report
 GEP Framework (continued)

Engineering
Quality Systems

Engineering Walk
Vendor Data Vendor CMMS Instrument Receipt Down and
Requirements Assessment Data Calibration Verification Punch
listing

PDI / FAT User Construction Instrument Installation

Testing Requirements Inspection Check Out Verification
 Quality Oversight model at full maturity of
the Engineering, Automation and Quality
processes.
Plan Design Build Test

User Commissioning FAT Receipt Commissioning Qualification

Quality Risk
Requirements Plan Verification & Tests - Automation Summary Performance
Assessments
Installation checkout, Performance Testing / PQ
 
Report

  Verification
 tests, SAT
  
Development
Validation Plan Design Reviews Testing

  
 Quality Pre and Post Approval Quality Review Quality Approval
Amgen Relational Model for Qualification
SME’s
 Process
 Product
 System User
 Regulatory Requirements
 Quality
 Vendors
Traceability

System Qualification
Risk Commissioning Performance
Specifications report
Assessment / Testing Qualification

Feed into ongoing

Design maintenance
Vendor Review  Vendor Documents management
Assessment  Good Engineering systems
Practices
 Change
Management

Illustrates how Qualification is Redefined

 Definitions:
Help People Understand the New Process
Processes

Verification: Activities within any of these processes

 Definitions (Continued)

• Strategic:
• Commissioning, Qualification, and
Validation are processes
• Tactical
• Verification is an activity within any of
these processes
 Risk Assessments

Quality Risk Assessment for Equipment and Automated

Systems
• Systems based approach to maintain flexibility

• Requires definitions of SQAs(CQAs) and SPPs (CPPs)

• Output of system considered ‘product’

• SQAs / SPPs for the ‘system product’ are identified by SME’s

 Definitions
System Quality Attributes
• A physical, chemical, biological, or microbiological property or
characteristic of the system output that should be within an
appropriate limit, range, or distribution.
System Process Parameters
• A process parameter whose variability has an impact on the
System Quality Attribute and therefore should be monitored or
controlled.
Critical Aspect (where applicable)
• Critical aspects of manufacturing systems are typically functions,
features, abilities, and performance characteristics necessary for
the manufacturing process and systems to ensure consistent
product quality and patient safety. (Often useful to assess after
completing the QRAES)
 The Value of the Risk Assessment

• Provides a definition / supporting rationale for what is

critical to “system product” quality
• Focuses Quality/Validation on critical aspects to
product quality
• Helps identify ‘Quality Requirements’ for the URS
• Defines the ‘controls’ in place around the identified risks
• Provides a ‘validation guide’ to ensure the identified
controls are in place and tested
• Defines the content of the traceability tool in the
Qualification Summary Report to the various lifecycle
activities and testing
 Requisites

• System Quality Attributes (for the system)

• System Process Parameters
• Draft or Final User Requirements
• Appropriate SME’s
• Preliminary or Final Design Specifications
Requirements
Identify SQAs SPPs – not always simple…..

Compressed Air System

SQA’s
• Particle content (viable and non viable)
• Hydrocarbon content
• Dew Point
SPP’s
• Pressure at point of use?
Critical Aspects
• Materials of Construction
• Selection and maintenance of system filters
• Pressure Dew Point Monitor
Requirement
• Provide high pressure air meeting the
specifications to the points of use.
Walk in Freezer System SQA’s & SPP’s
Walk in Freezer
SQA’s
• Temperature (of stored product)
SPP’s
• Room temperature
• Airflow
• Load configuration / cooling requirement

Requirement
• Provide an environment to maintain product in
pre-defined conditions – temperature – not
usually but potentially light levels, RH.

For Internal Use Only. Amgen Confidential. 24

 QRAES Example
Design features to Activities needed to verify
Reference No.

Procedures required to

Occurrence

Detection
Source or cause of the control the likelihood of the risk controls are in What mechanisms would

SQA Potential hazard to SQA
Particulate
1 Purity
contamination (metallic) of the system product
2 N/A
Severity
Effect / consequence of control the likelihood of Risk Impacted
hazard (how can the hazard occurrence place working as specified detect the result if the risk Comments
the hazard hazard occurrence (SOPs, Level Systems
hazard occur?) (Instrumentation, (development testing, IV, occurred?
training manuals)
alarms and interlocks). OV)
Compliance with the
Compliance with the
specifications for the
Breakdown of the product PM's will include the specifications for the
Specification of system materials of
contact materials of requirement to inspect system materials of
Potential contamination appropriate materials construction will be
construction (metallic) - the equipment during construction will be None N/A
for system construction confirmed through the
due to the system maintenance and report confirmed through the
and filters Commissioning Test
product. any degradation or commissioning test
Protocol (CTP).
corrosion found. protocol (CTP).
7 1 1 Low
The report from
The operational SOP will The commissioning test operations that the
The specification will
require a visual inspection protocol (CTP) will confirm system is not clean, or
call for the system to be
N/A N/A N/A of the system to ensure that the system was from maintenance that None N/A
cleaned and flushed
that it is clean and cleaned and flushed prior the system is damaged or
prior to use.
undamaged. to use. degradation / corrosion
has been found.
Score the results: Severity - score based on – if the hazard occurs
(i.e. no system based prevention or detection in place but considering
the impact of additional processing/testing that will occur)

SEVERITY of the effect of failure Scoring Guidance – if appropriate this may be used
Rating
(System/Equipment ) to help assess the severity rating

Severe – Serious impact to QA of the output of the

system/equipment NC Level 3 that would require a recall if found after the
9
and product was released to market
impact to final product quality attribute

Major - Significant impact to QA of the output of the

NC Level 2 - would most likely not require a recall if
system / equipment
7 found after the product was released to market. (Could
and
be supported with additional Testing/Data).
possible impact to final product quality attribute

Moderate - Possible impact to QA of the output of

the system/equipment
5 NC Level 2
and
no impact to final product quality attribute

Minor – Minor impact to QA of the output of the

system/equipment
3 NC level 1
and
no impact to final product quality attribute

Insignificant - No Impact to QA of the output of the

system/equipment
1 No Quality Impact
and
no impact to final product quality attribute

For Internal Use Only. Amgen Confidential. 26

Score the results: Occurrence - score based on the defined controls
being in place

Level Definition Scoring Guidance – if

appropriate this may be used
to help assess the occurrence
Level
9 Failure is almost inevitable.
Once a week or several time a
Frequent Consistent failure observed.
month

7 Failure is likely and will occur in most circumstances.

Once a month or several times a
Likely Repeated failures observed.
year

5 Failure is probable at some time and has been

Occasional observed. Once every 1 - 2 years

3 Failure could occur at some time.

Unlikely Only isolated incidents observed. Once every 3 - 5 years

1 Failure is extremely unlikely, no history of failure.

Remote N/A

For Internal Use Only. Amgen Confidential. 27

Score the results: Detection - score based on the detection
mechanisms being in place

Scoring Guidance – if
appropriate this may be used
Score QRAES definitions
to help assess the Detection
score
Absolutely uncertain – Existing controls cannot detect the
9 failure. No controls are in place. N/A

Remote - Remote chance that controls will detect the failure.

7 A control may be in place but is untested or unreliable. N/A

Moderate – A moderate chance that the control will detect

5 the failure. N/A

3 High – Very likely that the control will detect the failure. Procedural controls in place

Almost certain – The control will detect the failure in almost Monitored by automation system
every instance. using automated alarm for
1 the parameter.
Independent check, e.g. product
release test

For Internal Use Only. Amgen Confidential. 28

Determining Overall Risk Level
Risk Thresholds for Severity and Likelihood of Occurrence

Severity of Risk

Likelihood of 1 3 5 7 9
Occurrence Insignificant Minor Moderate Major Severe
9 – Frequent Medium Medium High High High
7 – Likely Low Medium High High High
5 – Occasional Low Medium Medium High High
3 – Unlikely Low Low Medium Medium High
1 – Remote Low Low Low Low Medium

NOTE: Utilize the output from the table above for a risk classification in the table below

Detection

Risk Risk Level

1 9
Classification from Table 2 3 5 7
Almost Absolutely
High Moderate Remote
certain uncertain

High Low Medium High High High

Medium Low Low Medium High High
Low Low Low Low Medium Medium

For Internal Use Only. Amgen Confidential. 29

Key Takeaways

• Seems so simple but…….

 Document Relationship and Process Deliverables

Risk Assessment Design Review URS

How does the design

Detectability
Probability
mitigate this source? How do site What mechanisms

Severity
Source of hazard (how (instrumentation, procedures mitigate would detect the
can the hazard alarms and this source? (Quality result if the hazard

RPN
Hazard happen?) interlocks) Systems) occurred?
Breakdown of Pipework, valve,
Particulate or chemical pipework/instrumentation gasket & Instrument Water Quality
contamination material 9 Specification IV 1 Monitoring 9 81

Alarm on high
Calibration of the on conductivity, with SOP
Provision of an on line line conductivity defining action in the
conductivity meter instrument event of an alarm 0
Provision of sample Off line quality
points Sampling procedures monitoring. 0

Breakdown of elastomers Pipework, valve,

e.g. Gaskets, valve gasket & Instrument Water Quality
diapragms 9 Specification IV 3 Monitoring 9 243
Change management

Input from
procurement
procedures &
Provide an approved maintenance Water Quality
spare parts list procedures Monitoring 0
Reverse flow of air into Pumps design to
the system through a drop maintain system Low loop return
valve. 9 pressure IV/ACO 1 pressure alarm 1 9
Drop valve orifices,
used to restrict outlet Low loop return

SME sub
flow. IV pressure alarm 0
Alarm on low loop Calibration of the SOP - action in the
return pressure pressure detector, event of an alarm 0

Contamination of the WFI

with "heating/cooling
media" through the heat Heat exchanger Water Quality
exchangers 9 specification IV 1 Monitoring 1 9
Record the operating

team
Design to maintain pressures of the WFI
WFI at a higher and utility supplying the
pressure than the control valve as it is Water Quality
heating/cooling media. tested during ACO Monitoring 0

Low Low temperature/

Microbiological temperature/inadequate Heat exchanger with inadequate sanitization
contamination sanitization 9 adequate heat capacity IV 3 time alarm 1 27
Calibration of the SOP - action in the
Temperature sensor temperature sensor event of an alarm 0
Online temperature
and pressure
System will be steam monitoring (DeltaV

Scope, CPPs,
sanitized after any recipe with alarms /
System can be steam shutdown exceeding 8 timers, + other
sanitized. hours (per SOP). thermocouples.) 0
Reverse flow of air into Pumps design to
the system through a drop maintain system Low loop return
valve. 9 pressure IV/ACO 1 pressure alarm 1 9
Drop valve orifices,
used to restrict outlet Low loop return
flow. IV pressure alarm 0

CQAs
Alarm on low loop Calibration of the SOP - action in the
return pressure pressure detector, event of an alarm 0

Contamination of the WFI

with "heating/cooling
media" through the heat Heat exchanger Water Quality
exchangers 9 specification IV 1 Monitoring 1 9
Record the operating
Design to maintain pressures of the WFI
WFI at a higher and utility supplying the
pressure than the control valve as it is Water Quality
heating/cooling media. tested during ACO Monitoring 0

IV,ACO,FT, IOQ

Qualification
Summary
Report

Verification Traceability
 Qualification Summary Reports

• Confirms that commissioning has been successfully

completed
• Provides traceability of testing activities to the Risk
Assessment:
• Confirms that the design risk controls were tested and working
properly
• Confirms that the procedural risk controls were incorporated
into the SOP’s/PM’s

• Qualification Summary Reports in the range of 10 – 16

pages
Proof of Concepts and
Change Management
The use of the proof-of-concept methodology
has led us to a practical, scalable approach

Site & Function

Cross-functional Review

Program Deliverables
Based
Corporate
Based
Proof
Program of
Theory Concept

Feedback
The Proof-of-Concept (POC) Methodology
Reinforces our Partnership Approach
Roles
• Corporate provide overall strategy for program
framework
• Functions provide technical perspective
• Sites provide execution perspective (i.e. will this work?)

POCs provide the feedback loop for the development and

implementation of the program deliverables
Amgen Document Hierarchy plays key
role in driving change
• Corporate Quality Policy
defines, for each sub-system,
Amgen’s requirements to Quality
comply with regulations Manual

• Corporate Operating Standards GMP Quality

details how a sub-system is to Policy
be detailed in SOPs
GMP
• Site SOPs provide “how to” Operating Specifications
perform a specific GMP task. Standards

Procedures

Records
Changes to Key Processes Have Resulted in
Measurable Value
Historical Approach New Approach Benefit
by applying...
Qualification protocols at Qualification process Efficient use of
project-end with testing integrated into resources and
redundant to engineering Good engineering project reduced pressure
project lifecycle Engineering without unnecessary on project schedule
Practices redundant testing
Qualification testing Testing also considers Focuses
based on equipment critical controls, qualification efforts
specifications and Risk detection mechanisms & on defined critical
capabilities Management all quality systems aspects
Design review applied Design review well- Enables appropriate
inconsistently with directed with defined and defendable
Systematic
unstructured Quality Quality involvement Quality oversight
Design Review
involvement
Changes are not well- All changes are Prevents need to
controlled until a system Engineering effectively managed perform redundant
is qualified and released Change throughout the testing at project-
for use Management engineering project end
The POC Projects Validate the Value of the
Concepts and Amgen Approach

Validation Projected
Project Cost Avoidance
23% Savings
Purification Train
Capacity Increase

Oral Solid Dosage 55% Savings

Facility
31% Savings
Automation Upgrade

 20% savings
Fill Finish Facility
We Tested More During FAT and Less on Site

39
 We Reduced Redundancy in Testing and
Documentation
• Process Equipment Example
500
• 75% reduction in total pages
18
• Eliminated redundant testing
across protocols
Quality Summary
400 Report • Eliminated redundant
attachment of vendor documents
CQP Document Pages

Commissioning Test
229 • Reduced un-necessary testing
Protocol
by benchmarking best in class
300 System Test
protocols across network
Qualification Matrix
Operational • 50% reduction in documents
Qualification
200 • Combined IV,RV, FAT, and
Factory Acceptance OQ into one protocol (CTP)
122 Testing
Installation
100 20 Verification
79 Receipt Verification
93

31
0 8
Project E Project F

Impact to the project is thousands of pages avoided

(and the related work completing them)
40
The Program will Provide Additional Benefits

Project Scope
Operate &
Plan Design Build Test
Maintain

Adopted Practices
SME’s
 Process Additional Value???
 Product
 System
 Regulatory
User • Change Control
 Quality
Requirements
 Vendors
Assessments
 Process
Characterization
data
• Failure Event Impact
Risk Assessments
Assessment Additional
Benefits • Preventive
Maintenance
• Process
Characterization
• Others?
Lessons Learned and Next Steps
 Energy Efficient!

Starting
Point

Goal –
Integrated
Processes
Lessons Learned: Effective Partnerships
have been Key to our Success
• Joint sponsorship demonstrated shared
leadership and accountability.
• Breaking down barriers between Functions
improved process and equipment knowledge.
• Different groups understand and appreciate
roles and interactions more clearly
Maturity? – Engineering:

• Front loaded – definitions of commissioning scope,

strategy, acceptance criteria, standardized deliverables
Maturity? – Quality:

• Trust – QA not QC role

• Review and approve plans/strategies, not pre and post
approve documents
• Focus on critical aspects
Lessons Learned: Challenges Remain:
Challenges
• Concerns around acceptability to Regulatory
Agencies
• Expectations around document types and Good
Documentation Practices
• GEP needs to be well established and
understood by key stakeholders and
practitioners
• Risk management principles must be well
understood and applied
 Next Steps - Maturing the Process

• Engineering is intensifying their practices and delivery

models to provide more robust systems
• Alignment of SOPs with the intent of the qualification
standard
• Alignment of SOPs between sites / common SOPs

• Alignment of procedures and practices between groups

(Engineering, Automation, Validation)
• Legacy systems applicability
Latest Application Simplifies
Documentation and Approval Efforts

49
 Questions?

Thanks
haycocks@amgen.com

For Internal Use Only. Amgen Confidential. 50