@y World Health WY Organization & Deviation Handling and Quality Risk Management A note for guidance for the manufacture of prequalified vaccines for supply to United Nations agencies July, 2013 Vaccine Quality and Regulatio Essential Medicines and Health Products World Health Organization (WHO), Geneva, SwitzerlandDeviation Handling and Quality Risk Management This guidance document Deviation Handling and Quality Risk Management is one of a series developed by WHO/EMP/HIS Quality, Safety & Standards team upon request from the manufacturers’ members of the Developing Countries Vaccine Manufacturers Network (DCVMN), with funds of USAID. A set of priority topics has been identified by vaccine manufacturers for WHO to provide guidance on expectations from the vaccine prequalification programme. The guidance document is targeted at manufacturers whOJare new to the prequalification of vaccines or who require guidance on the level of detail needed for risk assessment for deviation ‘management activities. It may also be a useful guide to National Regulatory Authorities (NRAS) in vaccine producing countries. These are not official WHO documents but rather notes for guidanee on expected standards to be met for the prequalification of vaccines: Based on WHO recommended requirements, these documents provide further explanations with examples in order to facilitate implementation.Deviation Handling and Quality Risk Management 4a. 42. 43. 44. 45. Table of Contents: Purpose Scope Introduction Deviation Handling Event Detection Deviation Categorization Deviation Treatment Root Cause Investigation Corrective and Preventive Actions (CAPA) Quality Risk Management and Deviations Quality Risk Management Steps Risk Assessment Risk Control Risk Review Risk Commi tion Purpose of Quality Risk Management Information Sources for QRM QRM Tools Examples of QRM for Production Processes Training Conclusions Glossary References Acknowledgements hr wa 15 16 16 16 7 17 17 20 24 24 24 26 27Deviation Handling and Quality Risk Management 1) Purpose The aim of this guidance document is to contribute to the understanding of a quality risk management approach in the handling of deviations from a practical perspective as per WHO expectations on the matter. This proposal does not have the intent to be prescriptive in any way. The intent is to support effective and timely implementation of tools related to deviation ‘management encountered during vaccine and biologicals manufacturing. This guidance document is in line with International Conference on Harmonization (ICH) documents like ICH Q10 Pharmaceutical Quality System, ICH Q9 Quality Risk Management, and with WHO, FDA and EU requirements. It also incorporates the experience of experts and auditors in the field 2) Scope This note for guidance provides vaccine and biologicals manufacturers with non-binding information concerning the criteria curently used by WHO regarding deviation management as part of the assessment of prequalified human vaccines. 3) Introduction Among the essential elements of a well established Quality Management System (QMS), deviation handling plays @ key role in assuring quality in products and by contributing to continuous improvement. Manufacturers are expected to “establish processes and define appropriate controls for measurement and analysis to identify nonconformities and potential non- conformities; defining when and how corrections, corrective actions, or preventive actions should be undertaken, These actions should be commensurate nonconformity or potential nonconformity” (7). ith the significance or risk of the As part of a comprehensive Corrective and Preventive Actions (CAPA) program, once a deviation is detected, it needs to be contained with immediate actions (ie., corrections), the root causes identified as necessary, and systemic actions implemented (i.e., corrective actions) as applicable in order to prevent future same or similar non conformances. GMPs have evolved as a consequence and of the inherent risks to the product during manufacturing operations in order to prevent significant deviations. More recently, Quality Risk Management (QRM) has been proposed as a strategy to manage risk in a systematic and documented manner, and has become a requirement of modem GMPs as recommended by international standards like WHO or ICH Q9.Deviation Handling and Quality Risk Management An efficient deviation handling system, should implement a mechanism to discriminate events based on their relevance and to objectively categorize them, concentrating resources and efforts in good quality investigations of the root causes of relevant deviations. A strong CAPA system requires this efficient deviation handling system which evaluates the ely manner, and event according to the associated risk, categorizes it and acts accordingly in a verifies the effectiveness of the actions taken. As a formal or informal tool, Quality Risk Management (QRM) has always been part of the analysis process linked to the handling of events and deviations in pharmaceutical operations. This guidance document proposes a possible strategy to differentiate non-significant events which actually do not affect the product’s quality or violate any norm or defined procedure, from actual deviations which could impact on the product's quality. 4) Deviation handling Quality Risk Management was mainly designed to be used prospectively when manufacturing operations are defined and validated. Therefore, potential deviations are identified and avoided by implementing risk control measures and preventive actions. QRM is based on the identification of product attributes and operational parameters which are critical to ‘manufacturing operations in order to identify im advance their associated risks. This guidance document describes how this information may be used as criteria for the categorization and treatment of events, and eventually, deviations. The application of risk management in dealing with deviations is not only practical but provides a framework for a decision-making process based on a scientifically sound and objective approach, while also enabling decisions to be confidently upheld before the regulatory authorities. Under this approach, a sequence of steps may be identified when handling events and possible deviations: © Event Detection © Decisi mn Making Process / Deviation Categorization © Deviation Treatment © Root cause investigation * CAPA 4.1 Event detection: The manner on how personnel react when in presence of an event is the first challenge to the system, and it largely depends on their level of training, qualification, commitment, and support form upper management.Deviation Handling and Quality Risk Management As a basic requirement, personnel are expected to be alert and aware of possible undesirable events and clearly know what to do in terms of documenting and communicating them. The way personnel react and make decisions can be systemized and improved by the use of a decision tree to initially sereen events based on their risk and impact on the product in order to categorize, record, and investigate them as needed. 4.2 Deviation Categorization The decision tree described in Diagram 1 is a simplified risk assessment that answers the following questions when an event is encountered: a. Can the event affect a product attribute, manufacturing operational parameter or the product's quality? b. Does the event contradict or omit a requirement or instruction contemplated in any kind of approved written procedure or specification? Incidents Should the answer be NO for questions a. and b. above, the event may be considered an Incident (irrelevant event, not impacting product's quality). It nevertheless needs to be documented (¢.g.: recorded in batch record or logbook, as appropriate) in case it needs to be retrieved later as part of an investigation as applicable. The following are possible examples of incidents. It is noted that each event needs to be analyzed as described above developing, an objective and justified criteria avoiding the natural bias from different people or groups. Therefore, the examples below should be considered as that only, and they could be categorized differently with proper justification: = Temporary power failure in a warehouse where no temperature sensitive materials are stored, with no temperature excursion from the established range. = Production process parameters or environmental monitoring data reach alert levels but are still within acceptable range. On the contrary, should the answer be YES for questions a, and b. above (or there is a degree of doubt), and based on the decision tree, the event shall follow the path towards a deviation category. Deviations should require a higher level of analysis and documentation, and are usually covered by a deviation handling procedure. At this point, a decision needs to be made to categorize the deviation as Minor, Major or Critical. This decision process should be based as applicable and as possible on the impact (or hazard) and risk on the process and product quality by the use of any QRM tool. The use of one of these tools is described in section 5.3. Minor Deviations When the deviation does not affect any quality attribute, a critical process parameter, or an equipment or instrument critical for process or control, it would be categorized as Minor, and 6Deviation Handling and Quality Risk Management treated as such by the applicable procedure. Possible examples of minor deviations (*) are given below: - Skip of FEFO principle (first expired-first out) in raw material handling. - Balance out of tolerance used to determine gross weight of raw materials upon reception. - Pressure differential out of established limits in class D washing area. - Inadequately trained personnel to perform warehouse cleaning activities. When the deviation affects a quality attribute, a critical process parameter, an equipment or instrument critical for process or control, of which the impact to patients (or personneV/environment) is unlikely, the deviation is categorized as Major requiring immediate action, investigation, and documented as such by the appropriate SOP. Possible examples of major deviations (*) are given below: - Use of unapproved reference standard to test an API or drug product, - Inadequately trained personnel to perform sterility tests. - Production started without line clearance. jer integrity test has been carried out using equipment with no documented installation qualification completed. - Gross misbehavior of staff in a critical aseptic process. - Pressure differential out of established limits in aseptic fill areas. = Operational parameter out of range for a parameter defined as non-critical. - Untrained personnel responsible for segregating the approved and rejected raw material in the warehouse c Deviations When the deviation affects a quality attribute, a critical process parameter, an equipment or instrument critical for process or control, of which the impact to patients (or personnel or environment) is highly probable, including life threatening situation, the deviation is categorized as Critical requiring immediate action, investigated, and documented as such by the appropriate SOP. Possible examples of critical deviations (*) are given below: - Expired or rejected API component used = Sterilization record of product-contact material used in aseptic filling process not available or unacceptable. - Incomplete inactivation stage of fermentation. - Temperature out of control limit during detoxification stage. (*) Note 1: Deviations need to be analyzed based on objective and justified criteria avoiding the natural bias from different people or groups. Therefore, the examples of minor, major and critical deviationsDeviation Handling and Quality Risk Management given above should be considered as that only, and they could be categorized differently with proper justification Note 2: A pre-existent QRM will always help answering these questions and categorizing the events ‘When a QRM information is not available, all process parameters are potentially critical until there is sufficient data (process and/or developmental) to justify the contrary.Deviation Handling and Quality Risk Management Diagram |. Decision Tree for Deviation Classification Yes [Undetermined Undetermined /No Undetermined / No UndeterminedDeviation Handling and Quality Risk Management 4.3 Deviation Treatment A pre-existent QRM will contribute to determine the categorization of the deviation. If QRM has not been performed, it may be carried out at this time as part of the impact assessment in order to determine the criticality of the process parameters involved, and the risk to the patient. Minor Deviations Minor Deviations may be treated as follows Item# | MINOR DEVIATION Description Coneetion Efficacy and Conelu Data base record ‘An adequate description of the deviation requires documented objective evidence written in a concise and clear way stating time, location and person that found the deviation when possible. Minor deviations are normally addressed by Corrections which are taken to correct and contain the problem (including immediate actions), based on sufficient documented evidence. Corrections are immediate actions taken based on a simplified analysis of the deviation. They should be QA approved before implemented if possible, and if this is not feasible, the authorized and qualified responsible personnel may approve and carry out the correction, and approved by QA as soon as possible. Corrections associated to manufacturing lots need to be QA approved before release. Minor deviations do not necessarily require an investigation aimed at identifying the root causes of the problem as major and critical deviations do. Some corrections could require a change control, Efficacy of the corrections is normally verified based on the immediate outcome of the actions, and this should be documented. The result of the documented evaluation of the correction/s has to be stated under Conclusions. The information may be recorded in any form of data base (a si case) where it can be retrieved later during quality reviews or inve ple matrix suffices, given the tigations,Deviation Handling and Quality Risk Management Major or Critical Deviations Major or Critical Deviations may be treated as follows: Item # | MAJOR or CRITICAL DE’ ION Description Correction Efficacy of Correction Batch Disposition, if applicable Root Cause Investigation CAPA a Efficacy of Corrective Action Conclusion’ Data base record Major or critical deviations usually require an enhanced, thorough and objective description which needs to be documented. An adequate description associated to the deviation is essential in order to perform a meaningful investigation Major or critical deviations would be typically first addressed by corrections, which would need QA approval as mentioned above. An investigation is then initiated on the root causes of the deviation, followed by the corresponding corrective actions. Ifa minor deviation is repeated a significant number of times, it could turn into a major deviation, and must be treated as such. The investigation of the deviation should also determine the reason why the implemented corrective actions were not successful. Based on the same rationale, repetitions of one same incident can turn it into a minor deviation. Note 1: These activities may take place in a sequence or fashion that could differ from the described above, however, the main analysis and criteria would be essentially the same, Note 2: The term “planned deviation” is frequently used to describe a decision to carry out a process in a different way from which it is established in a SOP, Method or Manufacturing Batch Record (e.g, @ eprocess) due to an unforeseen event. Planned deviations need to be fully documented and justified. Usually, planned deviations associated to onetime events, , and change control to permanent changes.Deviation Handling and Quality Risk Management 4.4 Root cause investigation Root Cause Investigation is a powerful tool used for quality improvement. Among the different tools available for Root Cause Investigation, the “5 Whys” and “Ishikawa Fish Bone Diagram” are the simplest and most used ones. The “5 Whys” refers to a series of sequential questions (i.e. each response given is asked “why”, normally from 3 up to 5 times). This exercise allows a thorough understanding of the underlying or root causes of the deviation, which may be related to a systemic problem, The Fish bone diagram (Diagram 2) is a cause-effect type of analysis where the product / process is the main spine, the effect is the actual nonconformance, and the secondary spines are the different factors or causes that could have affected or “caused” the deviation (i.e., materials, controls, personnel, equipment, procedures, ete. The impact on the affected process, equipment, system or product should be assessed regarding other similar situations that could be taking place or will occur. A “vertical” analysis to identify the root cause should always be accompanied by a “horizontal” analysis on the possible events that could be avoided in the future by extending the scope of the investigation to evaluate the possible impact of the deviation on other lots of the same product or on other similar manufacturing processes. It is reasonable to assume that often there will be deviations for which the root cause cannot be readily and clearly determined, and that a probable cause will not be determined. Also, in certain cases, the deviation will be attributed to unpredictable circumstances beyond control. In any case, conclusions and rationale should always be well supported and well documented. It is fundamental that investigations on root causes of deviations be carried out in a systematic and professional manner following an approved procedure, and conducted by adequately trained personnel. When well-managed, it provides an excellent opportunity to have departments communicate between them and to improve process understanding. Investigations should be based on historical data and accumulated knowledge. For further reading and training on the matter see “Quality management system —Medical Devices ~ Guidance on corrective action and preventive action and related QMS processes” (7)Deviation Handling and Quality Risk Management Diagram 2. Fish Bone Diagram Measurement Materials Methods Environment Manpower Machines 4.5 Corrective and Preventive Actions (CAPA) The root cause investigation process is a key step in handling major and critical deviations as it will provide objective evidence to implement corrective and possibly preventive actions as part of the CAPA system, Corrective Actions are taken to eliminate the root causes of deviations, and should be based on good quality investigations. Corrective actions should be QA approved before implemented and their efficacy verified in a documented manner, activity that could require a significant period of time. Corrective actions could be transferred to an independent CAPA system to avoid unnecessary delay for deviation closure. This independent CAPA system should include tracking of all actions required by a pre-approved CAPA plan and effectiveness check. Not all corrective actions will have associated preventive actions. Corrective actions are “reactive” in nature and are triggered in response to detected deviations and could generate preventive actions as well. These preventive actions (linked originally to nonconformities) will act on similar processes, manufacturing lines or different sites, where there has not been yet a deviationDeviation Handling and Quality Risk Management The following diagram (Diagram 3) could be considered part of the general CAPA strategy: Diagram 3. Improvement Process Investigate. —_____________» Identify Root Cau: Determine Effectiveness of Implemented Actions entity Actions | Implement Actions | Approve identified Actions Verify identified Actions (e.g. need for change control, revalidation) Based on (7) In addition, manufacturers are strongly recommended to identify preventive actions which are proactive in nature and are defined and implemented independently from the occurrence of deviations (i.e. preventive actions act on potential deviations). In other words, “The manufacturer may encounter situations that have not actually caused a nonconformity, but may do so in the future. Such situations may call for preventive action (7). In order to achieve this, the QMS has to establish the different sources of information to be followed and trended as part of a systematic, periodic and documented evaluation, usually steered by QA. Possible strategies and tools to be used for this purpose are described in ICH Q9. ‘As part of the CAPA and improvement process, activities like product and QMS review (e.g. Annual Product Review) give the opportunity to summarize the accumulated information, findings and trends on an annual basis in order to identify systemic actions to improve the QMS. Examples of information sources to identify preventive actions regarding production process, equipment or facilities would include: ‘© Manufacturing in-process control or Quality Control analytical trend data indicating that control or alert limits are being approached. Preventive actions could include actions planned to return process performance to nominal values from the edges of the process control range. 14Deviation Handling and Quality Risk Management Supplier Qualification Program data (¢.g. % rejected materials, external audit findings) Product quality related Complaints Production yield variations (e.g. caused by materials defects) Stability trend data Internal audit findings ‘Preventive Maintenance reports (e.g. equipment break down, spare parts usage) © Revalidation data (e within acceptable range) © Environmental and Water monitoring autoclave temperature profile shift while Note: The amount of work related to the improvement activities is dependent on the risk and significance of the deviation or potential deviation. 5) Quality Risk Management and Deviations Quality Risk Management (QRM) gives the possibility of determining the impact of a deviation in a process or product in an objective manner, in order to categorize it and facilitate its treatment. ICH Q9 describes in detail a methodology to perform QRM, and defines it as “a systematic process for the assessment, control, communication and review of risks to the quality of the drug (medicinal) product actoss the product lifecycle”. ICH Q9 recommends the use of this approach for 216 [_[ Major if RPN value > 40 and <216 Minor if RPN value <40 c ical RPN between 216 (6 x 6 x 6) and 512 (8 x 8 x 8) is considered a critical risk and must be addressed immediately and treated as a critical deviation. Corrections shall be implemented as applicable. An investigation of the root causes and an in depth investigation and CAPA process must always be carried out. The decision to release the batch (if applicable) should be made as part of the conclusion of the investigation process; in case the lot is already in the market, a series of actions may be required including product recall. CAPA and QRM should attempt to control or reduce the risk in the future by decreasing the frequency or probability of occurrence, by increasing the detectability or both. Note: The table is designed to assure that a Severity value of $4 will be categorized as critical regardless of the highest detection level possible (value of 2), and a highly improbable frequency (value of 2); RPN would be of at least 216 (54 x 2 x 2), which is the minimum value for a Critical risk. Consequently, the associated deviation shall be categorized as critical. As an example it can be mentioned a confirmed positive sterility test of a finished product. If there are deviations that could result in possible death to patient, they should be addressed immediately, especially if the product is in the market. The investigation process should evaluate if other batches of product or other products manufactured or to be produced could be affected.Deviation Handling and Quality Risk Management [__ [Major RPN between 64 and 216 is considered major risk and must be addressed in a timely manner as a major deviation. When applicable, the batch could be released depending on the conclusions of the investigation process. An investigation of the root causes as part of CAPA, and QRM if applicable must be initiated to control or reduce the risk by decreasing the frequency or probability of occurrence, by increasing the detectability, or both. The necessary corrections and corrective actions shall be implemented as applicable. Minor RPN between 8 and 64 indicates a low risk and must be addressed in a timely manner as a minor deviation, Minor deviations normally do not interfere with batch release, but need to be closed before that. An investigation of the root causes and a QRM process could be initiated if needed. The necessary corrections and corrective actions shall be implemented as applicable. 5.2.1 Examples of QRM for Production Processes An example of the use of FMEA to assess the risk of events associated with the manufacturing of biological products is shown below: 1. Preparation of Inoculum Step | Parameter Possible Cause |Impacton [Detection through IPC/ | P | D | S out of |of Out-ofRange Intermediate | Monitoring, Ren T1_ | Viability oF ‘Age of culture Interruption of [Daily cell count a i? |6 he inoculum inappropriate Inoculums ) ‘composition of culture media and culture conditions (agitation, COs, temperature) 12 [Purity of |N/A” |Culture media, Interruption of [Macroscopic / Microscopic] |2_ [6 2 inoculum operator's Inoculums ‘manipulation error materials failure T3 | Temperature]>25219 |AHU failure No impact [Temperature sensor, [6 |2 ‘of room recording, alarmDeviation Handling and Quality Risk Management Il, Fermentation ‘Step [Parameter [Values [Possible Cause of [Impact on Intern] Detection through IPC |P s out of | Out-ofRange ‘Monitoring RPN Range TL | DOG) | >65 Solenoid valve, gauge] Viability and |, Sensor of fermentor [6 2 [a failure /operator | glycosylation / 1 error, culture at static | pattern affected condition ornot | depending on growing the duration & ma 12 [DOC | <34 —_|Solenoid valve, gauge] Viability and [Air Sensor of utility line 4 sensor, utilities falurg glycosylation |(not part of fermentor's, ‘operator error, | pattem instrumentation), antifoam interfering | affected (0, Sensor of fermentor depending on uration & magnitude May have impact on quality. Note in 2 Severity: As the event is occurring at early stages of production, no harm to patient is considered, but it is significant process failure therefore a value of 6 (high) was assigned. Probability: not an uncommon event. There are a number oftrsk factors involved (i.: Handling of inoculum), therefore a value of 6 (moderate) was assigned, Detectabilty: a value of 2 was assigned considering that contamination can be detected visually or through microscopic technique (. igh detectability eapacity). RPN indicates a critical deviation as it is more than 216. 13 [pH $702 [Solenoid valve, sensor, ulties (CO) software, excess of base failure / operator error Viability and alycosylation pattern affected depending on duration & magnitude [pH Sensor of fermentor 22Deviation Handling and Quality Risk Management IL. Fermentation (continuation) ‘Step [Parameter [Values [Possible Cause of [Impact on [Detection through IPC) |P_ [DS out of |Out-of Range Intermediate _|Monitoring RPN Range 14 [pit 6.4 [Solenoid valve, Viability and | pH Sensor offenmentor 42 | [32 sensor, utilities glycosylation {(gases), microbial | pattern affected| ‘contamination, ‘depending on failure / operator error] duration 8 magnitude ‘Note: In ThA above a severity factor of 4 (moderate) was assigned considering the pFT excursion was significant RPN indicates a Minor deviation as itis below 40. TS [Tempera ]>37 —] Uilies child] Viability and | Temperature seasorof 4 ]2 [4 [32 ture of water) operator | glycosylation | fermentor fermentor error patter co affected depending on uration & magnitude Note: In IL.5 above, a severity factor of 4 (moderate) was assigned considering the temperature excursion was significant. A RPN factor of 32 indieates a medium risk, and deviation probably treated as a Minor deviation. 16 | Tempera [30 [Uuliies (industrial — ) Probable FTemperature sensorof [4 ]2_ | [32 ture of steam) / impact on cell. [Fermentor fermentor ‘operator error viability and eo) glycosylation pattem 17 | Viability of|<55 _|Failurein culture [Interruption of [Daily cell count orOD [42 |4_|32 fermentatio conditions fermentation ) TS_| Sterility af [NA Aseptic manipulations| Interruption of [Macroscopic & la |2_|54 [a2 fermentor’ ‘eulture media fermentation. |Microscopie materials failure | Lot rejected. Note: In ILS above a severity fictor of 54 (high) was assigned considering the significant impact a contamination has, but Detectability is high (value of 2), and Probability is moderate (value of 4). Therefore, RPN factor of 432 was defined indicating a High risk. Event probably associated with a Critical deviation 23TL, Fermentation (cont.) Deviation Handling and Quality Risk Management Seep alues Possible Cause of impact on [Detection through IPC] PD mit of [Out-of Range intermediate | Monitoring ke: Range i19 9S |Operatorerror, | Viabii Fermeniors command 2 software failure affected panel visual display depending on uration, magnitude ito 70 | Motor fire ‘Viabiliy | Fermenior's command 2 JOperatorerror, _fatfected | panel / visual display sofiware failure | depending on duration, magnitude Note: Glycolyzation is the process by which proteins normally link to oligosaccharides. Therefore, all nutrients that reach fermentor and the fermentation eonitions are essential to assure proper eonrol of this process. TIL. Final Bulk Seep anes Fostite Case af Tinpation oseion trough TPCT RET out of [out-of Range Intermediate | Monitoring Range Nit NIA Aseptic manipolations| Contamination, | Sterility test 5) Feulture media / materials failure Lot rejection Note: In IIL.1 above a Severity factor of $4 (critical) was assigned considering the significant impact a contamination has. This RPN should be associated with a eritical deviation. REI value could be increased considering factors like the capacity of the company to meet product demands (an example is indicated with (*) in the table above). 24Deviation Handling and Quality Risk Management 6) Training The sources of deviations are diverse, but probably the ones occurring during routine manufacturing operations are the most challenging. Adequate competence, adherence to procedures, training and commitment to quality is crucial for the detection of out-of-normal events and the timely handling of deviations. Trained personnel capable of recognizing non conformances, investigating them and learning from the conclusions obtained, constitute an essential value to the quality management system. Training and qualification of personnel, both in deviation handling, CAPA and QRM tools, are key factors to a successful quality system implementation, Clear documented responsibilities and a strong QA oversight are also essential, aimed at improving a quality oriented organizational culture. 7) Conclusion The recommendations described. in this guidance document propose a practical approach to manage non conformances based on QRM, considering the dynamic nature and every-day obj ctives of production operations. 8) Glossary Quality Risk Management (QRM): As part of EU regulations, in the section referred to Quality ‘Management (1), the concept of Quality Risk Management (QRM) is described as “a systematic process for the assessment, control, communication and review of risks to the quality of the medicinal product”, Risk Assessment: ‘A systematic process of organizing information to support a risk decision to be made within a risk ‘management process. It consists of the identification of hazards and the analysis and evaluation of risks associated with exposure to those hazards. (1) Risk identification ‘A systematic use of information to identify hazards referring to the risk question or problem description, Information can include historical data, theoretical analysis, informed opinions, and the concerns of stakeholders (1). Risk analysis Estimation of the risk associated with the identified hazards. It is the qualitative or quantitative process of linking the likelihood of occurrence and severity of harms. In some risk management tools, the ability to detect the harm (detectability) also factors in the estimation of risk (1). 25Deviation Handling and Quality Risk Management Risk evaluation Compares the identified and analyzed risk against given risk criteria. Risk evaluations consider the strength of evidence for all three of the fundamental questions (1). Risk control Process through which decisions are reached and protective measures are implemented for reducing risks to, or maintaining risks within, specified levels (6) Risk acceptance Decision to accept the residual risk after risk control actions is taken and that the quality risk is reduced to a specified (acceptable) level (1). Deviation / Nonconformity Any non-compliance of an established GMP standard or of approved requirements, specifications and standard operating procedures. Deviations need to be documented, evaluated and when appropriate, investigated in order to determine the originating causes to prevent recurrence. Correction Corrections are immediate actions taken to correct, contain or eliminate a nonconformity or other undesirable event, Note: A correction can be made in conjunction with a corrective action Corrective Action Action taken to eliminate the cause of the deviation, based on an investigation. Corrective actions should prevent recurrence of the deviation, Preventive action Action to eliminate the cause of a potential nonconformity. “Preventive a ‘occurrence whereas corrective action is taken to prevent recurrence” (7). ion is taken to prevent Quality Risk Management: A systematic process for the assessment, control, communication and review of risks to the quality of the drug (medicinal) product across the product lifecycle. (1) Risk: Combination of the probability of occurrence of harm and the severity of that harm (8) Harm Physical injury or damage to the health of people, or damage to property or the environment (8) Hazard Potential source of harm (8) Detectability Ability to discover or determine the existence, presence or fact of a hazard. (1) 26Deviation Handling and Quality Risk Management Severity A measure of the possible consequences of a hazard. (1) Frequency or Probability Frequency is the number of occurrences of a repeating event per u temporal frequency. time, It is also referred to as Risk Combination of the probability of occurrence of harm and the severity of that harm (8) Risk analysis Systematic use of available information to identify hazards and to estimate the risk. Production process parameters: Parameters that have to be followed during a manufacturing process to obtain a product that meets the expected quality attributes and is produced in a consistent manner, Risk Reduction: Actions taken to lessen the probability of occurrence of harm and the severity of that harm. (1) Risk Communication: ‘The sharing of information about risk and risk management between the decision maker and other stakeholders. (I) Risk Review Monitoring of output/results of the risk management process considering (if appropriate) new knowledge and experience about the risk. (1) FMEA (see IEC 60812) provides for an evaluation of potential failure modes for processes and their likely effect on outcomes and/or product performance. Once failure modes are established, risk reduction can be used to eliminate, contain, reduce or control the potential failures. FMEA relies on product and process understanding. FMEA methodically breaks down the analysis of complex processes into ‘manageable steps. It is a powerful tool for summarizing the important modes of failure, factors causing res and the likely effects of these failures.(1) these fai API: Active Pharmaceutical IngredientDeviation Handling and Quality Risk Management 9) References (1) ICH Harmonized Tripartite Guideline. Quality Risk Management Q9, Current Step 4 version, 9 November 2005 (2) WHO Expert Committee on Specifications for Pharmaceutical Preparations: thirty-seventh report, 2001. Annex 7, Application of Hazard Analysis and Critical Control Point (HACCP) method to pharmaceuticals (3) EU GMP Guide, Annex 20 (4) ICH Harmonized Tripartite Guideline, Pharmaceutical Quality System Q1O. Current Step 4 version, 4 June 2008, (5) European Journal of Parenteral & Pharmaceutical Sciences 2008; 13(3): 31-35 2008 Pharmaceutical and Healthcare Sciences Society. “Deviation management in the context of ICH Q9/Q10”, (6) ISO 149712000 - Application of Risk Management to Medical Devices. (7) GHTF Quality management system ~Medieal Devices ~ Guidance on correetive action and preventive action and related QMS processes. Global Harmonization Task Force. Proposed Document. Study Group 3, September 2009, (8) ISO/IEC Guide 51:1999 10) Acknowledgements This draft note for guidance was prepared by Victor Maqueda, Buenos Aires, Argentina, with the contribution of Josefina Vocos, Dr. Dora Tombari, Abel Olivera and Dr Anil Chawla