Risk Management: a new Risk-Based decision-making approach

by Andrea Villa* and Nicolas Livraghi**

On January 18th of this year (2023 ed.), the latest version of ICH Q9 was approved by the members of the ICH Assembly.

What changes from the previous version approved on November 9th, 2005?

In the new and most recent edition, a new risk-based decision-making approach is proposed, or in technical terms: Risk-Based. The Risk is defined as the combination of the probability of occurrence of damage, the detectability of damage, and the severity directly related to the damage itself.

The new revision of the ICH (Q9) identifies Risk-Based decision-making process as the best method for ensuring the quality in medicinal, biological and biotechnological products throughout their entire life cycle.

*Validation Specialist, PVS Srl

**Senior Validation Manager, PVS Srl

It is therefore very important to have full knowledge of the entire process leading to the manufacture of a medicinal product, in a range from the construction of the production facility to the packaging of the product. Within this wide range, it is necessary to identify what risks are associated with the production of a medicinal product both in the production of API and in the production of what will be considered the finished product.

The risk management process is mainly composed of three main macro areas:

- The first, identified as “Risk Assessment”, which includes hazard identification, risk analysis and then its evaluation;

- The second, identified as “Ri - sk Control,” which includes the reduction and assessment of risk acceptability. Indeed, it is hardly possible to cancel a risk, but it is possible to reduce it to consider it acceptable. Through the proper execution of qualification and validation processes, the good organization of quality review, and the use of increasingly advanced control systems, it is possible to reduce the probability, severity, and detectability factors that determine residual risk;

- The third and last, identified as “Risk Review”, which includes the review of events, with the aim of being able to evaluate, with a broad and general view, whether the “Risk Control” phase has been performed efficiently.

Moreover, it remains imperative that risk management should be based on scientific principles with the goal of ensuring patient safety. So, how is it possible to carry out an accurate risk-based decision-making process?

First, it is necessary to understand the level of formality that the process requires.

Formality means the ability to document, in an exhaustive way, a certain decision-making process to support and give strength to a certain thesis. The level of formality is directly related to the degree of uncertainty in the process. The same degree of uncertainty relates to what is known in terms of danger and damage, thus their associated risk, to the degree of importance and complexity of the process under analysis.

In fact, the higher the levels of uncertainty, importance, and complexity of the process under consideration, the higher the level of formality of Risk Management must be, detailing as best as possible the approa- ch chosen in order to improve risk management and give depth to Risk-Based decision-making.

Secondly, it is necessary to choose the correct risk-based decision-making approach. Not all decision-making processes are characterized by high levels of structure, and not all require highly formal analysis. Indeed, if the process under consideration has a low level of uncertainty and complexity and therefore does not require a comprehensive Risk Assessment, it is possible to manage the risk through, for example, the application of comprehensive and well-structured Standard Operating Procedures (SOPs), which obviously are in accordance with the relevant reference guidelines, or through Risk Assessments that are not overly structured. However, if the process under consideration reaches high levels of complexity and uncertainty, it is necessary to identify a correct and unambiguous approach, with the goal of better shaping the decision-making. Third, but not of less importance, is the ability to minimize subjectivity in the decision-making process. This makes possible the actual assessment of hazards, the probability that an event will occur, and the severity of the damage caused by the event.

In any case, it is not possible to completely eliminate subjectivity within a decision-making process, but it can be minimized by a multidisciplinary team, basing its arguments on scientific principles and applying, if necessary, the tools that Annex I to ICH Q9 proposes.

The new ICH Q9 therefore identifies three new factors of equal importance to be addressed in Risk-Based decision-making processes to ensure the right level of quality in drug manufacturing.

Perhaps it is better to talk about three new tools: formality, proper Risk-Based decision-making approach and subjectivity management. This new ICH Q9 delivers to ensure patient safety. l