White Paper

A Risk Management Solution Designed to Facilitate Risk-Based Qualification, Validation, and Change Control Activities within GMP and Pharmaceutical Regulatory Compliance Environments in the EU—Part II | IVT

Courtesy of Getty ImagesA Risk Management Solution Designed to Facilitate Risk-Based Qualification, Validation, and Change Control Activities within GMP and Pharmaceutical Regulatory Compliance Environments in the EU

Tool Scope, Structure, Limitations, Principle Findings, And Novel Elements

Note: The views expressed in this paper are those of the authors, and should not be taken to represent the views of the Irish Medicines Board.


In Part I of this paper, a risk management methodology was described that was designed to facilitate the European Union (EU) Good Manufacturing Practice (GMP) requirements for risk-based qualification, validation, and change control activities. Based on the guidance and principles presented by the International Conference on Harmonization (ICH) in its Q9 Guideline on Quality Risk Management,1 and utilising a documented ten-step process, this methodology, or tool, offers a documented and systematic solution for determining and managing, on a risk basis, the scope and extent of qualification and validation, and the likely impact of changes. This tool is based upon a set of fundamental principles and pre-defined design criteria, which were also discussed in Part I.

In this Part, the scope of this risk management tool is outlined, and the structure of the tool is explained. Some of the key features of this tool are outlined, and a number of its limitations are highlighted. Some novel elements behind this approach are discussed, and several of the main findings made to date using this tool are presented.

Scope of this Risk Management Solution

This risk management solution allows for a structured risk management approach to be applied to qualification, validation, and change control activities across a wide range of areas. These areas include:

  • GMP Processes, such as Manufacturing, Cleaning, and Packaging processes, together with their related items of equipment
  • GMP Systems, such as Heating, Ventilation, and Air Conditioning (HVAC), Building Management, Distribution, and company Regulatory Compliance systems
  • GMP Programmes, such as Stability, Complaints and Recalls, Pest Control, Supplier Approval, and Self-inspection programmes
  • GMP Regulatory Compliance activities, such as Market Surveillance programmes carried out by regulators

This risk management solution is flexible in how it may be used. It is designed so that it may be applied retrospectively or prospectively to the item under study and it can also be applied to change control requests, which are, by definition, prospective in nature. The tool can also be used to address specific, known problems with the item under study that have already been identified. Alternatively, it can be used to address potential risks, which have yet to be realised in practice.

With respect to regulators, one of the objectives laid down during the development of this risk management solution was that the scope of the tool should extend to Regulatory Compliance environments, such as Inspectorate and Official Medicines Control Laboratory (OMCL)2 related activities, and not be limited to manufacturing. To this end, the Market Compliance Section within the Compliance (Inspectorate) Department at the Irish Medicines Board, Ireland, took the opportunity to investigate whether a risk management approach might help identify areas within its own core business activities that might benefit from risk-based qualification, validation, and change control.

The timing for this was opportune, given the finalisation of ICH Q9 in November 2005, which presented detailed risk management guidance for Regulators as well as for Industry. The publication of an Irish Government Risk Management paper in March 20043 meant that agencies such as IMB were now required to apply Risk Management principles to their work in a formal manner. It was found, however, that there was no one risk management tool available that could be readily applied to this task without some modification, and this, in part, drove the development of this risk management solution.

One might ask, however, what do risk-based qualification, validation, and change control have to do with the work of regulatory authorities? Are these activities not specific to GMP-regulated environments, that is, to industry? At a fundamental level, the authors believe that qualification, validation, and change control are broad, useful concepts, and that there is no reason why these concepts cannot benefit regulators as well as industry. This is particularly so within Regulatory Compliance environments such as inspectorates and official medicines control laboratories which are concerned (directly and sometimes indirectly) with GMP. Indeed, the Compilation of Community Procedures on Inspections and Exchange of Information,4 which is published by the European Medicines Evaluation Agency (EMEA) on behalf of the European Commission, outlines certain change control and validation requirements for EU GMP Inspectorates. Thus, the concepts of change control and validation are already applicable to the work of GMP Inspectorates and the Risk Management methodology outlined here is designed to demonstrate how such activities can be made risk-based.

Tool Structure

This risk management tool is comprised of three discrete components: a tool worksheet, a laminated card, and a user manual.

  • The Tool Worksheet

This is a structured, instructional worksheet, addressing each of the ten steps making up the risk management process outlined in Part I of this paper. It is used to direct and document the risk management exercise, from defining the purpose and nature of the specific exercise at hand (Step 1), through to planning for a formal review of the risk management exercise at a later time (Step 10). The worksheet was developed and optimised using a series of case studies and practical examples, and it has been subjected to extensive user testing with industry and with academic validation and quality assurance groups.5

  • The Laminated Card (See Addendum)

This is used in conjunction with the tool worksheet, particularly during Step 3 of this risk management process. Its main purpose is to facilitate a review of the various default definitions for Probability, Severity, and Detection given by this tool, so that these definitions may either be agreed upon by the risk management team, or modified as required. This is where the tool may be customised to suit the particular exercise at hand. For example, there are default definitions given on the laminated card for the three severity levels used in the tool - Critical, Moderate, and Minor. These can be modified in order to reflect any specific stakeholders associated with the particular item under study. The laminated card also serves as an aide-memoir for the team performing the risk management exercise, because the reverse side of the card contains an outline of the complete ten-step process.

  • The User Manual

This contains information and guidance on:

    • The key concepts behind this risk management solution
    • The principles upon which this risk management solution is based
    • A general overview of the structure of this risk management tool, its uses, and scope
    • A series of completed real-life case studies that show, in practical terms, how this risk management tool is used, and the expected outputs of the tool
    • A Questions and Answers guidance document pertaining to each of the ten steps of the risk management solution

Key Features of this Risk Management Solution

This risk management solution provides a documented means for identifying GMP controls and critical process parameters, which are directly related to product quality and patient risk. It should be noted that in the authors' experience, no one tool can identify all of the critical controls and critical process parameters that relate to the item under study. However, many of these will already be known through routine product and process developmental work and existing scientific knowledge.

The following are some of the key features of this solution:

  • Complexity and Criticality Considerations

As a formal and rigorous approach to risk management, this tool is designed so that its use should be commensurate with the complexity and/or criticality of the issue to be addressed. To this end, only the highest priority or most important potential negative events should be selected for formal evaluation. This tool is not designed for use in all situations, or to address all risk areas or concerns, and in many instances, in line with ICH Q9 principles, a more informal approach to risk management may be more appropriate, and indeed proportionate.

  • Negative Events

This process uses the concept of negative events, which are defined simply as “what can go wrong.” A negative event can be a single event, or a number of individual occurrences leading to a negative outcome. Risks arising from negative events are estimated, assessed, and controlled in Steps 5-7 of the process. The term, negative event, is advantageous in that it is easy to understand, it is applicable to a wide range of activities and areas, and is perhaps simpler than the more commonly used terms: failure modes and hazards. Recognising the fact that individual negative events can have multiple causes with different probabilities of occurrence, the tool is designed to address the multiple risks, which may be associated with a single negative event, as documented in Step 4 of the tool worksheet.

  • GMP Controls

The tool focuses specifically on GMP controls and it requires a critical evaluation of current and proposed controls with respect to how they mitigate risk. The tool also offers a large degree of flexibility in how it deals with such controls. This is important because, from the authors' experience, too restrictive an approach can mean that a particular risk management tool cannot be used in many situations.

    • For example, different types of controls may be encountered in GMP environments that provide risk control. However, while some controls have associated critical process parameters that can be measured or verified, such as an in-process acidity test, which has pH as its critical process parameter, others, such as personnel training, or supplier qualification, are not so easily described in terms of critical process parameters. This can cause problems when one applies a risk management approach focused only on critical process parameters.
    • The tool addresses this difficulty through the design of Step 8 of the tool worksheet. Step 8 allows one to define acceptance criteria or required outcomes for a control, such as satisfactory performance in a training assessment test, without having to determine formal critical process parameters that can be measured or verified. Regardless of the terminology one uses in Step 8 of the worksheet, the end result is the same in that key measurables and expected outcomes for the control in question are defined and their qualification and validation requirements identified.
  • Qualification and Validation

These considerations are integral to the tool. In Step 8, the qualification and validation status of, and the related requirements for, the various controls documented in Steps 5-7 are critically determined. Given that some GMP controls required to address an identified risk will be personnel or training-based, the requirements for personnel competency and training-related controls are likewise evaluated and determined in Step 8 of the tool.

  • Multiple Tool Outputs

The tool has a large number of outputs and these are shown in Figure 1.

Note: This risk management solution need not be used in a stand-alone way, in isolation, and it may in fact be used in a synergistic manner with other risk management tools. These include formal Process Mapping, which can be of use during Step 4 of this Risk Management process when identifying potential negative events, and simple Cause and Effect diagrams, which can help provide causal information for Step 5 of the Risk Management exercise.

Limitations of this Risk Management Methodology

This is not a universal risk management solution that may be applied in all situations across all areas. For example, while this approach provides a means of prioritising risks and their required risk control activities, it does not provide a methodology for formal risk-filtering activities. Therefore, when prioritising sites for GMP inspection, or suppliers for auditing, this solution does not offer a means of doing this. There are specific and better tools available for these purposes, and ICH Q9 gives information in this regard.

Also, and as noted earlier, this is a formal and rigorous methodology, involving a detailed risk management process with ten discrete steps, and a tool worksheet that requires completion as the risk management exercise progresses. This means that documentation, effort, and training are required in order for this tool to be used effectively. As a result, this tool has been specifically designed to evaluate only a small number of potential negative events - those considered to be the most critical and/or most complex. While this is a key strength behind this approach, it also limits the application of this tool to a degree, and if a large number of negative events are to be studied, a less-detailed cause and effect approach, or a Hazard Analysis and Critical Control Points (HACCP) or Failure Mode and Effects Analysis (FMEA)-based approach may be more appropriate.

Figure 1: Tool Outputs.

Risk Management Tool

The Main Outputs from this Tool:

  • Risks associated with the item under study
  • A critical evaluation of current GMP controls from a risk perspective
  • A critical evaluation of proposed, new GMP controls from a risk perspective
  • Risk-based critical process parameters, together with their limits or other acceptance criteria
  • The required outcomes for controls that may not have formal critical process parameters associated with them
  • The Qualification and Validation status of each control
  • Qualification and Validation requirements for the item under study
  • Personnel training and training assessment requirements
  • Risks associated with implementing a Change Control and a strategy for dealing with such risks
  • A means of evaluating and justifying Process Analytical Technology (PAT) initiatives
  • A strategy for communicating risks to stakeholders
  • A plan for the continuous improvement of the risk management exercise
  • A documented and systematic means of meeting the EU GMP requirements to implement risk-based validation and change control programmes

Principal Findings to Date

Several detailed case studies have been developed on the application of this risk management solution across a number of very different areas relating to GMP and Regulatory Compliance activities. These included a manufacturing process, a laboratory-related change control, a company product recall procedure, and a regulatory quality defect and recall programme, as outlined below.

  • The manufacturing process was in place at a finished products manufacturing site. Here, the final mixing and filling steps for a paracetamol oral suspension product were assessed from a risk perspective. This was in response to concerns relating to the occurrence of repeated process deviations during mixing and filling. (This was a retrospective application of the risk management tool.)
  • The change control related to quality control testing at an Active Pharmaceutical Ingredient (API) manufacturing site. It involved a proposal to introduce Inductively-Coupled Plasma (ICP) technology to the site for the analysis of Nikel in a new API material. The change control also proposed switching over from Atomic Absorption Spectroscopy to ICP for the analysis of zinc in another API, and for the analysis of various metals in site water samples. (This was a prospective application of the risk management tool.)
  • The product recall procedure was in place at a finished product manufacturer that supplies compounded finished product directly to pharmacies and hospitals. The company had recently executed a product recall using this procedure, and it was an opportune time to determine any risk-based qualification and validation work required. (This was a retrospective application of the risk management tool.)
  • The regulatory quality defect and recall programme was in place within the Compliance Department of the Irish Medicines Board, in Dublin, Ireland. This programme is used to investigate notifications of suspected quality defects that are received (via Rapid Alerts) from other Competent Authorities, and to the mechanisms in place for communicating serious recall issues within Ireland. (This was, again, a retrospective application of this risk management tool.)

The above case-studies were based on real-life situations and experiences, but they have been written in a general manner, and some details have been changed so as not to indicate the companies or products concerned. In each case, this risk management solution identified and assessed risks of various magnitudes, some being significant which were associated with the items under study. Also, it identified several new qualification, validation, and training activities which were considered to be required in order to address the risks identified. These were over-and-above the qualification, validation, and training work that had already been performed, or for which planning had already been completed.

These exercises provide detailed and documented examples that demonstrate how risk management may be used in practice within GMP and Regulatory Compliance environments to facilitate risk-based qualification, validation, and change control activities.

Some Novel Aspects to this Risk Management Solution

In Part I of this paper, we discussed how this risk management solution builds upon some of the useful concepts and features of other risk management tools and approaches, such as FMEA, Failure Mode, Effects, and Criticality Analysis (FMECA), HACCP, the Good Automated Manufacturing Practice (GAMP) 4 Risk Assessment process, and the International Society of Pharmaceutical Engineering's (ISPE) Impact Assessment process. However, there are several features associated with this risk management solution that differentiate it from other approaches. For example:

  • This risk management solution provides a documented and simple strategy for dealing with uncertainties, conflicts, and doubts that may arise during certain stages of a risk management exercise, such as when estimating probability of occurrence and severity ratings for a particular negative event.
  • This solution is designed to serve as a direct aid when addressing the new Product Quality Review requirements of revised Chapter 1 of the EU GMP Guide,6 which include an assessment of any revalidation work required. This is because one output of the tool, via Step 8 of this risk management process, is an assessment of the Qualification and Validation status of the item under study.
  • Steps 5, 6, and 7 of this risk management process require a critical evaluation of the merit of each current and proposed new or improved GMP control from the perspective of risk control and protection of the patient. (This is required even when the risk is considered to be acceptable without any new or improved controls being put in place.)
    • As a result, this tool can help identify any required qualification or validation work for current controls that may have been overlooked to date.
    • This feature may serve as a means to justify the removal of some controls, which might not add value in terms of product quality, or which might not serve to benefit the patient. Examples here could include some in-process and finished product tests. Importantly, such controls should not be removed without first addressing any Marketing Authorization variation requirements that might be relevant.
    • This feature may also serve to justify the reduction of some ongoing qualification and validation activities for some older processes, where Critical Process Parameters (CPP) may have been registered in Marketing Authorisations without adequate scientific foundation.
  • This risk management solution can be used to formally identify and justify Process Analytical Technology (PAT) -based initiatives. This is because this approach can show in a scientific manner how PAT-based monitoring of a process may reduce or control an important risk.
  • This solution is designed so that it can be easily customised in a pre-defined way to suit the particular application at hand. For example, Step 3 of the risk management process allows the default definitions for Probability and Severity to be changed, perhaps by making them quantitative, and Severity ratings can be further modified to better reflect who the specific stakeholders are for the particular item under study.


In Parts I and II of this paper we highlight the need for patient-focused and value-adding qualification, validation, and change control programmes for manufacturing and regulating medicinal products in the EU, which are cost-effective and in-line with current regulatory requirements and guidance. To this end, a formal risk management solution was presented that seeks to demonstrate, in a practical way, how Regulators and Industry in the EU may achieve these goals.

This solution represents a formal and rigorous approach to risk management, offering a scientific and practical means for determining and managing, on a risk basis, the scope and extent of qualification and validation, and the likely impact of changes. Based on a ten-step, systematic process, this approach offers a ready-to-use and documented risk management methodology for these activities.

This tool is not intended for use in all situations, or to address all risk areas or concerns encountered in GMP and Regulatory Compliance environments. Rather, its use should be commensurate with the complexity and/or criticality of the issue to be addressed, and in many instances, and in-line with ICH Q9 principles, a more informal approach to risk management may be more useful, and indeed proportionate.

It is hoped that this work will serve to build upon the milestone that was ICH Q9, and the work done to date by Food and Drug Administration (FDA), ISPE, GAMP and many others in promoting true riskbased qualification, validation, and change control activities.


Kevin O'Donnell thanks the Irish Medicines Board for its support and for funding this work. Acknowledgements and gratitude are also extended to his IMB colleagues Pat Walsh, Maura O'Connell, Paul Sexton, Deirdre Morgan, Anne Hayes, Chris Cullen, Mike Morris, Ann O'Connor, and John Lynch for their valuable suggestions during the course of this work. Special thanks also to Mitsuko Oseto.

All views expressed in these papers are those of the authors.


  1. ICH Q9 - Quality Risk Management, at Step 4 of the ICH Process, November 9, 2005.
  2. An Official Medicines Control Laboratory is an independent laboratory used by regulatory authorities to independently analyse medicinal products and active pharmaceutical ingredients.
  3. 'Risk Management Guidance for Government Departments and Offices,' Irish Government Accounting Section, Dept. Of Finance, March 2004.
  4. Compilation of Community Procedures on Inspections and Exchange of Information, 15 September 2005
  5. A series of presentations and technical workshops were given to, and run with, academic and industry partners during 2004 and 2005, in order to test the underlying principles behind this Risk Management solution, and the resulting Risk Management process. These presentations and workshops, which used detailed case studies on use of the tool, allowed the structure and design of the tool worksheet to be evaluated and optimised.
  6. The Rules Governing Medicinal Products in the European Community, Volume IV, published by the European Commission

Product Added Successfully

This product has been added to your account and you can access it from your dashboard. As a member, you are entitled to a total of 0 products.

Do you want access to more of our products? Upgrade your membership now!

Your Product count is over the limit

Do you want access to more of our products? Upgrade your membership now!

Product added to cart successfully.

You can continue shopping or proceed to checkout.

Comments (0)

Post new comment

The content of this field is kept private and will not be shown publicly.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
  • Use to create page breaks.
Enter the characters shown in the image.
Validated Cloud logo