Risk management

Introduction

The adoption of a risk management system that applies through all stages of the product's life, from concept and tissue selection/collection to release and clinical use, is essential for ensuring optimum product quality and safety. The risk management methodology should assist the manufacturer to identify, analyse, evaluate and control the risks in all phases of a products' lifecycle.

This Appendix outlines the approach that should be taken to risk management as applicable to biologicals. The following documents may be used to guide the development and maintenance of a risk management framework.

• The Therapeutic Goods Administration's risk management approach to the regulation of therapeutic goods
• Draft international standard ISO/DIS 13022 'Medical products containing viable human cells - application of risk management and requirements for processing practices'
• ISO 14971 'Risk assessment for medical devices'
• ISO 22442 'Part 1 Medical devices utilizing animal tissues and their derivatives - Part 1: Application of risk management'
• ICH Q9 "Quality Risk Management"
• EMEA 'Guideline of Human cell-based medicinal products'
• EMEA 'Guideline on safety and efficacy following-up-Risk management of advance therapy medicinal products'
• AS/NZS ISO 31000:2009 Risk management, Principles and Guidelines.

These standards and guides are utilisable for assessing a broad range of therapeutic products and provide a valuable assessment methodology for biologicals to ensure risk minimisation, with risk defined as the effect of uncertainty on objectives (as defined in AS/NZS ISO 31000:2009). Risk can be further defined as likelihood of occurrence of harm x impact of that harm.

The strategic process applied in Risk Management is presented as a flow chart in Annex 1 and summarised in the following diagram, based on ISO 14971:

Figure 1 Summary of Risk Management process

Text version of Figure 1

• Risk identification is defined as 'the process of finding, recognising and describing risk'
• Risk analysis is defined as 'the process to comprehend the nature of risk and to determine the level of risk'
• Risk evaluation is defined as 'the process of comparing results of risk analysis with risk criteria to determine whether the risk and/or its magnitude is acceptable or tolerable'
• Risk treatment is defined as 'the process of identifying the range of options for treating risk, assessing those options, preparing risk management plans and implementing them'
• Post-control review is a key component of the risk management process, and ensures the risk remains at an acceptably low level and that the risk reduction policies implemented are consistently effective. Regular periodic quality reviews are required for compliance with the cGMP, and are especially important in the context of changes to key materials, processes and equipment

The Risk Management process, in relation to an activity or product, is not intended to create additional regulatory expectations. Indeed, if applied correctly through all phases of an activity, risk management should be integral to product development and production and facilitate compliance with regulatory requirements. An effective risk management program will greatly benefit the manufacturer, facilitating areas including (but not limited to);

• Identification of potential risk/hazards associated with the quality and safety of the product;
• Identification and utilisation of processes resulting in risk mitigation;
• Determination of the extent and focus of the data required during non-clinical and clinical development; and
• Establishing the need for additional risk minimisation activities.

As noted in ICH Q9, "An effective quality risk management approach can further ensure the high quality of the drug (medicinal) product to the patient by providing a proactive means to identify and control potential quality issues during development and manufacturing." However, it is important to note that appropriate use of risk management does not obviate industry's obligation to comply with regulatory requirements and does not replace appropriate communications between industry and the TGA.

Risk management for biologicals

Introduction

Biologicals should be thoroughly assessed for risk, because they pose a number of potential hazards that do not apply to other therapeutic goods. For example, they:

• Include viable materials;
• have a potential risk of contamination by agents causing TSE;
• have a potential risk of infectious disease transmission;
• patients may have immunological compatibility complications;
• if genetically modified, vectors have potential to induce tumorigenicity and oncogenicity;
• may be modified such that their natural function is fundamentally altered (potentially unintentionally); and/or
• may be used in non-homologous manner, which introduces additional risks

The diverse range of starting materials and manufacturing processes that could define a biological can lead to very different levels of risk, and the risk evaluation and risk management plans should be adjusted on a case by case basis to be commensurate with the intended application of the biological. Documentation will need to be provided for all Class 2-4 Biological products to demonstrate that the principles of risk management have been satisfactorily addressed. More detail on the level of documentation required for each Class of Biological is provided in the guidelines on Class 2, 3 or 4 Biological dossier requirements.

Risk identification

The risk management process begins with the identification of risk; that is the process of finding, recognizing and describing risks. In order for a risk management program to be effective the level at which risk is defined is important. Identification of risk at a very high level, for example 'risk of harm to recipients', may be difficult to analyse as there are a large number of potential hazards (defined as a source of potential harm) that could result in that risk. Conversely, identification of risk at a very low level, for example 'risk of tube A being put in the position for tube B in the flow cytometer' may miss the objective of the risk analysis. It is recommended that risks are broken down to manageable (and hence analysable) units. For example, 'risk of harm to recipients' could be broken down into 'as a result of collection process', 'as a result of manufacturing process' and 'as a result of storage and transportation process'. Alternatively, it could be broken down to 'risk of harm to recipients as a result of infectious disease transmission', 'risk of harm to recipients as a result of cell transformation process' and 'risk of harm to recipients as a result of degradation during storage'.

Available knowledge should be used to systematically identify and document hazards in the entire life-cycle of the biological. Individual hazards may refer only to a single step in the collection or manufacturing process (e.g. contamination with transmissible virus), or apply over the entire process (e.g. loss of traceability). Particular attention should be given to the known hazards associated with human cells and tissues, as highlighted in ISO/DIS 13022, such as:

• Potential for contamination by microbes, viruses and agents causing TSE
• Loss of activity and integrity of the biological material
• Tumorigenic/oncogenic potential of cells, particularly when they contain introduced vectors
• Loss of traceability of biological material
• Unintended clinical complications

Risk analysis

Risk analysis is the process whereby the risks identified are comprehended and the level of risk subsequently determined. At the beginning of the product development, an initial risk analysis should be performed based on existing knowledge of the type of product and its intended use. This analysis should be updated by the applicant throughout the product development and life, as data are collected and product knowledge increases, to further characterise the risk. This process would be reviewed as part of the quality management system under cGMP. Methodological tools for risk analysis are detailed in ICH Q9 and ISO 14971. The enumeration of risk may greatly aid the determination of the severity of a particular risk, based on the definition of risk severity being Risk Impact (to patient) x Risk likelihood (probability). Annex 2 details an example of a risk enumeration strategy, with the potential impact on the patient of a specific hazard classified into five levels, and the likelihood (probability) of a specific hazard also classified in to five levels.

Numerical values are assigned to each classification level and by multiplying the numerical values, an overall risk severity score can be calculated, and used to determine the level of the risk.

Risk evaluation

Having carried out a risk analysis to determine the nature and level of risk, risk evaluation results in the determination of which risks are acceptable and which require mitigation. Annex 2, Table 3 and contains a hypothetical risk severity/outcome matrix, whereby the calculated severity of the risk results in one of three outcomes - 'Acceptable risk with no action required', 'Risk mitigation required' and 'Unacceptable risk, significant change required'. This is also depicted graphically in Annex 2, Figure 1. The risk grading scheme is dependent on the manufacturer's attitude to risk - a conservative attitude would be expected for manufacturers of biologicals.

Risk treatment

Following the risk evaluation and the determination of whether the current level of risk is acceptable or unacceptable, those that are deemed unacceptable must undergo risk mitigation. Plans for the procedures required to reduce the risk to an acceptable level would be produced, implemented and documented, and the effectiveness of the risk treatment determined by commencing the risk management workflow again, beginning at the point of risk analysis. The process should only be accepted once the risk has reached a point at which it is acceptable. Annex 3, Table 1 documents the risk management process as applied to a number of risks relevant to Biologicals. Documenting the process in tables similar to these examples may assist the entire risk management process.

Where residual risk is still significant after control measures are in place a risk/benefit approach should be used to justify its acceptability. In addition, where risk is still unacceptable, alternative materials/sources/processing should also be considered and discussed.

Post-production review

At regular intervals the entire risk management process should be systematically reviewed. There should be processes for the collection and review of information that could inform the manufacturer of risk that may apply at any stage in the lifecycle of the biological. This review process would be reviewed as part of the quality management system under cGMP.

Annex 1 Summary of risk management process

Figure 1 The risk management process, adapted from ISO 14971

Annex 2 Example of enumeration of individual risks

Overall risk severity = Risk Impact (to patient) x Risk likelihood (probability)

Figure 1 Graphical representation of overall risk severity

		Impact
		Negligible	Marginal	Significant	Major	Catastrophic
Likelihood	Certain	5	10	48	20	25
	Likely	4	8	12	16	20
	Possible	3	6	9	12	15
	Rare	2	4	6	8	10
	Improbable	1	2	3	4	5

Annex 3 Documentation of risk management process

References

• TGA website
• TGA's risk management approach to the regulation of therapeutic goods
• ISO (International Organisation for Standardization)
• EMEA (European Medicines Agency)
• ICH (International Conference on Harmonization)
• AS/NZS (Standards Australia)