By Edward GriffithPrincipal Consultant, Fujitsu Consulting

Every product and every process has an associated risk. Every enterprise should have a methodology for identifying and evaluating the risks it faces and it should have a process for generating intervention plans to reduce the risks to an acceptable level. This process is generally referred to as a Risk Management Plan (RMP).

The FDA’s Risk-Based Approach Initiative

In early 2002, the Food and Drug Administration (FDA) announced its “Pharmaceutical Current Good Manufacturing Practices (cGMPs) for the 21st Century: A Risk-Based Approach.” According to the FDA position paper, “… it is time to step back and evaluate the currency of these [drug cGMP] programs so that:

The most up-to-date concepts of risk management and quality systems approaches are incorporated while continuing to ensure product quality;

* The latest scientific advances in pharmaceutical manufacturing and technology are encouraged;
* The submission review program and the inspection program operate in a coordinated and synergistic manner;
* Regulation and manufacturing standards are applied consistently;
* Management of the program encourages innovation in the pharmaceutical manufacturing sector; and
* FDA resources are used most effectively and efficiently to address the most significant health risks.”

The FDA defines a Risk Management Program (RMP) as, “a strategic safety program designed to decrease product risk by using one or more interventions or tools.” The FDA proposes that:

“…the sponsor of every product submitted for approval consider how to minimize risks from the product’s use. Risk management planning generally encompasses all efforts by a sponsor to minimize the risk from its product’s use and may include product labeling, risk assessment, pharmacovigilance, and special studies or interventions.”

The FDA expects the RMP to follow a basic process of: “(1) learning about and interpreting a product’s benefits and risks, (2) designing and implementing interventions to minimize a product’s risks, (3) evaluating interventions in light of new knowledge that is acquired over time, and (4) revising interventions when appropriate.”

Risk Management Plans (RMP)

A Risk Management Program starts with identifying the possible risks (and benefits) associated with a product or with the process used to develop, manufacture, and distribute the product. The following questions should be asked at each stage of the product’s life cycle:

* What are the safety risks?
* Who is at the highest risk?
* What populations are at risk?
* Are the risks predictable?
* Are the risks preventable?

The last question, “are the risks preventable” is very important because it forms the basis of the intervention plan. In order to determine if the risk is preventable, the root cause of each risk has to be determined. Once the root cause is established, the probability of occurrence can be calculated and the risk interpreted.

Risk Management Plans correlate the listing of risks with a listing of Risk Reduction Goals. The Risk Reduction Goals are the endpoint of the intervention plans. For example, if the severity of the risk has been evaluated as “Severe” with a frequency of “one per ten thousand,” the Risk Reduction Goal could be to reduce the severity to “Moderate” and reduce the frequency to “one per five hundred thousand”. The intervention plan details the steps that will be taken to reduce the risk to the acceptable levels and includes the metrics that will be used to measure the progress against the stated risk reduction goals.

Two critical elements of the intervention plan are the criteria that will be used to evaluate the progress toward achieving the stated risk reduction goal and the metrics use to measure the results. According to the FDA, an overall approach to RMP evaluation ideally would:

1. Select well-defined, validated metrics.
2. Use at least two different evaluation methods for key RMP goals or objectives. Preferably, the different evaluation methods would be both quantitative and representative to offset the biases that are intrinsic to any single evaluation process.
3. Use qualitative data collected from a large and diverse group of patients when quantitative data are either not available or not applicable to the evaluation measurement. Qualitative data such as focus group testing may be useful in assessing the effectiveness of education and comprehension about safety and risk information.
4. Consider using evaluation methods to assess if each RMP tool is performing as intended.

The remaining element of a RMP is a process for continuous review and evaluation. There should be a methodology established that assures the RMP is regularly reviewed and updated as necessary depending upon the status against the stated Risk Reduction Goals. The frequency of review should be based on the evaluation of the risk. The RMP for moderate to severe risks should be reviewed and updated more frequently than less those that have a lower evaluation.

Elements of a Risk Management Plan

The following table and checklists correlate Risk and Issue Management techniques and methodologies to the basic process described by the FDA:

FDA Guideline
RMP Elements
Learning about and interpreting a product’s benefit’s and risks
Risk and Issue Management Strategy
Risk Identification Technique
Risk Evaluation Technique
Designing and Implementing Interventions
Risk Response Planning
Risk and Issue Management Plan
Evaluating and Revising Interventions
Risk and Issue Management Plan

Risk and Issue Management Strategy

The Risk and Issue Management Strategy defines the approach, responsibilities, and activities that should be done to effectively manage the risks and issues. The Risk and Issue Management Strategy contains a brief explanation on the manner in which risks and issues will be handled by responsible individual(s) and how risks and issues will be raised, analyzed, reviewed, communicated, and escalated.

Risk and Issue Management Plan

The Risk and Issue Management Plan documents the strategy for managing the risks and issues and describes the corresponding approach, responsibilities, activities, and tools.The approach to risk and issue management specifies the manner in which risks and issues will be handled. The initial risk and issue identification approach is defined, the notification process and the way to document the risks and issues are determined, and the escalation process is established.

The Risk and Issue Management Plan identifies the managers who have primary responsibility for managing the risks and issues, and the domains for which they carry this responsibility. It identifies the domain experts who will lead the analysis for specific management domains. It outlines the risk and issue management activities to be performed throughout the project.The Risk and Issue Management Plan also provides tables to be used when categorizing and evaluating the risks and problems.

Risk Identification Technique

The Risk Identification Technique provides methods to identify risks that could affect the safety, quality, reliability, or durability of a product, process or program and organizes the risks in order to evaluate them and plan appropriate responses. Sometimes this is referred to as a “Hazards Analysis.” A Hazard Analysis is often used in conjunction with a “Failure Modes and Effects Analysis.

Risk Evaluation Technique

The Risk Evaluation Technique evaluates the priority and severity of an identified risk that threatens the safety, quality, reliability, or durability of a product, process, or program. The Risk Evaluation Technique allows the project team to assess the risk relatively quickly and to organize the team for subsequent action.

Impact Criteria Determination Technique

The Impact Criteria Determination Technique helps to identify the project areas or product attributes that might be affected by a risk or a problem, and establishes the criteria used to evaluate the impact of problems or the potential impact of risks.Each project risk and problem will have an impact assigned to it in order to determine its severity and priority.

Risk Response Planning Technique

The Risk Response Planning Technique allows the project team to determine how it will react to specific risks or problems. The range of responses can include accepting the risk as it is; changing the product, process or program; avoiding the risk altogether; or actively pursuing ways to reduce the risk’s threat to the product, process, or program.

Checklists

Checklists are used to assure that all of the necessary Risk Management Procedures have been identified and completed. Depending on the circumstances of the project, checklist should be reviewed at key milestones throughout the project.

Being Prepared

All products and all processes have an inherent element of risk. The important questions include:

* What risks are involved?
* What impacts do the risks have?
* How do we manage the risks to keep them within acceptable levels?

A Risk Management Plan helps to answer these questions.

Risk Management Plans have been used as best business practices for many years, especially in business environments experiencing reduced resources with increased liabilities. One such organization is the Food and Drug Administration. The FDA recognizes that it needs to reorganize its procedures and processes to incorporate the use of Risk Management Programs within the agency and within the industries it regulates. Consequently, the FDA has started issuing position papers and guidelines on what it expects to see in an RMP.

The key to being prepared it to understand the FDA’s current thinking on Risk Management Plans, as well as its recommended procedures for establishing, conducting, and communicating an effective RMP that will comply with the FDA guidelines.