© Copyright ISPE 2010. All rights reserved.www.ISPE.org

ISPEKnowledge Brief

by David D. Dolgin

and Jörg Block

Intermediate

KB-0019-Jan10

Applied Risk Management in Commissioning and QualificationIntroductionIn 2001, ISPE published the Baseline® Guide: Volume 5 – Commissioning and Qualification (from here on referred to as Baseline Guide 5), the seminal document of the global pharmaceutical industry’s then current direction toward risk-based Commissioning and Qualification (C&Q). Since then, the industry has been undergoing a sea-change toward science- and risk-based pharmaceutical development, validation, and manufacture.

With the publication of related guidance, such as ICH Q9 “Quality Risk Management” and ASTM E-2500-07 “Standard Guide for the Design, Specification, and Verification of Pharmaceutical and Biopharmaceutical Manufacturing Systems and Equipment,” an emphasis has been placed on the role of Quality Risk Management techniques in the design, construction, and verification of pharmaceutical facilities and equipment.

ISPE is developing a Good Practice Guide (GPG) on the practical implementation of risk-based C&Q. This

Knowledge Brief describes the general concepts of that document, which is intended to “bridge” the differences between traditional C&Q, as discussed in the ISPE Baseline Guide: Volume 5 – Commissioning and Qualification, and the risk-based ASTM verification practices.

What Changed Since Baseline Guide Volume 5Published with the input and review of the FDA, the ISPE Baseline Guide: Volume 5 – Commissioning and Qualification was the first industry guidance that attempted to re-establish the primacy of engineering practices and competencies (termed “Good Engineering Practices” or GEPs by that guide) in the specification, design, construction, and testing of pharmaceutical facilities and manufacturing systems. In addition to the recognition of the role of GEP, Baseline Guide Volume 5 also provided a mechanism – loosely based on the risks of a given system’s intended conditions of use – for differentiating the level of effort and formality required to commission and/or qualify said

Page 2 ISPE Knowledge Brief Applied Risk Management in Commissioning and Qualification

© Copyright ISPE 2010. All rights reserved.

system. Years later, ICH Q9 “Quality Risk Management” would articulate that exact principle. Lastly, an asset categorization system was proposed, dividing equipment, facilities, and utilities into three categories based on potential for product quality impact - Figure 1.

Although the approaches in Baseline Guide 5 can legitimately be called the start of risk-based C&Q, in the years since their initial publication, the asset-based (or “bottom-up”) approaches of Baseline Guide 5 have become somewhat dated due to the process-based (or “top-down”) approaches of ICH Q8, Q9, and ASTM E 2500-07 “Standard Guide for Specification, Design, and Verification of Pharmaceutical and Biopharmaceutical Manufacturing Systems and Equipment.” Rather than looking at a manufacturing system from the standpoint of how it interacts with the process (in the manner of the “Yes/

No” impact assessment questions from Baseline Guide 5), the later documents promote quality risk management by determining and documenting the quality requirements of the process itself, and assuring that known risks are inherently acceptable or have been mitigated by the intended design and function of the manufacturing systems supporting that process. As part of this paradigm shift to focus on the critical-to-process-quality, many of the old, established but questionably valuable “conventions” of Qualification practices in the pharmaceutical industry have been eliminated in the science- and risk-based “verification” process framed by ASTM.

Implementation of Risk-Based C&Q – The Cost of ChangeIn addition to better risk management through a focus on quality-critical aspects of manufacturing systems, verification of systems a la ASTM

can have decidedly positive impacts on project costs and timelines. But extensive changes to practices and terminology embedded in the cultures and Quality Systems of many firms for decades is not cheap or easy. In a challenging pharmaceutical marketplace and economic climate in general, a business case for change must be made in order for mass acceptance by the industry. Quality unit arguments that “…we need to better align with Q9…” are generally insufficient to inspire an organization’s financial and emotional support for the expenditure of time, money, and effort involved with a conversion from traditional C&Q practices to the risk-based process of ASTM. The business case for each firm also will be greatly influenced by the circumstances of that firm. “Old line” companies with global scope, multiple plants, and extensive systems of documentation and standards, may well reach different “return-on-investment” decisions then new, relatively smaller biotech start-ups. The product pipelines of companies also differ with different amounts of business and patient risk inherent in the nature of the products they provide. That being the case, different firms may “migrate” to ASTM methodologies to varying degrees and extents, based on their analysis of their own individual situations.

C&Q Good Practice GuideIn order to better serve the pharmaceutical community, in 2009, the ISPE Technical Documents Executive Committee approved the development and publication of a Good Practice Guide (GPG) on the practical implementation of risk-based C&Q. A task team to develop the document was identified from the C&Q COP Steering Committee and work on the draft has commenced.

The concept that the GPG Task Team is working from is the creation of a document to “bridge” the differences between traditional C&Q (Baseline Guide 5) and the risk-based ASTM verification practices - Figure 2.

The organizing idea being that a firm

Figure 1. Baseline Guide Volume 5 Differentiated Requirements Based on Risk (Impact).

Figure 2. GPG “Bridge” concept.

ISPE Knowledge Brief Page 3Applied Risk Management in Commissioning and Qualification

© Copyright ISPE 2010. All rights reserved.

can choose the “distance” they cross the bridge – or stay where they are – based on their own business case.

Applied Risk Management in C&Q“Applied Risk Management in C&Q” is the working title of the GPG, but it’s also what we are trying to accomplish with its content. Feedback from ISPE members and Annual Meeting attendees was gathered at the Annual Meeting in 2008. Topics we heard the audience request the GPG address included:

• Documentation Standards and Use of Commissioning

• Engineering Quality Systems• Roles and Responsibilities

(Specifically QA)• How to Handle Legacy Systems• C&Q Planning• Process Flows• Transitional and Hybrid Approaches

Based on that feedback, a subject outline was prepared and approved by the Technical Documents Executive Committee. Subject to change over the completion of the drafting process, the current GPG structure is shown in Figure 3.

Notes on GPG Philosophy and ContentOne of the implementation challenges that ASTM provides established firms is a near total change of C&Q terminology. “Verification” is used as an umbrella term to cover the range of activities used to demonstrate and document fitness for use. Such terminology changes can drive costs associated with document revision and retraining, and generally

contribute to “churn” within Quality Systems. One of the philosophical approaches of the GPG will be that activity or document names do not waste time or money – wasteful practices do. There is nothing wrong with “IQ” or “OQ” either as terminology or as mechanisms to organize documented evidence. Changing the many documents that reflect this terminology may not add value for some firms. However, focusing the content of these or other documents on the critical aspects to product quality and patient safety does add value. The key point is to not lose sight of the objective of the verification exercise – to assure that facilities and systems meet their user requirements and the compilation of auditable documentation to that effect. The science- and risk-based ASTM approach can be completely and efficiently integrated into the procedures and processes that a given firm already utilizes in order to accomplish this objective, and the GPG is intended as a roadmap for how to do so.

Another traditional C&Q mechanism that is utilized widely by the global industry is the asset categorization system introduced in Baseline Guide 5. This useful and logical organizational system also can be achieved and maintained through formal risk assessment as well as by the traditional “Impact Assessment” questionnaire (subject to some modification to remedy some of the Impact Assessment shortcomings previously discussed). The GPG will describe how to identify ASTM defined “critical aspects” – and therefore the “Impact” status of the systems that contain them – through standard risk

assessment tools such as Failure Modes and Effects Analysis (FMEA), as well as how to improve Impact Assessment where firms desire to retain it.

While the essential engineering tasks required to specify, design, build, install, and test a given system do not really change with the adoption of the ASTM, the roles and responsibilities of various units within the organization certainly are modified. The idea of a “QA Cop” to assure that Engineers do their jobs has been demonstrated to be expensive, inefficient, and ultimately unsuccessful. Quality Assurance, through oversight and auditing that appropriate GEP controls are in place during the design-build process, is much more effective than Quality Control, where QA approval is required for engineering to perform well understood tasks (tasks for which Quality is not an SME in any case). Meanwhile, Engineering must understand their more “front-and-center” role in producing evidence of fitness for use on a “right-first-time” basis. The experience of travelers over the C&Q bridge so far is that Quality unit and Engineering unit understanding and acceptance of their respective, equally important, but different, roles is a key to successful transformation from dated traditional practices to more efficient and effective work processes, and the GPG will be intended to help frame those roles and responsibilities.

The topic of legacy system lifecycle management will be an additional point of emphasis in the GPG. While the delivery of new facilities and systems is always a “hot topic” for many firms and plants, new major capital projects are rare. However, even for legacy systems, significant improvements in both Quality Assurance and lifecycle cost management can be accomplished through the professional and practical application of risk management techniques. The GPG will present and discuss opportunities and options for the use of Engineering Change Management (ECM) instead of Quality preapproved (or “Operational”) change control, risk-based ongoing monitoring of system Figure 3. Good Practice Guide Structure – building from the ground up.

Page 4 ISPE Knowledge Brief Applied Risk Management in Commissioning and Qualification

© Copyright ISPE 2010. All rights reserved.

performance, and maintenance of the “Qualified state.”

Lastly, but certainly not of least importance, will be content on cost control and process performance, including suggestions for how C&Q professionals can measure their “traditional” costs and build the business case for a trip at least partially across the C&Q ‘bridge.’”

ConclusionThe global pharmaceutical industry is undergoing a sea-change toward science- and risk-based pharmaceutical development, validation, and manufacture. Risk-based C&Q is an important element of that change. Quality systems must adapt to these changes or place their firms at a significant competitive and compliance disadvantage. But the distance to be travelled by each firm must be planned and justified technically and financially by the circumstances of that firm, and the upcoming C&Q GPG will attempt to provide a practical map to bridging the gap.

References1. ASTM E-2500-07 – “Standard

Guide for Specification, Design, and Verification of Pharmaceutical and Biopharmaceutical Manufacturing Systems and Equipment.”

2. ISPE Baseline® Guide: Volume 5 – Commissioning and Qualification, March 2001.

For Further InformationFor more detailed and related information, the following ISPE resources are available:

Technical Document:• ISPE Baseline® Guide: Volume 5 –

Commissioning and Qualification, March 2001.

http://www.ispe.org/baselineguides

Pharmaceutical Engineering Articles:• Pharmaceutical Engineering,

November/December 2009, Volume 29, Number 6 (Issue Theme: Integrated Commissioning and Qualification).

• “Commissioning and Qualification: A New ASTM Standard - GMP Regulations,” by Robert E. Chew and David Petko, Pharmaceutical Engineering, November/December 2007, Volume 27, Number 6, pp. 38-50.

• “Solving the Terminology Conundrum,” by Robert Adamson, Nuala Calnan, Robert E. Chew, and Steven J. Wisniewski, Pharmaceutical Engineering, July/August 2008, Volume 28, Number 3, pp. 60-67.

http://www.ispe.org/pharmaceuticalengineering

Recorded Webinars:• Implementing the ASTM Standard for

Verification (C&Q)• Lean C&Q: Strategy, Schedule, and

Success

• ISPE 2009 Strasbourg Conference Wrap Up, Pfizer Case Study: Implementation of an ASTM E2500-Based Verification Approach.

• Baseline Guide 12 Overview. http://www.ispe.org/onlinelearning

Commissioning & Qualification Community of Practice (C&Q COP):• Visit the C&Q COP on the ISPE Web

site for the most current and up-to-the-minute discussions on risk-based commissioning and qualification and other related topics.

http://www.ispe.org/communitiesofpractice

About the AuthorsDavid D. Dolgin is Senior Quality Program Manager at Abbott Labs. He has 29 years of pharmaceutical Quality Assurance experience. He has experience with all aspects of qualification and validation with particular expertise in validation change control, commissioning and qualification, and aseptic operations. Dolgin is currently responsible for QA program management for the C&Q program of Abbott’s Global Pharmaceutical Operations group.

Jörg Block has more than 18 years of experience in the pharmaceutical industry (Schering AG and Bayer HealthCare AG). He has held positions in Engineering, Project Management, Production Management, Development, QA Engineering, and Technical Compliance. Block currently is responsible for Technical Compliance in Bayer HealthCare - Product Supply - Technical Support, coordinating Qualification and Computer System Validation projects on a corporate level. He is member of the ISPE COP C&Q Steering Team and member of the authoring team for Baseline Guide Volume 12 and Co-Leader of the C&Q GPG. Block is a Chemical Engineer and received a PhD in bio-chemical engineering from Technical University in Berlin. •