49.2.1 Risk Identification

In early risk assessment, risk identification activities focus on the ability of the potential routes and process to meet both the QTPP and any constraints or opportunities provided by the use of novel and developing technologies. Examples of such technologies are flow and biocatalysis, safety and environmental considerations, and manufacturability aspects including cost, cycle time, and operability. A common approach taken here is structured brainstorms guided by criteria derived from the QTPP in addition to manufacturing considerations.

When route and process have been defined, the later risk identification activities can commence. At this stage, the identification of potential CQAs is usually possible, and this provides one aspect of the scope of the activity. The aim of this step is to identify what could potentially go wrong during the operation of a process and then outline the possible causes and consequences. There are a number of different ways that this can be achieved, and they fall into two main categories, the “top‐down” approach and the “bottom‐up” approach. Ideally each of these will deliver the same end result but the journey will look different. The top‐down approach focuses the initial effort on identification of failure modes that have the potential to impact the quality of the API. This activity can be informed by several different inputs, and those most commonly used include historical data and experience with the specified process, in addition to expert opinions based on information from similar processes and equipment. Once credible failure modes have been identified, the consequences need to be fully explored as the direct impacts can themselves have a secondary impact further through the process. An example of such a situation would be variations in reaction conditions that increase the level of impurity A, and the impurity is not removed in the subsequent downstream operations, resulting in higher levels of the impurity in the next stage of the process. In addition, it may be found that higher levels of impurity A entering the next stage result in a change to the reaction rate or the performance of the crystallization and give rise to elevated levels of a second impurity, impurity B. Increased levels of both impurity A and impurity B are then consequences of the failure mode.

Once a failure mode has been identified, the risk assessment process can then explore the potential causes of the failure. For APIs, these are often variation in parameter settings and levels of impurities, though they can also be due to equipment selection. The detail to which the potential causes are identified can vary depending on the type of risk assessment being carried out and the desired outputs. In some situations, identification of the parameter(s) directly causing the failure modes is sufficient; in other cases, the root cause(s) behind the parameter variation is also recorded. The potential for two or more parameters and attributes to interact and jointly influence a particular failure mode should also be considered. Interactions commonly occur within the same unit operation though they may also include parameters and attributes that are introduced in different parts of the process.

The bottom‐up approach is similar but starts with a list of the parameters and other sources of variation and uses either data or expert opinion to assess what the likely failure modes could be as the parameters vary from high to low values within the range being assessed. In practice, it is often a combination of these two approaches that produces a pragmatic list of the potential risks.

A number of approaches that can be utilized to identify risks and common ones include the following:

• Brainstorming. Working as a group to explore many “what‐if” scenarios before focusing down to the likely/credible/realistic ones.
• Fishbone diagrams, also known as Ishikawa diagrams, provide a structure on which to brainstorm. They ensure that possible causes of a particular failure mode, or variables impacting a CQA, are explored from a variety of perspectives, thus ensuring that the initial list of variables (parameters and attributes) included in the risk assessment is comprehensive. An example of this can be seen in Figure 49.2.
• Input process output (IPO) diagrams. These are visual representations that focus on identifying the inputs and outputs of a process. For a risk assessment, the inputs are typically the starting materials, reagents, solvents, excipients, etc., and the outputs are the CQAs. The parameters, both those that can be controlled and that contribute to the noise, are then added. This is another way to encourage teams to think more broadly than just the process aspects and help to link the causes of failure to the effects. An example of this type of diagram can be seen in Figure 49.3.
• Gemba literally means “the real place” and refers to the place where value is created [5]. The risk identification activity happens as the process operation is observed and provides an excellent way of engaging with the practicalities. It has the advantage of highlighting potential failure modes that may be less obvious from written instructions or equipment diagrams.
• Process mapping describes the individual steps within a process and how they link together and includes information on where substances are added or removed from the process train. Additional information on the equipment and physical state of the process can be added to aid in risk identification during the brainstorm activity. A simple example can be seen in Figure 49.4.
• Mechanism mapping can take a number of formats and uses pictures and diagrams to look in detail at what is happening within the process. It is ideally suited to explaining areas of complexity where a deep understanding of how changes to the material being processed can impact an aspect of the output of the process. In API manufacture, this is typically employed in areas such as particle formation, where understanding the physical mechanisms at play is key to identifying risks. A common application of mechanism mapping for API is in the formation and fate of impurities; visual representations that describe how impurities form and transform, including any mechanistic understanding, and how and where they purge, are used to direct the brainstorming activities.

As with most activities, the quality of the input has a bearing on the quality of the output; the same principles can be applied to the risk assessment process. Having a range of expertise available to work as a team to complete the various stages of the risk assessment will result in a more rigorous assessment and hence ensure that no significant risks are omitted. When assessing an API process, the range of technical experts may typically include representation from engineering, chemistry, analysis, formulation, production, statistics, quality, and regulatory affairs who work together with a facilitator. The value of team members who have practical experience of the process under evaluation cannot be overemphasized; they are in an excellent position to identify any practical constraints that may lead to failure and will have awareness of any previous deviations that have given rise to unanticipated results.

49.2.2 Risk Analysis and Evaluation

Having identified the risks, the next step is to provide an assessment of the adverse impact of the risk and its likelihood of occurrence, in either a quantitative or qualitative manner. In many processes, there is also a consideration of the ability to detect the risk, and in some cases, a knowledge rating may also be included either in the evaluation of the risk or to provide context to the scoring that has been applied. Following these steps, the risks are then ordered, or a particular set of criteria applied, to identify any actions required during risk mitigation.

In the early phases of risk assessment, and in instances where knowledge may be limited, the quantification of risk may not be possible, and in these cases a qualitative system is often used, such as high/low or a traffic light system where red, amber, and green indicate the degree of risk posed by each failure mode. The scoring is often reached through discussion within an expert group, and it is acknowledged that as more information becomes available, the scoring may require reevaluation. It is important to draw the distinction between a lack of knowledge and high risk; not all knowledge gaps result in high risks when data does become available; in fact, it is often the case that those areas where little knowledge exists ultimately prove to be low risk, but this cannot be guaranteed.

As development of the process proceeds and data is generated to support the risk assessment, a more detailed scoring of the risk becomes possible, and at this phase quantitative systems are more prevalent. Typically, tools such as failure mode, effects, and criticality analysis (FMECA) and failure mode effect analysis (FMEA) are used to capture the scoring; see Section 49.4.3 for further information.

Scoring for severity or impact typically considers the link between either the failure mode or the causes of the failure and the ultimate impact that has on the patient. This may be considered as a direct link, by assessment of the impact of the effect of the failure on the patient, for example, or it could be linked through a series of steps as shown in Figure 49.5.

The scoring system may be based on a generic assessment of classes of parameters or attributes or may require an individual assessment of each parameter or material attribute. Inputs to consider when determining the severity score in the latter way include any univariate or multifactorial data and the range of the parameter or material attribute that has been investigated. As is the case with risk identification, risk scoring also requires the right technical input to interpret the data and produce a well‐reasoned score. This is particularly important as once a high level of process understanding has been achieved, the individual severity scores should not be reduced as a means of reducing the risk score.

Scoring the probability or occurrence of the failure mode requires an assessment of how likely it is that the failure mode will occur, either through a direct scoring of the probability of the failure mode occurring or linked to the underlying causes such as parameters varying from their target value or range. This is typically assigned a numerical probability based on the projected frequency of occurrence and may also take into consideration capability of the process or equipment to deliver within a specified range. For example, it could be assumed that the variability in process parameters fits a normal distribution, and plant capability, or normal operating range (NOR), could be defined as one standard deviation; the probability will then be scored directly based on the capability value calculated. More qualitative ways of scoring probability may take account of the type of controls in place and any historical knowledge or data of how these typically perform.

The third element of risk scoring represents detection, and this links directly to the control strategy that is being employed. There are many methods of detection, and common ones can include analysis of starting material, reagents, and solvents to determine if a batch is of the appropriate quality, the use of PAT and in‐line or off‐line analysis during processing to monitor physical and chemical changes, and analysis of the isolated material. This score may reflect either where in a process any detection of the failure mode takes place or how capable the detection method is. Some systems will incorporate both of these elements into the scoring, and emphasis is often placed on whether the detection method can enable an avoiding action to be employed or whether it is just observing, and preventing, onward processing of a batch of insufficient quality. In some cases, where the link between the cause of failure and the failure mode is well established, it may be appropriate to consider detection of the cause in addition to the failure mode as this may offer more opportunity for developing a preventative control strategy.

Following the scoring of the individual components of each risk, the information is combined to provide a risk evaluation. The output of this provides a ranking of the identified risks. The evaluation of the risks often takes one of two common approaches; if quantitative scoring has been applied in the analysis phase, then application of an appropriate formula will result in a numerical scoring of each risk. Where risks have been assessed using qualitative descriptors such as “high,” “medium,” or “low,” an alternative is to make use of a risk matrix. Once the numerical scores have been calculated for each risk, predetermined cutoff values may be applied, or risk ranking tools such as Pareto charts can be used. These enable identification of a specific proportion of the highest scoring risks. The risk matrix approach applies predefined criteria to each combination of scoring for severity, probability, and detection and results in a categorization being applied that feeds into the risk reduction and acceptance phase.

49.2.3 Risk Reduction and Acceptance

Having evaluated the risk, decisions then needs to be made to determine whether the risk will be accepted or whether actions will be required to reduce the risk to an acceptable level. A number of factors may contribute to the decision‐making process including the size of the risk, whether it is practical to implement the changes required to reduce the risk, the cost benefit analysis of making any improvements to the controls, and the potential impact that any risk may have on the patient. For those risks identified as requiring mitigating actions, the choices are the following:

• Reduce the severity of the risk; this can rarely be achieved without introducing a modification to the process as the severity often describes a fundamental relationship.
• Reduce the probability of occurrence of the risk; this is often targeted as a way of reducing risk and relies on improvements either to ways of working or to instrument or equipment capability.
• Improve the detection of the failure mode, typically by the addition of analytical controls or in some cases by moving, or improving, existing controls.

Whenever changes to the control strategy are introduced, it is important to reevaluate the risk assessment to determine if new risks have been created and if the scoring of existing risks is impacted by the change.

Some risks will be of low significance, and the decision may be to accept these risks without making further attempts to reduce them. Elimination of risk entirely is not possible, and there will come a point where it may be impractical to reduce the risk further without committing a disproportionate amount of resource.

49.2.4 Risk Communication and Review

Following a risk assessment exercise, the conclusions concerning the risks and those identified as posing the greatest risk are communicated to the stakeholders. Mitigation plans to reduce the risk and actions to manage any residual risk once the improved controls have been implemented should also be included.

Risk management plays a fundamental part in ensuring the quality of a product or process and needs to be regularly utilized during development to assess any changes and their impact on the control strategy. As the product moves from development into its product life cycle, the risk management process will continue to be used to assess the impact of both planned and unplanned changes.

49.3.1 Attribute Risk Assessment (Defining CQAs Based on Product/Patient Risk)

As mentioned in the preceding sections, it is necessary to establish which attributes of the API are critical. ICH Q8 [1] defines CQAs as follows: “A CQA is a physical, chemical, biological, or microbiological property or characteristic that should be within an appropriate limit, range, or distribution to ensure the desired product quality.” In the case of solid oral dosage forms, CQAs are related to those attributes that impact “product purity, strength, drug release, and stability.” For other dosage forms, additional drug product attributes may be identified, and the starting point for the drug substance risk assessment is to understand the API CQAs that are known to link to these DP CQAs.

Purity is the most straightforward – if impurities are present in the API, they will be present in the drug product and are potentially impactful to the patient. In general, impurities observed in the drug substance are deemed to be CQAs of the API. More specifically, for regions following ICH guidance, non‐mutagenic impurities that are typically found in the API above the ICH Q3A reporting limits [6] are considered to impact the impurity profile of the drug substance and may be deemed as critical impurities. Health authorities require detailed knowledge of impurity formation and purge throughout the synthetic process to make the API. In the case where impurities are related to those formed in synthetic steps prior to the final API step, the precursor impurities may also be designated as critical impurities if they are not completely purged and have the potential to result in impurities in drug substance. Genotoxic impurities and known, or suspected, human carcinogens are special classes of impurities [7] that are typically always deemed critical if they can be present in the API. Typically, a limit may be applied to this, and an example would be that genotoxic impurities potentially present at, or above, 30% of the ICHM7 Threshold of Toxicological Concern are defined as CQAs. Solvents and elemental impurities used in the manufacturing process may also be defined as API CQAs. Assessment of the potential impurities should consider not only the input materials and the process but also the storage of the API. New or raised levels of impurities seen on stability should be included as API CQAs. Water present in API, if shown to increase bioburden or impact the chemical stability, may also be defined as a CQA. The strength or dose of a drug product has two aspects – the average dose and the dose uniformity (also called content uniformity). Each of these is required to be maintained within a range to ensure safe dosing of the patient. The criticality of dose and content uniform may depend on the therapeutic window of the drug (dose range that is effective and safe) and the consequences of chronic or acute under‐ or overdosing. In turn, API properties can impact the effective tablet dose (e.g. API assay) and content uniformity (e.g. particle size distribution). For example, for a low dose drug product, if the particle size distribution includes very large particles, the presence of a few large particles in a tablet can have a large influence on the percent assay of active ingredient in the tablet. In such cases, the particle size distribution can be deemed critical.

Bioavailability of the drug and dissolution performance of the drug product are other typical CQAs of the drug product. API crystal form (which impacts solubility and potentially dissolution) and particle size distribution (which impacts dissolution in most cases) may be designated as critical if they impact bioavailability and dissolution.

An example of how these and a few other aspects are used to generate an attribute risk assessment is given in Table 49.1. In this case, the risk is a simple qualitative risk assessment using expert knowledge of the drug product and drug substance synthesis to arrive at a rationale for criticality or noncriticality of the attributes. In some instances, the link between drug product CQAs and drug substance CQAs needs to be assessed through the generation of data to establish a link; an example of where this is particularly important is in the determination of API physical property CQAs.

49.3.2 Input Material Quality Risk Assessment

The parameters, the elements of the process that are typically described in the process definition and explored during experimentation, are often the initial focus of the risk assessment in building a comprehensive control strategy. However, consideration of parameters alone will lead to an incomplete control strategy without also considering the quality of the input materials. In an API process the main aspect of input quality comes from the impurities in the starting materials, intermediates, reagents, and solvents. When developing a drug product process or, in some instances, the latter stages of an API process, the impurities and material properties of excipients also need to be included in the risk assessment.

To enable a rigorous assessment of the impurities entering the process, data from multiple representative batches of all inputs should be assembled and then reviewed against any existing specifications. Where possible, knowledge of the synthetic route used to generate the starting materials and more complex intermediates should be obtained for the risk assessment. This data provides the starting point for assessing the probability of encountering these impurities at a level that could impact the quality of the final drug substance. In addition, an understanding of the fate of these impurities in the stage in which they are initially added to the process, and all downstream stages until they are fully purged, is required to determine the severity of impact that they may impose on the process. The ability to detect these impurities is also important to the assessment. If analytical methods are not capable, or are not in use, the risk to the patient may be increased.

With the information outlined above, it is possible to include the quality inputs directly into the same assessment as the parameters. Where there is significant complexity (i.e. numerous potential impurities), it is recommended to complete an initial triage of the impurities using risk‐based tools before combining with the other elements of the process.

Consideration of the input quality should not be limited to impurities alone. Several of the more common material attributes that also require consideration are listed below:

• Physical properties – Variation of physical properties in the inputs can play a significant role in the performance of the process and needs to be carefully considered in the risk assessment. Particle size and the polymorphic form of the input material in particular can impact the rate of dissolution that in turn can affect the rate of the reaction and relative stoichiometry, giving rise to multiple potential failure modes. For heterogeneous reactions, the particle surface area, in addition to PSD, can also impact reaction rate. For catalysts, there is also an influence of surface area and surface activity that can impact both the reaction rate and the reaction mechanism, giving rise to new impurities and varying levels of known impurities. When considering seeded crystallizations, for example, the characteristics of the seed including PSD, form, and even the mode of seed generation should be included in the risk assessment as all have the potential to influence the isolated material.
• Color – A significant number of inputs into reactions either contain colored impurities or are themselves colored when isolated. Depending on the formulation of the drug product selected, there is potential for any color introduced into the process to carry forward with the API into the drug product. In some situations, the color can be controlled through specific impurity control. In other cases, when the link is difficult to establish, the risk assessment will need to draw on data and process experience to assess the risk posed by this input material attribute.
• Bioburden – Bioburden is defined as the combination of microbiological and endotoxin contamination. In processes where bioburden in the drug substance poses a risk to patients, the potential to introduce bioburden in the input material needs to be included in the risk assessment.

49.3.3 Process Risk Assessment/Technical Risk Assessment

Once the CQAs of the drug substance are established via the attribute risk assessment, an assessment of the process or technical risks can occur. In these risk assessments, aspects of the process that may have variability (e.g. process parameters, input material quality) are examined to understand the risk posed by that variability on quality. It is typically taken as a given that the procedural steps that constitute the process will be followed per instructions and that a facility will be used that is suitable for drug substance or intermediate manufacture. The GMP systems that safeguard these aspects can be subject to their own, separate risk assessment and do not need to be included in a risk assessment of a particular process.

In preparation for a risk assessment, the background information is typically compiled in advance of a risk assessment session. This may include the synthetic scheme, a process description, a parameter table and/or Ishikawa diagram, a list of IPCs including procedures to be followed in case of failure to meet control limits, prior performance information, and information on impurities and other quality attributes such as residual solvents, metals, or crystal form. This information is used along with an understanding of the equipment and capabilities of a typical pharmaceutical manufacturing plant to perform the risk assessment. The knowledge of attribute criticality developed in the attribute risk assessment may be used to limit the risk assessment scope to only those items that impact critical attributes.

Either the top‐down or bottom‐up approach (or both), discussed in Section 49.2, may then be used to perform the risk assessment. In the top‐down approach, the individual quality attributes (either all attributes or only the critical ones) are listed, and potential causes are considered. The methods discussed in Section 49.2 (brainstorming, fishbone diagrams, etc.) may be used at this point. An example of top‐down risk identification and enumeration of potential causes is given in Table 49.2. The bottom‐up approach can be particularly effective later in the development cycle when deviations in most or all of the process parameters have been studied, and thus a highly comprehensive examination of failure modes around each is possible. An example of bottom‐up risk assessment is given in Table 49.3.

Once the failure types and potential causes are identified, the risk associated with each can be assessed. The manner of assessment depends on the risk assessment tool being used. These tools and examples using them will be provided in Section 49.4.

A final step in the risk assessment is to describe any risk mitigations that have been, or will be, put into place to mitigate the risk and to evaluate their effectiveness in risk reduction. These controls, which can be of the various types discussed in Section 49.1, collectively can be referred to as the control strategy. The level of risk that exists after controls are put in place is known as the residual risk. In general, mitigations are put into place until the residual risk falls either into the “low risk” category or a “moderate risk, but as low as reasonably practicable (ALARP).” The ALARP concept acknowledges that with infinite resources, a risk could be driven very low; however it is not appropriate to spend excessive resources to affect a minor reduction in risk. In instances where the residual risk after controls are put in place is high, many companies will deem the risk as unacceptable and look to avoid the risk altogether, for example, by redesign of the process or use of different process chemistry or technology.

Effective application of risk management requires that the risk assessment process is regularly updated throughout development. As a greater understanding of the process is formed, and knowledge gaps are filled, the assessment of severity can be refined. Increasing experience in operation of the process leads to a better estimate of the probability of a failure mode occurring, and with evolving analytical controls, and enhanced monitoring of the process, changes to the detection scoring may also be required.

49.3.4 Manufacturing/Operational Risk Assessment

Manufacturing or operational risk assessments differ from process risk assessments in that they are generally focused on a specific plant or equipment train. The risk assessment may still be a step‐by‐step examination of the process; however the probability of failure, failure detection systems, and controls will be specific to the facility. As examples, the precision of the weigh scales used, accuracy of temperature probes and control capability of the heat transfer system, and specific alarms and interlocks could all influence the probability of failure and ability to detect and control the risk.

Often, the general process or technical risk assessment will be taken as the input to the operational risk assessment. The risk rating (if applicable, the probability and detectability ratings) can be determined for the particular plant implementation. A brief example of operational risk assessment is provided in Table 49.4.

49.4.1 Risk Triage/Three‐Level Qualitative Risk Assessment

The simplest method of risk assessment may be the risk triage. This qualitative risk assessment approach has the advantage of being expedient, and it results in concise, easily digestible output. The main disadvantage is that it is less thorough and nuanced than tools such as FMEA.

A typical risk triage can consider the impact or severity of the risk and the likelihood or probability. These together can be used to define an overall risk level. A scoring guide is typically used to ensure consistent risk rating between assessors. An example scoring system is given in Table 49.5.

Using this guide and the example failure information from Table 49.3, Table 49.6 is an example qualitative risk assessment. In this example, four failures with moderate or high risk were identified, which necessitate the implementation of controls.

49.4.2 Risk Relationship Matrices

Relationship matrices can be used throughout the risk management process and provide a visual way to convey the areas of potential risk that need to be considered. They are structured to enable an assessment of risk, or a known relationship, to be recorded and typically have a list of CQAs on one axis. The other axis can be populated at various levels depending on the information available and may include, for example, each stage of a process, or each unit operation, or each parameter as shown in the example in Table 49.7. The strength of relationship, or size of the risk, can be represented by a categorical or numeric input. These can be particularly useful as a quick way to brainstorm where there may be risks that need further analysis and which parts of a process present lower risk.

Similar matrices can also be used to represent the relationships between API CQAs and drug product CQAs.

49.4.3 Failure Mode and Effects Analysis (FMEA)

Failure mode and effects analysis is a tool that was developed in the late 1950s to study potential malfunctions of military systems. It is a highly structured and systematic method of failure analysis that is well suited to detailed assessment of pharmaceutical (and other industries') manufacturing processes. There are several types of FMEA analysis that are used in different contexts, but in this chapter, we will focus on process FMEAs. Process FMEAs are ubiquitous in pharmaceutical process development and manufacturing.

In later‐stage development, failure mode and effect analysis (FMEA) is recommended as a risk management tool given its thorough and detailed approach and broad acceptance by global health authorities. FMEA provides for a numerical evaluation of various potential failure modes and their likely effect on product performance and safety. Failure modes are identified and scored according to the mode severity, probability of occurrence, and detectability. Risk is then calculated as a product (Risk Priority Number or RPN) by

(Detectability may not always be employed as a separate step; see Section 49.4.3.3.)