Risk-based validation is a validation philosophy in which the qualification and validation processes are streamlined through an objective assessment of the risks to product quality posed by equipment functionality, process steps, or process capability. Quality is defined in terms of identity, purity, potency and safety. Performing validation using a risk-based philosophy allows us to focus our energies in time and testing on the areas where we most strongly need to be assured of quality performance.
In a previous article, “Benefits of Risk-Based Validation: A Suite of Case Studies,” published in August 2013 in Pharmaceutical Manufacturing, Pharmatech Associates examined how risk-based validation can benefit all phases of a company’s lifecycle, from pre-clinical startup to established commercial producer. However, it is the role and responsibility of the functional groups within our organizations that are accountable for successful implementation of a risk-based validation philosophy. Aside from the Validation group itself, the key players are Quality Assurance (QA), Equipment and/or Process Engineering (EE and PE), Maintenance and/or Calibration and Operations.
NOT ALL RISK IS CREATED EQUAL
By job description, QA representatives are supposed to be risk-averse, cautious and conservative; they are the group whose understanding of the choices made during the process is most important, as they are most frequently called upon to defend in audits. They are accountable for the decisions and rationale behind validation, and for ensuring all predefined quality elements have been satisfied for the product. For this reason, it is critical that QA representatives have a strong understanding of the process and its critical-to-quality attributes. They must have knowledge of the realities of what the equipment, process, and materials can do, could do, might do, and won’t do as they enter into discussions about acceptable levels of risk.
It is the role of Engineering to ensure that QA has access to this information, and it is up to the QA representatives to become familiar with it and to hold it in mind when making decisions about validation activities and documentation. It is also critical that the QA group is able and willing to accept some level of risk, and that acceptable level should vary based upon the criticality of the at-risk item. A risk to the end product’s identity, purity, potency and safety must be treated differently than risks to yield, or risks of increased paperwork. Not all risk is created equal. Lastly, QA must be familiar with any regulatory aspect impacting decision-making, from the content of the filings (in the case of established products having equipment changes) to regulatory agencies’ recommendations as they pertain to the process, product and/or equipment.
Engineering representatives in the risk-based validation process must be able and willing to explain the subject matter to other decision-makers. Engineering holds in mind the minutiae of equipment specifications, process/controls/calibration ranges, and the physical realities affecting manufacturing controls (in the case of EE) or process requirements (in the case of PE) when making decisions about validation activities and documentation. It is also essential that the Engineering group differentiate between critical-to-quality attributes and everything else that might be important for the equipment or process to provide.
The Validation group is the heart of any effort to undertake Risk-Based Validation. It is critical that those representing Validation understand the equipment and process, that they are transparent to the other working groups about decision-making during the validation process; that is, that they are able and willing to explain and defend which items are tested and why, as well as which items are not tested and why, so that QA and others are likewise able to perform their functions within the team.
The Validation group should provide a strong framework and conscientious support of the decision making process, particularly the Failure Modes and Effects Analysis (FMEA), sometimes known simply as Risk Assessment. The FMEA document provides the assurance to internal and external auditors and those who will be working with the equipment or process in the future know what decisions were made about where to spend energy during Risk-Based Validation. It shows that these decisions were based upon informed, honest and careful evaluation of the risks to the product, process and equipment.
ASSESSING FAILURE: SEVERITY, OCCURRENCE, AND DETECTABILITY
If Risk-Based-Validation is used, the FMEA should have, at minimum, the following assessments: Severity, Occurrence and Detectability.
The Severity of a failure mode is the intensity of its impact on the product, equipment or process, and can be considered within two types of impact: first and most importantly, the significance of the problem to product quality; could this failure lead to an impact on identity, purity, potency and/or safety of the product to the consumer, and if so, how much of an impact? To a lesser extent, Severity may also be considered as the impact of the event on yield, maintenance needs and other business risks, but these considerations should be limited as much as practical within the FMEA, as they are not directly impactful to GXP operations.
The Occurrence of a failure mode – its frequency and/or likelihood – is determined, either by previous experience with the same equipment or process, or based upon the best-available comparisons, such as other sites’ experience with the same equipment, or similar processes.
The Detectability of a failure mode is assessed by taking into consideration how the failure will be observed. Process alarms, in-process inspections, process value observations, downstream processing or inspections play their part. Will the failure be observed immediately, as in a sensor failure that produces an alarm on the operator interface, or will the problem not be observed until the end result of the process is evaluated? These three metrics: Severity, Occurrence and Detection, are the backbone of the FMEA and combine to produce a number reflecting the level of risk inherent in each given failure mode.
In support of the FMEA, the contributions of experienced equipment Operators (production technicians), Calibration and Maintenance personnel cannot be overstated. Operators and maintenance personnel contribute to the FMEA process by sharing their personal experiences. This can lead to insights that might not be considered by FMEA participants with less hands-on experience of the equipment or process. Calibration personnel provide insight into the stability in function of the sensing equipment; how predictable is sensor drift, and how much strain is provided to the sensors during the process, as indicated by consistent rates of sensor calibration failures, or the opposite observation: robust sensor systems that rarely, if ever, require adjustment. In addition, regular contact with equipment and regular participation in production processing provides first-hand observation of failures occurring (or being prevented by timely intervention) and informs the FMEA process in a way that is incredibly valuable, because all failure modes are considered, but weighted by Occurrence.
THE VALUE OF SEPARATE ROLES IN BALANCE
Over the course of Pharmatech Associates’ work with different client companies, we’ve observed that Validation is not always a separate functional group in the business organization. However, I’ve also observed that one of the critical responsibilities of the Validation group, especially in the course of risk-based validation activities, is to act as the bridge or middle ground between QA and Engineers. If this group is officially or by company culture subordinated to one of those other two, or if one individual wears two hats in the project, it may seem a short-term expedient, but the likelihood of success can be decreased in the long run. When Engineering heavily influences Validation, testing can become so overly technical that its rationale and intent is inaccessible to future readers or outside observers. It may appear to inadequately support the process or equipment’s use in production because it is based upon concepts that require advanced subject matter understanding. When Validation is overly influenced by QA, testing can become overly risk-averse, time-consuming and unwieldy, and the intent of Risk-Based Validation – using validation testing as a focused tool to challenge, confirm and mitigate the areas of most risk to product quality – is lost.
Solid, defensible execution of Risk-Based Validation requires the kind of consideration of all angles and balancing of needs that can only be provided by the combined career experience of each of these three functional groups working together, with solid information contributed by others who are familiar with the equipment or process.
