ISO 14971 – Process Risk Assessments (Part 2)

Editor’s Note: This is part 2 of a 7 part series on Process Risk Assessments.

Last week we defined a common structure and terms for process risk assessments. This was the first article in a series intended to rationalize and standardize the risk assessment discussion to communicate strategies that provide consistency, objectivity, and risk understanding. Over the next few weeks, we’ll be sharing strategies and approaches that explain how to manage these situations.

While there is no single, all-encompassing definition of risk in the biopharma industry (or any other industry for that matter), we put forth definitions designed to work across the industry. Now that we have our terms defined, we will explore how these definitions intersect with ISO 14971. Even though this standard is designed for medical devices, a number of the definitions we just reviewed are found in this standard and are applied to other sectors such as the pharmaceutical/biotech industry via the guidance provided in ICH Q9.

This post covers how to use the concepts of ISO 14971 to create a generalized framework for risk management that works across pharma and is compatible with (and leverages the best parts from) medical devices.

Let’s review!

The ISO 14971 Standard

In 2000, the first edition of ISO 14971 was released as the international standard for risk management of medical devices. In 2007, the second edition of ISO 14971 was released and there have been subsequent branches and revisions since then. Even though this standard is designed for medical devices, a number of the same concepts described in the previous section are found in this standard and are applied to other sectors such as the pharmaceutical/biotech industry (ICH Q9). A brief summary of the ISO 14971 standard is described here along with some additional clarifications necessary to appreciate the nuances of risk assessment. The diagram below provides a flowchart depiction of risk analysis. There is a hazard that leads to a hazardous situation which can then lead to harm. The harm has an estimated severity which is combined with the probability of the occurrence of harm to provide an estimate of the risk. That is, R = S * P.

In the discussion of probability/occurrence/frequency in the last section, we noted that this concept needed a little further explanation. As you can see from the diagram above, the probability of occurrence of harm is actually the product of two probabilities – P = P1 * P2.

P1 = Probability of the hazardous situation occurring (e.g. probability of having a gas leak)
P2 = Probability of hazardous situation leading to harm (e.g. probability of gas leak causing an explosion)

People often miss that P has these two components. So, if P is given a value indicating moderate probability, does a “Moderate” score mean that there is a moderate chance that the hazardous situation (gas leak) will occur and a moderate chance that it will lead to an explosion? Or does it mean that there is a high chance of the gas leak but a very low chance of an explosion? The distinction is important because it will certainly guide where you focus your mitigation efforts and associated control strategies. In some cases, a conservative approach is taken where it is assumed that the hazardous situation will lead to harm (P2 = 1). In this case, P = P1.

Putting all of these concepts together, we have created a table that provides three examples of risk assessment for non-pharma, pharma, and general manufacturing processes.

Risk Assessment Examples for Manufacturing Processes

Risk ElementNon-Pharma ExamplePharma ExampleManufacturing Example
HazardGas leakExcessive degradation of drug productCO2 stripping time is out-of-specification (OOS)
Potential CausesCorrosion; incorrect installation of valveExtended excursion from recommended storage temperatures.CO2 sparging not working correctly
Exposure (P1) or Probability of Hazardous Situation occurringProbability of gas leak in roomProbability of excessive degradationProbability of CO2 stripping time being OOS
Hazardous SituationPeople or equipment in room with gas leakDrug product has excessive degradation when the patient takes it, leading to an adverse reaction.CO2 stripping time is OOS during the manufacturing process.
HarmExplosion that injures people or damages equipmentAdministration of drug product with excessive degradation leads to adverse eventCO2 stripping time OOS causes dissolved CO2 OOS in production bioreactor
Probability or Likelihood of Harm (P2)Probability of explosion occurring when there is a gas leakProbability of adverse event when patient takes drug that has excessive degradationProbability of dissolved CO2 being OOS if CO2 stripping time is OOS
Severity of Harm (S)Explosion leads to death or irreparable damage of equipmentDegradation products in drug product lead to severe allergic reactionHow sensitive is dissolved CO2 to CO2 stripping time
Probability of Occurrence of Harm (P1 x P2)Probability of a gas leak and a subsequent explosionProbability of drug having excessive degradation and adverse event occurringProbability of CO2 stripping time OOS and dissolved CO2 OOS
Risk (S x P1 x P2)Risk to personnel if there is a gas leak that leads to an explosionRisk to the patient if they take a drug with excessive degradation and an adverse event occurs.Degree of dissolved CO2 OOS if CO2 stripping time is OOS
Mitigation StrategiesPersonnel properly trained on installation; use of stainless steel components to minimize corrosionAddition of excipients to inhibit degradationConfirm correct sparger design/type for scale
Control StrategiesSensor installed in the laboratory with an alarm to detect the presence of gas in the airUsing temperature control devices during shipping to track temperature excursionUse CO2 sensor to monitor dissolved CO2 in-process

Pretty simple, right?

Now that we have our terms defined and related them to the ISO 14971, next week we’ll explore how these concepts line up with FMEA/FMECA methodologies. Recent presentations and publications by the FDA related to their knowledge-aided assessment & structured applications (KASA) initiative recommend the use of FMEA/FMECA for the risk assessment of pharmaceutical manufacturing processes. Our next post will cover how these two methodologies can be used in conjunction with the concepts we’ve discussed thus far.

This post is part 2 of 7 in a series on practical risk management for pharmaceutical process development. Tune in next week for a discussion on FMEA/FMECA.