Quality, Not Quantity

What is the best way to define your GMP implantation strategy? Many will be familiar with a traditional gap analysis starting with a GMP Guideline. You take the list of requirements and compare them line-by-line with your activities to see whether you comply and then implement action to close any gaps. This approach is moderately effective but limited in terms of flexibility and how much you can actually learn about your activities.

My preference is to use a risk-based approach, where you systematically examine your activities, process by process to identify, analyze, evaluate, treat, monitor and communicate the risks in their proper context. However, many risk-based approaches are compromised by failing to understand the understand the difference between risks and hazards.

Let’s say you’re swimming in the sea off the coast of Australia. A shark is a hazard – and I’m sure you can guess what the consequences of meeting in the water are! If you are also in the sea, then you can’t eliminate the hazard completely and reduce the risk of a shark attack to zero. But you can greatly reduce the probability of a shark attack by taking steps to reduce the likelihood, such as by only swimming at designated beaches protected by shark nets. By reducing the probability of realizing the consequences of the hazard we can reduce the risk to a tolerable level. 

So which risk assessment tool can we use to help us with our GMP gap analysis? There are a number of out there. ICH HQ9 discusses a large number, including failure mode and effects analysis (FMEA): this is a qualitative method, which can be great if you’ve got information concerning the rates of failure in various activities. But the problem with numbers is understanding what they mean and what to do about them… What’s the difference between a reading of 586 and 738? A qualitative judgement where you categorize risk in terms of high, and low is simple and effective. If it’s low, you don’t have to do anything; but for high, definitely take some actions.  

My preference is to analyze your process or activity step by step. At each step identify the hazards, an assign a number (say one to five) to the consequences of the hazard, and then consider the probability of realizing the consequences on a similar scale (one to five). Multiply the two to define the risk on a 1-25 scale. Then identify what mitigations you already have in place to address the risk. Set a criticality level, so any step with a risk over 18 is a critical step. 

Then determine what mitigations you need to apply at this point. Here the GMP Guidelines have many tested and proven approaches to reducing risk. Once applied recalculate the risk with the reduced probability score.

With the entire process analyzed in this manner you can then set some boundaries on whether the residual risk is low, medium or high. If the risk is low, then no further action is needed. Remember the risk can never be zero if the hazard is present. If the risk is high, then you must go back to the GMPs and see what else you can do to reduce the risk.

With the risk analysis completed then the analysis also provides you with a means of identifying the critical points in you process. Any controls that reduce the risk by a large number, say from 25 to 10, would be critical steps so any deviations at this point must trigger a thorough investigation.

Who do you want in your risk assessment team? You should include the people who actually perform the tasks. They are doing the job and they know what’s happening on a day-to-day basis.

A central benefit of this approach is that it places all of your activities in context. It is also simple and logical. It uses the flow of the activity in question as the basis of the risk assessment, and then matches the GMP controls required to manage and reduce those risks. Like all risk assessments, it has to be reviewed and revised when there are changes, and more importantly when deviations are realized.

For me this risk assessment is also the best GMP training your operational people can receive – they know the activity and the analysis will make them much more aware of the hazards, risks and the GMP controls that they need to apply.