“Level of Risk”
So… when is it expected that we identify the root cause related to an “unexplained discrepancy” (see 211.192)? Or when can we close the investigation with potential contributing factors (without identifying the “root cause” with some level of certainty)?
This question has caused us GMPers headaches for decades, due to the significant resources needed to dig down to the root. The Live Oak tree grows roots up to ~4 feet underground. Sometimes, depending on the investigation, a root cause dig can feel nearly impossible, much like digging 4 feet into our Texas rocky & clay-based soil! So, when is enough, enough – considering our limited resources?
Let’s take a look at a recent case study (drawn from an FDA Form 483 (Observation 1) issued 02FEB2024) for some insight:
The firm finds “unknown extraneous peaks” in cleaning verification swab results for what appear to be product contact surfaces (oral solid dosage).
Further analysis via LC-MS finds the identity of two peaks to be other drugs manufactured within the facility, with the remaining peaks being unidentified/unknown.
Investigations are closed without identifying the “root cause”, based on impact assessments and CAPAs.
The investigator concluded that the cleaning program was “deficient and unreliable” based on the findings summarized above. Namely, the failure to identify the “root cause”. Why were the impact assessments and CAPAs insufficient? Let’s look to ICH Q9(R1) for some guidance:
Firstly, the amount of effort we put into any investigation (211.192) depends on the “level of risk” (Q9).
The problem here is that we as an industry do not empower our employees to comply with this expectation. We often see the “zero defects” or “quality culture” on massive company posters accompanied with pictures of our patients, which translates to employees as we do not tolerate any risk to patient. Transparency with reality is not an option. There is no usable SOP to even refer to! As a result, we have to skip this step and hope that no regulator ever asks the question, with our fingers crossed that the level of effort we put into the investigation was OK. The truth is that there is increased risk, otherwise we wouldn’t have opened the investigation in the first place!
As an FYI here: risk is defined as the severity of a hazard occurring, combined with the probability or vulnerability of that hazard occurring. The tool used to determine this “level of risk” (Q9) varies (I recommend the qualitative nine-box methodology!).
In this case study, because the investigation was initiated due to carry-over residue of APIs and unknowns, it appears that the investigator considered the “level of risk” (Q9) to be high (severity of hazard * vulnerability). This is generally the case with cleaning (high * high) due to:
Severity: The unknowns that come with consuming impurities (think nitrosamines…) = high
Vulnerability: The highly manual and variable nature of cleaning (minus CIP) = high
The firm should have performed this calculation from the very beginning. We might refer to this as the North Star – guiding the investigation team through the process regarding the level of “effort, formality and documentation” (Q9). Management could have then dedicated resources to this particular issue, while diverting resources from other, lower risk investigations.
Without this initial calculation, or the ability to perform this calculation due to inadequate investigation SOPs, the investigation team is lost at sea. No North Star to guide them, and insufficient deckhands. The team will not know how far to dig (is 2 feet enough?), and management will not know how to “[free] up resources for managing higher risk issues” (Q9).
Lessons learned: Empower your investigation teams to follow the principles of ICH Q9(R1) – starting with determining the “level of risk” of any given issue. This small investment in employee development will reap dividends well into the future, by addressing the reality of risk, patient, and limited resources.
Pete
