Effective risk management should be trained into employees, integrated into existing operations, documented.

BALTIMORE -- "Training of industry and regulatory personnel in risk management and assessment provides for greater understanding of decision-making processes and builds confidence in quality risk-management outcomes," said Susan Banks-Williams, Ph.D., president of Regulatory Matters, Montclair, NJ, on Oct. 18.

Proactive risk management and assessment can help to reduce reactive corrective actions, [and can] result in reducing time and delays in implementation of pre-approved actions, she noted at the Oct. 17-19 RAPS annual meeting.

Effective quality risk management "can facilitate better and more informed decisions, can provide regulators with greater assurance of a company's ability to deal with potential risks, and can beneficially affect the extent and level of direct regulatory oversight," she said. She added that risk management needs to be integrated into existing company operations, and then appropriately documented.

In assessing risk, questions that employees must be trained to ask include:

* What might go wrong?

* What is the likelihood it will go wrong?

* What are the consequences?

* Is the risk above an acceptable level?

* What can be done to reduce, control or eliminate risk?

* What is the appropriate balance among benefits, risks and resources?

She said companies should have assessment criteria in place, such as, a company risk-management policy, which must be completely documented. A quality review board also should be maintained, which attempts to make predeterminations of life cycle changes and probable product risks. Also, a management team should be in place to evaluate and prioritize risk and major change policy.

Enhancing the annual product review process is one effective way for a company to assess its risk management. Some areas to focus on, she added, are the formulation development summary; manufacturing process validation summary; product life-cycle design space evaluation; equipment validation and calibration; incident and deviation reports; and consumer complaints.

"Risk assessment does not need to be a formal process once decision parameters are defined." Define failure criteria during early development, and challenge assessments during the validation process. "Summarize assessments in the original application," and "review assessments upon subsequent annual reports," she said.

Risk assessment steps should include the following:

* Deviation and incident report review;

* Annual product review summary;

* Risk assessment re-evaluation; and

* Modify risk assessment periodically.

Risk management tools that are available include failure mode effects analysis (FMEA), fault tree analysis, preliminary hazard analysis (PHA) and risk ranking and filtering, she said. These tools should be used "in conjunction with current documentation."

In devising a risk communication strategy, it is important to determine who are the interested parties, Banks-Williams continued. These could include internal management, government regulators, doctors and pharmacists, and patients themselves. Also important to consider are the mechanisms that are used for communication, which could be MedWatch reports, periodic reports, labeling revisions, website updates, "dear doctor" letters and recalls.

Joseph Pickett, Managing Editor