Developments in ICH Q9 and Pharma Risk Management: Risk Registers

By Dr Mike Long, MBB

There is a recent expectation that pharmaceutical manufacturing sites have specific high-level risk overview documents. These are known as risk registers, or risk master plans. The expectation was   formally laid out last June in the  MHRA’s GMP–Quality Risk Management: Frequently Asked Questions document

  http://www.mhra.gov.uk/Howweregulate/Medicines/Inspectionandstandards/GoodManufacturingPractice/FAQ/QualityRiskManagement/index.htm


The expectation arises from the formal inclusion of the review of risk assessments during inspections. The EMA has a requirement that all manufacturing sites and active pharmaceutical ingredient manufacturers have a system for risk management. While the FDA has no formal requirement for the use of risk management, it encourages the use of these tools as they assist in the decision-making process and in documenting product and process knowledge.

The evolution of the use of risk management in the industry  has brought it to a point where a collection of risk assessments performed on the site need to be managed as a whole, not just as individual assessments. The use of risk registers or risk master plans can be seen as a natural progression in the evolution and the maturation of the industry in its use of risk management.

A formal risk register or risk master plan can be seen as mutually beneficial for both the industry and the regulators. It provides a summary document for the regulators to review during inspections, and a living document to the management of a manufacturing site summarizing the high-risk items for their site.  If created properly, can be an excellent communication tool that compliments overall risk management process.

This high-level document will summarize the significant risks of a manufacturing site and should provide a brief explanation of the mitigation of those risks or the current plan to which these risks are being reduced. It is also expected that the risk register or risk master plan has links to or has listed within, the individual formal risk assessments that have been performed at the site. There is also an expectation that the risk register will include an explanation of the manufacturing sites risk review process, or how often the risk register is reviewed and residual risk updated .

The rate of adoption for these registers has been slow,  most likely a result of three things:
1. Lack of knowledge of the requirement
2. Lack of Clear Guidance on implementation
3. Lack of visibility of regulatory enforcement of Registers

As is quite common in the industry, continuous improvement is generally preceded by regulatory actions by agencies. Expect this trend to continue with the adoption of risk registers, which is unfortunate. If properly used and implemented these can be of great value to  management by providing them with visibility they currently do not have.