GAMP 5 - Good Automated Manufacturing Practice M3: Appendix M3 Science-Based Quality Risk Management

The appendix details the five-step process consistent with ICH Q9 and applies critical thinking to it. Roles are the process or system owner who establishes the team and approves, a team of subject matter experts and key users who identify, analyse and evaluate risks and develop controls, the quality unit for regulatory and quality risks, and the supplier who explains how the product was developed, works and might fail. Risk is understood through the business process: the hazards including system and user failures, the harm, the impact, the probability of failure, which rises with complexity and category, the detectability before harm occurs, and how the risk will be managed, all context sensitive, with zero risk unattainable and risk tolerance context dependent. The initial risk assessment precedes or parallels the requirements, is based on business process understanding and regulatory requirements, includes the GxP determination listing the specific regulations and the parts of the system they apply to, determines system impact with high-impact systems being those supporting submissions data, critical parameters, product release, recall and pharmacovigilance, and decides the need for further assessments by category. Risk-based decisions follow during planning, in functional risk assessments that also consider risks introduced by computerization so that a computerized system does not increase the overall risk of the process, in test planning, in operational planning of availability, backup, disaster planning, security, change control and periodic review, in change control where a changed risk profile is recorded, and at retirement. The functional assessment method plots severity against probability to give a risk class and risk class against detectability to give a risk priority, with the meanings of high, medium and low agreed per system and rigor focused on high-impact functions; controls eliminate risk by redesign, reduce probability, increase detectability or add downstream checks, with wider strategies of changing project structure, documentation level or the business process, or avoiding the risk; residual risk is reassessed until acceptable; life cycle activities are scaled by impact, complexity and novelty and supplier capability; risk information is communicated and kept in a risk register reviewed at periodic review; and for cloud services supplier assessment and contractually obligated continuous monitoring become part of quality risk management. Other tools such as HAZOP, FMEA, FMECA, FTA, HACCP, PHA and risk ranking may supplement or replace the GAMP tool.