“How much do we need to qualify?” This question comes up at the start of almost every project. The honest answer is: as much as the risk to product and patient demands. Annex 15 of the EU GMP Guide requires the scope and extent of qualification to be determined on the basis of a justified and documented risk assessment. The principles are set out in ICH Q9(R1) on quality risk management: the level of effort, formality and documentation should be commensurate with the level of risk. This article shows how that becomes a justified scope in practice.
The risk assessment in practice
A two-stage approach has proven useful: a general risk assessment at project level, followed by a detailed assessment for each system.
An FMEA is widely used. For each function or component, the potential failure and its effect are described and three factors are rated:
| Factor | Question |
|---|---|
| Occurrence (O) | How likely is the failure? |
| Severity (S) | How serious is the effect on product or patient? |
| Detection (D) | How reliably is the failure detected before it has an effect? |
Multiplying the three values gives the risk priority number (RPN). This calculation is common in practice, but it is not prescribed by ICH Q9(R1). The guideline describes the rating of severity, occurrence and detection under FMECA (Annex I.3) and points out that poorly designed scoring scales increase subjectivity. As an alternative, we also use a matrix of severity and probability with fixed risk classes in practice. The method and scale to be used, and the point at which a risk is considered acceptable, should be defined in an SOP of the operating company. If no such rule exists, it is agreed and justified at the start of the project. Limits that are adjusted after the fact stand out during inspections.
The analysis produces three things:
- Critical functions. These get their own tests in the OQ, with clearly testable acceptance criteria that are numerical wherever possible.
- Quality-relevant measuring points. These go into the calibration plan. Their calibration is verified in the IQ so that the OQ measurements can be relied on.
- Requirements for the URS. Anything that reduces a risk is written as a requirement and tested later.
In practice, we also record in which qualification phase a measure is tested and whether the remaining residual risk has been accepted.
Examples of risk-based scope
Cleanrooms. In sterile manufacturing, the scope depends heavily on the cleanroom grade under Annex 1. Aseptic areas of grades A and B are fully qualified from DQ to PQ, with the tests listed in Annex 1 where they are relevant to the design and operation of the installation. These include filter integrity, airflow visualisation, recovery time for areas without unidirectional airflow, and microbiological tests at rest and in operation. In sterile manufacturing, grade C and D areas are also classified and qualified. How deeply individual room functions are tested, airlock door interlocks for example, follows from the risk assessment. In controlled not classified (CNC) areas, testing is carried out where the risk assessment shows an impact on the product. Whether a test belongs to the room or the HVAC system is set by the qualification interface.
HVAC systems. Not every parameter is critical. If a product is heat-sensitive, room temperature is qualified with a tight tolerance and an alarm. If it is only a comfort value, technical acceptance under Good Engineering Practice (GEP) is sufficient.
Pharmaceutical water. Here the link to the product is obvious. The quality of Purified Water and Water for Injections (WFI) is governed by the Ph. Eur. monographs. The risk assessment focuses on generation, storage, distribution and points of use. In sterile manufacturing, Annex 1 expects the sampling programme to include all outlets and points of use at specified intervals. The risk assessment then defines the intervals and the parameters monitored, but not whether a point of use is sampled.
Simple instruments. For a simple measuring instrument, a reduced scope may be enough, such as incoming inspection, calibration and an operating SOP. This is acceptable if the risk assessment justifies it.
What a risk assessment is not
It is not a form to be filled in at the end of the project to justify the qualification after the event. Nor is it a list of every conceivable failure of a system. It concentrates on what affects product and patient. Purely technical or commercial risks such as energy consumption matter, but they belong in the engineering design. Failures that put the availability of the product at risk are different: under ICH Q9(R1) they count as quality risks. In practice, a failure or a lack of redundancy is GMP-relevant whenever it puts controlled conditions at risk, for example during a conversion while operations continue.
The risk assessment lives on
After approval, the risk assessment remains the tool for managing changes. In change control it shows whether a change is relevant to qualification and which tests need to be repeated. During the periodic review, which Annex 15 requires at appropriate intervals, it is reviewed together with calibration trends, maintenance reports, deviations and the minor changes that have accumulated. This shows whether a system can still be regarded as qualified. In practice, changes to the room book or the ventilation schematic are also a reason to update it.
A note on medical devices
For medical devices, risk management follows ISO 14971 and cleanrooms are classified according to ISO 14644, typically as ISO 7 or ISO 8. The scope of qualification is defined there by the manufacturer’s SOPs.
Conclusion
A good risk assessment makes qualification more targeted. It explains why one area is fully qualified and another is not, and it provides the requirements for the URS. In practice, the sequence qualification master plan, risk assessment, URS has proven useful.
For more on what belongs in a URS, see the article What belongs in a URS, and what does not?. For support with risk assessment and qualification planning, see Qualification.