Quality Risk Management, ICH Q9(R1) Training

FMEA – Failure Mode and Effects Analysis
FMEA is a semi-quantitative or quantitative analysis methodology that relies on product and process understanding in order to methodically breakdown the analysis of complex processes or systems into manageable steps. FMEA is used to:
Identify potential failure modes;
Identify their likely effect on outcomes and/or product performance;
Rank the potential risk according to the effect of the failure mode (severity), probability of the failure mode to result in the effect, and the ability to detect the failure mode, failure effect, or failure causes;
Document controls for preventing the failure mode and/or its causes. FMEA is useful:
When analyzing systems, products, etc., and may be used to analyze specific manufacturing processes and its effect on product or process
For identifying potential failure elements/operations within a system or device that render it vulnerable in order to eliminate, contain, reduce, or control the failures “What might go wrong?” “What is the likelihood (probability) it will go wrong?” “What are the consequences (severity)?” What is Failure Mode and Effects Analysis? 4<br>

Key Definitions<br>

FMEA Benefits Proactive Approach: FMEA is instrumental in pinpointing potential issues before they manifest. It facilitates the early detection of individual failure points and complications arising from system interfaces that could adversely affect product quality.
Systematic Evaluation: FMEA serves as a robust mechanism for thoroughly assessing processes, services, or products. It is equally beneficial for identifying improvement opportunities as it is for steering the creation of new processes.
Enhanced Design and Safety: FMEA contributes to the refinement of product and process design, as well as to improvements in reliability, quality, and safety.
Performance Improvement: FMEA provides a strategic means to identify areas where performance may be lacking and implement enhancements.
Failure Reduction: FMEA aids in recognizing and mitigating or eliminating potential failures related to products and processes.
Knowledge Documentation: FMEA enables the systematic documentation and organization of shared knowledge for both current and future applications.
Cost Efficiency: By addressing issues early, FMEA helps in reducing costs and preventing complications later in the product lifecycle.<br>

FMEA Limitations Subjectivity: The effectiveness of FMEA relies heavily on the experience and judgment of the team conducting the analysis. The assignment of risk priority numbers (RPNs) and the ranking of severity, occurrence, and detection can be subjective, leading to variability in results 
Time-Consuming: Conducting an FMEA can be a lengthy process, especially for complex systems with many components and potential failure modes. This can make it impractical for some projects
Complexity: For large systems, the FMEA process can become overwhelming due to the sheer volume of potential failure modes and their interactions. This can lead to incomplete analyses and missed failure modes 
Focus on Components: FMEA often emphasizes individual components rather than the system as a whole, which can result in overlooking system-level risks and failure modes
Resource Intensive: Because FMEA requires significant time and manpower, it can be resource-intensive. Organizations may find it challenging to allocate the necessary resources, particularly when balancing other project demands While FMEAs are inherently designed to detail and understand failure scenarios, which is a considerable strength of the tool, this very focus can also present a drawback. There is a risk of becoming overly immersed in the intricacies of potential failures, potentially hindering progress. In such cases, it may be more beneficial to concentrate on the controls aspect rather than getting bogged down in overly detailed failure analysis using this specific tool. Therefore, it is essential to recognize when to pivot to alternative tools or methods, such as HACCP (Hazard Analysis and Critical Control Points), which may better serve the purpose of more in-depth definition of hazards and controls, to ensure effective control measures are in place.<br>

8 Formality of Quality Risk Management Tools Technical Scientific Rationale Risk Ranking
Checklist
Decision Tree
What If FMEA
PHA
FTA
HACCP Less formal More formal FMEA is considered to be relatively high on the scale of formality in QRM tools.<br>

9 Design FMEA Process FMEA Usability FMEA Intended to recognize and evaluate the potential failure of a design and its effect
How can this design fail to do what it is supposed to do?
What should we do to prevent these potential design failures? Intended to recognize and evaluate the potential failure of a process and its effect
How can this process fail to do what it is supposed to do?
What should we do to prevent these potential process failures? Intended to recognize and evaluate the potential failure of a product use based on the user needs and the intended use description
How can this user fail to use the product based on its intended use?
What should we do to prevent these potential user failures? Types of FMEA - Examples<br>

Key Steps* *There may be additional steps not shown here, for example reassessment of risk and RPN after designing and/or implementing risk controls.<br>

11 Example FMEA Template*
(considering current controls only) *There are many variations of FMEA templates. There is no fixed template that must be used.<br>

12 Example FMEA Template*
(pre-/post additional risk controls) *There are many variations of FMEA templates. There is no fixed template that must be used.<br>

13 In order to reduce subjectivity, it is good practice to document current controls considered in the assessment.​​ In order to prevent risk, procedural controls / training are not always effective. Instead, design controls are preferred. In this example, risk is calculated twice:
based on current controls in place
as estimated after implementation of additional planned controls
This is not a requirement. The Risk Priority Number (RPN) is often established by multiplying SxOxD. In fact, this means putting risk (S, O) on a par with detectability (D). As a result, the RPN can lead to biased risk prioritization, by over-emphasising detectability. Where possible, it is best practice to focus on risk prevention (reducing O) rather than risk detection (increasing D). FMEA Template Considerations Note: See the ICH training slides on Subjectivity in QRM, Part II, for considerations about risk rating scales.<br>

14 FMEA Scoring Note: See the ICH training slides on Subjectivity in QRM, Part II, for considerations about rating scales.<br>

Example:
Risk Rating in an FMEA<br>

16 Identify Potential Failure Modes and Effects: Example Syringe Product A Failure Mode is how something goes wrong, or how you become aware that something went wrong.
The failure effect answers the questions, “then what?” or “so what?” Compromised product sterility or stability, increased risk of contamination Compromised cleanroom environment, increased risk of contamination Inaccurate test results, product release based on incorrect data MODES EFFECTS Equipment Calibration Errors Packaging Integrity Failure HVAC System Failure Note: See the ICH training slides on Hazard Identification for considerations about failure modes.<br>

17 Identify Failure Causes – Example Syringe Product Packaging Integrity Failure Compromised product sterility or stability, increased risk of contamination Failure Mode Failure Effect Improper sealing: If the syringe is not properly sealed with a rubber stopper, contaminants might enter and compromise the sterility of the product.
Physical damage: Any damage to the primary packaging material, such as breakage, punctures, or cracks, can compromise the integrity of the packaging and allow microorganisms to enter. Failure Causes:
The reasons of the failure<br>

18 Packaging Integrity Failure: Scoring the Severity Compromised product sterility can lead to a deterioration in product quality and pose potential risks to patient safety. A packaging integrity failure can result in microbial contamination of the product, product degradation and/or reduced efficacy. Patients using the contaminated product may suffer from infections and potentially severe adverse reactions.
 Severity is scored critical given its impact to product quality and patient safety. Note: See the ICH training slides on Subjectivity in QRM, Part II, for considerations about rating scales. Packaging Integrity Failure Compromised product sterility or stability, increased risk of contamination Failure Mode Failure Effect Improper sealing: If the syringe is not properly sealed with a rubber stopper, contaminants might enter and compromise the sterility of the product.
Physical damage: Any damage to the primary packaging material, such as breakage, punctures, or cracks, can compromise the integrity of the packaging and allow microorganisms to enter. Failure Causes<br>

Design Quality System Manufacturing Critical Aspects of Equipment
Equipment Setup & Control Loops / Alarms
Product / Process Design
Material of Construction In process Testing*
SOPs and Training
Batch Records Preventive and Predictive Maintenance
Qualification / Validation**
Aseptic Process Simulation
Visual Acuity Types of Risk Controls: Preventive Controls Precision engineering of sealing equipment: Designing and maintaining sealing equipment with high precision and reliability to ensure consistent and secure sealing of products, minimizing the risk of improper seals.

Inline measurement systems: This system uses non-destructive techniques such as pressure decay testing or vacuum decay testing to verify the integrity of seals, identifying any leaks or weak seals that may compromise product integrity. Standard Operating Procedures (SOPs): Establishing clear and comprehensive SOPs for the sealing process, including equipment setup, operating parameters, and inspection criteria, ensures that operators follow standardized procedures to achieve consistent and proper seals.

Training Programs: Providing training to personnel involved in the sealing process and implementing operator qualification programs to ensure that they are proficient in the operation of sealing equipment and understand the critical parameters for achieving proper seals. Equipment Qualification: Performing thorough qualification, calibration, and validation of sealing equipment to ensure that it is capable of consistently producing proper seals within specified parameters. This includes installation qualification (IQ), operational qualification (OQ), and performance qualification (PQ) to verify the equipment's suitability for the intended sealing process.

Process Qualification: Validating the sealing process through documented protocols to establish that it consistently produces proper seals. This involves determining critical process parameters, conducting process performance qualification (PPQ), and setting acceptance criteria for seal quality. Examples Examples Examples Examples Examples Examples * In-process testing may also be considered detection control if it leads to removal of material from the batch
** In some contexts, qualification/validation activities can be considered controls, in other contexts they serve as the verification of controls.<br>

Scoring the Probability of Occurrence After analyzing historical data and documented cases of packaging integrity failures leading to compromised product sterility, the probability of such occurrences, given the existing preventive controls, is considered remote. Note: See the ICH training slides on Subjectivity in QRM, Part II, for considerations about rating scales. 20<br>

Determining Risk Acceptability Note: It is vital that Risk Acceptability is defined before starting the FMEA to avoid a conflict of interest.

Ref. ICH training slides on Subjectivity in QRM, Part II. Example of a Risk Acceptability Matrix (S & O) Note: It is important to clearly define what the severity / occurrence ratings mean so that they are discernible. Based on a predefined risk acceptability matrix (see example on the left), the risk associated with the failure is determined as the combination of severity and occurrence. Based on ratings for S (critical) and O (remote),
the risk shows medium (yellow). Note: The severity was rated as Critical. Critical patient harm may involve risk of death. Even if the occurrence is extremely low (remote), risk of death is not considered "acceptable" (green) per se and additional controls should be considered. 21<br>

Detection Controls in place: Seal Integrity Testing: dye penetration tests and vacuum decay tests are in place to assess the strength and integrity of packaging and seals Note: Detection controls are less helpful than prevention controls as they allow the failure to happen first and then try to detect and remove the defect “after the fact”. Detection controls can still be valuable where prevention controls are not fully effective.

Note: You can look at whether a control serves the prevention or detection of failures in more than one way, depending on the point in time it is used in the process. Types of Risk controls: Detection Controls 22<br>

Scoring the Likelihood of Detection Considering current detection controls in place, the likelihood of detection is rated as Moderate given detection controls in place. Note: See the ICH training slides on Subjectivity in QRM, Part II, for considerations about rating scales. 23<br>

Risk Priority Number (RPN) In the sterile syringe example, the RPN score was driven by:
S = Critical, O = Remote, D = Moderate

Higher RPN values typically indicate higher-priority risks that may require immediate attention and mitigation. Lower RPN values indicate that the failure modes constitute less risk, either because they are simply rare, or because their occurrence can be detected and then corrected before they cause harm. Note: See the ICH training slides on Subjectivity in QRM, Part II, for considerations about rating scales. Note: It is important to clearly define what the detection ratings mean so that they are discernible. RPN = Combination of Severity (S), Occurrence (O) and Detectability (D) Based on a predefined risk acceptability matrix (see example above), the Risk Priority Number shows medium (yellow). Therefore, additional controls are to be considered. Reference: PDA TR54-2 Implementation of Quality Risk Management for Pharmaceutical and Biotechnology Manufacturing Operations- Case Study Examples for Quality Risk Management in Packaging and Labeling 24<br>

Adding Further Controls An additional detection control was implemented: Seal Integrity Testing: dye penetration tests and vacuum decay tests in place to assess the strength and integrity of seals and packaging.

NEW: Automated Inspection Systems: machine vision system and optical imaging to detect defects in seals and packaging integrity and identify abnormalities that may not be readily visible to the naked eye. Considering both detection controls in place, the likelihood of detection is now rated as Almost Certain. Risk Priority Number = 9
S = Critical (9)
O = Remote (1)
D = Almost Certain (1) The risk priority number is shown to be acceptable<br>

Risk Reduction
Risk Acceptance Completely Eliminate Source of Failure Mode Reduce Severity Reduce Occurrence Improve Detection Accept Risk Eliminate risk, if possible, by implementing design or process improvements. In order to prioritise additional risk controls, and to accept risk, follow the pathway below: Reduce severity of the failure effect, if possible. Reduce probability of occurrence by adding or improving prevention controls Improve detection by adding or improving detection controls Document justification for Accepting the risk Note: For any new controls, consider if new risks are being introduced 26<br>

Summary FMEA analyses failure modes and their effects on products, processes or systems.
Its structured analysis allows for a systematic understanding of residual risks.
By rating severity, occurrence and detection, residual risk is assessed for acceptability, or the need for additional controls.
The separation of prevention vs. detection controls supports the design of efficient processes, equipment, systems etc. 27<br>

Acknowledgement to the ICH Q9(R1) Expert Working Group (EWG)
For any questions, please contact the ICH Secretariat:

admin@ich.org EWG Acknowledgment and Contact<br>