{"id":14351,"date":"2023-04-17T20:00:00","date_gmt":"2023-04-17T20:00:00","guid":{"rendered":"https:\/\/www.thermofisher.com\/blog\/analyteguru\/?p=14351"},"modified":"2026-08-25T21:38:26","modified_gmt":"2026-08-25T21:38:26","slug":"quality-risk-management-defining-responsibilities","status":"publish","type":"post","link":"https:\/\/www.thermofisher.com\/blog\/analyteguru\/quality-risk-management-defining-responsibilities\/","title":{"rendered":"Quality Risk Management: Defining Responsibilities"},"content":{"rendered":"\n

This is the second in a series of four blog posts on quality risk management. Follow for these and more upcoming regulatory updates in 2023.<\/em><\/p>\n\n\n\n

I think everyone can relate to remembering a younger-you, fantasizing about gaining a new freedom once a particular milestone was crossed. Maybe it was getting a driver’s license, eating unlimited amounts of cereal, or being able to stay up long enough to see a late-night television program.<\/p>\n\n\n\n

Just as quickly as we cross the milestone, we realize that freedom comes with a new set of responsibilities. I think that realization can be particularly heavy when you become a decision-maker in industry and realize that your policy decisions will guide products to market for real people.<\/p>\n\n\n\n

\"Risk<\/figure>\n\n\n\n

Striving for change and retaining the ability to evolve products and procedures ensures that the quality threshold continues to rise.<\/p>\n\n\n\n

Change is coming<\/strong><\/p>\n\n\n\n

The first installment of this blog, Know the Risks<\/a>, noted that the release of the drafted ICH Q9 quality risk management guideline was pending early\/mid 2023. The revision (Q9(R1))1<\/sup> was released on January 18 and is now available for implementation. An introductory training presentation and additional guidance support information to facilitate updating quality systems was posted for use on the ICH website2.<\/p>\n\n\n\n

As we saw in last year\u2019s announcement from the FDA3<\/sup> that was prompted from the shortages seen during the pandemic, the industry has been asked to re-evaluate their quality risk management plans utilized for the manufacture of products.  The FDA guidance on risk management for shortages4<\/sup> is still undergoing draft status and is accepting comments, but in true FDA fashion may remain as a draft for a few years.<\/p>\n\n\n\n

So, in this blog post we will look at the changes to the ICH Q9 quality risk management guideline by first discussing responsibilities. The most notable differences in the responsibilities section between the original guidance5<\/sup> from 2015 and the revision1<\/sup> from 2023 is the addition of language surrounding subjectivity, with an additional guidance responsibility for decision-makers being added distinctly as,<\/p>\n\n\n\n

\u201cassure that subjectivity in quality risk management activities is managed and minimized, to facilitate scientifically robust risk-based decision-making.\u201d<\/p>\n\n\n\n

Assurance to manage and minimize subjectivity is further discussed as avoiding the introduction of bias with an emphasis to recognize that tools utilized may potentially add bias within the additional sections in chapter 5 of the new guidance.<\/p>\n\n\n\n

Tools in risk assessment<\/strong><\/p>\n\n\n\n

A risk matrix can be a common risk management tool and is created with a combination of scores to determine if process steps or product feature use is a high-risk activity. As an example, the below risk score is presented for some selected actions in chromatography with a score assigned for the frequency of the action, a score of its risk relative to product quality, and a score of the likelihood of it being found in review. <\/p>\n\n\n\n

Action<\/strong><\/td>Use Frequency<\/strong><\/td>Relative Impact<\/strong><\/td>Inability to Track Use<\/strong><\/td>Composite Score<\/strong><\/td><\/tr>
Configure a new instrument<\/strong><\/td>1<\/strong><\/strong><\/td>1<\/strong><\/strong><\/td>1<\/strong><\/strong><\/td>3<\/strong><\/strong><\/td><\/tr>
Acquire single test injections<\/strong><\/td>2<\/strong><\/strong><\/td>2<\/strong><\/strong><\/td>2<\/strong><\/strong><\/td>6<\/strong><\/strong><\/td><\/tr>
Manual integration<\/strong><\/td>3<\/strong><\/strong><\/td>3<\/strong><\/strong><\/td>2<\/strong><\/strong><\/td>8<\/strong><\/strong><\/td><\/tr>
Modify instrument methods<\/strong><\/td>2<\/strong><\/strong><\/td>2<\/strong><\/strong><\/td>2<\/strong><\/strong><\/td>6<\/strong><\/strong><\/td><\/tr><\/tbody><\/table>
Figure 1- Example Risk Matrix. Color for 1-3 score on Use Frequency, Relative Impact, and Inability to Track Use of green (low), yellow (medium), red (high), with Composite Score (sum) scales as 1-3 (low), 4-6 (medium), 7-9 (high).<\/figcaption><\/figure>\n\n\n\n

Giving this example a quick look at the composite score for manual integration, this would indicate that manual integration should have a further risk plan associated with it.  That risk plan could be composed of privilege management, creating a document outlining manual integration use, or implementation of a multistep process of review prior to acceptance for use.<\/p>\n\n\n\n

Upon closer inspection, this example is clearly subject to bias. One bias source is that this score could be completely different depending on the person scoring or the context of their use.  As another, the composite scores could shift in severity if the scoring criteria was more than just a 1-3 scale.<\/p>\n\n\n\n

These are just some simple examples of bias introduced into this basic risk assessment matrix.<\/p>\n\n\n\n

High-risk activity: privileges<\/strong><\/p>\n\n\n\n

In this blog post, I will focus on the privileged access management tools for Thermo Scientific\u2122 Chromeleon\u2122 7.3.2 Chromatography Data System<\/a> (CDS).<\/p>\n\n\n\n

In the case of highest scored risk actions, it is often the simplest route to simply restrict the ability. However, disallowing a privilege for \u201cintegration\u201d just to restrict \u201cmanual integration\u201d is too generic to be considered usable. Given the variety of different ways actions can be carried out and the grouping of them into a given set of privileges, a privilege system needs to be granular and flexible to be considered useful.   <\/p>\n\n\n\n

Chromeleon CDS 7.3.2 features a more granular privilege system than ever before with easy-to-understand restriction implications. Beyond Create, Modify, Copy, and Delete, a custom privilege set can be made as a Ruleset from much more granular selections.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Options exist for custom privileges for processing actions. These include:<\/p>\n\n\n\n